joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406796
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4067ba
xor eax, eax
test eax, eax
je 0x4067cd
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4067cd
xor ecx, ecx
jmp 0x4067d0
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x404dd5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x184
lea eax, [ebp - 0x18]
lea esi, [ebp - 0x18c]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x495190
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push 0xc8
push 0
push esi
call fcn.004969d0
add esp, 0xc
xorps xmm0, xmm0
lea eax, [0x48f829]
lea edi, [ebp - 0xc4]
mov dword [esi - 4], 0xcc
mov dword [esi + 0x28], 1
movups xmmword [ebp - 0x34], xmm0
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xe5ea38f
mov edx, dword [edi]
call fcn.00404248
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [edi + 0x20], xmm0
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
cmp ecx, 0x2f
ja 0x404e73
mov edx, dword [ecx + 0x49f160]
xor edx, dword [eax + ecx]
mov dword [ebp + ecx - 0xc4], edx
add ecx, 4
jmp 0x404e59
movzx ecx, byte [eax + 0x32]
movzx eax, word [eax + 0x30]
lea ebx, [ebp - 0xc4]
xor eax, 0x33dc
xor cl, 0x8d
mov word [ebx + 0x30], ax
mov byte [ebx + 0x32], cl
push 0x33
pop esi
lea eax, [ebp - 0x84]
push esi
push edi
push eax
call fcn.00496450
add esp, 0xc
mov ecx, esi
call fcn.00418dee
mov edi, eax
mov dword [ebp - 0x24], edx
push esi
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00496450
add esp, 0xc
add esi, edi
mov dword [ebx + 4], edi
mov edx, ebx
mov dword [ebx + 8], esi
and word [ebx + 0xc], 0
lea esi, [ebp - 0x84]
mov dword [ebx], 1
mov ecx, esi
call fcn.00402ad7
mov ebx, dword [esi]
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x190]
push eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x404f36
push dword [ebp - 0x34]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x30]
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0x80]
mov ecx, ebx
call fcn.00476713
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.00418e1f
xor esi, esi
jmp 0x404fba
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x38]
lea esi, [ebp - 0x50]
lea edx, [ebp - 0xc4]
mov dword [esi], ecx
mov dword [ecx], eax
xor ecx, ecx
mov dword [edx], str.Failed_to_start_process:
mov dword [esi + 4], fcn.00412220
inc ecx
mov dword [edx + 4], ecx
and dword [edx + 0x10], 0
mov dword [edx + 8], esi
lea esi, [ebp - 0x90]
mov dword [edx + 0xc], ecx
mov ecx, esi
call fcn.00402ef6
mov eax, dword [esi]
movsd xmm0, qword [esi + 4]
mov dword [ebp - 0x20], eax
movups xmmword [ebp - 0x48], xmm0
mov al, byte [0x4f3270]
push 0xc
pop ecx
push 4
pop edx
call fcn.0040e870
test eax, eax
je 0x404fd0
mov esi, eax
mov eax, dword [ebp - 0x20]
movups xmm0, xmmword [ebp - 0x48]
mov ecx, ebx
mov dword [esi], eax
movlps qword [esi + 4], xmm0
mov edx, dword [ebp - 0x80]
call fcn.00476713
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.00418e1f
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x184
pop esi
pop edi
pop ebx
pop ebp
ret
and dword [ebp - 0x10], 0
push 4
pop ecx
push 0xc
pop edx
call fcn.0049a0b0
ud2
Function at 0x409a41
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x180
mov dword [esp + 0xc], ecx
lea esi, [esp + 0xe8]
push 0x10
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov byte [esi + 0x40], 0
push 8
pop ecx
lea eax, [esp + 0xc0]
mov esi, 0x49f140
mov ebx, dword [ebp + 8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
cmp ebx, 0x3f
ja 0x409ab7
mov esi, edx
push 0x40
pop edx
lea ecx, [esp + 0xe8]
push 0x49e9c0
push ebx
call fcn.00402cbd
pop ecx
pop ecx
mov ecx, eax
push 0x49e9d0
push ebx
push esi
call fcn.00478f87
add esp, 0xc
jmp 0x409b05
lea ecx, [esp + 0xc0]
mov edi, ebx
mov esi, ebx
shr ebx, 6
and dword [ecx + 0x24], 0
and edi, 0xffffffc0
