joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b900
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
push esi
mov esi, ecx
cmp dword [esi], 0x3f
jne 0x40b966
xor eax, eax
cmp dword [esi + 4], eax
jbe 0x40b920
mov cl, byte [esi + eax + 8]
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, dword [esi + 4]
jb 0x40b912
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x40b941
cmp eax, 0x20
jae 0x40ba69
mov edx, dword [esi + 0x18]
mov dl, byte [ecx + edx]
mov byte [eax + esi + 0x20], dl
inc ecx
inc eax
cmp ecx, dword [esi + 0x1c]
jb 0x40b927
cmp eax, 0x20
jae 0x40ba69
mov edx, 0x20
sub edx, eax
push edx
lea ecx, [eax + esi + 0x20]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
pop esi
add esp, 0x74
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
push ebx
push ebp
lea eax, [eax + ecx + 8]
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x40b98a
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
mov edx, dword [esi + 4]
push edx
lea eax, [esi + 8]
push eax
push ebx
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [esi + 4]
add edi, ebx
add edi, dword [esi + 0x1c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
add esp, 0x18
mov eax, 1
xor edx, edx
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call fcn.00419340
mov ebp, eax
mov dword [esp + 0x18], edx
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, ebx
lea ecx, [esp + 0x20]
call fcn.0040b440
xor eax, eax
inc byte [eax + edi]
jne 0x40ba3d
inc eax
cmp eax, 8
jb 0x40ba32
mov eax, dword [esp + 0x18]
add ebp, 0xffffffff
adc eax, 0xffffffff
mov edx, ebp
or edx, eax
mov dword [esp + 0x18], eax
jne 0x40ba20
lea edx, [esi + 0x20]
lea ecx, [esp + 0x1c]
call fcn.0040b6f0
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
Function at 0x41117b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4111a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4111a1
xor al, al
jmp 0x4111b6
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x418d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420b80], ecx
inc edx
cmp edx, 0x100
jb 0x418d52
cmp edx, 0x800
jae 0x418e29
lea esp, [esp]
mov eax, dword [edx*4 + 0x420780]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420b80]
inc edx
mov dword [edx*4 + 0x420b7c], eax
cmp edx, 0x800
jb 0x418e00
mov eax, 0x419630
mov dword [0x420b74], eax
mov dword [0x422b80], eax
mov dword [0x420b70], 0x419550
call fcn.00419060
test eax, eax
jne 0x418e55
mov dword [0x422b80], 0x419550
ret
Function at 0x417e10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417e36
mov eax, dword [0x6377d0]
test eax, eax
je 0x417e2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6377d0], eax
test eax, eax
pop ebx
je 0x417ed1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6377d0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6377cc], eax
call esi
mov ecx, dword [0x6377cc]
mov dword [0x6377d4], eax
test ecx, ecx
je 0x417ec7
test eax, eax
je 0x417ec7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6377d0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x43bbd2
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x3aa13a20
mov eax, dword [0xa239a23a]
mov byte [0x23b822b9], al
mov eax, 0x3d25be24
cmpsd dword [esi], dword es:[edi]
xor ebp, dword [ecx - 0x55cd56ce]
mov cl, 0x2a
mov byte [0x23b822b9], al
mov eax, 0x3d25be24
cmpsd dword [esi], dword es:[edi]
xor ebp, dword [ecx - 0x55cd56ce]
mov cl, 0x2a
mov al, 0x2b
mov bh, 0x2c
mov dh, 0x2d
scasb al, byte es:[edi]
xor eax, 0xb9034af
mov al, byte [0x22ba21bb]
mov edx, 0xb822b922
and edi, dword [edi]
movsb byte es:[edi], byte [esi]
aas
movsd dword es:[edi], dword [esi]
cmp eax, 0xb3a73ca6
sub dword [ecx - 0x4ad248d6], esi
das
or esp, dword [eax - 0x5bc05cc7]
cmpsb byte ds:[esi], byte es:[edi]
mov esp, 0xb029b228
sub al, 0xb6
xor al, 0x4a
cmpsb byte [esi], byte es:[edi]
jge 0x43bba6
dec ebp
test al, 0x4f
sub ecx, ecx
das
retf
Function at 0x43ef1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop es
sub al, 0x90
wait
push es
pop edi
pop ebp
outsd dx, dword [esi]
inc esp
push cs
jl 0x43eed0
inc ebp
sbb bl, byte [edx]
push eax
cmp esp, ebx
fist dword [ebx]
sbb ebx, dword [ebx + 0x7aabe578]
xchg dh, bl
daa
adc al, 0x67
jne 0x43eeaa
mov edx, 0xb28e6548
test byte [edx + 0x5e3cfb2c], ch
add eax, 0xefe84df9
jle 0x43ef3b
invalid
mov ecx, 0x9de9922d
cmp eax, 0x74ec92b
cdq
out dx, al
salc
dec ebp
inc eax
inc esi
not dword [ebx]
mov al, byte [0xf2bb9530]
cdq
cmp al, 8
cwde
dec eax
or al, byte [esi]
push esp
popal
adc esp, edx
invalid
outsd dx, dword [esi]
sub dword [ebx], ebp
inc edi
int 0x4b
das
push ebp
mov al, 0x64
invalid
lodsd eax, dword [esi]
xor eax, 0x749ecb95
fstp qword [edx + 0x32]
dec ecx
and al, 0xff
jl 0x43eeae
invalid
pop esi
enter 0xffffffffffffba0c, 0xffffffffffffffb6
xchg ebp, eax
add ch, al
xchg esp, eax
in al, dx
mov edi, 0xbc74cc57
jecxz 0x43ef05
or byte [0x172f4dfc], bh
push ss
push ss
outsb dx, byte [esi]
ja 0x43efaa
mov esp, 0xba8ef175
rol byte [eax + 0x4f], 0x56
lodsd eax, dword [esi]
ljmp 0x1ecd
invalid

Function at 0x455d5c
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pop esi
wait
in eax, dx
