joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410890
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4108fe
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x4108cf
cmp eax, 2
jne 0x4108ea
mov eax, dword [esp]
test esi, esi
je 0x4108f8
test eax, eax
je 0x4108f3
test al, 1
jne 0x4108ea
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4108f8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x4109e0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x210
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x20c], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.0054e420
add esp, 0xc
lea edx, [esp]
push edx
lea eax, [esp + 8]
push eax
mov dword [esp + 8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x410a56
lea ecx, [esp + 4]
push str.SYSTEM
push ecx
call fcn.0054bc3c
add esp, 8
test eax, eax
jne 0x410a56
mov al, 1
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00548a41
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
xor al, al
call fcn.00548a41
add esp, 0x210
ret

Function at 0x413410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aae18
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esi + 0x30], 0x10
jb 0x41344e
mov eax, dword [esi + 0x1c]
push eax
call fcn.00548a36
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x413474
mov eax, dword [esi]
push eax
call fcn.00548a36
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4134b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5abf58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea esi, [ecx + 4]
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp dword [esi + 0x30], 0x10
jb 0x4134f2
mov eax, dword [esi + 0x1c]
push eax
call fcn.00548a36
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
mov dword [esp + 0x18], 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x413518
mov eax, dword [esi]
push eax
call fcn.00548a36
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x414e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5be2b8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
fldz
xor eax, eax
fstp qword [esp + 0x1c]
mov dword [esp + 4], vtable.ipc::proto::Variable.0
mov dword [esp + 8], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0x625620
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 4]
push eax
call fcn.004149c0
test al, al
jne 0x414efa
lea ecx, [esp + 4]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00420640
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
add esp, 0x4c
ret 4
cmp dword [esp + 0xc], 1
jne 0x414ed5
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 0x54]
mov byte [edx], cl
lea ecx, [esp + 4]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00420640
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
add esp, 0x4c
ret 4
Function at 0x427390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bff69
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], vtable.ipc::proto::CandidateList.0
mov dword [esi + 4], eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0x10], ecx
mov ecx, 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
lea edx, [esi + 0x3c]
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov byte [esp + 0x10], 3
mov ecx, 1
mov dword [esi + 0x74], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x5c], 0xa
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00428a30
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x457530
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b58e3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x18], edi
push 0x22
xor eax, eax
mov esi, 7
push str.SoftwareGoogleGoogle_Input_Tools
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], edi
mov word [esp + 0x2c], ax
call fcn.00401d20
push 0x28
mov dword [esp + 0x54], edi
call fcn.00548a50
add esp, 4
cmp eax, edi
je 0x4575bb
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0x20], esi
xor ecx, ecx
mov dword [eax + 0x1c], edi
mov word [eax + 0xc], cx
mov esi, eax
jmp 0x4575bd
xor esi, esi
mov byte [esp + 0x50], 0
mov eax, dword [esp + 0x24]
mov ebx, 8
cmp dword [esp + 0x38], ebx
jae 0x4575d5
lea eax, [esp + 0x24]
push esi
mov edx, 0x2011f
mov ecx, reloc.WS2_32.dll_accept
call fcn.004036a0
test eax, eax
je 0x457617
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x38], ebx
jae 0x4575f7
lea eax, [esp + 0x24]
push 0x2011f
push esi
mov ecx, reloc.WS2_32.dll_accept
call fcn.00402f90
test eax, eax
je 0x457617
cmp esi, edi
je 0x457615
push esi
call fcn.0040f950
xor esi, esi
mov dword [esp + 0x18], esi
mov byte [esp + 0x50], 4
cmp dword [esp + 0x38], ebx
jb 0x457633
mov edx, dword [esp + 0x24]
push edx
call fcn.00548a36
add esp, 4
cmp esi, edi
jne 0x45763e
xor al, al
jmp 0x4576e5
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x2c], edi
mov eax, dword [esi]
push str.GACurrentSessionTime
mov ebx, 4
push eax
mov byte [esp + 0x2f], 0
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x457683
cmp dword [esp + 0x18], ebx
jne 0x457683
cmp dword [esp + 0x1c], edi
jbe 0x457683
mov byte [esp + 0x17], 1
push edi
call fcn.0054a7dc
add esp, 4
cmp byte [esp + 0x17], 0
mov ebx, eax
mov eax, dword [esp + 0x1c]
je 0x45769e
cmp ebx, eax
jne 0x45769e
inc ebx
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x28], eax
mov edx, dword [esi]
push str.GALastSessionTime
push edx
call edi
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
mov dword [esp + 0x28], ebx
mov ecx, dword [esi]
push str.GACurrentSessionTime
push ecx
call edi
push esi
mov dword [esp + 0x54], 0xffffffff
call fcn.0040f950
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00548a41
mov esp, ebp
pop ebp
ret
Function at 0x457710
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b26a3
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push 0x22
xor edi, edi
xor eax, eax
mov esi, 7
push str.SoftwareGoogleGoogle_Input_Tools
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], edi
mov word [esp + 0x28], ax
call fcn.00401d20
push 0x28
mov dword [esp + 0x4c], edi
call fcn.00548a50
add esp, 4
cmp eax, edi
je 0x457795
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0x20], esi
xor ecx, ecx
mov dword [eax + 0x1c], edi
mov word [eax + 0xc], cx
mov esi, eax
jmp 0x457797
xor esi, esi
mov byte [esp + 0x48], 0
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x4577ab
lea eax, [esp + 0x20]
push esi
mov edx, 0x2011f
mov ecx, reloc.WS2_32.dll_accept
call fcn.004036a0
test eax, eax
je 0x4577ee
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x4577ce
lea eax, [esp + 0x20]
push 0x2011f
push esi
mov ecx, reloc.WS2_32.dll_accept
call fcn.00402f90
test eax, eax
je 0x4577ee
cmp esi, edi
je 0x4577ec
push esi
call fcn.0040f950
xor esi, esi
mov dword [esp + 0x18], esi
mov ebx, 4
mov byte [esp + 0x48], bl
cmp dword [esp + 0x34], 8
jb 0x45780f
mov edx, dword [esp + 0x20]
push edx
call fcn.00548a36
add esp, 4
cmp esi, edi
jne 0x457817
xor al, al
jmp 0x457884
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push str.GATotalSessionCount
push eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x457843
cmp dword [esp + 0x18], ebx
je 0x45784d
mov dword [esp + 0x14], 1
jmp 0x457851
inc dword [esp + 0x14]
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push edi
push str.GATotalSessionCount
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push esi
sete bl
mov dword [esp + 0x4c], 0xffffffff
call fcn.0040f950
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00548a41
add esp, 0x3c
ret
Function at 0x47404e
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, ecx
call fcn.004109e0
test al, al
jne 0x47409f
lea eax, [esp + 4]
push esi
push eax
call fcn.00473bb0
mov eax, dword [esp + 0xc]
mov esi, 8
add esp, 8
cmp dword [esp + 0x18], esi
jae 0x47407b
lea eax, [esp + 4]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x18], esi
jb 0x47409f
mov ecx, dword [esp + 4]
push ecx
call fcn.00548a36
add esp, 4
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
call fcn.00548a41
add esp, 0x20
ret