and esi, 0x3f
mov dword [ecx + 0x20], ebx
add edi, edx
push ebx
call fcn.0047703c
pop eax
push 0x40
pop edx
lea ecx, [esp + 0xe8]
push 0x49e9a0
push esi
call fcn.00402cbd
pop ecx
pop ecx
mov ecx, eax
push 0x49e9b0
push esi
push edi
call fcn.00478f87
add esp, 0xc
mov ebx, esi
lea esi, [esp + 0xc0]
mov byte [esi + 0x68], bl
push 0x1c
pop ecx
lea eax, [esp + 0x50]
xorps xmm0, xmm0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x78]
mov dword [esp], eax
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movzx eax, byte [esi + 0x40]
mov ebx, dword [esi - 8]
mov edi, dword [esi - 4]
lea ecx, [eax*8]
mov byte [esp + eax + 0x78], 0x80
mov dword [esp + 8], eax
inc eax
mov dword [esp + 4], ecx
push 0x40
pop edx
mov ecx, esi
push 0x49e9e0
push eax
call fcn.00402c9e
pop ecx
pop ecx
test edx, edx
je 0x409b74
mov byte [eax], 0
inc eax
dec edx
jmp 0x409b69
shld edi, ebx, 9
shl ebx, 9
mov eax, dword [esp + 8]
or ebx, dword [esp + 4]
bswap edi
not eax
bswap ebx
test al, 0x38
jne 0x409bbd
mov ecx, esp
mov edx, esi
call fcn.00404cde
lea edx, [esp + 0x130]
xorps xmm0, xmm0
mov ecx, esp
and dword [edx + 0x34], 0
and dword [edx + 0x30], 0
movaps xmmword [edx + 0x20], xmm0
movaps xmmword [edx + 0x10], xmm0
movaps xmmword [edx], xmm0
mov dword [edx + 0x3c], ebx
mov dword [edx + 0x38], edi
jmp 0x409bcf
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], ebx
mov ecx, esp
mov edx, esi
call fcn.00404cde
mov byte [esp + 0xb8], 0
push 0xffffffffffffffe0
pop eax
mov ecx, dword [esp]
test eax, eax
je 0x409bf5
mov edx, dword [ecx + eax + 0x20]
bswap edx
mov dword [esp + eax + 0x30], edx
add eax, 4
jmp 0x409be2
lea eax, [esp + 0x10]
lea esi, [esp + 0x30]
push 0x20
pop edx
mov ecx, esi
push 0x49e92c
push 0x20
push eax
call fcn.00478f87
add esp, 0xc
movaps xmm0, xmmword [esi]
movaps xmm1, xmmword [esi + 0x10]
lea eax, [esp + 0x130]
lea esi, [esp + 0x50]
movaps xmmword [eax], xmm0
xorps xmm0, xmm0
movaps xmmword [eax + 0x10], xmm1
movaps xmmword [esi], xmm0
push 0x10
pop edx
mov ecx, esi
push 0x49f468
push 0x10
push eax
call fcn.00478f87
add esp, 0xc
movaps xmm0, xmmword [esi]
mov eax, dword [esp + 0xc]
movups xmmword [eax], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x416f80
cmp esi, edi
ja 0x416fe8
cmp edi, dword [esp + 0x1c]
ja 0x416ffb
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x416f82
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x416f70
jmp 0x416fdf
ja 0x416f88
cmp eax, edx
mov esi, edi
jne 0x416f43
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x416fc0
mov ebp, esi
sub ecx, edx
jns 0x416fd7
jmp 0x416fe1
cmp esi, edi
je 0x417010
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x416fe1
xor al, 1
cmp ebp, edi
jne 0x416fa0
jmp 0x416fe1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x4a106c
call fcn.0049a5e0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x4a106c
call fcn.0049a3d0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x4a105c
call fcn.0049a440
add esp, 4
ud2
Function at 0x418d0b
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push eax
mov edi, esp
mov esi, ecx
and dword [edi], 0
push edi
push 0
push 0
push 0x4a1a00
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
mov eax, dword [edi]
je 0x418d29
push eax
call sub.ole32.dll_CoTaskMemFree
mov byte [esi + 0xc], 2
jmp 0x418d43
push eax
call sub.kernel32.dll_lstrlenW
mov edx, dword [esp]
mov ecx, esi
push eax
call fcn.0047e350
pop eax
push dword [esp]
call sub.ole32.dll_CoTaskMemFree
add esp, 4
pop esi
pop edi
ret
Function at 0x43121c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x130
mov edi, dword [esp + 0x148]
mov ebx, dword [esp + 0x144]
call fcn.00431239

Function at 0x436987
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [0x4f3188]
mov esi, ecx
test ebp, ebp
jne 0x436a7f
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x4369da
