joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4119e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x411a38
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x411a30
cmp ebp, ebx
jb 0x411ab2
cmp ebp, dword [esp + 0x1c]
ja 0x411ac3
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x411a32
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x411a20
jmp 0x411a8f
ja 0x411a38
cmp edx, edi
mov ebx, ebp
jne 0x4119f5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x411a93
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x411a70
mov esi, edi
sub ecx, ebx
jns 0x411a87
jmp 0x411a95
cmp edi, edx
je 0x411a9c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x411a95
xor al, 1
cmp esi, edx
jne 0x411a50
jmp 0x411a95
xor eax, eax
jmp 0x411a95
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x460728
push 0x2b
push 0x45fbcd
call fcn.0044dcd0
add esp, 0xc
ud2
push 0x460718
push ebp
push ebx
call fcn.0044e0d0
add esp, 0xc
ud2
push 0x460718
push dword [esp + 0x20]
push ebp
call fcn.0044e060
add esp, 0xc
ud2
Function at 0x415710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41ecb0
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x4157a0
jmp 0x41578e
jbe 0x415834
cmp esi, 0x201
jae 0x4157a0
lea ebx, [ebp - 0x448]
mov dword [ebp - 0x28], 0x200
mov edi, esi
jmp 0x4157db
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x4157cc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.0044e360
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4157ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415897
cmp esi, edi
jne 0x415780
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4158b3
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x41578e
jmp 0x4157a0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x4158d0
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.00416e70
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x415881
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.004447e0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi], 0
mov dword [esi + 4], eax
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x415871
jmp 0x415881
mov dword [ebp - 0x10], 0
push 0x462e00
push 0x28
push str.internal_error:_entered_unreachable_codeassertion_failed:_self.is_char_boundary_new_len__rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225library_alloc_src_string.rs
call fcn.0044dcd0
add esp, 0xc
jmp 0x4158df
push 0x462e10
push eax
push esi
call fcn.0044e060
add esp, 0xc
ud2
Function at 0x41b940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x41b984
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x41b98a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41b9c6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x41b9eb
test eax, eax
js 0x41b9d5
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x41b9e1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x46283c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.00416a60
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00414260
mov ecx, 7
int 0x29
ud2

Function at 0x41c2e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x41eeb0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x41c35e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x30], 0x4629b0
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], 0x415e50
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x30]
push 0x4629dc
push eax
call fcn.0044dc10
add esp, 8
ud2
Function at 0x41cb00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41eed0
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x41cb3e
test eax, eax
jne 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cb67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41cb98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41cb60
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cb60
test byte [ebp - 0x20], 1
je 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cbc7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41cbf8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41cbc0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cbc0
test byte [ebp - 0x20], 1
je 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cc27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41cc58
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41cc20
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cc20
test byte [ebp - 0x20], 1
je 0x41ccba
mov ebx, dword [0x4a126c]
test ebx, ebx
je 0x41ccba
mov dword [ebp - 0x20], 0
jmp 0x41cc87
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41ccb4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41cc80
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41cc80
test byte [ebp - 0x20], 1
jne 0x41ccd4
movzx eax, byte [0x499054]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x4a126c]
jmp 0x41ccdf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41ccba
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41cd0b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41ccdc
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x41ccdc
mov dword [ebp - 0x10], 0
push 0x462d04
push 0x2b
push 0x4613a0
call fcn.0044dcd0
add esp, 0xc
ud2
Function at 0x41e650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x4a1044]
mov esi, ecx
test eax, eax
je 0x41e676
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41e68f
cmp dword [eax + 4], 0
je 0x41e68f
add eax, 8
pop esi
pop edi
ret
push 0x4a1044
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41e66a
mov eax, dword [0x4a1044]
test eax, eax
je 0x41e726
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41e743
mov edi, eax
test eax, eax
jne 0x41e6ef
movzx eax, byte [0x4a16e5]
push 4
push 0x10
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41e757
mov dword [eax], 0x4a1044
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a1044]
test eax, eax
je 0x41e748
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41e70f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x41e713
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x41e713
xor ecx, ecx
xor edx, edx
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
lea eax, [edi + 8]
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x4a1044
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41e6ad
xor eax, eax
pop esi
pop edi
ret
push 0x4a1044
call fcn.0044d4c0
add esp, 4
jmp 0x41e6e7
push 0x10
push 4
call fcn.0044ea80
add esp, 8
ud2
Function at 0x41e770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41ef60
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x4a1054]
test eax, eax
je 0x41e7c5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41e7de
cmp dword [eax + 4], 0
mov ebx, eax
je 0x41e7de
add ebx, 8
jmp 0x41e8a8
push 0x4a1054
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41e7b5
mov eax, dword [0x4a1054]
test eax, eax
je 0x41e889
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41e8a6
mov edi, eax
test eax, eax
jne 0x41e842
movzx eax, byte [0x4a16e5]
push 4
push 0x10
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41e8cd