Function at 0x475780
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5b93b3
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x24]
mov dword [esi + 0xc], ecx
push edi
mov dword [esi], vtable.ggadget::View::Impl::TimerWatchCallback.0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x20], edi
push eax
lea ecx, [esi + 0x34]
push ecx
xor ebx, ebx
mov dword [eax], 0x9c43
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
call fcn.00490800
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov al, 1
mov byte [esp + 0x1c], al
push 0xc
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ebp
mov byte [esi + 0x58], al
call fcn.00548a50
add esp, 4
cmp eax, edi
je 0x475835
mov dword [eax], vtable.._AV__MethodSlot0_XVTimerWatchCallback_Impl_View_ggadget__P81234_AEXXZ_ggadget__.0
mov dword [eax + 4], esi
mov dword [eax + 8], 0x475ab0
mov edi, eax
mov eax, dword [esi + 0x18]
add eax, 0x160
push edi
call fcn.0048acd0
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x4836e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b0b99
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x24], eax
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp byte [esp + 0x44], 0
fld qword [esp + 0x50]
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
jne 0x48373d
xor eax, eax
fstp st(0)
mov dword [edi + 8], 0
mov dword [edi], eax
mov dword [edi + 4], eax
jmp 0x4837d8
sub esp, 8
cmp byte [esp + 0x48], 0
je 0x4837af
fmul qword [0x5ef4e8]
fadd qword [0x5ef450]
fstp qword [esp]
call fcn.005a8840
call fcn.005a8790
push eax
lea eax, [esp + 0x1c]
push str._d__
push eax
call fcn.00494220
add esp, 0x14
mov dword [esp + 0x38], 0
mov dword [edi + 8], 4
mov dword [esp + 8], edi
push eax
mov byte [esp + 0x3c], 1
call fcn.00471b70
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x4837d8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00548a36
add esp, 4
jmp 0x4837d8
fstp st(0)
mov dword [edi + 8], 2
fld qword [esp + 0x50]
fadd qword [0x5ef450]
fstp qword [esp]
call fcn.005a8840
add esp, 8
call fcn.005a8790
cdq
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00548a41
add esp, 0x34
ret

