joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440420
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [esp + 0x50], eax
lea eax, [esp + 0x4f]
mov byte [eax], 0xff
push eax
push dword [ecx + 0x24]
call fcn.00436be0
add esp, 8
test al, al
je 0x44045a
cmp byte [esp + 0x4f], 0
setne al
jmp 0x440469
mov ecx, dword [esi + 0x90]
call fcn.0042c270
mov byte [esp + 0x4f], al
mov ecx, dword [esi + 0x4c]
movzx eax, al
push eax
call fcn.00428a30
lea eax, [esp + 0x4e]
mov byte [eax], 0xff
push eax
push dword [esi + 0x24]
call fcn.00436c70
add esp, 8
test al, al
je 0x440492
mov al, byte [esp + 0x4e]
jmp 0x4404a1
mov ecx, dword [esi + 0x94]
call fcn.0042c270
mov byte [esp + 0x4e], al
mov ecx, dword [esi + 0x4c]
mov byte [ecx + 0x75], al
cmp dword [esi + 0x98], 0
je 0x4404c1
mov ecx, dword [esi + 0x9c]
test ecx, ecx
je 0x4404c5
call fcn.0042c270
jmp 0x4404c7
mov al, 1
jmp 0x4404c7
xor eax, eax
mov ecx, dword [esi + 0x4c]
mov byte [ecx + 0x76], al
call fcn.00491f90
push eax
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00437190
add esp, 0xc
test eax, eax
jne 0x44052c
mov ecx, dword [esi + 0x4c]
call fcn.00429520
test al, al
je 0x44052c
mov ecx, dword [esi + 0x4c]
call fcn.004298e0
test al, al
jne 0x44052c
mov edi, esp
mov ecx, edi
push 0x479
push str.LayoutProgressDialog
push 0
call fcn.0044c760
lea ecx, [esp + 0x3c]
push 0x51f6b8
push str.Declined_running_the_installer_as_admin
call fcn.00415500
mov ecx, edi
call fcn.0044c9f0
mov eax, dword [esi + 0x20]
cmp byte [eax + 0x114], 0
je 0x44055b
mov eax, dword [esi + 0x110]
test eax, eax
je 0x44055b
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44055b
push 0
push dword [esi + 0x110]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00415730
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.00440760
mov ebx, dword [esi + 0xf0]
test ebx, ebx
je 0x440592
mov eax, dword [esi + 0x1c]
add esi, 0x1c
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
jmp 0x4405c2
mov ecx, esi
call fcn.00440ee0
mov ecx, esi
call fcn.00415730
push 0xd7
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esi + 0x4c]
call fcn.00420f60
mov byte [esi + 0xfc], 1
test ebx, ebx
sete bl
mov ecx, dword [esp + 0x50]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x538010]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push ebx
push edi
call ecx
test eax, eax
je 0x4444b4
mov esi, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x44449b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x4444c6
mov ebx, esi
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x444463
cmp ebx, 0xffffffff
je 0x4444cb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4444a0
mov ebx, dword [ebp - 0x14]
jmp 0x4444a0
int3

Function at 0x444760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx + 8]
inc eax
cmp eax, 2
jae 0x4447df
mov esi, ecx
push dword [ebp + 8]
call fcn.004444d0
add esp, 4
mov edi, eax
cmp dword [esi + 8], eax
je 0x4447c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 8]
inc eax
cmp eax, 2
jb 0x4447ab
call fcn.00489980
push dword [esi + 8]
call fcn.00476780
add esp, 4
mov dword [esi + 8], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x4447bb
mov dword [esi + 8], edi
call fcn.00489980
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 8]
lea eax, [edi + 1]
cmp eax, 2
jb 0x4447d0
mov dword [esi + 0x14], edi
test eax, 0xfffffffe
setne al
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
Function at 0x447df0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov ebx, dword [ebp + 8]
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x447e13
mov eax, dword [ebx]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x447ea3
mov edi, eax
push eax
call fcn.004d05d3
add esp, 4
mov esi, eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x447e3a
mov eax, dword [ebx]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x447eaa
xor eax, eax
dec eax
lea ecx, [ebp - 0xc4]
mov dword [ecx], eax
lea edx, [ebp - 0xc8]
mov dword [edx], eax
push edx
push ecx
push 0x51fa20
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne bl
je 0x447f5a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc4]
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [eax + 0x10], xmm1
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
movups xmm1, xmmword [ecx + 0x20]
movups xmmword [eax + 0x20], xmm1