out dx, eax
cmp dword [ebp - 0x51], 0xffffff80
insb byte es:[edi], dx
cmpsd dword [esi], dword es:[edi]
or eax, dword [edx + eax*2]
push ebp
cmc
push 0x48
fisttp word [edx - 0x69947faa]
cmp edx, dword [edx + 0x13]
popfd
and esi, ecx
cmp ecx, dword [ebx - 0x65]
in eax, dx
add esp, 0x1cf8de3c
sub al, 0x15
push dword [edi + 0x1a]
xlatb
and bh, byte [eax + 0xc]
movsb byte es:[edi], byte [esi]
and byte [edx - 0x2e56d06b], dh
add dword [edi + 0x38e9da84], ebp
mov byte cs:[0xa7473ce8], bl
cdq
stc
aad 0x3a
adc al, byte [esp + esi*2 - 0x2e]
push 0xffffffffffffff8e
invalid
Function at 0x62a421
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6343a8
cmp edx, dword [eax]
je 0x62a443
add eax, 8
inc ecx
cmp eax, 0x634438
jl 0x62a434
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6343a8]
jne 0x62a571
mov eax, dword [0x638d7c]
cmp eax, 1
je 0x62a54b
test eax, eax
jne 0x62a474
cmp dword [0x6342d4], 1
je 0x62a54b
cmp edx, 0xfc
je 0x62a571
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62a4ab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062ae00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062b290
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62a4ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062b290
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62fd54
push edi
call fcn.0062d160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062ae00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062ae10
lea eax, [ebp - 0xa0]
push 0x62fd34
push eax
call fcn.0062ae10
push dword [esi + 0x6343ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062ae10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062d0d4
add esp, 0x2c
pop edi
jmp 0x62a571
lea eax, [ebp + 8]
lea esi, [esi + 0x6343ac]
push 0
push eax
push dword [esi]
call fcn.0062b290
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401ca0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x418014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x10], eax
xor esi, esi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x401d95
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 0x190000
push 3
push esi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x401d80
push dword [ebp + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x401d80
push esi
push 0x190000
push 3
push esi
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d80
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x401d74
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x401d74
push 0
push dword [ebp - 0xc]
push 0x40c
push dword [ebp - 0x10]
push 0x410
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov esi, eax
cmp edi, 0xffffffff
je 0x401d80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004102b0
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004102b0
mov esp, ebp
pop ebp
ret 0x20
Function at 0x404cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411b10
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x418014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push 0
push 0
push 1
push 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
cmp esi, 0xffffffff
je 0x404e5d
mov ebx, dword [ebp + 0xc]
nop dword [eax]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x38]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x404e0b
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x404dba
sub eax, 1
je 0x404e8c
jmp 0x404d70
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x404e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x404e8c
push 0
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x6c]
call fcn.0040e628
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x54]
call fcn.00404600
push 0x416248
jmp 0x404e99
cmp eax, 0x6d
je 0x404e8c
push 0
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x6c]
call fcn.0040e628
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x54]
call fcn.00404600
push 0x416248
jmp 0x404e99
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004102b0
mov esp, ebp
pop ebp
ret 8
push 0
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x6c]
call fcn.0040e628
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x54]
call fcn.00404600
push 0x416248
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
lea ecx, [ebp - 0x54]
call fcn.00404690
push 0x416210
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x404f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411b78
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x418014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
je 0x405096
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 1
push 0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
cmp esi, 0xffffffff
je 0x4050ac
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x38]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40500e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x405033
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x404ffb
sub eax, 1
jne 0x404fb6
jmp 0x405096
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004102b0
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x40507e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe9
