joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448720
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x54e434]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4487a2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4487a2
test ecx, ecx
je 0x44879e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x448760
xor eax, eax
jmp 0x4487a7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4487b1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d12c9
add esp, 0xc
ret 0xc
Function at 0x44bdd0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503124
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x54e434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040a7c0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a7c0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a7c0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a7c0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x453480
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x54e434]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4534e5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4534c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4534e5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004d12c9
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004d12c9
add esp, 8
ret 4
Function at 0x453660
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5040f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x54e434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x4536a9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x4537fb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x4537c6
test eax, eax
je 0x4537c6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x4537c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x45374b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45373f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45374b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x453759
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.0040a7e0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x4537c6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x453704
jmp 0x4537c9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x4537f2
test edx, edx
je 0x4537ee
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x4536c0
mov al, 1
jmp 0x4537fd
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4537fb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d12c9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x453c70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcfb8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x54e434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x551889], 0
jne 0x453e3f
push str.Advapi32.dll
lea ecx, [ebp - 0x24]
call fcn.0040a780
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
call fcn.00424d90
mov ecx, eax
call fcn.00424e50
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040a6f0
test edi, edi
je 0x453eef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x529e90
push edi
call esi
push 0x529ea0
push edi
mov dword [0x5518b8], eax
call esi
push 0x529de8
push edi
mov dword [0x5518bc], eax
call esi
push str.GetSecurityInfo
push edi
mov dword [0x5518c4], eax
call esi
push str.InitializeAcl
push edi
mov dword [0x55189c], eax
call esi
push str.GetAclInformation
push edi
mov dword [0x5518a0], eax
call esi
push str.GetAce
push edi
mov dword [0x5518ac], eax
call esi
push str.AddAce
push edi
mov dword [0x55188c], eax
call esi
push str.DeleteAce
push edi
mov dword [0x551894], eax
call esi
push str.SetSecurityInfo
push edi
mov dword [0x5518b0], eax
call esi
push str.OpenProcessToken
push edi
mov dword [0x5518b4], eax
call esi
push str.GetTokenInformation
push edi
mov dword [0x551898], eax
call esi
push str.CopySid
push edi
mov dword [0x5518a4], eax
call esi
push str.GetLengthSid
push edi
mov dword [0x551890], eax
call esi
push str.EqualSid
push edi
mov dword [0x5518a8], eax
call esi
cmp dword [0x5518b8], 0
mov dword [0x5518c0], eax
je 0x453e52
cmp dword [0x5518bc], 0
je 0x453e52
cmp dword [0x5518c4], 0
je 0x453e52
cmp dword [0x55189c], 0
je 0x453e52
cmp dword [0x5518a0], 0
je 0x453e52
cmp dword [0x5518ac], 0
je 0x453e52
cmp dword [0x55188c], 0
je 0x453e52
cmp dword [0x551894], 0
je 0x453e52
cmp dword [0x5518b0], 0
je 0x453e52
cmp dword [0x5518b4], 0
je 0x453e52
cmp dword [0x551898], 0
je 0x453e52
cmp dword [0x5518a4], 0
je 0x453e52
cmp dword [0x551890], 0
je 0x453e52
cmp dword [0x5518a8], 0
je 0x453e52
test eax, eax
je 0x453e52
mov byte [0x551889], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x551889], 0
mov dword [0x5518b8], 0
mov dword [0x5518bc], 0
mov dword [0x5518c4], 0
mov dword [0x55189c], 0
mov dword [0x5518a0], 0
mov dword [0x5518ac], 0
mov dword [0x55188c], 0
mov dword [0x551894], 0
mov dword [0x5518b0], 0
mov dword [0x5518b4], 0
mov dword [0x551898], 0
mov dword [0x5518a4], 0
mov dword [0x551890], 0
mov dword [0x5518a8], 0
mov dword [0x5518c0], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x455520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x230
push 0xffffffffffffffff
push 0x504448
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x54e434]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push edi