mov ebx, eax
push str.WaitOnAddress
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4369da
mov edi, eax
push str.WakeByAddressSingle
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4369da
mov ebx, eax
mov dword [esp], 0
jmp 0x436a41
push 0x4bff40
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x436a8d
mov edi, eax
push str.NtCreateKeyedEvent
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436a8d
mov ebp, eax
push str.NtReleaseKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436a8d
mov ebx, eax
push str.NtWaitForKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436a8d
mov edi, eax
mov dword [esp], ebx
lea eax, [esp + 4]
push 0
push 0
push 0xc0000000
push eax
call ebp
test eax, eax
jne 0x436a8d
mov ebx, dword [esp + 4]
push 0xc
pop ecx
call fcn.00436655
mov ebp, eax
mov eax, dword [esp]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ebx
xor eax, eax
lock cmpxchg dword [0x4f3188], ebp
je 0x436a7f
cmp dword [ebp], 0
mov edi, eax
je 0x436a73
push dword [ebp + 8]
call sub.kernel32.dll_CloseHandle
push 4
pop edx
mov ecx, ebp
call fcn.0040e8d0
mov ebp, edi
and dword [esi + 4], 0
mov dword [esi], ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5b
pop edx
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
push 0x4c0040
call fcn.0049b506
pop eax
ud2
Function at 0x43fa04
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x58]
mov edx, dword [edx + 0x60]
push 0x4c3fec
push dword [edi + 0x50]
call fcn.0043f7ee
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x80]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x43fb3d
test eax, eax
je 0x43fad3
cmp eax, 0x90317
je 0x43fb36
cmp eax, 0x90321
jne 0x43fb4a
mov dword [edi + 0x20], 0x10000
mov byte [edi + 0x24], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x43fabe
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0043f9b9
and dword [edi + 0xa0], 0
jmp 0x43fb5b
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x58]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x60]
and dword [edi + 0x48], 0
lea ebx, [edi + 0x40]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.0043fb73
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.0048f792
pop eax
and dword [edi + 0x3c], 0
and dword [edi + 0x38], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x43fb1a
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0043f9b9
mov eax, dword [edi + 0x50]
xor ecx, ecx
or eax, dword [edi + 0x54]
sete cl
mov dword [edi + 0xa0], ecx
jmp 0x43fb5b
mov word [esi], 0x104
jmp 0x43fb60
cmp dword [esp + 0x10], 4
jne 0x43fb52
mov eax, dword [esp + 0xc]
jmp 0x43fb55
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x43fb60
xor eax, eax
inc eax
mov dword [edi + 0xa0], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fe29
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x100]
mov edx, dword [edx + 0x108]
push 0x4c3fec
push dword [edi + 0xf8]
call fcn.0043f7ee
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x128]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x43ff8f
test eax, eax
je 0x43ff0a
cmp eax, 0x90317
je 0x43ff88
cmp eax, 0x90321
jne 0x43ff9c
mov dword [edi + 0xc8], 0x10000
mov byte [edi + 0xcc], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x43fef5
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0043fdd2
and dword [edi + 0x148], 0
jmp 0x43ffad
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x100]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x108]
and dword [edi + 0xf0], 0
lea ebx, [edi + 0xe8]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.0043fb73
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.0048f792
pop eax
and dword [edi + 0xe4], 0
and dword [edi + 0xe0], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x43ff66
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0043fdd2
