joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45786c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x457886
mov byte [eax], bl
mov ecx, dword [ebp + 0xc]
test cl, 1
je 0x457895
mov dword [ebp - 4], 3
test cl, 2
je 0x4578a1
mov dword [ebp - 4], 1
push 4
mov dword [ebp - 8], ecx
pop edx
and dword [ebp - 8], edx
je 0x4578af
mov dword [ebp - 4], edx
test cl, 8
je 0x4578bb
mov dword [ebp - 4], 2
test cl, 0x10
je 0x4578c7
mov dword [ebp - 4], 5
cmp dword [ebp - 4], ebx
jne 0x4578d3
xor eax, eax
jmp 0x4579d6
mov edi, 0x40000000
test cl, 0x40
je 0x4578df
mov ebx, edi
test cl, cl
jns 0x4578e5
mov ebx, edx
test cl, 0x20
je 0x4578f0
or ebx, 0x80000000
mov esi, 0x100
test ecx, 0x4000
je 0x4578ff
or ebx, esi
test ecx, 0x80000
je 0x45790d
or ebx, 0x20000000
mov eax, ecx
shr eax, 8
not eax
and eax, 1
test ecx, 0x200
jne 0x457922
or eax, 2
test ecx, 0x10000
je 0x45792c
or eax, edx
xor edx, edx
test ecx, 0x400
je 0x457938
mov edx, edi
test dword [ebp + 0xc], 0x800
je 0x457943
or edx, esi
test dword [ebp + 0xc], 0x1000
je 0x45794f
or edx, 2
test dword [ebp + 0xc], 0x2000
je 0x45795e
or edx, 0x4000000
test dword [ebp + 0xc], 0x40000
je 0x45796d
or edx, 0x2000000
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x457978
mov ecx, dword [ecx]
push 0
push edx
push dword [ebp - 4]
push 0
push eax
push ebx
push ecx
call dword [0x52b160]
mov ebx, dword [ebp + 0x10]
mov esi, dword [0x52b28c]
mov edi, eax
test ebx, ebx
je 0x4579ba
cmp edi, 0xffffffff
je 0x4579ba
cmp dword [ebp - 8], 0
je 0x4579b1
call esi
cmp eax, 0xb7
setne al
mov byte [ebx], al
jmp 0x4579ba
test byte [ebp + 0xc], 0xa
je 0x4579ba
mov byte [ebx], 1
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x4579d4
cmp edi, 0xffffffff
je 0x4579cb
and dword [ebx], 0
jmp 0x4579d4
call esi
call fcn.004579ef
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x458196
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, word [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [eax + ecx + 0x18]
lea edx, [esi + 0xc]
cmp ebx, dword [edx]
jae 0x4581b3
mov eax, ebx
jmp 0x4581f4
push edi
movzx edi, word [ecx + 6]
xor eax, eax
test edi, edi
je 0x4581f0
mov dword [ebp + 8], edx
lea edx, [eax + 1]
mov dword [ebp - 8], edx
cmp edx, edi
jne 0x4581d0
mov edx, dword [ecx + 0x50]
jmp 0x4581d6
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x28]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
cmp ebx, dword [edx]
jb 0x4581e5
cmp ebx, dword [ebp - 4]
jb 0x4581f8
mov eax, dword [ebp - 8]
add dword [ebp + 8], 0x28
cmp eax, edi
jb 0x4581c1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
imul eax, eax, 0x28
lea ecx, [eax + esi]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, ebx
jmp 0x4581f3
Function at 0x45b94a
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x45bab3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
cmp byte [ebp + 8], al
je 0x45bb3f
xor ecx, ecx
mov word [ebp - 0x210], cx
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0xffffffffffffffff
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x45bafa
xor al, al
jmp 0x45bc08
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x248]
call fcn.0040204f
mov eax, esi
push eax
lea eax, [ebp - 0x22c]
call fcn.0044a559
push eax
push ebx
call fcn.0044a59f
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.004021a4
push 1
lea esi, [ebp - 0x248]
call fcn.004021a4
jmp 0x45bb4d
push 0x6c
mov ecx, ebx
call fcn.00454a03
pop ecx
test al, al
je 0x45baf3
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov dword [ebp - 0x250], str.Microsoft
mov dword [ebp - 0x24c], 9
call fcn.0044ad1c
push eax
push ebx
call fcn.0044a59f
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.004021a4
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov dword [ebp - 0x250], str.Internet_Explorer
mov dword [ebp - 0x24c], 0x11
call fcn.0044ad1c
push eax
push ebx
call fcn.0044a59f
push 1
lea esi, [ebp - 0x22c]
call fcn.004021a4
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov dword [ebp - 0x250], str.Quick_Launch
mov dword [ebp - 0x24c], 0xc
call fcn.0044ad1c
push eax
push ebx
call fcn.0044a59f
push 1
lea esi, [ebp - 0x22c]
call fcn.004021a4
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret

Function at 0x45e20f