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x1c], 0
call fcn.00403240
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x1c]
cmp eax, 0x7530
jb 0x455726
lea eax, [edi + 4]
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.0040a290
lea ebx, [edi + 0x10]
mov ecx, ebx
call fcn.0040a290
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4556e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x529dc4
push eax
call esi
push str.RegEnumValueW
push dword [edi + 0x20]
mov dword [ebp + 0x20], eax
call esi
push 0x529de8
push dword [edi + 0x20]
mov dword [ebp - 0x10], eax
call esi
cmp dword [ebp + 0x20], 0
mov dword [ebp - 0x1c], eax
je 0x4556e7
cmp dword [ebp - 0x10], 0
je 0x4556e7
test eax, eax
je 0x4556e7
mov dword [ebp], 0
mov esi, 0x20019
call fcn.00423da0
test al, al
mov ecx, 0x20119
push str.SOFTWAREMicrosoftWindowsCurrentVersionApplicationAssociationToasts
cmovne esi, ecx
lea ecx, [ebp + 4]
call fcn.0040a780
mov byte [ebp - 4], 1
lea eax, [ebp]
push eax
push esi
push 0
lea ecx, [ebp + 4]
call fcn.0040a590
push eax
push 0x80000001
call dword [ebp + 0x20]
test eax, eax
jne 0x4556db
push 0x208
xor esi, esi
mov dword [ebp + 0x20], 0x103
lea eax, [ebp + 0x24]
push esi
push eax
call fcn.004d4490
add esp, 0xc
lea eax, [ebp + 0x20]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp + 0x24]
push eax
push esi
push dword [ebp]
call dword [ebp - 0x10]
test eax, eax
jne 0x4556ce
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
cmp word [ebp + 0x24], 0
je 0x4556a4
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040a780
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
call fcn.00414cc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0040a6f0
xor eax, eax
mov dword [ebp + 0x20], 0x103
push eax
push eax
push eax
push eax
mov word [ebp + 0x24], ax
inc esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x24]
push eax
push esi
push dword [ebp]
call ebx
test eax, eax
je 0x455676
mov edi, dword [ebp - 0x18]
lea ebx, [edi + 0x10]
push dword [ebp]
call dword [ebp - 0x1c]
mov dword [ebp], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 4]
call fcn.0040a6f0
push ebx
push 0
push 0
mov ecx, edi
call fcn.00455760
push ebx
push 1
push 0
mov ecx, edi
call fcn.00455760
push ebx
push 0
push 1
mov ecx, edi
call fcn.00455760
push ebx
push 1
push 1
mov ecx, edi
call fcn.00455760
push ebx
call fcn.004561c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1c]
call fcn.00403260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.004d12c9
lea esp, [ebp + 0x230]
pop ebp
ret
Function at 0x456c80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x54e434]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.004d4490
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x456cfe
cmp dword [esp + 0x14], 6
jb 0x456cfe
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00456af0
add esp, 0xc
test al, al
je 0x456cfe
cmp word [esi], 0
jne 0x456d56
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00456af0
add esp, 0xc
test al, al
je 0x456d2a
cmp word [esi], 0
jne 0x456d56
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00456af0
add esp, 0xc
test al, al
je 0x456d6b
cmp word [esi], 0
je 0x456d6b
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.004d12c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.004d12c9
mov esp, ebp
pop ebp
ret
Function at 0x457340
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x283c]
mov eax, 0x283c
call fcn.004d2ae0
push 0xffffffffffffffff
push 0x5047a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x54e434]
xor eax, ebp
mov dword [ebp + 0x2838], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp + 0x630]
push ebx
push eax
call fcn.004d4490
add esp, 0xc
mov eax, 0x22
mov word [ebp + 0x630], ax
test esi, esi
je 0x457541
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x457541
push esi
call edi
cmp eax, 0xffa
jge 0x457541
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x630]
push eax
call esi
push 0x523d34
lea eax, [ebp + 0x630]
push eax
call esi
push 0x529d30
lea ecx, [ebp - 0x2c]
call fcn.0040a780
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.00424d90
mov ecx, eax
call fcn.00424e50
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040a6f0
test esi, esi
je 0x457541
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x457541
lea ecx, [ebp]
call fcn.00456d80
xor edi, edi
lea esi, [ebp]
cmp word [esi], 0
je 0x457466
push 1
push 0
lea eax, [ebp + 0x630]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x10]
cmp eax, 0x20
ja 0x457474
inc edi
add esi, 0x210
cmp edi, 3
jl 0x457445
jmp 0x457496
imul ebx, edi, 0x210
cmp dword [ebp + ebx + 0x208], 0
mov ebx, dword [ebp + ebx + 0x20c]
jne 0x45748e
add ebx, 0x10
test ebx, ebx
jne 0x45753d
mov edi, dword [ebp - 0x10]
lea eax, [ebp + 0x630]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x457538
mov dword [ebp - 0x14], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x10], str._programfiles_Internet_Exploreriexplore.exe
nop dword [eax + eax]
push 0x208
lea eax, [ebp + 0x2630]
push 0
push eax
call fcn.004d4490
add esp, 0xc
lea eax, [ebp + 0x2630]
push 0x103
push eax
push dword [ebp + esi*4 - 0x14]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x2630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45752e
push 1