je 0x40507e
push 0
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x6c]
call fcn.0040e628
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x88]
call fcn.00404600
push 0x416248
lea eax, [ebp - 0x88]
jmp 0x4050a6
lea ecx, [ebp - 0x88]
call fcn.00404690
push 0x416210
lea eax, [ebp - 0x88]
jmp 0x4050a6
lea ecx, [ebp - 0x54]
call fcn.00404690
push 0x416210
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x6c]
call fcn.0040e628
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x54]
call fcn.00404600
push 0x416248
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x405e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x418014]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push 0x17
push str.SOFTWAREPoliciesAdobe
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], 0
call fcn.0040b8c0
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0
cmovae eax, dword [esp + 0x1c]
push 0
push eax
push 0x80000002
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405edb
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.ResetOutlookConnection
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xc], 1
mov edx, dword [esp + 0x28]
sete bl
cmp edx, 0x10
jb 0x405f1b
mov ecx, dword [esp + 0x14]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405f11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405f11
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004102f1
add esp, 8
mov ecx, dword [esp + 0x2c]
mov al, bl
pop ebx
xor ecx, esp
call fcn.004102b0
mov esp, ebp
pop ebp
ret
Function at 0x40faa4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push esi
push eax
push 1
push eax
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x40fad9
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
leave
ret
push str.unable_to_create_tls_index
lea ecx, [ebp - 0x1c]
call fcn.004045d0
push 0x4161cc
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call fcn.004102c1
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x405220
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x405321
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x405321
push ebx
call fcn.0040da90
add esp, 4
test eax, eax
je 0x40527a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0x405281
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0x405260
jmp 0x405283
mov esi, 0x1505
jmp 0x405283
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0x405321
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4052b4
inc ebp
dec ebx
je 0x40531f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0x40531f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0x4052b0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040da90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x4052b0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040dab0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x4052b0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40531f
cmp dword [eax + 4], 2
mov edi, 0
jne 0x405321
mov edi, dword [eax + 8]
jmp 0x405321
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405350
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0x4053bb
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4053bb
push esi
call fcn.0040da90
add esp, 4
test eax, eax
je 0x40539a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0x4053a1
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0x405380
jmp 0x4053a3
mov ebp, 0x1505
jmp 0x4053a3
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x4053c7
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x4053e4
inc ebx
dec edi
je 0x4053bb
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x4053bb
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0x4053e0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040da90
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0x4053e0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.0040dab0
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x4053e0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4053bb
cmp dword [eax + 4], 3
jne 0x4053bb
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0x4053bb
Function at 0x4058b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0x40591d
mov esi, dword [esp + 0x28]
test esi, esi
je 0x40591d
push esi
call fcn.0040da90
add esp, 4
test eax, eax
je 0x4058fa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0x405901
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0x4058e0
jmp 0x405903
mov ebx, 0x1505
jmp 0x405903
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0x405925
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0x405934
inc ebp
dec edi
je 0x40591b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0x40591b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0x405930
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.0040da90
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0x405930
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.0040dab0
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0x405930
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0x40591d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0x40591d