mov dword [eax], 0x4a1054
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a1054]
test eax, eax
je 0x41e8bb
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41e85c
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x41e860
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x41e860
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x41e8a8
test ecx, ecx
je 0x41e8a8
lock dec dword [ecx]
jne 0x41e8a8
call fcn.00414d40
jmp 0x41e8a8
push 0x4a1054
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41e7fc
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4a1054
call fcn.0044d4c0
add esp, 4
jmp 0x41e83a
mov dword [ebp - 0x10], 0
push 0x10
push 4
call fcn.0044ea80
add esp, 8
ud2
Function at 0x41e910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41ef70
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x4a1064]
test eax, eax
je 0x41e965
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41e97e
cmp dword [eax + 4], 0
mov ebx, eax
je 0x41e97e
add ebx, 8
jmp 0x41ea3a
push 0x4a1064
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41e955
mov eax, dword [0x4a1064]
test eax, eax
je 0x41ea1b
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41ea38
mov edi, eax
test eax, eax
jne 0x41e9de
movzx eax, byte [0x4a16e5]
push 4
push 0xc
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41ea5f
mov dword [eax], 0x4a1064
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4a1064]
test eax, eax
je 0x41ea4d
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41e9f3
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x41e9f5
mov eax, dword [esi + 4]
jmp 0x41e9f5
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x41ea3a
test ecx, ecx
je 0x41ea3a
lock dec dword [ecx]
jne 0x41ea3a
call fcn.00414da0
jmp 0x41ea3a
push 0x4a1064
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41e99c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4a1064
call fcn.0044d4c0
add esp, 4
jmp 0x41e9d6
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.0044ea80
add esp, 8
ud2
Function at 0x41eaa0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x4a1074]
test eax, eax
je 0x41eb9f
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41ead1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x41eb9a
mov eax, dword [0x4a1074]
test eax, eax
je 0x41ebc1
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41ebde
mov esi, eax
test eax, eax
jne 0x41eb3c
movzx eax, byte [0x4a16e5]
push 8
push 0x20
call fcn.004447d0
add esp, 8
test eax, eax
je 0x41ebfa
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x4a1074
mov esi, eax
mov eax, dword [0x4a1074]
test eax, eax
je 0x41ebe8
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x41eb5b
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x41eb89
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x41eb7b
movaps xmm0, xmmword [esp]
jmp 0x41eb89
lea ecx, [esp + 0x10]
call fcn.0041c2e0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x41ebe0
push 0x4a1074
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41eac4
jmp 0x41ead1
push 0x4a1074
call fcn.0044d4c0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41eaef
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x4a1074
call fcn.0044d4c0
add esp, 4
jmp 0x41eb34
push 0x20
push 8
call fcn.0044ea80
add esp, 8
ud2
Function at 0x42cbc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, edx
mov edi, dword [ebp + 8]
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x104
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x42cd2e
push str.MicrosoftWindowsStart_MenuPrograms_
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x42cd2e
mov ecx, dword [esi + 0x10]
lea eax, [ecx - 0x7ffffffb]
cmp eax, 3
jbe 0x42cd40
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov edx, dword [esi + 0x14]
lea edi, [ebp - 0x28]
mov dword [edi], 0
lea eax, [ecx + 4]
mov ebx, 7
cmp eax, 8
jb 0x42cca4
mov dword [ebp - 0x30], edx
mov edx, eax
or edx, 7
cmp edx, 0xb
mov ebx, 0xa
cmovae ebx, edx
mov edx, SysReAllocString
cmp ebx, edx
cmovae ebx, edx
lea edi, [ebx + ebx]
cmp ebx, 0x7ff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jb 0x42cc8a
cmp ebx, 0x7fffffee
jae 0x42cd45
add edi, 0x25
push edi
call fcn.004484c5
add esp, 4
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x42cc98
add edi, 2
push edi
call fcn.004484c5
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp edx, 8
cmovae esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
lea eax, [ecx + ecx]
push eax
push esi
push edi
mov esi, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + esi*2 + 4], 0x6b006e
mov dword [edi + esi*2], 0x6c002e
mov word [edi + esi*2 + 8], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x42cce3
mov eax, dword [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x42cd2e
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x42cd24
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x42cd4a
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.004484f5
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0044fcd0
call fcn.0044fce0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42cd9b
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x463f90]
pmovmskb edx, xmm0
cmp edx, 0xffff
je 0x42cd92
movdqu xmm0, xmmword [eax]
pcmpeqb xmm0, xmmword [0x463fa0]
pmovmskb edx, xmm0
mov eax, 0x80004002
cmp edx, 0xffff
jne 0x42cda0
mov eax, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x42cda0
mov eax, 0x80004003
pop ebp
ret 0xc
Function at 0x42eaa0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov esi, eax
call fcn.004011f0
mov ecx, dword [eax]
or ecx, 2
xor edx, edx
push esi
push edx
push dword [ebp + 0xc]
push edx
push edx
push dword [eax + 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
xor ecx, ecx
dec ecx
test eax, eax
cmovs eax, ecx
lea edi, [eax + 1]
lea ebx, [eax + eax]
add ebx, 2
push ebx
call fcn.004484b7
add esp, 4
mov esi, eax
push ebx
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ebx, [ebp + 0x18]
mov dword [ebp - 0x18], ebx
call fcn.004011f0
push ebx
xor ecx, ecx
push ecx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
add esp, 0x1c
mov eax, str.Error:__s___S:_d_
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push eax
call fcn.0044eb90
add esp, 0x10
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
lea ebx, [eax + eax]
add ebx, 2
cmp eax, 0xffffffff
mov eax, 0xffffffff
cmovl ebx, eax
push ebx
call fcn.004484b7
add esp, 4
mov edi, eax
push ebx
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
mov eax, str.Error:__s___S:_d_
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
call fcn.0044ebf0
add esp, 0x1c
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x42ebcf
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [eax], edi
sub esp, 0x24
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x464450]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push edi
call fcn.004484c0
add esp, 4
push esi
call fcn.004484c0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret