joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f670
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0x6a3100
sub esp, 0xc
mov dword [0x6a3180], 0
mov dword [0x6a3184], 0
sub edx, ecx
mov eax, dword [edx + ecx]
mov dword [ecx], eax
test eax, eax
je 0x41f6a8
add ecx, 4
cmp ecx, 0x6a3180
jl 0x41f694
push esi
lea eax, [ebp - 0xc]
push str.WWRIP.EXE
push eax
call fcn.0041f2d0
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, dword [ebp - 8]
cmp ecx, eax
je 0x41f6f1
sub eax, ecx
xor esi, esi
sar eax, 2
test eax, eax
je 0x41f6f1
push edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
push dword [ecx + esi*4]
push 0x41f240
call edi
mov eax, dword [ebp - 8]
inc esi
mov ecx, dword [ebp - 0xc]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x41f6d6
pop edi
cmp dword [0x6a3184], 1
jle 0x41f716
push str.Multiple_instances_of_RIP_shell_currently_running.
push 0x10
push str.Fatal_Error
call fcn.004154f0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [0x6a3180]
test ecx, ecx
je 0x41f74c
mov edx, dword [ebp - 4]
mov eax, ecx
sub edx, ecx
and edx, 0xfffffffc
cmp edx, 0x1000
jb 0x41f742
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f753
push edx
push ecx
call fcn.004b3acc
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004c342f
int3

Function at 0x41fd50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x52ae20]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jns 0x41fda4
push 0x4fd8ac
call fcn.0041c8c0
push eax
push str.PRINTLOG
call fcn.004129d0
add esp, 0xc
test eax, eax
je 0x41fd9b
push eax
call fcn.004cd97e
add esp, 4
jmp 0x41fd9d
xor eax, eax
mov dword [0x52ae20], eax
test eax, eax
jle 0x41fde7
push 0x4fda68
push esi
call fcn.0041d3a0
mov esi, eax
add esp, 8
test esi, esi
je 0x41fde7
push esi
push 0x800
lea eax, [ebp - 0x804]
push 1
push eax
call fcn.004c37de
push esi
call fcn.004c35d5
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push eax
call fcn.0041fe00
add esp, 0x20
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
Function at 0x42aec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x1c]
test eax, eax
je 0x42af25
push 0x4fda68
push eax
call fcn.0041d3a0
mov esi, eax
add esp, 8
test esi, esi
je 0x42af25
push esi
push 0x800
lea eax, [ebp - 0x804]
push 1
push eax
call fcn.004c37de
push esi
call fcn.004c35d5
mov esi, dword [ebp - 0x7f8]
add esp, 0x14
jmp 0x42af28
mov esi, dword [ebp + 0x18]
test edi, edi
je 0x42afa6
cvttsd2si eax, qword [edi + 0x40]
push dword [ebp + 8]
push eax
call fcn.00429d90
movd xmm2, dword [edi + 0x1c]
add eax, eax
cvtdq2pd xmm2, xmm2
mov ecx, dword [edi + 0x20]
add esp, 8
sub ecx, eax
sub ecx, esi
mulsd xmm2, qword [0x4ff3f8]
movd xmm1, ecx
mov ecx, dword [ebp - 0x808]
cvtdq2pd xmm1, xmm1
divsd xmm2, qword [edi + 0x38]
movd xmm0, dword [ecx]
mulsd xmm1, qword [0x4ff3f8]
cvtdq2pd xmm0, xmm0
divsd xmm1, qword [edi + 0x40]
comisd xmm0, xmm2
jbe 0x42af8b
cvttsd2si eax, xmm2
mov dword [ecx], eax
movd xmm0, dword [ebx]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jbe 0x42afa6
xorps xmm0, xmm0
maxsd xmm0, xmm1
cvttsd2si eax, xmm0
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3f28
mov esp, ebp
pop ebp
ret

Function at 0x42bed0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6a4aec]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x42befb
push eax
call fcn.004c98b4
add esp, 4
push 0x100
call fcn.004c98cf
mov ebx, dword [ebp + 8]
mov esi, eax
add esp, 4
mov dword [0x6a4aec], esi
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
mov al, byte [edx + ebx]
mov byte [ebp + ecx - 0x104], al
inc ecx
cmp ecx, 0xfa
jl 0x42bf15
mov byte [ebp - 0xa], 0
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jb 0x42bf33
xor edi, edi
mov ecx, 0xfa
mov dword [ebp - 0x108], edi
nop dword [eax + eax]
mov eax, edi
mov bl, byte [edi + esi]
xor edx, edx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x104]
add eax, dword [ebp - 0x108]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x108], ecx
mov dword [0x6a4af4], ecx
mov al, byte [ecx + esi]
mov byte [ecx + esi], bl
mov ecx, 0xfa
mov byte [edi + esi], al
inc edi
cmp edi, 0x100
jb 0x42bf50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x6a4af0], 0
pop ebx
mov dword [0x6a4af4], 0
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
Function at 0x42ede0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x32
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42ee21
nop
test esi, esi
js 0x42ee21
push 0x14
call fcn.00415440
add esp, 4
test esi, esi
je 0x42ee26
push 1
push edi
push ebx
dec esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x42ee00
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Disk_access_error_in_writeWasatchConfigurationFile_nduring_update_of__s_nGetLastError_returned__d
call fcn.00414600
add esp, 0xc
push 0
call fcn.004cf3c2
int3

Function at 0x42f260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6a3ad4], 0
jne 0x42f3df
push esi
call fcn.0042f4c0
push str.initialSetupV3
push dword [0x6a4be8]
call fcn.00442ef0
push str.manufactureDate
push dword [0x6a4be8]
mov esi, eax
call fcn.00442ef0
add esp, 0x10
test eax, eax
je 0x42f2c2
call eax
mov edx, 0x6a4bf0
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x42f2b5
test esi, esi
je 0x42f415
imul eax, dword [0x52af40], 0x488
push eax
call fcn.00417230
imul ecx, dword [0x52af40], 0x488
mov dword [0x6a3ad4], eax
push ecx
push 0
push eax
call fcn.004b90a0
add esp, 0x10
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x6a4b14]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x45], al
test al, al
jne 0x42f300
push dword [0x6a3ad4]
lea eax, [ebp - 0x44]
push eax
push dword [0x6a4b60]
push dword [0x6a4b3c]
push dword [0x6a4b44]
push dword [0x6a4b40]
push dword [ebp + 8]
call esi
mov edx, dword [0x6a3ad4]
add esp, 0x1c
xor ecx, ecx
pop esi
cmp dword [edx + 0x10], ecx
je 0x42f369
mov eax, edx
nop dword [eax + eax]
cmp dword [eax + 0x18], 0x2d
jne 0x42f3ed
inc ecx
imul eax, ecx, 0x488
add eax, edx
cmp dword [eax + 0x10], 0
jne 0x42f350
push str.editionName
push dword [0x6a4be8]
call fcn.00442ef0
add esp, 8
test eax, eax
je 0x42f39d
call eax
mov edx, 0x6a4b68
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x42f390
mov ecx, dword [0x6a4be8]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x58]
mov dword [0x6a4b64], eax
call fcn.00415140
mov ecx, dword [0x6a3ad4]
xor edx, edx
cmp dword [ecx + 0x10], edx
je 0x42f3df
mov eax, dword [0x68b608]
inc edx
mov dword [ecx + 0x458], eax
imul ecx, edx, 0x488
add ecx, dword [0x6a3ad4]
cmp dword [ecx + 0x10], 0
jne 0x42f3c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
imul eax, ecx, 0x488
push dword [eax + edx + 0x10]
push 0x2d
push str.Statically_linked_layer._n_nComponent_mismatch_n_nFailed_to_match_DRVR_REVISION_CODE___d_n_n_s
push 0x10
push str.Error
call fcn.004154f0
add esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.initialSetup
call fcn.0042f430
int3
Function at 0x42f430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f55ad
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push str.Wasatch_SoftRIP
call fcn.00405cf0
push str.___Fatal_Error
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.00420a30
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.004025c0
push 0x501b6c
call fcn.0041c8c0
add esp, 4
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.0042f420
push edi
push esi
push str.Mismatched_component__s_n_nmissing__n_n_s
push 0x10
push eax
call fcn.004154f0
add esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42fcd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004184a0
add esp, 4
test eax, eax
je 0x42fd66
push edi
push 0x4fda68
push esi
call fcn.0041d3a0
mov edi, eax
add esp, 8
test edi, edi
je 0x42fd52
push edi
push 0x800
lea eax, [ebp - 0x804]
push 1
push eax
call fcn.004c37de
mov ecx, dword [ebp - 0x140]
mov esi, dword [ebp - 0x7f4]
push edi
mov ecx, dword [ecx*4 + 0x52af48]
mov dword [ebx], ecx
call fcn.004c35d5
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
pop esi
pop ebx
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
Function at 0x430490
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f55ed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x52de04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
cmp dword [edi + 0x10], 0
mov dword [ebp - 4], 0
jne 0x4304f8
sub esp, 0x18
lea eax, [ebp + 8]
mov esi, esp
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402330
push esi
call fcn.0044fb30
add esp, 0x1c
mov ecx, edi
call fcn.00430ca0
test al, al
je 0x430637
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00402330
call fcn.0044fad0
add esp, 0x18
mov dword [edi + 0x18], eax
test eax, eax
je 0x430637
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.readImageFileHeader
push eax
mov byte [ebp - 4], 1
call esi
push str.readImageLine
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.readImageTail
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
push str.sampleType
push dword [edi + 0x18]
mov dword [edi + 0x30], eax
call esi
push str.getEmbeddedICCProfileV2
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
mov edx, dword [edi + 0x28]
mov dword [edi + 0x20], eax
test edx, edx
je 0x430655
cmp dword [edi + 0x2c], 0
je 0x43065e
cmp dword [edi + 0x30], 0
je 0x430667
cmp dword [edi + 0x24], 0
je 0x430670
cmp dword [ebp + 0x1c], 0x10
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x58]
push eax
lea eax, [edi + 0x50]
push eax
lea eax, [edi + 0x4c]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push ecx
call edx
mov edx, eax
add esp, 0x14
mov dword [edi + 0x1c], edx
test edx, edx
je 0x430679
mov ecx, dword [edi + 0x24]
lea eax, [edi + 0x6c]
push eax
lea eax, [edi + 0x68]
push eax
push edx
call ecx
add esp, 0xc
cmp dword [edi + 0x20], 0
je 0x43060b
push 0x800000
call fcn.00417230
mov ecx, dword [edi + 0x20]
mov esi, eax
push esi
push dword [edi + 0x1c]
call ecx
add esp, 0xc
mov dword [edi + 0x74], eax
test eax, eax
je 0x430602
push eax
call fcn.00417230
push dword [edi + 0x74]
mov dword [edi + 0x70], eax
push esi
push eax
call fcn.004b8680
add esp, 0x10
push esi
call fcn.00417300
add esp, 4
lea ecx, [ebp + 8]
call fcn.004025c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp + 8]
call fcn.004025c0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0
push 0
call fcn.004b8c76
push 0
push 0
call fcn.004b8c76
push 0
push 0
call fcn.004b8c76
push 0
push 0
call fcn.004b8c76
push 0
push 0
call fcn.004b8c76
int3
Function at 0x4426d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4426fa
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6a6998]
inc eax
and eax, 0x8000000f
jns 0x44270c
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x6a6998], eax
lea eax, [ebp - 0x224]
push ecx
push eax
call fcn.00442840
mov ecx, eax
add esp, 8
cmp dword [ecx + 0x14], 0x10
jb 0x44272b
mov ecx, dword [ecx]
lea edx, [ebp - 0x20c]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x442733
mov ecx, dword [ebp - 0x210]
cmp ecx, 0x10
jb 0x44277a
mov edx, dword [ebp - 0x224]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x442770
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x442832
push ecx
push edx
call fcn.004b3acc
add esp, 8
push str.configurations
call fcn.0041c8c0
lea ecx, [ebp - 0x20c]
push ecx
push eax
imul eax, dword [0x6a6998], 0x104
push 0x4ff75c
add eax, 0x6a5958
push eax
call fcn.00404ce0
push str.configurations
call fcn.0041c8c0
push eax
call fcn.004dbca0
imul eax, dword [0x6a6998], 0x104
add eax, 0x6a5958
push eax
call fcn.004dbca0
imul eax, dword [0x6a6998], 0x104
push str.none
add eax, 0x6a5958
push eax
lea eax, [ebp - 0x108]
push 0x4ff75c
push eax
call fcn.00404ce0
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0041d2e0
add esp, 0x38
test eax, eax
je 0x442815
lea eax, [ebp - 0x108]
push eax
call fcn.004dbca0
add esp, 4
imul eax, dword [0x6a6998], 0x104
mov ecx, dword [ebp - 4]
xor ecx, ebp
add eax, 0x6a5958
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
call fcn.004c342f
int3
Function at 0x444370
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6a6b0c]
push esi
push edi
test eax, eax
jne 0x4443d1
push str.devices.dll
call fcn.0041c9d0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6a6b0c], eax
test eax, eax
jne 0x4443d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.00414680
push 0x501b6c
mov esi, eax
call fcn.0041c8c0
push esi
push edi
push eax
push str.Failure_to_load__s_n_nWindows_Error__d:__s
push 0x10
push str.Fatal_Error
call fcn.004154f0
add esp, 0x20
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
ret

Function at 0x445900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x44591c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
cmp dword [ebp + 0xc], ecx
jle 0x44597a
mov al, byte [ebx]
mov esi, dword [ebp - 4]
shr al, cl
inc esi
and al, 1
lea ecx, [edi + edi]
movzx edx, al
or dx, cx
mov ecx, dword [ebp + 0xc]
cmp esi, 7
lea eax, [ecx - 1]
cmovle eax, ecx
mov dword [ebp + 0xc], eax
mov eax, edx
xor eax, 0x8005
movzx ecx, ax
movzx eax, dx
mov edx, 0x8000
cmp di, dx
cmovb ecx, eax
lea eax, [ebx + 1]
movzx edx, cx
xor ecx, ecx
cmp esi, 7
mov edi, edx
cmovle ecx, esi
cmovle eax, ebx
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov dword [ebp - 4], ecx
jg 0x445922
mov esi, 0x10
nop
lea edx, [edi + edi]
mov eax, edx
xor eax, 0x8005
movzx ecx, ax
movzx eax, dx
mov edx, 0x8000
cmp di, dx
cmovb ecx, eax
movzx eax, cx
mov ecx, eax
mov edi, eax
sub esi, 1
jne 0x445980
mov eax, edx
lea edx, [esi + 1]
nop dword [eax]
test eax, ecx
je 0x4459b6
or esi, edx
add edx, edx
sar eax, 1
jne 0x4459b0
movzx eax, si
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446720
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x104]
push 0x80
push ecx
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push 4
lea eax, [ebp - 0x104]
push str.NTFS
push eax
call fcn.004dbd59
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
Function at 0x4470f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push str.SOFTWAREWasatch
push connect
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4471a9
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.HomeFolder
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea ecx, [ebp - 0x20c]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 2]
mov dword [esi + 0x14], 0
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x447190
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
jmp 0x4471c4
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x4ffbfc
mov ecx, esi
call fcn.004021b0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret

Function at 0x449390
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004497b0
cmp dword [0x52b0ac], 0
je 0x4493c3
sub esp, 0x18
mov ecx, esp
push 0x52b0b0
call fcn.00402330
call fcn.00442200
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x6a6db0], 0
je 0x4494a9
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x6a6db4]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 0x4e20
jbe 0x449437
call edi
mov esi, eax
call ebx
sub eax, dword [0x6a6db4]
sub esp, 0x18
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x500f40]
mov eax, esp
push esi
sub esp, 8
divsd xmm0, qword [0x4fdeb8]
movsd qword [esp], xmm0
push str.freeQueuesLock:_Warning___lock_freed_after__G_seconds_by_process_id__d
push eax
call fcn.00415150
add esp, 0x14
call fcn.004492f0
add esp, 0x18
push dword [0x6a6db0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x6a6db0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x52b0a8], 0
mov dword [0x6a6db0], 0
je 0x4494a9
call edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call ebx
sub eax, dword [0x6a6db4]
push edi
push esi
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x500f40]
divsd xmm0, qword [0x4fdeb8]
movsd qword [esp], xmm0
push str.freed__G_second_queues_lock_for_thread__d__process__d_n
call fcn.004059c0
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x44c7b6
push 0x4fda68
push eax
call fcn.0041d3a0
mov esi, eax
add esp, 8
test esi, esi
je 0x44c7b6
push esi
push 0x80
lea eax, [ebp - 0x84]
push 1
push eax
call fcn.004c37de
add esp, 0x10
push esi
cmp eax, 0x80
je 0x44c7c7
call fcn.004c35d5
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
call fcn.004c35d5
lea eax, [ebp - 0x84]
push eax
call fcn.0044c5e0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret

Function at 0x44c8e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x44c92b
push 0x4fda68
push eax
call fcn.0041d3a0
mov esi, eax
add esp, 8
test esi, esi
je 0x44c92b
push esi
push 1
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004c37de
add esp, 0x10
push esi
cmp eax, 1
je 0x44c93c
call fcn.004c35d5
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
call fcn.004c35d5
mov ecx, dword [ebp - 4]
add esp, 4
xor eax, eax
cmp dword [ebp - 0x44], 0x885d9a88
sete al
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret

Function at 0x44db20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push esi
call fcn.004c3c02
push esi
push 1
lea eax, [ebp - 0x8c]
push 8
push eax
call fcn.004c37de
push esi
push 1
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004c37de
push esi
push 1
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004c37de
push esi
call fcn.004d245c
add esp, 0x40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
push 0
push 0
push esi
call fcn.004c3c02
push esi
push 1
lea eax, [ebp - 0x8c]
push 8
push eax
call fcn.004c3f01
push esi
push 1
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004c3f01
push esi
push 1
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004c3f01
push esi
call fcn.004d245c
mov ecx, dword [ebp - 4]
add esp, 0x40
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
Function at 0x44dbf0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [0x6ab468]
mov eax, dword [ecx + 0x110]
movzx eax, word [eax + 0x10]
dec eax
cmp eax, 0x64
ja case.0x44dc11.2
movzx eax, byte [eax + 0x44dd84]
jmp dword [eax*4 + 0x44dd70]
mov dword [ecx + 0x114], 0x44de50
ret
mov dword [ecx + 0x114], 0x44d970
ret
push esi
push edi
push 0x100
mov dword [ecx + 0x114], 0x44dee0
call fcn.00417230
mov ecx, dword [0x6ab468]
push 0x100
mov dword [ecx + 0x124], eax
call fcn.00417230
mov ecx, dword [0x6ab468]
push 0x100
mov dword [ecx + 0x128], eax
call fcn.00417230
mov ecx, dword [0x6ab468]
push dword [ecx + 0x80]
mov dword [ecx + 0x12c], eax
push 1
push 0x100
push dword [ecx + 0x124]
call fcn.004c37de
mov eax, dword [0x6ab468]
push dword [eax + 0x80]
push 1
push 0x100
push dword [eax + 0x128]
call fcn.004c37de
mov eax, dword [0x6ab468]
push dword [eax + 0x80]
push 1
push 0x100
push dword [eax + 0x12c]
call fcn.004c37de
mov eax, dword [0x6ab468]
mov ecx, 0x40
mov edi, 0x6ab470
add esp, 0x3c
mov esi, dword [eax + 0x124]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0x128]
mov ecx, 0x40
mov edi, 0x6ab570
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0x12c]
mov ecx, 0x40
mov edi, 0x6ab670
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
push dword [ecx + 0x80]
mov dword [ecx + 0x114], 0x44dfb0
call fcn.004c35d5
mov ecx, dword [0x6ab468]
push 0
mov eax, dword [ecx + 0x110]
mov dword [ecx + 0x80], 0
push dword [eax + 0x1c]
push 0x80
push dword [eax + 4]
push dword [eax]
push 1
push ecx
call fcn.00479180
mov ecx, dword [0x6ab468]
add esp, 0x20
mov dword [ecx + 0x120], eax
ret
push str.Unsupported_encoding_in_readWimHeader__
call fcn.004158e0
pop ecx
ret
Function at 0x450470
Capabilities:
Set environment variable

Disassembly:
cmp dword [0x52be94], 0
je 0x4504f5
cmp dword [0x52be98], 0x10
mov eax, 0x52be84
cmovae eax, dword [0x52be84]
push eax
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x4fd8ac
call fcn.0041c8c0
push eax
push 0x504ac0
call fcn.00412960
add esp, 0xc
test eax, eax
je 0x4504d5
cmp dword [0x52be98], 0x10
mov eax, 0x52be84
cmovae eax, dword [0x52be84]
push eax
push str.just_restored_PATH_to_n_n_s
call fcn.004153c0
add esp, 8
cmp dword [0x52be98], 0x10
mov eax, 0x52be84
mov dword [0x52be94], 0
cmovae eax, dword [0x52be84]
mov byte [eax], 0
ret