joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bdb0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
mov esi, edx
push eax
push 0x5ec468
push reloc.WS2_32.dll_bind
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40be01
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40bdd5
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
push 1
push 0
push edi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x40dad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x40]
sub eax, ecx
sar eax, 3
mov dword [esp + 0x10], ebx
lea esi, [eax - 1]
cmp esi, eax
jae 0x40db00
lea eax, [ecx + esi*8]
test eax, eax
jne 0x40db05
mov eax, 0x5ed574
mov ecx, 0xfff8
cmp word [eax + 6], cx
jne 0x40dcaf
mov ebp, dword [eax]
test ebp, ebp
je 0x40dcaf
mov edi, dword [ebp + 0x14]
mov ecx, ebx
push 1
mov edx, edi
call fcn.004146b0
mov ecx, ebx
add esp, 4
mov eax, dword [ecx + 0x44]
mov edx, dword [eax - 8]
mov dword [esp + 0x3c], edx
mov esi, dword [edx + 0x14]
mov eax, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
lea ebx, [esi + edi]
lea edi, [ebp + 0x1c]
mov dword [esp + 0x38], ebx
mov ebp, dword [ebp + 0x14]
add ebp, edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
or edi, 0xffffffff
mov dword [esp + 0x18], ebp
or ebp, edi
mov dword [esp + 0x14], edx
nop dword [eax]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], edi
mov edi, ebp
or ebp, 0xffffffff
cmp dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
jae 0x40dbbe
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
lea edx, [esp + 0x24]
push dword [esp + 0x28]
call fcn.0040d2d0
add esp, 0xc
test eax, eax
je 0x40dc83
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
test edi, edi
js 0x40db70
mov ecx, dword [esp + 0x10]
jmp 0x40dbc2
test edi, edi
js 0x40dc2a
sub ebx, esi
cmp ebx, 0x38
jae 0x40dbff
sub esi, eax
mov eax, esi
shr eax, 2
lea ebx, [esi + 0x78]
add ebx, eax
cmp ebx, esi
jb 0x40dc9b
push ebx
call fcn.0042f810
mov ecx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x34], ecx
lea eax, [ecx + esi]
mov dword [esp + 0x30], eax
lea eax, [ecx + ebx]
mov dword [esp + 0x38], eax
push dword [esp + 0x28]
lea edx, [esp + 0x34]
push ebp
push dword [esp + 0x34]
push edi
call fcn.0040d9f0
mov edx, dword [esp + 0x4c]
add esp, 0x10
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
jmp 0x40db68
sub esi, eax
push esi
call fcn.0042f810
mov ebx, dword [esp + 0x14]
add esp, 4
or edx, 0xffffffff
mov ecx, ebx
call fcn.004108f0
mov esi, eax
mov ecx, ebx
lea eax, [esp + 0x2c]
mov edx, esi
push eax
call fcn.00411910
add esp, 4
mov edx, eax
mov ecx, ebx
push dword [esp + 0x2c]
call fcn.00413880
add esp, 4
mov edx, esi
mov ecx, ebx
call fcn.00411220
mov edx, 0xfffffffe
mov ecx, ebx
call fcn.00411370
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
mov edx, str.duk_unicode_support.c
push str.internal_error
push 0x100011a
call fcn.0040d110
push str.buffer_too_long
push 0x3000040
mov edx, str.duk_util_bufwriter.c
call fcn.0040d110
push 0x604140
push 0xffffffffffffffff
push 0x835
mov edx, 0x604148
mov ecx, ebx
call fcn.0040d130
int3
Function at 0x40e260
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov eax, 0xaaaaaaab
mul edi
mov esi, ecx
shr edx, 1
lea eax, [edx + edx*2]
lea ebx, [eax + esi]
sub edi, eax
mov eax, dword [esp + 0x10]
cmp esi, ebx
je 0x40e2de
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add esi, 3
add edx, ecx
mov ecx, edx
shr ecx, 0x12
movzx ecx, byte [ecx + 0x5f0088]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x5f0088]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + 0x5f0088]
mov byte [eax + 2], cl
movzx ecx, byte [edx + 0x5f0088]
mov byte [eax + 3], cl
add eax, 4
cmp esi, ebx
jne 0x40e280
sub edi, 1
je 0x40e32a
sub edi, 1
jne 0x40e351
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
mov ecx, edx
shr ecx, 0xa
pop edi
pop esi
pop ebx
movzx ecx, byte [ecx + 0x5f0088]