push 0
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x2630]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x457538
inc esi
cmp esi, 2
jb 0x4574d0
mov eax, ebx
jmp 0x457543
mov ebx, 0x10
mov eax, ebx
jmp 0x457543
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2838]
xor ecx, ebp
call fcn.004d12c9
lea esp, [ebp + 0x283c]
pop ebp
ret
Function at 0x45aa30
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x54e434]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004d4490
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x45aac7
cmp dword [esp + 8], 6
jb 0x45aac7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004d12c9
add esp, 0x118
ret

Function at 0x45aae0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x54e434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.0040a780
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00424d90
mov ecx, eax
call fcn.00424e50
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a6f0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.0040a780
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00424d90
mov ecx, eax
call fcn.00424e50
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a6f0
test ebx, ebx
je 0x45abf5
test esi, esi
je 0x45abf5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bd00
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504fd1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x54e434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.DL::RCSimpleDownloadHandler.0
mov dword [edi + 4], vtable.DL::RCSimpleDownloadHandler.1.0
mov dword [ebp - 4], 7
mov dword [edi + 0x98], 0
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov esi, dword [edi + 0xf8]
test esi, esi
je 0x45bd7b
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x45bd7b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x45bd7b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0xec]
test ecx, ecx
je 0x45bd96
lock xadd dword [ecx + 8], ebx
dec ebx
jne 0x45bd96
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test eax, eax
je 0x45bdc7
push eax
call ebx
push 0x18
push dword [edi + 0xe4]
call fcn.004d1408
add esp, 8
mov dword [edi + 0xe4], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0xc0]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 8
mov eax, dword [esi]
test eax, eax
je 0x45bdeb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 8]
call fcn.0040a6f0
mov byte [ebp - 4], 2
mov eax, dword [edi + 0xac]
test eax, eax
je 0x45be22
push eax
call ebx
push 0x18
push dword [edi + 0xac]
call fcn.004d1408
add esp, 8
mov dword [edi + 0xac], 0
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x45be9d
mov edx, dword [edi + 0xa4]
push ecx
call fcn.0044cd70
mov eax, dword [edi + 0xa8]
add esp, 4
mov ecx, dword [edi + 0xa0]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
cmp edx, 0x1000
jb 0x45be75
mov esi, dword [ecx - 4]
add edx, 0x23
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x45bf1c
mov ecx, esi
push edx
push ecx
call fcn.004d1408
add esp, 8
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov byte [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x70]
call fcn.0040a6f0
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
call fcn.0040a6f0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x30]
call fcn.0040a6f0
mov byte [ebp - 4], 9
lea ecx, [esi + 0x18]
call fcn.0040a6f0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.0040a6f0
mov dword [ebp - 4], 0xe
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.DL::ISimpleDownloadHandler.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.RC::IRefCount.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004dcc99
int3
Function at 0x45e330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505578
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x54e434]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.00425a50
test al, al
jne 0x45e390
mov eax, 1
jmp 0x45e50d
push 0x10000
call fcn.004d1e1e
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.004d4490
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x45e4e6
test ebx, ebx
je 0x45e4e6
cmp dword [eax], 0xffffffff
je 0x45e4e6
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45e4e6
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x45e4dc
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.00468fa0
test al, al
je 0x45e4cf
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x45e482
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x45e471
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x45e4dc
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x45e48c
add ebx, eax
cmp ebx, 0x8000
je 0x45e49c
cmp dword [ebp - 0x28], 0xf
ja 0x45e4c5
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x45e420
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x45e4be
add ecx, 4
add esi, 4
sub edx, 4
jae 0x45e4a6
mov esi, 4
jmp 0x45e4f7
mov esi, 5
jmp 0x45e4f7
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x45e4f7
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x45e4f1
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x45e4f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x45e50b
push ebx
call fcn.004d14b2
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d12c9
mov esp, ebp
pop ebp
ret 0xc