movups xmmword [eax], xmm0
mov ecx, dword [eax + 0x18]
and dword [eax + 0x1c], ecx
jmp 0x447fa1
xor ebx, ebx
jmp 0x447fae
push 1
call fcn.004cc010
add esp, 4
test al, al
je 0x447f56
call fcn.00488670
lea ecx, [ebp - 0xb8]
push eax
push 1
push 0x23
push str.module_version.cc
call fcn.004887a0
lea eax, [ebp - 0xb0]
push 0x14
push str.GetFileVersionInfo:
push eax
call fcn.00417b30
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
mov dword [ebp - 0xcc], eax
jns 0x447eff
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
lea edi, [ebp - 0xc4]
push ecx
push ebx
push edi
call fcn.004ca870
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x447f24
mov eax, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
push eax
push edi
push dword [ebp - 0xcc]
call fcn.00417b30
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x447f4b
push dword [ebp - 0xc4]
call fcn.004d05a5
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00488850
xor ebx, ebx
jmp 0x447fa1
push 1
call fcn.004cc010
add esp, 4
test al, al
je 0x447fa1
call fcn.00488670
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 1
push 0x2e
push str.module_version.cc
call fcn.004887a0
lea eax, [ebp - 0xb0]
push 0xd
push str.VerQueryValue
push eax
call fcn.00417b30
add esp, 0xc
mov ecx, edi
call fcn.00488850
test esi, esi
je 0x447fae
push esi
call fcn.004d05dc
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44b9a0
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.004d4450
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [eax], 0x101
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x44ba3e
movzx edx, byte [esi + 0xb]
test dl, dl
js 0x44b9fa
mov eax, 4
jmp 0x44ba0b
mov eax, 0x7fffffff
and eax, dword [esi + 8]
dec eax
cmp eax, 0xa
jae 0x44ba5a
mov edx, dword [esi + 4]
mov ebx, 0xa
sub ebx, eax
mov ecx, esi
push str.UICreated_
push 0xa
push edx
push 0
push edx
push ebx
push eax
call fcn.0046efe0
lea ebx, [ebp - 0x212]
push ebx
call fcn.004ec838
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.0046fa90
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi]
movups xmm0, xmmword [str.UICreated_]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0x5f0064
cmp byte [esi + 0xb], 0
jns 0x44ba82
mov dword [esi + 4], 0xa
mov word [eax + 0x14], 0
jmp 0x44ba2c
push str.__s_should_never_be_greater_than_or_equal_to_the_short_string_capacity
push str.__s_____min_cap
push 0x6c6
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.00448430
Function at 0x4757b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
test bl, bl
jns 0x4757cc
mov ebx, dword [esi + 4]
mov esi, dword [esi]
mov eax, ebx
mov ecx, esi
mov edx, ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 4
jb 0x475807
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, esi
imul ebx, dword [ecx], 0x5bd1e995
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x4757e1
cmp edx, 1
je 0x475828
cmp edx, 2
je 0x47581f
cmp edx, 3
jne 0x475833
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x47594f
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, 0x33333333
mov ecx, ebx
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
ja 0x47589c
lea edx, [ecx - 1]
and edx, edi
jmp 0x4758a8
mov edx, edi
cmp edi, ecx
jb 0x4758a8
mov eax, edi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x47594d
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
mov ebx, dword [eax]
test ebx, ebx
mov ecx, 0
je 0x47594f
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x47590e
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x4758e8
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x47592b
lea ecx, [ebx + 8]
test al, al
jns 0x4758f6
mov ecx, dword [ecx]
js 0x475933
test eax, eax
je 0x475949
xor ecx, ecx
mov dl, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x47592b
inc ecx
cmp eax, ecx
jne 0x4758fe
jmp 0x475949
cmp dword [ebp - 0x20], 1
ja 0x475919
and eax, dword [ebp - 0x1c]
jmp 0x475926
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x475926
xor edx, edx
div ecx
mov eax, edx
cmp eax, dword [ebp - 0x10]
jne 0x47594d
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4758d4
jmp 0x47594d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x475949
push eax
push esi
push ecx
call fcn.004d284d
add esp, 0xc
test eax, eax
jne 0x47592b
mov ecx, ebx
jmp 0x47594f
