joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5b6df8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4698da
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4698d0
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4697ba
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4697ba
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4697cd
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x4698a7
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x46989b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x469892
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x469820
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x469863
mov eax, 1
cmp eax, ecx
ja 0x469857
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.0046d1c0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x46988d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x46985c
mov ecx, dword [esp + 0xc]
jmp 0x469825
call fcn.0046d160
xor eax, eax
mov ecx, eax
call fcn.0046d150
call fcn.0046d1c0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x4698cb
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x4698a0
mov ecx, dword [esp + 0x18]
jmp 0x4697d2
call fcn.0046d160
xor eax, eax
mov ecx, eax
call fcn.0046d150
nop
call fcn.0046bcd0
jmp fcn.00469760
Function at 0x46af80
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x5b6df8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46b01b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x5b6df8]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0046d2a7
lea ecx, [0x456a00]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0046bbe0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0046bcd0
jmp fcn.0046af80
Function at 0x46cf80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5b7060]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46b70b
je 0x46b75e
cmp ebx, 0x20
jbe 0x46b764
cmp ebx, 0x40
jbe 0x46b7aa
jmp 0x46b84b
test ebx, ebx
je 0x46b754
add eax, 0x10
test ax, 0xff0
je 0x46b740
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x50b280]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x50b380]
jmp 0x46b728
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x46b728
pxor xmm1, xmmword [0x5b7070]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5b7070]
pxor xmm2, xmmword [0x5b7080]
pxor xmm3, xmmword [0x5b7090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5b7070]
pxor xmm2, xmmword [0x5b7080]
pxor xmm3, xmmword [0x5b7090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46b8aa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5b6cc5], 0
je 0x46cf9a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x46b6d0
jmp fcn.00408b40
Function at 0x46cfa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x5b6df8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4037ec
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00408b40
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0046bcd0
jmp 0x4037b0
cmp byte [0x5b6cc5], 0
je 0x46cfbb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x46b6d0
jmp 0x4037b0

Function at 0x46de00
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46de1a
mov ecx, 0x14
jmp 0x46de23
shl ecx, 2
add ecx, 0xe10
mov dword [0x5b6df8], ecx
ret
Function at 0x4873b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5b6df8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4874aa
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x4873f0
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x487429
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00471550
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4873e3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x487433
inc eax
cmp eax, 4
jge 0x487449
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x4874a3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.004715a0
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x48746c
jmp 0x487432
call fcn.0046bcd0
jmp fcn.004873b0
Function at 0x491780
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5b6df8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49196a
sub esp, 0x48
mov eax, dword [0x59188c]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.0048e500
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046d78e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046d78e
call fcn.0048e260
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.0045f950
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x491857
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x491871
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4918e8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4918be
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x4918ba
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x4918b3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x4918c0