mov byte [eax], cl
mov ecx, edx
shr ecx, 4
and ecx, 0x3f
and edx, 0xf
movzx ecx, byte [ecx + 0x5f0088]
mov byte [eax + 1], cl
movzx ecx, byte [edx*4 + 0x5f0088]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
ret
movzx edx, byte [esi]
mov ecx, edx
and edx, 3
shr ecx, 2
shl edx, 4
movzx ecx, byte [ecx + 0x5f0088]
mov byte [eax], cl
movzx ecx, byte [edx + 0x5f0088]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
pop edi
pop esi
pop ebx
ret
Function at 0x412080
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004108f0
mov edx, dword [ebx + 0x44]
mov esi, eax
mov edi, dword [ebx + 0x40]
sub edx, edi
sar edx, 3
test esi, esi
jns 0x4120a7
lea eax, [edx + esi]
cmp eax, edx
jae 0x4120b2
lea ecx, [edi + eax*8]
test ecx, ecx
jne 0x4120b7
mov ecx, 0x5ed574
call fcn.004132c0
test eax, 0x2c0
je 0x41216f
lea eax, [edx + esi]
test esi, esi
js 0x4120d0
mov eax, esi
cmp eax, edx
jae 0x4120db
lea ecx, [edi + eax*8]
test ecx, ecx
jne 0x4120e0
mov ecx, 0x5ed574
movzx eax, word [ecx + 6]
sub eax, 0xfff7
je 0x412176
sub eax, 2
je 0x412104
sub eax, 1
je 0x4120fd
xor edi, edi
jmp 0x41217b
mov edi, 0x16
jmp 0x41217b
mov eax, dword [ecx]
mov edi, dword [eax]
shr edi, 0x1b
cmp edi, 0xe
jne 0x41217b
test esi, esi
jns 0x412119
mov eax, dword [ebx + 0x44]
jmp 0x41211c
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax + esi*8]
lea eax, [eax + esi*8]
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0x18]
mov edx, ecx
push eax
mov eax, dword [ebx + 0x2c]
push dword [eax + 0x398]
call fcn.00433de0
add esp, 0xc
test eax, eax
je 0x41217b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [edx + 0x18]
lea ecx, [ecx + eax*2]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x41217b
mov ecx, ebx
call fcn.004148d0
mov edx, esi
mov ecx, ebx
call fcn.00411220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 3
mov eax, dword [ebp + 8]
mov ecx, 0x28
test eax, eax
jne 0x4121b5
cmp edi, 6
je 0x4121ba
mov edi, 0x4e
push ecx
mov edx, esi
mov ecx, ebx
call fcn.00411ec0
add esp, 4
test eax, eax
jne 0x41216f
push edi
mov edx, esi
mov ecx, ebx
call fcn.00411ec0
add esp, 4
test eax, eax
jne 0x41216f
jmp 0x4121c4
cmp eax, 1
jne 0x41218c
mov ecx, 0x4e
lea edi, [ecx - 0x26]
jmp 0x412191
push 0xab9
push 0x6042bc
push str.coercion_to_primitive_failed
mov edx, 6
mov ecx, ebx
call fcn.0042f580
int3
Function at 0x42bdb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x1c], eax
movzx eax, word [edx + 6]
push esi
add eax, 0xffff000e
mov esi, ecx
push edi
cmp eax, 8
ja case.default.0x42bdda
jmp dword [eax*4 + 0x42bfa4]
push 1
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x16
call fcn.0042b920
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x15
call fcn.0042b920
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x17
call fcn.0042b920
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
cmp word [edx + 4], 0
lea edx, [esp + 8]
push 1
sete al
add al, 0x18
mov byte [esp + 0xc], al
call fcn.0042b920
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
call fcn.0042bc90
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
movzx ecx, word [edx + 4]
mov eax, dword [edx]
lea edx, [esp + 0xc]
mov dword [esp + 0x18], eax
mov eax, ecx
shr eax, 8
mov byte [esp + 0xe], cl
mov ecx, esi
push 4
mov byte [esp + 0x10], 0x1d
mov byte [esp + 0x11], al
mov byte [esp + 0x13], 4
call fcn.0042b920
push 4
lea edx, [esp + 0x20]
jmp 0x42bf89
mov edx, dword [edx]
call fcn.0042bb30
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
call fcn.0042bd50
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
call fcn.0042bbf0
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [edx]
lea ecx, [esp + 0x10]
cvttsd2si edx, xmm0
lea edi, [esp + 0x18]
movsd qword [esp + 0x10], xmm0
mov eax, dword [ecx]
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
cmp eax, dword [edi]
jne 0x42bf5d