Function at 0x484590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b5548
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push eax
xor ecx, ecx
lea edx, [esp + 0x14]
call fcn.0048a950
mov dword [esp + 0x30], 0
cmp dword [esp + 0x14], 7
jne 0x484606
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.00485ae0
test eax, eax
je 0x484606
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push 0
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004846c0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00548a41
mov esp, ebp
pop ebp
ret 4
Function at 0x49e590
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x5b074b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x62c198]
xor esi, esi
cmp eax, 0xffffffff
je 0x49e5d1
mov ecx, dword [0x62c198]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, esi
jne 0x49e5fb
push 4
call fcn.00548a50
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], esi
cmp eax, esi
je 0x49e5f0
mov esi, eax
call fcn.0049e4e0
mov esi, eax
push esi
call fcn.0049e9e0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x4aeae0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b7153
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push fcn.004846c0
push 0x484640
push 1
push 0x10
lea eax, [esp + 0x2c]
push eax
call fcn.005a3330
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], 0xa
mov dword [esp + 0xc], edi
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 1
call fcn.004847a0
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.004846c0
push 1
push esi
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
call fcn.0048a950
mov cl, byte [eax]
mov byte [esp + 0xa], cl
mov byte [esp + 0x38], 2
cmp dword [esp + 0x14], 7
jne 0x4aeb9a
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xf]
mov byte [esp + 0xf], bl
call fcn.00485ae0
cmp eax, ebx
je 0x4aeb9a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push ebx
call eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.004846c0
push fcn.004846c0
push 1
push 0x10
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x48], 0xffffffff
call fcn.005494cc
mov al, byte [esp + 0xa]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00548a41
add esp, 0x34
ret
Function at 0x4b7300
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5b074b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0x60
call fcn.00548a50
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
test eax, eax
je 0x4b7347
push eax
call fcn.004b6a00
mov edi, eax
jmp 0x4b7349
xor edi, edi
mov dword [esp + 0x18], 0xffffffff
mov esi, dword [ebx + 4]
cmp esi, edi
je 0x4b736e
test esi, esi
je 0x4b736b
push esi
call fcn.004b6b00
push esi
call fcn.00548a36
add esp, 4
mov dword [ebx + 4], edi
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x4b738b
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x18
fld qword [esp + 0x30]
mov eax, dword [esp + 0x24]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x38]
fstp qword [esp]
push eax
mov eax, dword [esp + 0x34]
call fcn.004b6c70
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x18
Function at 0x4bfac0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b512e
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
test byte [0x63dd48], 1
mov esi, ecx
jne 0x4bfb2b
or dword [0x63dd48], 1
lea eax, [esp + 0x23]
xor ebx, ebx
push eax
mov dword [esp + 0x54], ebx
call fcn.004c0390
push 0x5c4d50
call fcn.005493bf
add esp, 4
mov dword [esp + 0x50], 0xffffffff
jmp 0x4bfb2d
xor ebx, ebx
lea ecx, [esp + 0x24]
push ecx
call fcn.004c0480
mov eax, dword [esp + 0x24]
cmp eax, dword [0x63dce4]
je 0x4bfb4b
add eax, 0x24
jmp 0x4bfcb6
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionFontLinkSystemLink
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x4bfcb4
mov edi, 8
mov dword [esp + 0x18], ebx
cmp dword [esi + 0x14], edi
jb 0x4bfb84
mov eax, dword [esi]
jmp 0x4bfb86
mov eax, esi
mov edx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push eax
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call fcn.00547a7c
mov ebx, eax
add esp, 4
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], 1
cmp dword [esi + 0x14], edi
jb 0x4bfbc0
mov eax, dword [esi]
jmp 0x4bfbc2
mov eax, esi
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0
push 0
push eax
push edx
call ebp
test eax, eax
js 0x4bfca3
mov ecx, esi
call fcn.004c0140
mov ebp, dword [esp + 0x18]
mov edi, eax
xor eax, eax
shr ebp, 1
je 0x4bfc8e
cmp eax, ebp
jae 0x4bfc03
cmp word [ebx + eax*2], 0x2c
je 0x4bfc03
inc eax
cmp eax, ebp
jb 0x4bfbf7
inc eax
mov esi, eax
cmp eax, ebp
jae 0x4bfc1c
lea ebx, [ebx]
cmp word [ebx + esi*2], 0
je 0x4bfc1c
inc esi
cmp esi, ebp
jb 0x4bfc10
mov edx, esi
sub edx, eax
xor ecx, ecx
push edx
lea eax, [ebx + eax*2]
mov word [esp + 0x2c], cx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
call fcn.00401d20
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 2
call fcn.00410d60
mov byte [esp + 0x50], 1
cmp dword [esp + 0x3c], 8
jb 0x4bfc6c
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00548a36
add esp, 4
xor edx, edx
lea eax, [esi + 1]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], dx
cmp eax, ebp
jb 0x4bfbf7
push ebx
mov dword [esp + 0x54], 0xffffffff
call fcn.00549081
add esp, 4
mov eax, edi
jmp 0x4bfcb6
push ebx
mov dword [esp + 0x54], 0xffffffff
call fcn.00549081
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00548a41
add esp, 0x40
ret
Function at 0x4c0650
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [eax + 0x14], 8
push esi
jb 0x4c065b
mov ecx, dword [eax]
jmp 0x4c065d
mov ecx, eax
mov edx, dword [eax + 0x10]
lea edx, [ecx + edx*2]
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x4c0682
lea esp, [esp]
movzx esi, word [ecx]
imul eax, eax, 0x1000193
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x4c0670
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.005a41cf
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x4c06ac
add eax, 0x7fffffff
pop esi
ret