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x475f80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x53e964]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x475fcd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, 0x53e960
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x53e964
call fcn.004d0617
add esp, 4
cmp dword [0x53e964], 0xffffffff
jne 0x475fb3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004d4450
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.004d0575
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x53e994]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x476076
mov ecx, esi
push ebx
push 0x53e970
push edi
call fcn.00476180
mov dword [0x53e960], esi
push 0x53e964
call fcn.004d068d
add esp, 4
jmp 0x475fb3
push 0x53e994
call fcn.004d0617
add esp, 4
cmp dword [0x53e994], 0xffffffff
jne 0x476050
xorps xmm0, xmm0
movups xmmword [0x53e980], xmm0
movups xmmword [0x53e970], xmm0
mov dword [0x53e990], 0
push 0x53e970
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x53e994
call fcn.004d068d
add esp, 4
jmp 0x476050

Function at 0x4760e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x53e994]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x476111
movzx eax, word [0x53e970]
cmp eax, 9
jne 0x47615c
xor eax, eax
inc eax
pop ebp
ret
push 0x53e994
call fcn.004d0617
add esp, 4
cmp dword [0x53e994], 0xffffffff
jne 0x476100
xorps xmm0, xmm0
movups xmmword [0x53e980], xmm0
movups xmmword [0x53e970], xmm0
mov dword [0x53e990], 0
push 0x53e970
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x53e994
call fcn.004d068d
add esp, 4
jmp 0x476100
test eax, eax
je 0x47610f
cmp eax, 6
jne 0x47616c
mov eax, 2
jmp 0x47610f
cmp eax, 0xc
jne 0x476178
mov eax, 3
jmp 0x47610f
mov eax, 4
jmp 0x47610f

Function at 0x4768a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4
Function at 0x4768d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x476930
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x476930
cmp dword [ebp - 0x18], 4
jne 0x476930
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x476950
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.004d1990
mov esi, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0xff
push ebx
call fcn.004d4450
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], edi
push ecx
push ebx
push eax
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x476b10
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x4769f4
mov edi, 0x3f4
cmp eax, 1
jne 0x476b10
push ebx
call fcn.004ec838
add esp, 4
movzx ecx, byte [esi + 0xb]
test cl, cl
js 0x476a5d
mov edi, esi
cmp eax, 4
jbe 0x476ab0
mov edx, 4
jmp 0x476a6d
lea esi, [ebp - 0x1010]
push 0x800
push 0xff
push esi
call fcn.004d4450
add esp, 0xc
push 0x400
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x476b10
push esi
call fcn.004ec838
add esp, 4
mov ebx, eax
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0xb]
test al, al
js 0x476a83
mov edi, esi
cmp ebx, 4
jbe 0x476ae1
mov edx, 4
jmp 0x476a93
mov edx, 0x7fffffff
and edx, dword [esi + 8]
dec edx
cmp edx, eax
jae 0x476aae
mov ecx, dword [esi + 4]
mov dword [ebp - 0x101c], ecx
mov edi, eax
sub edi, edx
mov ecx, esi
push ebx
push eax
mov eax, dword [ebp - 0x101c]
jmp 0x476aa1
mov edx, 0x7fffffff
and edx, dword [esi + 8]
dec edx
cmp edx, ebx
jae 0x476adf
mov eax, dword [esi + 4]
mov edi, ebx
sub edi, edx
mov ecx, esi
lea esi, [ebp - 0x1010]
push esi
push ebx
push eax
push 0
push eax
push edi
push edx
call fcn.0046efe0
jmp 0x476b0e
mov edi, dword [esi]
lea ecx, [eax + eax]
push ecx
push ebx
push edi
mov ebx, eax
call fcn.004d3ed0
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x476ad2
cmp ebx, 5
jae 0x476b29
mov eax, ebx
mov byte [esi + 0xb], al
jmp 0x476ad7
mov dword [esi + 4], ebx
mov eax, ebx
mov word [edi + eax*2], 0
jmp 0x476b0e
mov edi, dword [esi]
lea eax, [ebx + ebx]
push eax
lea eax, [ebp - 0x1010]
push eax
push edi
call fcn.004d3ed0
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x476b05
cmp ebx, 5
jae 0x476b29
mov byte [esi + 0xb], bl
jmp 0x476b08
mov dword [esi + 4], ebx
mov word [edi + ebx*2], 0
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.__s_should_never_be_greater_than_or_equal_to_the_short_string_capacity
push str.__s_____min_cap
push 0x6c6
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.00448430