mov ebx, 0x1d
jmp 0x4918de
mov ebp, eax
jmp 0x4918c0
mov ebp, eax
cmp ebp, 0xd
jae 0x49195d
lea eax, [ebp - 1]
lea edx, [0x58c800]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x491953
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4918e8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x49191a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x491922
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.0046d150
mov eax, ebp
mov ecx, 0xd
call fcn.0046d150
nop
call fcn.0046bcd0
jmp fcn.00491780
Function at 0x68f3b7
Capabilities:
Encode data using xor

Disassembly:
pop ebp
mov eax, dword [0x80d5b331]
or eax, 0xe245d90
cmp dword [esp + edx*2 + 5], edx
pop esp
jg 0x68f3b1
mov ah, 0x30
push ecx
aas
inc eax
adc ah, cl
scasb al, byte es:[edi]
retf
mov bh, 0xd3
xchg ecx, eax
xor dword [eax + 0x31], eax
adc ebp, 0x106090b0
in eax, dx
je 0x68f3e2
arpl word [ebx + edx*2], sp
push esp
inc ecx
push ecx
and eax, 0x11ba6130
add ecx, edx
xor byte [edx], 0xe0
loopne 0x68f425
loopne 0x68f393
jno 0x68f3a6
int1
jnp 0x68f378
leave
mov eax, 0x90b0dea5
mov edx, 0xa191c54e
jge 0x68f435
dec ebp
sub eax, 0x3190274d
mov ah, 0x34
mov cl, ah
fisubr dword [edx]
jl 0x68f3b5
pop eax
invalid
je 0x68f450
popfd
push edi
xor eax, 0xfd02d2f
or eax, 0xa10c15d8
in eax, 0xea
xor ebp, dword [ebx]
ror byte [edx], 0xdd
mov esp, dword [esp + esi*4]
loopne 0x68f3e6
rcr ah, cl
ret 0x78c4
rcl byte [edx + 0x22], cl
add eax, 0xce7df8b1
mov esp, 0xa280a864
dec esi
inc edx
ret 0xa154
and byte [edx + 0x54c2424e], 0xa1
sub byte [eax + edx*4 - 0x40b9e270], 0x73
jle 0x68f447
sbb eax, 0x7e73bf46
sbb al, 0x7d
pop esp
jge 0x68f489
fadd qword [esi*4 + 0x140104a8]
cmc
add byte [edx - 0x7c], dl
insd dword es:[edi], dx
out 0xa6, eax
jb 0x68f480
int 0x9c
invalid
xchg edx, eax
mov ah, 0x1f
insb byte es:[edi], dx
mov word [eax + 0x39], ds
cmp byte [0x211285ed], cl
wait
push ebx
into
nop
jno 0x68f3e2
in eax, dx
test dword [edx], edx
and dword [ebx + 0x7190ce53], ebx
mov byte [ebp + 0x73], dh
jne 0x68f4cf
adc eax, 0xccd175b3
xor al, 0x83
and al, 0xed
xor eax, 0x859d2c24
jns 0x68f41a
cmp eax, 0x254d5154
and eax, 0x9fdc6db5
lahf
mov eax, 0x754db59f
jno 0x68f40f
add edi, 0x4d6095d4
push ecx
mov fs, word [ebx]
invalid
adc dword [edx], ebp
rcl dword [esi - 0x23], 4
or dword [ebp + 0x1bb4f21], 0xd5747cc4
mov edx, 0xdc528d75
fnstsw word [ebx]
dec ebp
movsb byte es:[edi], byte [esi]
push ebp
sar edi, 0x44
xchg edx, eax
sbb dl, byte [ebp + 0x25798be5]
stosb byte es:[edi], al
inc edx
movsb byte es:[edi], byte [esi]
mov esi, 0xd283b784
push ds
loop 0x68f465
xchg esp, eax
pushfd
jbe 0x68f4ad
jno 0x68f523
and eax, 0x24352044
dec esp
insd dword es:[edi], dx
adc dword [edx], ecx
or al, 0x72
dec edi
in eax, 0x9a
salc
add ch, byte [edx - 0x535a5ab3]
dec ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
or al, 0x96
hlt
push ebp
sbb al, 0xcb
jecxz 0x68f53c
bound edx, qword [eax]
xor edx, dword [edi]
adc al, 0xd9
push ecx
mov eax, dword [0x9624cd5d]
add byte [eax + esi*8], bh
mov ebp, 0x26917f16
shl byte [eax + 0x6fb085f6], cl
shl byte es:[eax + 0x6fb085f6], cl
adc byte [eax], 0x44
inc ecx
out 0x12, eax
inc esi
imul edx, dword [ecx], 0xb
not dword [ebp + 0x6231e079]
fmul dword [ecx + 0x1bd4c81]
or esp, dword [ebx + ebx*8 - 0x356f9e70]
push ecx
mov ebp, 0x45407949
mov ah, 0x30
jmp [ebx - 0x21aea2cc]
Function at 0x401a00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x401a34
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.00403540
lea eax, [ebx + 1]
cmp eax, 2
jb 0x401a2d
mov dword [esi], ebx
call fcn.00407340
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x403ef0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.005050d0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x78
call fcn.00503246
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x5d7d54]
mov ecx, dword [0x5da474]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0xc]
jg 0x403fae
mov ecx, esi
push ebx
push 0x5d7d30
push edi
call fcn.00404060
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005035b5
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5d7d54
call fcn.00503551
add esp, 4
cmp dword [0x5d7d54], 0xffffffff
jne 0x403f89
xorps xmm0, xmm0
movups xmmword [0x5d7d40], xmm0
movups xmmword [0x5d7d30], xmm0
mov dword [0x5d7d50], 0
push 0x5d7d30
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x5d7d54
call fcn.00503500
add esp, 4
jmp 0x403f89
Function at 0x40ff20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x40ff4c
test eax, eax
jne 0x40ff4c
xor eax, eax
cmp dword [esi + 0xc], 0
jne 0x40ff4c
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x40ff9c
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x40ff6b
call fcn.00407340
push dword [esi]
call fcn.00413210
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x40ff91