Function at 0x4c0e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b7071
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6216ec]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.004c1350
push eax
mov esi, 1
push edi
mov dword [esp + 0x40], esi
call fcn.004c0cd0
add esp, 8
mov byte [esp + 0x38], 0
cmp dword [esp + 0x24], 0x10
mov dword [esp + 8], esi
jb 0x4c0e84
mov eax, dword [esp + 0x10]
push eax
call fcn.00548a36
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00548a41
add esp, 0x34
ret

Function at 0x4c1350
Capabilities:
Identify system language via api

Disassembly:
push ecx
push edi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call fcn.004c11d0
lea eax, [eax + eax*2]
add eax, eax
mov ecx, dword [eax + eax + 0x5d41a4]
add eax, eax
add esp, 4
test ecx, ecx
jne 0x4c1384
mov ecx, dword [eax + 0x5d41a0]
mov eax, ecx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4c13a0
sub eax, edi
push eax
push ecx
mov ecx, esi
call fcn.00408800
mov eax, esi
pop edi
pop ecx
ret

Function at 0x4c2850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [eax]
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c2858
sub eax, esi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x4c2880
lea esp, [esp]
movzx esi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, esi
cmp edx, eax
jne 0x4c2870
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.005a41cf
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x4c28ab
add eax, 0x7fffffff
pop esi
ret