mov eax, dword [edi + 0xf8]
xor ecx, ecx
or eax, dword [edi + 0xfc]
sete cl
mov dword [edi + 0x148], ecx
jmp 0x43ffad
mov word [esi], 0x104
jmp 0x43ffb2
cmp dword [esp + 0x10], 4
jne 0x43ffa4
mov eax, dword [esp + 0xc]
jmp 0x43ffa7
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x43ffb2
xor eax, eax
inc eax
mov dword [edi + 0x148], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x448edc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x890
mov dword [esp + 0x30], ecx
mov ecx, dword [edx]
mov ebx, dword [ebp + 8]
call fcn.00448ef9
Function at 0x464d65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x150
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x78], 2
and dword [esp + 0x88], 0
mov ecx, dword [esi + 0x100]
mov dword [esi + 0x100], 3
cmp ecx, 3
je 0x464ece
lea eax, [esp + 0x3c]
add esi, 0x104
mov dword [eax - 4], ecx
push 0xd
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x20]
mov eax, dword [ebx + 0x3c]
and dword [ebx + 0x3c], 0
cmp eax, 1
je 0x464dda
cmp eax, 2
jne 0x464eec
lea ecx, [esp + 0x38]
jmp 0x464ec9
mov al, byte [esp + 0x60]
movsd xmm1, qword [esp + 0x40]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 8], edx
movsd xmm0, qword [esp + 0x38]
mov esi, dword [esp + 0x68]
movzx edx, word [esp + 0x6c]
mov byte [esp + 3], al
mov al, byte [esp + 0x6e]
movsd qword [ecx + 8], xmm1
movsd xmm1, qword [esp + 0x48]
movsd qword [ecx], xmm0
movsd qword [ecx + 0x10], xmm1
mov dword [ecx + 0x18], esi
mov byte [ecx + 0x1e], al
mov byte [esp + 2], al
mov word [ecx + 0x1c], dx
call fcn.00448341
test eax, eax
je 0x464ec5
mov ecx, dword [esp + 4]
cmp byte [esp + 3], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], eax
je 0x464e5a
mov al, byte [esp + 2]
or al, 1
mov byte [esp + 0x36], al
movsd xmm1, qword [esp + 0x28]
lea edi, [esp + 0x90]
movsd xmm0, qword [esp + 0x30]
movsd xmm2, qword [esp + 0x18]
lea esi, [esp + 0xc]
mov ecx, esi
movsd qword [edi + 0x18], xmm1
movsd xmm1, qword [esp + 0x20]
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 8], xmm2
movsd qword [edi + 0x10], xmm1
mov byte [edi], 0
call fcn.0041f706
mov edx, dword [esp + 8]
lea ecx, [eax + 0x64]
push edi
call fcn.00464f01
pop eax
mov ecx, esi
call fcn.0041f693
cmp dword [eax + 0x3c], 0
jle 0x464ec1
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.004200c4
mov bl, 1
jmp 0x464ed0
lea ecx, [esp + 0x18]
call fcn.00447ba8
xor ebx, ebx
lea esi, [esp + 0x70]
mov ecx, esi
call fcn.0041c39f
mov ecx, esi
call fcn.0044843a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x23
pop edx
mov ecx, str.wasnt_expecting_a_frame_to_reclaim
push 0x4c14e8
call fcn.0049d36b
pop eax
ud2
Function at 0x46ce38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, edx
mov edx, dword [esp + 0x38]
lea edi, [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, edi
push 0xb
call fcn.0046ce0f
pop eax
mov eax, esp
mov ecx, 0x800
mov dword [eax], 0x800
lea eax, [esp + 8]
and dword [eax], 0
call fcn.00418dee
lea esi, [esp + 0xc]
mov edi, dword [edi]
mov ebx, eax
mov dword [esi], eax
mov dword [esi + 4], edx
and dword [esi + 8], 0
mov eax, esp
push eax
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push edi
push ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x46ceab
mov edx, dword [esp]
mov ecx, esi
call fcn.00418d5d
mov ebx, dword [esp + 0xc]
jmp 0x46ce81
test eax, eax
jne 0x46ceca
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
jbe 0x46cee6
mov eax, 0xde
jmp 0x46cece
mov edx, dword [esp + 4]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], eax
mov byte [edx + 0xc], 0xc
mov edx, dword [esp + 0x10]
mov ecx, ebx
call fcn.00418e1f
jmp 0x46cefa
mov ecx, dword [esp + 0x14]
movsd xmm0, qword [esp + 0xc]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
mov edx, dword [esp + 0x1c]
mov ecx, edi
call fcn.00476713
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x476a34