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 8]
or dword [ebp + 8], 0xffffffff
push esi
push edi
mov dword [ebp - 8], 8
cmp dword [ebp - 8], 0xffffffff
lea eax, [ebp + 8]
ja 0x45e239
lea eax, [ebp - 8]
mov edi, dword [eax]
push edi
push ebx
call dword [0x52b05c]
test al, al
je 0x45e26c
test byte [ebp - 0xc], 1
je 0x45e25c
and dword [ebp - 0xc], 0xfffffffe
lea esi, [ebp - 0xbc]
call fcn.0044dd6a
sub dword [ebp - 8], edi
add ebx, edi
cmp dword [ebp - 8], 0
ja 0x45e22d
pop edi
pop esi
pop ebx
leave
ret
call fcn.00456f6c
int3

Function at 0x45ee28
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x46267a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x12c
call fcn.004fe799
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4626c3
push 0x128
lea esi, [ebx + 4]
push 0
push esi
mov dword [ebx], 0x54c370
call fcn.00506540
add esp, 0xc
lea edi, [esi + 0x100]
push 8
pop ecx
mov esi, 0x536c1c
rep movsd dword es:[edi], dword [esi]
mov esi, ebx
jmp 0x4626c5
xor esi, esi
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov edx, dword [esi]
push dword [eax]
mov ecx, esi
call dword [edx + 4]
mov eax, dword [esi]
push 0x10
push dword [ebp + 0xc]
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x469cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52a3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
push edi
mov eax, dword [0x58569c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
lea eax, [esp + 0x34]
push eax
call fcn.00465b40
lea ecx, [esp + 0x34]
mov dword [esp + 0x60], ecx
mov eax, ecx
mov dword [esp + 0x70], 0
call fcn.00465cf0
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x34]
mov eax, edx
mov dword [esp + 0xc], eax
xor eax, eax
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x64], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x465e00
mov dword [esp + 0x1c], 0x465eb0
mov dword [esp + 0x20], 0x465ed0
mov dword [esp + 0x24], 0x465ef0
mov dword [esp + 0x28], 0x466000
mov dword [esp + 0x2c], 0x466030
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call fcn.004baa50
mov esi, eax
add esp, 4
test esi, esi
js 0x469dbb
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x469da4
lea ecx, [esp + 0x34]
mov dword [esp + 0x70], 0xffffffff
call fcn.00465c20
mov eax, 0x80004005
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.00469ac0
mov esi, eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x70], 0xffffffff
call fcn.00465c20
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4869a0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523118
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x58569c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea edi, [edi + edi*2]
shl edi, 4
add edi, dword [eax + 0xe0]
lea ecx, [ebp + 0x14]
push ecx
lea ecx, [edi + 0x20]
lea eax, [esp + 0x18]
call fcn.0049c480
mov ecx, dword [esp + 0x14]
cmp ecx, dword [edi + 0x24]
je 0x486a42
mov esi, dword [ecx + 0x10]
cmp esi, dword [esi]
je 0x486a42
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [edx + 0xb0]
lea ecx, [eax + 8]
mov eax, dword [eax]
push ecx
push ecx
mov ecx, esp
mov dword [ecx], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x44]
mov dword [esp + 0x20], esp
push ebx
call eax
mov esi, dword [esi + 4]
test eax, eax
jne 0x486ad8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x10]
cmp esi, dword [eax]
jne 0x486a00
lea eax, [ebp + 0x14]
push eax
lea eax, [esp + 0x18]
mov ecx, edi
call fcn.004933a0
mov esi, dword [esp + 0x14]
cmp esi, dword [edi + 4]
je 0x486b1f
lea ecx, [esp + 0x1c]
push ecx
call dword [0x52b420]
push 0
mov dword [esp + 0x3c], 0
mov ecx, dword [esi + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x38]
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
call edx
test eax, eax
js 0x486b0c
push 0
push 9
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov dword [esp + 0x28], esp
push eax
mov eax, dword [edx + 0x3c]
call eax
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
mov dword [esp + 0x3c], 0xffffffff
call dword [0x52b41c]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0x14]
push 0
push 0xa
add esi, 0x10
push esi
push ecx
mov eax, esp
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
mov dword [esp + 0x28], esp
push eax
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x3c], 0xffffffff
