joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440080
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x4400a9
test ebx, ebx
je 0x44009f
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44012f
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x4400da
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00439450
mov esi, eax
call fcn.00439ca0
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00439450
mov esi, eax
push 0x5299f4
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add ebx, 4
push ebx
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x440139
mov dword [ebx], eax
test eax, eax
jne 0x44009f
cmp byte [esi + 0x128], al
je 0x44014e
add esi, 0x18
jmp 0x440151
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.00439450
mov edi, eax
push 0x529a04
push 0x52139c
mov edx, edi
call fcn.0043a8a0
add esi, 4
push esi
push 0x52139c
mov edx, edi
call fcn.0043a8a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x440190
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44022d
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x4401d8
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00439450
mov esi, eax
call fcn.00439ca0
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00439450
mov esi, eax
push 0x529a24
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add ebx, 4
push ebx
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x440237
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc
Function at 0x441030
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50a7db
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x13a]
push ecx
mov esi, edx
mov word [esp + 0x13c], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4410dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00439450
mov esi, eax
push 0x52a650
push 0x52139c
mov edx, esi
call fcn.0043a8a0
push edi
push 0x529348
mov edx, esi
call fcn.0043a8a0
add esp, 0x10
xor al, al
jmp 0x44118b
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4410e7
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x441129
lea eax, [esp + 0x130]
lea edx, [eax + 2]
jmp 0x441110
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441110
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.0043a090
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.0043a2e0
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x441154
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.0043a2e0
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x441189
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x441189
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004ccee1
add esp, 0x33c
ret

Function at 0x4411c0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
add esi, 0x4d4
cmp word [esi], 0
push edi
jne 0x4411f9
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x4411f9
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x4411f9
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x4419f0
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x6dc]
call fcn.0043a2e0
cmp byte [esi + 0x7f8], 0
lea eax, [esi + 0x6e8]
jne 0x441a1e
mov eax, dword [esi + 0x6e4]
add esi, 0x800
add eax, 4
mov edx, esi
call fcn.0043a2e0
mov eax, esi
call fcn.0043ac80
pop edi
mov al, 1
pop esi
ret

Function at 0x442870
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004d3fc0
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4428d7
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004ccee1
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x442937
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004ccee1
add esp, 0x424
ret
push edi
push esi
call fcn.004ccfcd
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x44294e
xor al, al
jmp 0x4429f8
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4429ed
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4429ed
cmp dword [esp + 0x10], 4
jb 0x4429ed
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04xCompanyName
lea edx, [esp + 0x234]
call fcn.00413390
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x230]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4429ed
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x4429ed
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x4429e1
mov edx, ebp
call fcn.0043a2e0
jmp 0x4429eb
push eax
mov eax, ecx
mov ebx, ebp
call fcn.0043a340
mov bl, 1
push edi
call fcn.004ccef0
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ccee1
add esp, 0x424
ret