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [edx + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
and dword [esp + 0x20], 0
and dword [esp + 0x1c], 0
and dword [esp + 0x28], 0
and dword [esp + 0x24], 0
and dword [esp + 0x30], 0
and dword [esp + 0x2c], 0
and dword [esp + 0x38], 0
and dword [esp + 0x34], 0
and dword [esp + 0x3c], 0
and dword [esp + 0x44], 0
mov dword [esp + 0x10], 4
mov dword [esp], ecx
mov dword [esp + 0x40], 0x400010
test eax, eax
je 0x476a9c
mov ecx, dword [edx + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x18]
test eax, eax
je 0x476abe
mov edi, dword [edx + 0x20]
xor ecx, ecx
test edi, edi
je 0x476aba
movzx esi, byte [eax]
inc eax
or ecx, dword [esi*4 + 0x4ef808]
dec edi
jne 0x476aac
mov dword [esp + 0x30], ecx
mov ebp, dword [edx + 8]
lea edi, [ebp*4]
test ebp, ebp
je 0x476aff
cmp ebp, 0x20000000
jae 0x476b81
mov esi, dword [edx]
push 4
pop ecx
mov edx, edi
call fcn.004114d4
test eax, eax
je 0x476b88
mov ebx, eax
xor eax, eax
mov ecx, dword [esi + eax*4]
mov dword [ebx + eax*4], ecx
inc eax
cmp ebp, eax
jne 0x476af0
mov eax, ebp
jmp 0x476b04
xor eax, eax
push 4
pop ebx
lea ecx, [esp + 0x10]
mov dword [ecx + 4], eax
lea eax, [esp + 4]
mov dword [ecx + 8], ebx
push 0
push eax
push 0
push 0
push ecx
push 0
push 2
push 0x4c5987
push 0
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x476b3a
mov ecx, dword [esp]
and dword [ecx], 0
mov dword [ecx + 4], eax
jmp 0x476b69
mov dword [esp + 0xc], edi
mov edi, dword [esp + 8]
mov esi, dword [esp + 4]
push 0x10
pop ecx
call fcn.0041157b
xor ecx, ecx
mov edx, dword [esp]
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov edi, dword [esp + 0xc]
mov dword [edx + 4], eax
mov byte [edx], 4
test ebp, ebp
je 0x476b79
push 4
pop edx
mov ecx, ebx
push edi
call fcn.0040416c
pop eax
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040fdc0
ud2
push 4
pop ecx
mov edx, edi
call fcn.0049a0b0
ud2

Function at 0x476ff9
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov eax, esp
mov esi, ecx
and dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x477018
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x477021
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 4
pop esi
ret
Function at 0x47829b
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [edx]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp], edx
mov edi, esi
mov dword [esp + 4], esi
rol esi, 0xe
mov eax, ecx
rol ecx, 0xe
rol edi, 0x19
rol eax, 0x19
xor esi, edi
mov edi, dword [edx + 4]
xor ecx, eax
mov eax, edx
mov ebx, edi
mov edx, edi
rol ebx, 0x19
rol edx, 0xe
xor edx, ebx
mov ebx, dword [eax + 8]
mov eax, ebx
mov ebp, ebx
rol eax, 0x19
rol ebp, 0xe
xor ebp, eax
mov eax, dword [esp + 0x20]
shr eax, 3
xor eax, ecx
mov ecx, dword [esp + 4]
add eax, ecx
shr ecx, 3
xor ecx, esi
add ecx, edi
shr edi, 3
xor edi, edx
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp]
add edi, ebx
shr ebx, 3
xor ebx, ebp
mov ebp, dword [esp + 0x28]
add ebx, dword [edx + 0xc]
add esi, dword [ecx]
add edi, dword [ecx + 4]
mov edx, dword [ebp + 4]
add eax, dword [ebp + 0xc]
mov ebp, dword [ebp]
mov dword [esp + 4], esi
add ebx, dword [ecx + 8]
mov ecx, edx
mov esi, edx
shr edx, 0xa
mov dword [esp], eax
mov eax, ebp
rol ecx, 0xf
rol esi, 0xd
rol eax, 0xf
xor esi, ecx
xor edx, esi
add edx, ebx
mov ebx, ebp
shr ebp, 0xa
rol ebx, 0xd
mov esi, edx
xor ebx, eax
mov eax, edx
rol esi, 0xd
rol eax, 0xf
xor ebp, ebx
xor esi, eax
mov eax, edx
add ebp, edi
shr eax, 0xa
mov ebx, ebp
mov edi, ebp
xor eax, esi
mov esi, ebp
rol ebx, 0xf
shr edi, 0xa
rol esi, 0xd
add eax, dword [esp + 4]
xor esi, ebx
xor edi, esi
mov esi, dword [esp + 8]
add edi, dword [esp]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
mov dword [esi + 0xc], edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret