joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64fd9f10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6517dd40]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x64fd86fb
je 0x64fd874a
cmp ebx, 0x20
jbe 0x64fd8750
cmp ebx, 0x40
jbe 0x64fd878e
jmp 0x64fd881f
test ebx, ebx
je 0x64fd8740
add eax, 0x10
test ax, 0xff0
je 0x64fd872c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x650d4d60]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x650d4e60]
jmp 0x64fd8718
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x64fd8718
pxor xmm1, xmmword [0x6517dd50]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6517dd50]
pxor xmm2, xmmword [0x6517dd60]
pxor xmm3, xmmword [0x6517dd70]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6517dd50]
pxor xmm2, xmmword [0x6517dd60]
pxor xmm3, xmmword [0x6517dd70]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x64fd887e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x6517da51], 0
je 0x64fd9f2a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x64fd86c0
jmp fcn.64f88320
Function at 0x64fd9f30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x64f82e0e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.64f88320
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.64fd8c20
jmp 0x64f82dd0
cmp byte [0x6517da51], 0
je 0x64fd9f4b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x64fd86c0
jmp 0x64f82dd0

Function at 0x64fdace0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.64fd9e90
call fcn.64fd8a90
ret
Function at 0x6505c7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6505c8ea
sub esp, 0x18
lea eax, [0x6508bc40]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.64fc4670
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
xor esi, esi
xor edi, edi
xor esi, esi
xchg esi, eax
mov byte [esp + 0x12], al
xchg esi, eax
xor esi, esi
jmp 0x6505c857
mov edi, dword [esp + 0x1c]
movzx edi, byte [edi + esi]
xor edi, edx
xchg edi, ebx
mov byte [eax + esi], bl
xchg edi, ebx
inc esi
mov edx, dword [esp + 0x1c]
movzx edi, byte [esp + 0x12]
movzx edi, byte [esp + 0x13]
cmp ecx, esi
jle 0x6505c8b7
inc edi
xchg edi, eax
mov byte [esp + 0x13], al
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
cmp ebx, edi
jbe 0x6505c8e0
mov dword [esp + 0x14], esi
movzx edx, byte [ebp + edi]
movzx esi, byte [esp + 0x12]
add esi, edx
xchg esi, eax
mov byte [esp + 0x12], al
xchg esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
cmp ebx, esi
jbe 0x6505c8d7
movzx ebx, byte [ebp + esi]
mov byte [ebp + edi], bl
mov byte [ebp + esi], dl
movzx ebx, byte [ebp + edi]
add edx, ebx
movzx edx, dl
mov ebx, dword [esp + 0x2c]
cmp ebx, edx
jbe 0x6505c8ce
movzx edx, byte [edx + ebp]
mov esi, dword [esp + 0x14]
cmp ecx, esi
ja 0x6505c837
jmp 0x6505c8c7
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
add esp, 0x18
ret
mov eax, esi
call fcn.64fda100
mov eax, edx
mov ecx, ebx
call fcn.64fda100
mov eax, esi
mov ecx, ebx
call fcn.64fda100
mov eax, edi
mov ecx, ebx
call fcn.64fda100
nop
call fcn.64fd8c20
jmp fcn.6505c7e0

Function at 0x6505e260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push ebx
sub esp, 0x24
lea eax, [esp + 0x1c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
mov dword [esp], 0x651539f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebx], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [ebx + 4], eax
mov dword [esp], ebx
call esi
sub esp, 4
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x65063b50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.65065160
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.65065160
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x65063bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x65183424]
test esi, esi
jle 0x65063cd0
mov eax, dword [0x65183428]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x65063be4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x65063c67
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x65063bd0
mov dword [esp], ebx
call fcn.65064310
mov edi, eax
test eax, eax
je 0x65063cf7
mov eax, dword [0x65183428]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.65064450
mov edx, dword [0x65183428]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x65063cd7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x65063c60
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x65063c70
add dword [0x65183424], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x65183428]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x65063c60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.65063b50
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x65063bee
mov eax, dword [0x65183428]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.65063b50
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.65063b50
lea esi, [esi]
nop
Function at 0x65063f90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x65183434
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6518342c]
sub esp, 4
test ebx, ebx
je 0x65063fe5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x65063fde
test esi, esi
je 0x65063fde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65063fc0
mov dword [esp], 0x65183434
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x65064310
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x64f80000], 0x5a4d
jne 0x65064335
mov ecx, dword [0x64f8003c]
cmp dword [ecx + 0x64f80000], 0x4550
lea edx, [ecx + 0x64f80000]
je 0x65064340
ret
cmp word [ecx + 0x64f80018], 0x10b
jne 0x65064335
push esi
movzx eax, word [ecx + 0x64f80014]
push ebx
movzx esi, word [ecx + 0x64f80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x64f80000
test esi, esi
je 0x65064388
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6506437e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6506438a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x65064370
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4023e0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x402450
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004013f0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x82b67b7
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x20540d76
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00431219
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004013c0
mov esi, dword [0x44e580]
mov edi, dword [0x44e568]
mov edx, dword [0x44e564]
mov ebx, dword [0x44e574]
inc esi
mov ecx, esi
and ecx, dword [0x44e570]
lea eax, [edi + esi]
or eax, ecx
imul eax, dword [0x44e56c]
dec edi
add esp, 0x10
mov dword [0x44e56c], eax
mov dword [0x44e568], edi
cmp edx, edi
jne 0x401081
mov ecx, dword [0x44e560]
push ebp
mov ebp, dword [0x44e57c]
inc ebp
inc ecx
mov dword [0x44e57c], ebp
add ebp, ecx
mov dword [0x44e560], ecx
neg ecx
and ebp, ecx
imul eax, ebp
mov dword [0x44e56c], eax
pop ebp
jmp 0x401099
mov edx, dword [0x44e560]
mov ecx, ebx
add edx, 0x5781
neg ecx
xor edx, ecx
mov dword [0x44e564], edx
mov ecx, edx
and ecx, 0x2fb3
imul ecx, esi
cmp edi, eax
mov dword [0x44e580], ecx
jle 0x4010c5
inc ebx
mov dword [0x44e574], ebx
xor ebx, edx
neg ecx
or ebx, ecx
and edx, ebx
mov dword [0x44e564], edx
jmp 0x4010d9
mov edx, 0xffff9a24
sub edx, ebx
imul edx, dword [0x44e57c]
mov dword [0x44e57c], edx
mov esi, dword [esp + 0x18]
push 0x441d80
push esi
call fcn.00423bd7
add esp, 8
test eax, eax
jne 0x401119
push eax
call fcn.00406610
xor ecx, ecx
test al, al
sete cl
cmp byte [0x44e54c], 0
mov esi, ecx
je 0x401111
push 1
call fcn.00420790
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret 0x10
mov eax, dword [0x44e570]
mov ecx, dword [0x44e57c]
imul eax, eax, 0x2b33
mov edx, ecx
not edx
xor eax, edx
mov dword [0x44e56c], eax
cmp eax, 0xafb
mov eax, dword [0x44e578]
jne 0x40115c
mov edx, dword [0x44e55c]
imul edx, dword [0x44e574]
xor edx, eax
or edx, 0x2b33
mov dword [0x44e574], edx
mov edx, dword [0x44e560]
inc edx
dec ecx
mov dword [0x44e560], edx
mov edi, ecx
and edi, edx
mov edx, eax
imul edx, ecx
imul edx, dword [0x44e580]
neg edx
and eax, edx
push str._UUS
push esi
mov dword [0x44e57c], ecx
mov dword [0x44e570], edi
mov dword [0x44e578], eax
call fcn.00423bd7
add esp, 8
test eax, eax
jne 0x4011a8
push 1
jmp 0x4010f0
cmp byte [0x44e54c], 0
je 0x4011bb
push 1
call fcn.00420790
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret 0x10

Function at 0x4011d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x449f6c]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.CrashReport.exe
push esi
lea eax, [esp + 0x10]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
push ecx
call ebx
test eax, eax
jne 0x401223
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004239c1
add esp, 0x20c
ret
push str.CrashUL.exe
push esi
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 8]
push eax
call ebx
mov ecx, dword [esp + 0x210]
test eax, eax
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.004239c1
add esp, 0x20c
ret
Function at 0x401260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
xor esi, esi
push esi
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40129c
cmp dword [esp + 4], 4
lea eax, [esi + 1]
je 0x40129e
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x401690
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43bbf3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x449f6c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
mov eax, dword [0x449f6c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00423c6a
xor ebx, ebx
mov dword [esp + 0x30], ebx
push 0xffffffffffffffff
lea esi, [edi + 0xc]
mov dword [edi], vtable.mjz::WinError.0
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push ebp
mov ecx, esi
mov byte [esi + 4], bl
call fcn.0040f0a0
xor eax, eax
mov byte [esp + 0x30], 1
push 0xa
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
push 0x10
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x20], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004240b6
add esp, 0x10
push 0xb
push str._LastError:
mov eax, esi
call fcn.004073a0
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401744
sub eax, edx
push eax
lea ecx, [esp + 0x18]
push ecx
mov eax, esi
call fcn.004073a0
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004239c1
add esp, 0x24
ret 4

Function at 0x401bc0
Capabilities:
Initialize winhttp library

Disassembly:
push 0xffffffffffffffff
push 0x43d1e6
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x449f6c]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa8]
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esp + 0xa0], ebx
mov eax, 1
mov dword [esi], vtable.mjz::RefHandle.0
mov dword [esi + 4], eax
push 0x10000000
push ebx
push ebx
push eax
mov byte [esp + 0xb0], al
push str.BDI18N
mov dword [esi], vtable.mjz::HttpSession.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x401c77
push 0x13
push str.WinHttpOpen_failed.
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0040ec00
lea eax, [esp + 0x10]
push eax
lea edi, [esp + 0x4c]
mov byte [esp + 0xa4], 2
call fcn.00401690
push 0x444ba4
mov ecx, edi
push ecx
call fcn.004257eb
push ebx
push 0xffffffffffffffff
push 0x401d20
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp eax, 0xffffffff
jne 0x401cbc
push str.WinHttpSetStatusCallback_failed.
lea ecx, [esp + 0x30]
call fcn.0040ece0
lea edx, [esp + 0x2c]
push edx
lea edi, [esp + 0x74]
mov byte [esp + 0xa4], 3
call fcn.00401690
push 0x444ba4
mov eax, edi
push eax
call fcn.004257eb
mov eax, esi
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x94
ret 4