call fcn.00407340
push dword [esi + 4]
call fcn.00413210
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
xorps xmm0, xmm0
movlps qword [esi + 8], xmm0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x40ffe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x40ffc7
call fcn.00407340
push dword [esi]
call fcn.00413210
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40ffd6
mov dword [esi], ebx
call fcn.00407340
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x41002c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jb 0x410012
call fcn.00407340
push dword [esi + 4]
call fcn.00413210
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x410022
mov dword [esi + 4], ebx
call fcn.00407340
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x410140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x4101d0
mov edi, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov ebx, eax
call esi
lea ecx, [ebp - 0x14]
push 2
push 0
push 0
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x4101d4
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x4101e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x4101bb
mov dword [ebp - 0x18], eax
call fcn.00407340
push dword [esi]
call fcn.00413210
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x4101da
mov dword [esi], ebx
mov esi, eax
call fcn.00407340
mov eax, esi
jmp 0x4101da
mov bl, 1
jmp 0x4101e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005035b5
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410bb0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
pop ebp
ret 4

Function at 0x410bd0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
pop ebp
ret 4

Function at 0x411296
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
call fcn.004100d0
test al, al
je 0x4112bc
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.00411366
mov ebx, dword [esi + 0x30]
test ebx, ebx
je 0x411323
mov dword [ebp - 0x10], edi
mov edi, dword [esi + 0x34]
cmp ebx, edi
je 0x4112ea
mov ecx, ebx
call fcn.004107d0
add ebx, 0xc
cmp ebx, edi
jne 0x4112d9
mov ebx, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
sub eax, ebx
cmp eax, 0x1000
mov edi, dword [ebp - 0x10]
jb 0x41130b
mov ecx, dword [ebx - 4]
add ebx, 0xfffffffc
sub ebx, ecx
cmp ebx, 0x20
jae 0x411360
add eax, 0x23
mov ebx, ecx
push eax
push ebx
call fcn.00503276
add esp, 8
xorps xmm0, xmm0
movlps qword [esi + 0x30], xmm0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x411333
push eax
call fcn.0050a9ff
add esp, 4
mov ecx, edi
call fcn.0041138a
lea ecx, [esi + 0x18]
call fcn.00403540
lea ecx, [esi + 0x14]
call fcn.00403540
lea ecx, [esi + 0x10]
call fcn.00403540
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00410040
call fcn.005099a6
int3
Function at 0x415850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x5cc440]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x4158b8
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x4158b8
cmp dword [ebp - 0x14], 4
jne 0x4158b8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005035b5
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x4158d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.00503970
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x5cc440]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.005050d0
add esp, 0xc
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x101c], 0x800
lea eax, [ebp - 0x101c]
lea ecx, [ebp - 0x1018]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x415a30
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1018]
cmp eax, 2
je 0x41598a
mov edi, 0x3f4
cmp eax, 1
jne 0x415a30
push ebx
call fcn.0050a652
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x14]
cmp eax, edi
jae 0x4159f9
sub esp, 0xc
mov al, byte [ebp - 0x1010]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
mov ecx, esi
jmp 0x4159f2
lea esi, [ebp - 0x1010]
push 0x800
push 0xff
push esi
call fcn.005050d0
add esp, 0xc
push 0x400
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x101c], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x415a30
push esi
call fcn.0050a652
add esp, 4
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x14]
cmp eax, edi
mov edx, esi
jae 0x415a0d
sub esp, 0xc
mov al, byte [ebp - 0x1014]
mov byte [esp + 4], al
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.004065d0
jmp 0x415a2e
mov ecx, esi
cmp eax, 8
jb 0x415a02
mov esi, dword [ecx]
mov dword [ecx + 0x10], edi
mov eax, edi
add eax, edi
push eax
push ebx
jmp 0x415a1f
mov esi, ecx
cmp eax, 8
jb 0x415a16
mov esi, dword [ecx]
mov dword [ecx + 0x10], edi
mov eax, edi
add eax, edi
push eax
push edx
push esi
call fcn.00504b50
add esp, 0xc
mov word [esi + edi*2], 0
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005035b5
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8