call dword [0x52b41c]
lea eax, [ebp + 0x14]
push eax
lea ecx, [edi + 0x10]
lea eax, [esp + 0x18]
call fcn.0049c070
mov edi, dword [edi + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, edi
jne 0x486b54
mov eax, 0x80004005
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
add eax, 0x18
push 9
push eax
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov dword [esp + 0x28], esp
push eax
mov eax, dword [edx + 0x3c]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49dfa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi - 8]
test edi, edi
je 0x49dfb4
lea eax, [edi + 4]
jmp 0x49dfb6
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0x9c4
push eax
call edx
cmp eax, 2
je 0x49e0a8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0x4b9
push eax
call edx
cmp eax, 0x20
jne 0x49e0a8
mov eax, dword [esi + 0x168]
test al, 1
je 0x49e0a8
and eax, 0xfffffffe
push 1
mov dword [esi + 0x168], eax
call dword [0x52b58c]
shr eax, 0xf
test al, 1
jne 0x49e072
test byte [esi + 0x168], 2
push ebx
je 0x49e035
test edi, edi
je 0x49e01e
lea eax, [edi + 4]
jmp 0x49e020
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0x9c4
push eax
call edx
test eax, eax
jne 0x49e035
mov bl, 1
jmp 0x49e037
xor bl, bl
test edi, edi
je 0x49e040
lea eax, [edi + 4]
jmp 0x49e042
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
push 0x417
push eax
call edx
test al, al
je 0x49e062
mov ecx, dword [esi - 4]
mov edx, dword [ecx + 0xe4]
lea eax, [esi - 4]
push eax
call edx
test bl, bl
pop ebx
je 0x49e093
mov eax, dword [edi]
mov edx, dword [eax + 0x60]
mov ecx, edi
call edx
jmp 0x49e093
test edi, edi
je 0x49e07b
lea eax, [edi + 4]
jmp 0x49e07d
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
push 0x417
push eax
call edx
test al, al
je 0x49e093
call fcn.004a5de0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x8c]
push 1
push 0x480
push eax
call edx
pop edi
pop esi
pop ebp
ret 8

Function at 0x49e430
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi - 8]
test edi, edi
je 0x49e444
lea eax, [edi + 4]
jmp 0x49e446
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0x9c4
push eax
call edx
cmp eax, 2
je 0x49e50d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x8c]
push ebx
push 1
push 0x480
push eax
call edx
mov eax, dword [esi - 4]
mov ecx, dword [eax + 0xe8]
add esi, 0xfffffffc
push esi
call ecx
mov ebx, dword [0x52b58c]
push 1
call ebx
shr eax, 0xf
test al, 1
je 0x49e4e6
mov edx, dword [esi]
mov eax, dword [edx + 0xe0]
push esi
call eax
test edi, edi
je 0x49e4a6
lea eax, [edi + 4]
jmp 0x49e4a8
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
push 0x417
push eax
call edx
test al, al
je 0x49e4e6
push 1
call ebx
shr eax, 0xf
test al, 1
je 0x49e4db
mov eax, dword [ebp + 8]
test byte [eax + 0x168], 2
jne 0x49e4e6
push 1
mov ecx, edi
call fcn.0049ef00
jmp 0x49e4e6
mov ecx, dword [esi]
mov edx, dword [ecx + 0xe4]
push esi
call edx
pop ebx
test edi, edi
je 0x49e4f0
lea eax, [edi + 4]
jmp 0x49e4f2
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0x9c4
push eax
call edx
cmp eax, 1
jne 0x49e50d
mov eax, dword [edi]
mov edx, dword [eax + 0x60]
mov ecx, edi
call edx
pop edi
pop esi
pop ebp
ret 8
Function at 0x49f270
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi - 8]
test edi, edi
je 0x49f284
lea eax, [edi + 4]
jmp 0x49f286
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0x9c4
push eax
call edx
cmp eax, 2
je 0x49f2e6
test edi, edi
je 0x49f2a1
lea eax, [edi + 4]
jmp 0x49f2a3
xor eax, eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
push 0x417
push eax
call edx
test al, al
je 0x49f2e6
push 1
call dword [0x52b58c]
shr eax, 0xf
test al, 1
je 0x49f2e6
test byte [esi + 0x168], 1
jne 0x49f2e6
call fcn.004a5de0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x8c]
push 1
push 0x480
push eax
call edx
pop edi
pop esi
pop ebp
ret 8
Function at 0x4ab310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5280ed
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x58569c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.ATL::CComPolyObject_class_Smartui::CQtlHwndHost_.0
cmp ecx, eax
jne 0x4ab347
mov ecx, esi
mov edx, dword [0x52b504]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
