joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cad74
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40cf10]
call fcn.00407d88
xor eax, eax
push ebp
push 0x4caebe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5512e0], 0
jne 0x4cadc8
mov ecx, dword [0x551d20]
mov dl, 1
mov eax, dword [0x40e3c0]
call fcn.004198b8
call fcn.00405d2c
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00404a1c
mov eax, ebx
call fcn.00406d08
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4caecc
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040a094
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4cae0f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4cae64
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4cae5d
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00407360
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.004072f8
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.004133d0
test eax, eax
jne 0x4cae5d
mov ebx, 0x15
jmp 0x4cae69
mov ebx, 0x10
jmp 0x4cae69
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x5512e0]
call fcn.004cab84
mov eax, dword [ebp - 4]
call fcn.004cab84
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040a0ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4caec5
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407108
lea eax, [ebp - 0xc]
mov edx, dword [0x40cf10]
call fcn.00407e60
ret
Function at 0x4cf104
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x4cf11c
add esp, 0xfffffff0
call fcn.004056c4
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4cf236
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0040446c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x4cf220
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004cab84
xor eax, eax
push ebp
push 0x4cf20d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004cab84
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00407360
jmp 0x4cf1de
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407908
mov eax, dword [ebx + 4]
call fcn.00407468
dec eax
jle 0x4cf1f2
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x4cf1cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf214
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf23d
lea eax, [ebp - 4]
call fcn.00406b24
ret
Function at 0x4f39e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe00
mov ebx, eax
test ebx, ebx
je 0x4f3af2
mov ebp, ebx
mov eax, ebp
test eax, eax
je 0x4f3a09
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test ebx, ebx
je 0x4f3a19
mov eax, ebp
sub eax, 0xa
movzx eax, word [eax]
jmp 0x4f3a1d
mov ax, 2
cmp ax, 1
jne 0x4f3a96
test ebx, ebx
je 0x4f3a31
mov eax, ebp
sub eax, 0xc
movzx eax, word [eax]
jmp 0x4f3a39
mov eax, dword [0x552264]
movzx eax, word [eax]
push 0
push 0
push edi
push ebx
push 0
movzx eax, ax
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x100
jle 0x4f3a61
mov eax, edi
add eax, eax
call fcn.00404484
mov esi, eax
jmp 0x4f3a63
mov esi, esp
test ebx, ebx
je 0x4f3a71
mov eax, ebp
sub eax, 0xc
movzx edx, word [eax]
jmp 0x4f3a7a
mov edx, dword [0x552264]
movzx edx, word [edx]
mov eax, ebp
test eax, eax
je 0x4f3a85
sub eax, 4
mov eax, dword [eax]
push edi
push esi
push eax
push ebx
push 0
movzx eax, dx
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
jmp 0x4f3aba
cmp edi, 0x100
jle 0x4f3aab
mov eax, edi
add eax, eax
call fcn.00404484
mov esi, eax
jmp 0x4f3aad
mov esi, esp
mov ecx, edi
add ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0040463c
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4f3ae3
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4f3acd
mov eax, esp
cmp esi, eax
je 0x4f3af4
mov eax, esi
call fcn.004044a0
jmp 0x4f3af4
xor ebx, ebx
mov eax, ebx
add esp, 0x200
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5092c0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x5092e5
cmp dword [esp + 4], 5
jb 0x5092e5
mov al, 1
jmp 0x5092e7
xor eax, eax
add esp, 0x114
ret
Function at 0x53fd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004070f8
xor eax, eax
push ebp
push 0x53ff25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x53fdad
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x53fdad
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004066c0
test eax, eax
je 0x53fdb6
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jns 0x53fdbf
add edi, 3
sar edi, 2
cmp edi, 6
jge 0x53fdd9
mov eax, dword [ebp - 0x10]
mov edx, 0x53ff40
call fcn.00407110
jmp 0x53feef
push edi
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x53fcb8]
call fcn.00408b14
add esp, 4
push edi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x53fcb8]
call fcn.00408b14
add esp, 4
mov ebx, 1
xor esi, esi
jmp 0x53fe78
lea eax, [ebp - 0x14]
push eax
mov ecx, 2
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407838
mov eax, dword [ebp - 0x14]
call fcn.0053fce8
movzx eax, al
mov edx, dword [ebp - 8]
mov dword [edx + esi*4], eax
mov eax, esi
mov ecx, 0xff
cdq
idiv ecx
mov eax, edi
dec eax
sub eax, edx
mov edx, dword [ebp - 8]
xor dword [edx + esi*4], eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebx + 2]
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00407838
mov eax, dword [ebp - 0x18]
call fcn.0053fce8
movzx eax, al
mov edx, dword [ebp - 8]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx*4], eax
inc esi
add ebx, 4
mov eax, edi
dec eax
add eax, eax
add eax, eax
inc eax
cmp ebx, eax
jle 0x53fe10
mov esi, edi
dec esi
test esi, esi
jl 0x53feb1
inc esi
xor ebx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
add eax, ebx
add eax, 0xa
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
mov ecx, dword [ebp - 0xc]
xor dword [ecx + eax*4], edx
inc ebx
dec esi
jne 0x53fe8e
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00407110
mov esi, edi
dec esi
test esi, esi
jl 0x53feef
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + ebx*4]
cmp edi, 0xf0
je 0x53feef
lea eax, [ebp - 0x1c]
mov edx, edi
call fcn.0040727c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.0040750c
mov eax, dword [ebp - 0x10]
inc ebx
dec esi
jne 0x53fec5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ff2c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00407108
lea eax, [ebp - 0xc]
mov edx, dword [0x53fcb8]
mov ecx, 2
call fcn.00407eb0
lea eax, [ebp - 4]
call fcn.00407100
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4036a0
Capabilities:
Check mutex on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498e90
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push str.5C324FDF_EA5B_48BF_B83F_2941F6D3501A
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 8], eax
test eax, eax
je 0x403811
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403815
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov dword [edi + 8], 0
mov ecx, esp
mov dword [ebp - 0x3c], esp
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x2c], xmm0
xor eax, eax
movq qword [ebp - 0x1c], xmm0
push 0x24
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.D13B339E_7CF1_4818_8461_702766FDA684