Function at 0x4430e0
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.00448b50
Function at 0x4431e0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00443240
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.004483a0
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x443240
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x50d2ab
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x37c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38c]
lea esi, [esp + 0x1c]
mov ebx, ecx
mov edi, edx
call fcn.0043fc80
xor esi, esi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], esi
mov dword [esp + 0x370], esi
push esi
push ebx
lea eax, [esp + 0x24]
push eax
mov eax, edi
mov dword [esp + 0x390], esi
call fcn.0043fdc0
test al, al
je 0x4433b8
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4432f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x4432f6
mov esi, edi
push 0x100000
mov dword [esp + 0x370], esi
call fcn.004ccfcd
mov edi, eax
mov eax, dword [esp + 0x370]
add esp, 4
sub eax, dword [esp + 0x370]
je 0x44335e
mov esi, eax
cmp eax, 0x100000
jb 0x44332a
mov esi, 0x100000
push esi
push edi
push ebx
lea ecx, [esp + 0x374]
call fcn.00447bd0
push edi
test al, al
je 0x4433f3
mov eax, esi
mov ecx, ebp
call fcn.00448100
mov eax, dword [esp + 0x370]
add esp, 4
sub eax, dword [esp + 0x370]
jne 0x44331c
push edi
call fcn.004ccef0
mov dword [esp + 0x388], 0xffffffff
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043fcf0
mov al, 1
mov ecx, dword [esp + 0x37c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x360]
xor ecx, esp
call fcn.004ccee1
add esp, 0x374
ret
push 0x52a85c
push ebx
call fcn.00439500
mov dword [esp + 0x38c], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov bl, al
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043fcf0
mov al, bl
jmp 0x443390
call fcn.004ccef0
add esp, 4
mov ecx, ebx
call fcn.00439450
push 0x52a85c
push 0x52139c
mov edx, eax
call fcn.0043a8a0
mov dword [esp + 0x38c], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0043fcf0
xor al, al
jmp 0x443390
Function at 0x445570
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x44569b
test ebx, ebx
je 0x445647
cmp word [ebx], 0
je 0x445647
cmp byte [esi + 0x128], 0
je 0x4455d9
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x4455e0
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00439450
mov esi, eax
call fcn.00439ca0
mov ecx, ebp
call fcn.00439450
mov esi, eax
push 0x52acb0
push 0x52139c
mov edx, esi
call fcn.0043a8a0
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x52139c
mov edx, esi
call fcn.0043a8a0
push 0x5212f4
push 0x52139c
mov edx, esi
call fcn.0043a8a0
push ebx
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x445656
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00439450
mov esi, eax
call fcn.00439ca0
mov ecx, ebp
call fcn.00439450
mov esi, eax
push 0x52acb0
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add ebx, 4
push ebx
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x44577c
test ebx, ebx
je 0x445734
cmp word [ebx], 0
je 0x445734
cmp byte [esi + 0x128], 0
je 0x4456c9
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x4456d0
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00439450
xor edi, edi
mov esi, eax
call fcn.00439ca0
mov ecx, ebp
call fcn.00439450
mov esi, eax
push 0x52acc0
push 0x52139c
mov edx, esi
call fcn.0043a8a0
mov ecx, dword [esp + 0x28]
add ecx, 4
add esp, 8
push ecx
mov ecx, esi
call fcn.00439dd0
mov esi, eax
push 0x5212f4
push 0x52139c
mov edx, esi
call fcn.0043a8a0
add esp, 8
push ebx
mov ecx, esi
call fcn.00439dd0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
je 0x445742
add esi, 0x18
jmp 0x445745
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.00439450
mov edi, eax
push 0x52acc0
push 0x52139c
mov edx, edi
call fcn.0043a8a0
add esi, 4
push esi
push 0x52139c
mov edx, edi
call fcn.0043a8a0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x446840
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4468ae
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x44687f
cmp eax, 2
jne 0x44689a
mov eax, dword [esp]
test esi, esi
je 0x4468a8
test eax, eax
je 0x4468a3
test al, 1
jne 0x44689a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4468a8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x446a70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50b228
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x11
mov esi, ecx
xor ebx, ebx
xor eax, eax
push str.SoftwareClasses_
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
call fcn.0042ae00
mov eax, esi
mov dword [esp + 0x38], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x446ad0
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.004471d0
push 6
push str.Shell
call fcn.004471d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.0042ad00
push reloc.WS2_32.dll_accept
push edi
call fcn.00446c60
add esp, 0x24
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x446b46
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004cf512
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ccee1
add esp, 0x30
ret
Function at 0x446b70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50b228
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x446bc0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0042ae00
push 6
push str.Shell
lea esi, [esp + 0x18]
mov dword [esp + 0x40], ebx
call fcn.004471d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.0042ad00
push bind
push edi
call fcn.00446c60
add esp, 0x24
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x446c3e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004cf512
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ccee1
add esp, 0x30
ret
Function at 0x446ee0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50c316
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x3e
xor ebx, ebx
mov word [esp + 0x30], cx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
call fcn.0042ae00
mov eax, str.http
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x446f60
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x446f60
sub eax, edx
sar eax, 1
push eax
push str.http
lea esi, [esp + 0x30]
call fcn.004471d0
push 0xb
push 0x52ae10
call fcn.004471d0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x446fa9
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x44709d
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.004d3fc0
add esp, 0xc
push str.Progid
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.00446840
test eax, eax
jne 0x44708e
xor ecx, ecx
cmp cx, word [esp + 0x44]
jne 0x447040
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x44702a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
mov dword [esp + 0x458], 0xffffffff
call fcn.0042aad0
jmp 0x4470bc
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x44]
call fcn.00446a70
test al, al
jne 0x447060
lea ecx, [esp + 0x44]
call fcn.00446b70
mov byte [esp + 0x13], al
jmp 0x447065
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x447074
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
mov dword [esp + 0x458], 0xffffffff
call fcn.0042aad0
mov al, byte [esp + 0x13]
jmp 0x4470be
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x44709d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x458], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4470bc
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cf512
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004ccee1
mov esp, ebp
pop ebp
ret
Function at 0x447b80
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push 0
push eax
mov eax, dword [esp + 0x14]
push edi
call fcn.0043fdc0
test al, al
jne 0x447b98
pop esi
pop ecx
ret 4
mov edx, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x447bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x447bc2
xor esi, esi
mov dword [edi + 0x350], esi
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x449080
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.00448b50
test eax, eax
jl 0x4492b8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4490ed
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4490b0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4492b4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x525c98]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525c98]
and esi, 0xff
mov esi, dword [esi*4 + 0x526898]
and edi, 0xff
xor esi, dword [edi*4 + 0x527098]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525c98]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527498]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x525c98]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x526c98]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x525c98]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525c98]
and esi, 0xff
mov esi, dword [esi*4 + 0x526898]
and edi, 0xff
xor esi, dword [edi*4 + 0x527098]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x525c98]
and edi, 0xff
xor esi, dword [edi*4 + 0x526c98]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525c98]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527498]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x525c98]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525c98]
and esi, 0xff
mov esi, dword [esi*4 + 0x526898]
and edi, 0xff
xor esi, dword [edi*4 + 0x527098]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x525c98]
and edi, 0xff
xor esi, dword [edi*4 + 0x526c98]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525c98]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527498]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x525c98]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525c98]
and esi, 0xff
mov esi, dword [esi*4 + 0x526898]
and edi, 0xff
xor esi, dword [edi*4 + 0x527098]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x525c98]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525c98]
and edi, 0xff
xor esi, dword [edi*4 + 0x526c98]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527498]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x449101
pop edi
xor eax, eax
pop esi
ret