int3
Function at 0x476b50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x538010]
xor edx, ebp
mov dword [ebp - 8], edx
mov edx, 4
lea esi, [ebp + 0xc]
push edx
push esi
push edx
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d1573
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x476f80
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x538010]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x53e9a8]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x476fab
jnp 0x476fd0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.004d1573
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x53e9b8]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x477105
mov eax, dword [0x53e9c8]
mov ecx, dword [0x53ca88]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47713e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea edi, [esp + 0x38]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [edi]
mov ebx, dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x53e9c0]
sbb ebx, dword [0x53e9c4]
movd xmm0, ebx
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x5250e8]
ucomisd xmm2, xmm1
ja 0x476fab
mov eax, dword [esp + 8]
sub eax, dword [0x53e9b0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x53e9b4]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x5250c0]
subpd xmm0, xmmword [0x5250d0]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x53e9a8], xmm0
jmp 0x476fab
push 0x53e9b8
call fcn.004d0617
add esp, 4
cmp dword [0x53e9b8], 0xffffffff
jne 0x47700f
rdtsc
mov dword [0x53e9b0], eax
mov dword [0x53e9b4], edx
push 0x53e9b8
call fcn.004d068d
add esp, 4
jmp 0x47700f
push 0x53e9c8
call fcn.004d0617
add esp, 4
cmp dword [0x53e9c8], 0xffffffff
jne 0x477030
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x53e9c4], ecx
mov dword [0x53e9c0], eax
push 0x53e9c8
call fcn.004d068d
add esp, 4
jmp 0x477030
Function at 0x47729f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
or eax, 0x103b9
add eax, 0x74f8
or eax, 0xf042
pop eax
push edi
add edi, 0x1168d
and edi, 0x114bd
pop edi
mov eax, 0x4d
mov word [ebp - 0x1e34], ax
mov ecx, 0x42
mov word [ebp - 0x1e32], cx
mov edx, 0x53
mov word [ebp - 0x1e30], dx
mov eax, 0x65
mov word [ebp - 0x1e2e], ax
mov ecx, 0x72
mov word [ebp - 0x1e2c], cx
mov edx, 0x76
mov word [ebp - 0x1e2a], dx
mov eax, 0x69
mov word [ebp - 0x1e28], ax
mov ecx, 0x63
mov word [ebp - 0x1e26], cx
mov edx, 0x65
mov word [ebp - 0x1e24], dx
mov eax, 0x2e
mov word [ebp - 0x1e22], ax
mov ecx, 0x65
mov word [ebp - 0x1e20], cx
mov edx, pe_nt_image_headers32
mov word [ebp - 0x1e1e], dx
mov eax, 0x65
mov word [ebp - 0x1e1c], ax
xor ecx, ecx
mov word [ebp - 0x1e1a], cx
push edi
or edi, 0x3887
and edi, 0x5857
pop edi
push edi
add edi, 0x10886
xor edi, 0x156b6
xor edi, 0x1590d
pop edi
push ecx
sub ecx, 0x14120
pop ecx
push eax
sub eax, 0x14fb1
pop eax
mov byte [ebp - 0xddc], 0x43
mov byte [ebp - 0xddb], 0x72
mov byte [ebp - 0xdda], 0x65
mov byte [ebp - 0xdd9], 0x61
mov byte [ebp - 0xdd8], 0x74
mov byte [ebp - 0xdd7], 0x65
mov byte [ebp - 0xdd6], 0x54
mov byte [ebp - 0xdd5], 0x6f
mov byte [ebp - 0xdd4], 0x6f
mov byte [ebp - 0xdd3], 0x6c
mov byte [ebp - 0xdd2], 0x68
mov byte [ebp - 0xdd1], 0x65
mov byte [ebp - 0xdd0], 0x6c
mov byte [ebp - 0xdcf], 0x70
mov byte [ebp - 0xdce], 0x33
mov byte [ebp - 0xdcd], 0x32
mov byte [ebp - 0xdcc], 0x53
mov byte [ebp - 0xdcb], 0x6e
mov byte [ebp - 0xdca], 0x61
invalid

Function at 0x47787f
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ebx
mov dword [ebp - 0x28d4], 0x22c
mov edx, dword [ebp - 0x2614]
mov dword [ebp - 0xc68], edx
push eax
push ecx
add esp, 4
and eax, 0xf83e
and eax, 0x14dcd
xor eax, 0x1fe9
sub eax, 0xd5b1
pop eax
push edi
add edi, 0x798c
sub edi, 0xb2dd
or edi, 0x7e2d
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x23d8], eax
mov ecx, dword [ebp - 0x23d8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x23dc], edx
mov eax, dword [ebp - 0x23dc]
mov dword [ebp - 0x19c4], eax
push esi
or esi, 0x8770
or esi, 0x17bab
pop esi
push esi
call 0x47787f
add byte [eax + 0x37], cl
dec eax
inc ecx
inc esi
inc ebp
xor eax, dword [ebx - 0x317efb3c]
inc esi
sub al, 0
add byte [ecx + 0x39e5f6], al
add byte [ecx + 0x4dc7f6], al
add byte [esi - 0x7d], bl
mov ebp, 0xffffe63c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x3b0], 0
jmp 0x477b69