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 4]
jne 0x42bf5d
mov ecx, esi
call fcn.0042ba00
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 8]
mov eax, dword [esp + 0x14]
bswap ecx
bswap eax
mov dword [esp + 0x14], ecx
mov ecx, esi
push 1
mov dword [esp + 0x14], eax
mov byte [esp + 0xc], 0x1a
call fcn.0042b920
push 8
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.0042b920
mov ecx, dword [esp + 0x2c]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
Function at 0x4551c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, ecx
mov dword [esp + 4], 0
push ebx
push ebp
mov dword [esp + 0x10], eax
mov eax, dword [eax + 0x2c]
push esi
push edi
mov ebx, dword [eax + 0x88]
mov ebp, dword [eax + 0x8c]
nop dword [eax]
nop dword [eax + eax]
add ebx, 0x7f4a7c15
mov ecx, ebx
adc ebp, 0x9e3779b9
mov eax, ebp
shrd ecx, eax, 0x1e
push 0xbf58476d
shr eax, 0x1e
xor ecx, ebx
push 0x1ce4e5b9
xor eax, ebp
push eax
push ecx
call fcn.005856b0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1b
push 0x94d049bb
shr ecx, 0x1b
xor esi, eax
push 0x133111eb
xor ecx, edx
push ecx
push esi
call fcn.005856b0
mov esi, eax
mov edi, edx
shrd esi, edi, 0x1f
xor esi, eax
shr edi, 0x1f
mov eax, dword [esp + 0x18]
xor edi, edx
mov edx, dword [esp + 0x14]
mov ecx, edx
and ecx, 1
inc edx
mov dword [esp + 0x14], edx
mov eax, dword [eax + 0x2c]
mov dword [eax + ecx*8 + 0x88], esi
mov dword [eax + ecx*8 + 0x8c], edi
cmp edx, 0x40
jb 0x4551f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45c3b0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
mov eax, dword [esi + 0x44]
cmp eax, dword [esi + 0x38]
jae 0x45c4f7
mov ecx, dword [esi + 0x2c]
lea eax, [esp + 0x14]
push eax
push 0
mov edx, 0x34
call fcn.0042f6e0
mov edx, eax
add esp, 8
test edx, edx
je 0x45c50b
mov eax, dword [esi + 0x44]
xor ecx, ecx
mov edi, dword [esp + 0x14]
or ecx, 0xfffa0000
mov dword [eax], edx
mov dword [eax + 4], ecx
inc dword [edx + 4]
add dword [esi + 0x44], 8
test edi, edi
je 0x45c521
push 0x34
push 0
push edi
call fcn.005869c0
add esp, 0xc
mov dword [edi], 0x24
mov dword [edi + 4], 0
mov edx, 0xfffffffe
mov eax, dword [0x61c4d0]
mov ecx, esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], 2
add edi, 0x10
push 0x607f70
call fcn.0040f8b0
mov eax, dword [esp + 0x30]
add esp, 4
mov ebx, dword [esp + 0x28]
mov ecx, 0x45c390
mov dword [edi + 0xc], eax
mov edx, 0x45c300
xor eax, eax
test ebx, ebx
push edi
cmovne eax, ecx
mov ecx, esi
push eax
push 0x45c320
call fcn.0049a3a0
add esp, 0xc
mov dword [edi], eax
mov edx, 0x45c340
mov ecx, esi
push edi
push 0x45c370
call fcn.004a9490
mov dword [edi + 4], eax
add esp, 8
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x14], ebp
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
sub eax, ecx
sar eax, 3
lea edx, [eax - 1]
cmp edx, eax
jae 0x45c4c3
lea eax, [ecx + edx*8]
test eax, eax
jne 0x45c4c8
mov eax, 0x5ed574
mov ecx, 0xfff8
cmp word [eax + 6], cx
jae 0x45c4e5
xor eax, eax
mov dword [edi + 8], ebx
mov dword [edi + 0x10], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [eax]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push str.cannot_push_beyond_allocated_stack
push 0x3001475
mov edx, 0x6045c0
call fcn.0040d110
push str.alloc_failed
push 0x100147e
mov edx, 0x6045f0
mov ecx, esi
call fcn.0040d110
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x46d
mov edx, 0x61c474
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x46d
push 0x61c490
push 0x61c4ac
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x464210
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x424], eax
push esi
push edi
lea eax, [esp + 0x1c]
mov esi, ecx
push eax
push 0x400
lea eax, [esp + 0x30]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x464392
cmp byte [esp + 0x28], 0
je 0x464392
mov ecx, esi
call fcn.00413fd0
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.00413910
push 0x60926c
mov edx, 0xfffffffe
mov ecx, esi
call fcn.0040f8b0
add esp, 4
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4642f8
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
call fcn.005855c0
movaps xmm1, xmm0
mov ecx, esi
call fcn.00413760
push 0x609274
mov edx, 0xfffffffe
mov ecx, esi
call fcn.0040f8b0
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [esp + 0x10]
call fcn.005855c0
movaps xmm1, xmm0
mov ecx, esi
call fcn.00413760
push str.free
mov edx, 0xfffffffe
mov ecx, esi
call fcn.0040f8b0
add esp, 4
lea eax, [edi - 2]
cmp eax, 4
ja case.default.0x464300
jmp dword [eax*4 + 0x4643ac]
mov edx, str.REMOVABLE
jmp 0x46432f
mov edx, str.FIXED
jmp 0x46432f
mov edx, str.REMOTE
jmp 0x46432f
mov edx, str.CDROM
jmp 0x46432f
mov edx, str.RAMDISK
jmp 0x46432f
mov edx, 0x6092b0
mov ecx, esi
call fcn.00413910
push 0x6092b8
mov edx, 0xfffffffe
mov ecx, esi
call fcn.0040f8b0
add esp, 4
mov edx, 0x4641a0
mov ecx, esi
push 6
push 0x18075380
push 0
call fcn.004142f0
add esp, 0xc
mov edx, 0xfffffffe
mov ecx, esi
push 0x6092c0
call fcn.0040f8b0
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.00584a28
add esp, 0x42c
ret
mov ecx, dword [esp + 0x42c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00584a28
add esp, 0x42c
ret
Function at 0x46cb10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6009e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x12
xor esi, esi
push esi
push esi
push 0x5f0de4
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46cb51
xor eax, eax
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
xor edi, edi
push edi
push 0x5f0de4
push edi
push ebx
mov dword [ebp - 0x28], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x46cc52
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
jne 0x46cb9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x46cc33
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
lea esi, [eax + 0x24]
mov eax, esi
call fcn.005851e0
mov edi, esp
test edi, edi
je 0x46cc99
push esi
push 0
push edi
call fcn.005869c0
mov eax, dword [ebp - 0x2c]
lea esi, [edi + 0x10]
mov dword [edi], eax
add esp, 0xc
mov dword [edi + 4], 4
mov eax, dword [0x61c4d0]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 1
cmp dword [esi - 0xc], 0
jbe 0x46cbf0
mov ecx, dword [esi - 0x10]
add ecx, esi
jmp 0x46cbf5
mov ecx, 0xfffffff0
push 0
mov dword [ecx], 4
mov dword [ecx + 4], 0
mov eax, dword [0x61c4d8]
push 0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x20]
mov dword [ecx + 0xc], 2
mov dword [esi], 5
push dword [ebp - 0x24]
push esi
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
jne 0x46cc52
mov edi, dword [ebp - 0x28]
xor esi, esi
lea eax, [ebp - 0x20]
inc edi
push eax
push edi
push 0x5f0de4
push 0
push ebx
mov dword [ebp - 0x28], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
jne 0x46cb77
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test esi, esi
je 0x46cb3b
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00584a28
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x46d
mov edx, 0x61c474
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x46d
push 0x61c490
push 0x61c4ac
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x46d0a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
xor ebx, ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], ebx
jne 0x46d0c5
mov eax, dword [esi + 0x40]
cmp dword [eax + 4], 0
jle 0x46d118
mov eax, dword [esi + 0x40]
xor edi, edi
mov eax, dword [eax + 0xc]
test eax, eax
je 0x46d0d3
mov edi, dword [eax]
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
lea eax, [ecx + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push dword [edi + 8]
lea eax, [edi + 0xc]
push eax
push dword [ecx + 0x38]
call ebp
cmp eax, 1
jne 0x46d13a
cmp dword [esi + 4], 0
jne 0x46d161
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x46d109
call fcn.004b2ec0
push edi
call fcn.0058bf82
add esp, 4
cmp dword [esi + 4], 0
je 0x46d0bc
cmp dword [esi + 4], 0
jne 0x46d161
test ebx, ebx
je 0x46d12d
push esi
push dword [esi]
call fcn.0046cfb0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x46d118
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x46d16b
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 0x46d010
push esi
push 0
call fcn.004b4b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [esi]
call fcn.0046ce70
add esp, 8
mov eax, 0xfffffffc
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497030
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebx, ecx
mov dword [esp + 0x10], edx
lea ebp, [edi + 0xc]
push ebp
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x49709f
push ebp
push 0
push esi
call fcn.005869c0
mov eax, dword [esp + 0x1c]
lea ecx, [esi + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
mov edx, edi
mov dword [esi + 4], edi
push edi
push dword [esp + 0x1c]
call fcn.00401000
mov eax, dword [ebx + 0x38]
add esp, 8
test eax, eax
jne 0x497089
mov dword [ebx + 0x38], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [eax], 0
je 0x497097
nop
mov eax, dword [eax]
cmp dword [eax], 0
jne 0x497090
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x49a6b0
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
or edx, 0xffffffff
mov esi, ecx
call fcn.0040e9d0
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
sub edx, ecx
sar edx, 3
mov dword [esp + 0x14], eax
lea edi, [edx - 1]
cmp edi, edx
jae 0x49a6de
lea eax, [ecx + edi*8]
test eax, eax
jne 0x49a6e3
mov eax, 0x5ed574
mov ecx, 0xfff8
cmp word [eax + 6], cx
jne 0x49a6f9
mov edi, dword [eax]
test edi, edi
je 0x49a6f9
mov edi, dword [edi + 0x14]
jmp 0x49a6fb
xor edi, edi
mov ecx, esi
call fcn.00413e30
push 0x616ae4
or edx, 0xffffffff
mov ecx, esi
xor ebx, ebx
call fcn.0040fec0
add esp, 4
test eax, eax
je 0x49a73f
push 0x616ae4
or edx, 0xffffffff
mov ecx, esi
call fcn.0040f5e0
add esp, 4
or edx, 0xffffffff
mov ecx, esi
call fcn.00412f30
mov ecx, esi
mov ebx, eax
call fcn.00414cb0
mov ecx, esi
call fcn.00414cb0
test ebx, ebx
je 0x49a7c8
lea ebp, [edi + 5]
push ebp
call fcn.0058d200
mov esi, eax
add esp, 4
test esi, esi
je 0x49a82a
push ebp
push 0
push esi
call fcn.005869c0
add esp, 0xc
mov dword [esi], ebx
lea ecx, [esi + 4]
mov edx, edi
push edi
push dword [esp + 0x18]
call fcn.00401000
mov byte [esi + edi + 4], 0
add esp, 8
mov edi, dword [ebx + 0xc]
cmp dword [edi + 8], 0
je 0x49a7b4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
je 0x49a7b4
mov ecx, dword [ebx + 0xc]
mov edx, fcn.004a0850
push esi
push 1
call fcn.004ae9f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
push dword [ebx + 0xc]
call fcn.004a0850
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea ebp, [edi + 4]
push ebp
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49a82a
push ebp
push 0
push ebx
call fcn.005869c0
add esp, 0xc
mov dword [ebx], ebp
lea ecx, [ebx + 4]
mov edx, edi
push edi
push dword [esp + 0x18]
call fcn.00401000
add esp, 8
lea eax, [esp + 0x18]
push 0
push eax
push ebp
push ebx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, esi
call fcn.00414cb0
push ebx
call fcn.0058bf82
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x61c4e8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x4c4
push 0x61c504
push 0x61c520
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3
Function at 0x49d550
Capabilities:
Terminate process

Disassembly:
push ecx
push 0x49ca80
push ecx
push 0x49ca20
mov edx, 0x49c910
mov ecx, 0x49c880
call fcn.0042fdb0
add esp, 0xc
test eax, eax
je 0x49d57b
mov eax, dword [eax + 0x70]
test eax, eax
je 0x49d57b
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x70a
mov edx, 0x619d7c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x70a
push 0x619dac
push 0x619ddc
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3