mov word [ecx], ax
call fcn.00402760
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040d060
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0040d270
mov edi, eax
test edi, edi
je 0x4037c2
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4037c2
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x4037bb
test eax, 0x20000000
je 0x4037bb
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
push 2
push 0x4a
push edi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [esi + 0x10], 0
je 0x403802
lea ecx, [ebp - 0x2c]
call fcn.0040d270
test eax, eax
je 0x403802
cmp dword [esi + 0x14], 8
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x38], 0
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x34], ecx
jb 0x4037f0
mov esi, dword [esi]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x30], esi
push ecx
push 1
push 0x4a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040d150
xor al, al
jmp 0x403817
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004970e3
mov esp, ebp
pop ebp
ret 4
Function at 0x40ae00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a030
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
test esi, esi
je 0x40af73
cmp byte [esi + 0x54], 0
je 0x40af73
add esi, 0x1c
xorps xmm0, xmm0
xor bl, bl
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], bl
test esi, esi
je 0x40ae86
mov eax, dword [esi]
test eax, eax
je 0x40ae83
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40ae7d
cmp eax, 0x80
je 0x40ae7d
xor bl, bl
jmp 0x40ae83
mov byte [esi + 4], 1
mov bl, 1
mov byte [ebp - 0x18], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
cmp dword [eax + 0x14], 8
jb 0x40ae98
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40af4c
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
push 0
call fcn.00471bd0
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x38]
push 0
push ecx
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x40af3a
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40af30
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40af30
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00497124
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40af6c
test bl, bl
je 0x40af6c
mov eax, dword [esi]
test eax, eax
je 0x40af68
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004970e3
mov esp, ebp
pop ebp
ret 4
Function at 0x419880
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b8b7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov byte [edi], 0
call fcn.004970f4
add esp, 4
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
lea esi, [edi + 8]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041b790
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041b790
mov dword [esi], eax
mov byte [ebp - 4], 6
xor eax, eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov byte [ebp - 4], 7
lea ecx, [edi + 0x38]
call fcn.004085c0
mov byte [ebp - 4], 8
lea eax, [edi + 0xb8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], 7
mov word [edi + 0xf0], ax
mov byte [ebp - 4], 0xb
mov dword [edi + 0x118], eax
mov dword [edi + 0x11c], 0xf
mov byte [edi + 0x108], al
mov byte [ebp - 4], 0xc
mov dword [edi + 0x130], eax
mov dword [edi + 0x134], 0xf
mov byte [edi + 0x120], al
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c478
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x41f295
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x34], edx
call fcn.0041b220
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x41f219
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41f285
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41f27b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41f27b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f1dc
test esi, esi
je 0x41f1dc
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 8
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41f1dc
push edx
push ecx
call fcn.00497124
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004970e3
mov esp, ebp
pop ebp
ret 4
Function at 0x422f50
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cbd3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0041b790
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004274c0
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00427430
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004274c0
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004273b0
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00427320
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00427320
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.00427320
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea eax, [edi + 0x40]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x18
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [edi + 0x88], ecx
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x454120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x4c60b0], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x4c5db0], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x4c5fb0], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x4c5eb0], al
inc esi
cmp esi, 0x100
jl 0x454230
pop esi
add esp, 0x80
ret
Function at 0x459c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2a98
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [eax]
xor edi, edi
test eax, eax
je 0x459dd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push eax
call esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x64]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
push str.RegCloseKey
push dword [eax]
call esi
mov esi, eax
cmp dword [ebp - 0x58], edi
je 0x459dd1
cmp dword [ebp - 0x68], edi
je 0x459dd1
test esi, esi
je 0x459dd1
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x40], 0x65004b
mov dword [ebp - 0x3c], 0x620079
mov dword [ebp - 0x38], 0x61006f
mov dword [ebp - 0x34], 0x640072
mov dword [ebp - 0x30], 0x4c0020
mov dword [ebp - 0x2c], 0x790061
mov dword [ebp - 0x28], 0x75006f
mov dword [ebp - 0x24], 0x5c0074
mov dword [ebp - 0x20], 0x720050
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x61006f
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x60], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x5c], edi
push eax
push 0x20019
lea ecx, [ebp - 0x60]
call fcn.00472f80
push eax
call dword [ebp - 0x58]
test eax, eax
jne 0x459da7
mov dword [ebp - 0x44], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x14
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 0x4af1c4
push dword [ebp - 0x5c]
movups xmmword [ebp - 0x54], xmm0
call dword [ebp - 0x68]
test eax, eax
jne 0x459da2
push 0x10
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov edi, eax
push dword [ebp - 0x5c]
call esi
lea ecx, [ebp - 0x60]
call fcn.004731b0
test edi, edi
je 0x459dbe
mov ecx, dword [ebp - 0x64]
push edi
call fcn.00459df0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004731b0
mov eax, edi
jmp 0x459dd3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004970e3
mov esp, ebp
pop ebp
ret