mov dword [esi + 0x1c], vtable.Smartui::CQtlSupperWindowImpl_class_Smartui::CQtlHwndHost__class_ATL::CWindow__class_ATL::CWinTraits_1442840576__0__.0
mov dword [esi + 0x44], eax
mov dword [esi + 8], vtable.ATL::CComContainedObject_class_Smartui::CQtlHwndHost_.0
mov dword [esi + 0x1c], vtable.ATL::CComContainedObject_class_Smartui::CQtlHwndHost_.1.0
mov dword [esi + 0x40], vtable.ATL::CComContainedObject_class_Smartui::CQtlHwndHost_.2.0
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], eax
mov ecx, dword [0x59bb7c]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4c0ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52620b
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x58569c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.ATL::CComPolyObject_class_Smartui::CQtlHwndSource_.0
cmp ecx, eax
jne 0x4c0af7
mov ecx, esi
mov edx, dword [0x52b504]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov byte [esi + 0x54], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0xc], vtable.ATL::CComContainedObject_class_Smartui::CQtlHwndSource_.0
mov dword [esi + 0x10], vtable.ATL::CComContainedObject_class_Smartui::CQtlHwndSource_.1.0
mov dword [esi + 0x34], vtable.ATL::CComContainedObject_class_Smartui::CQtlHwndSource_.2.0
mov dword [esi + 0x38], ecx
mov dword [ebp - 4], eax
mov ecx, dword [0x59bb7c]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c53d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5247a2
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x58569c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
xor eax, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov byte [esi + 0x2c], bl
mov byte [ebp - 4], 1
lea edi, [esi + 0x30]
push 0x18
mov dword [ebp - 0x14], edi
mov dword [edi + 8], ebx
call fcn.004fe799
add esp, 4
cmp eax, ebx
je 0x4c5477
mov dword [edi + 4], eax
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov eax, dword [edi + 4]
mov byte [eax + 0x14], 1
mov ecx, dword [edi + 4]
mov byte [ecx + 0x15], 1
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.00504414
push 0x578000
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.00504518
int3

Function at 0x4c9720
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor ecx, ecx
push eax
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x60]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.004cd5c0
push edi
mov ecx, esi
call fcn.004cd670
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.004fe191
mov esp, ebp
pop ebp
ret
Function at 0x4c98a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x20119
xor edi, edi
push edi
push 0x55d984
push 0x80000002
mov dword [ebp - 0x10], edi
call dword [0x52b010]
test eax, eax
jne 0x4c9a18
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [ebp - 8]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0xc]
push str.Operator
mov edi, 0x400
push eax
mov dword [ebp - 4], edi
call dword [0x52b054]
test eax, eax
jne 0x4c9930
cmp dword [ebp - 8], 1
jne 0x4c9a02
mov eax, ebx
mov ebx, dword [ebp - 4]
sub edi, ebx
mov dword [esi], eax
lea ebx, [ebx + eax]
je 0x4c9a02
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 8]
push edx
push 0
push str.IssueDate
push eax
mov dword [ebp - 4], edi
call dword [0x52b054]
test eax, eax
jne 0x4c996b
cmp dword [ebp - 8], 1
jne 0x4c9a02
mov eax, dword [ebp - 4]
mov dword [esi + 4], ebx
add ebx, eax
sub edi, eax
je 0x4c9a02
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 8]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [ebp - 4], edi
call dword [0x52b054]
test eax, eax
jne 0x4c999e
cmp dword [ebp - 8], 1
jne 0x4c9a02
mov eax, dword [ebp - 4]
mov dword [esi + 8], ebx
add ebx, eax
sub edi, eax
je 0x4c9a02
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea edx, [ebp - 8]
push edx
push 0
push str.SignData
push eax
mov dword [ebp - 4], edi
call dword [0x52b054]
test eax, eax
jne 0x4c9a02
cmp dword [ebp - 8], 3
jne 0x4c9a02
mov eax, dword [ebp - 4]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x4c9a02
lea eax, [esi + 0xc]
call fcn.004c9780
test eax, eax
je 0x4c9a02
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [0x52b018]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
push eax
call dword [0x52b018]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret