joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4189a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x418b8e
sub esp, 0x34
movzx eax, byte [0x773f68]
test al, al
jne 0x418b76
mov eax, dword [0x776730]
mov dword [esp + 0x18], eax
shr eax, 1
and eax, 1
lea eax, [eax + eax*4]
lea edx, [0x776748]
lea eax, [edx + eax*4]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.0041c980
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
xor ebx, ebx
jmp 0x418a0c
inc ebx
cmp ebx, eax
jge 0x418afd
mov ebp, dword [ecx + ebx*4]
movzx esi, byte [ebp + 0x3c]
xchg esi, eax
cmp al, 1
xchg esi, eax
jne 0x418a0b
movzx esi, byte [0x784c18]
xchg esi, eax
test al, al
xchg esi, eax
je 0x418af0
mov esi, dword [ebp + 0x58]
test esi, esi
je 0x418a0b
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebp
lea eax, [ebp + 0x54]
mov dword [esp + 0x30], eax
mov dword [esp], eax
call fcn.00407c40
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x58]
jmp 0x418a5c
mov ecx, dword [ecx]
test ecx, ecx
je 0x418acf
movzx edx, byte [ecx + 6]
cmp dl, 1
jne 0x418a5a
movzx edx, word [ecx + 4]
mov ebx, dword [eax + 0x40]
mov ebp, dword [eax + 0xc]
test ebx, ebx
je 0x418b01
mov dword [esp + 0x2c], ecx
mov eax, edx
xor edx, edx
div ebx
imul eax, ebx
lea ecx, [ebp + eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
call fcn.0041a650
mov ecx, dword [esp + 0x2c]
lea edx, [ecx + 8]
lea ebx, [0x7440a1]
mov dword [esp + 8], ebx
mov dword [esp], edx
mov dword [esp + 4], 4
mov edx, dword [esp + 0x38]
mov dword [esp + 0xc], edx
call fcn.0041a550
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
jmp 0x418a5a
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00407e10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
jmp 0x418a0b
mov esi, dword [ebp + 0x30]
cmp esi, edx
je 0x418a33
jmp 0x418b08
add esp, 0x34
ret
call fcn.00425b00
ud2
mov dword [esp + 0x1c], esi
call fcn.004275d0
lea eax, [0x5ebe37]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00427e50
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00427b70
call fcn.004277a0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00427b70
call fcn.004277e0
call fcn.00427640
lea eax, [0x5ee515]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00426d10
ud2
lea eax, [0x5f542d]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00426d10
ud2
call fcn.00449da0
jmp fcn.004189a0
Function at 0x420520
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x420638
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4205ae
cmp cl, 2
jne 0x420620
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.004211a0
lea eax, [0x778c24]
mov dword [esp], eax
call fcn.00407c40
lea eax, [0x778c00]
test byte [eax], al
mov eax, dword [0x778c18]
sub eax, dword [0x778c00]
mov dword [0x778c18], eax
mov eax, dword [0x778c0c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x778c0c], ecx
lea eax, [0x778c24]
mov dword [esp], eax
call fcn.00407e10
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.004128f0
lea eax, [0x778c24]
mov dword [esp], eax
call fcn.00407c40
lea eax, [0x778bdc]
test byte [eax], al
mov eax, dword [0x778bf4]
sub eax, dword [0x778bdc]
mov dword [0x778bf4], eax
mov eax, dword [0x778be8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x778be8], ecx
lea eax, [0x778c24]
mov dword [esp], eax
call fcn.00407e10
jmp 0x4205aa
lea eax, [0x5ee495]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00426d10
ud2
call fcn.00449da0
jmp fcn.00420520
Function at 0x43e230
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x148]
inc ecx
mov dword [eax + 0x148], ecx
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
lea edx, [ecx + 0xc0]
test byte [edx], al
mov edx, eax
mov dword [ecx + 0xc0], eax
lea eax, [edx + 0x84]
test byte [eax], al
mov eax, dword [edx + 0x18]
mov dword [edx + 0x84], eax
mov dword [esp], 0
lea eax, [0x5fead0]
mov dword [esp + 4], eax
call fcn.00425cc0
test eax, eax
jne 0x43e32b
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x194]
test byte [ecx], al
mov edx, dword [esp + 0x14]
mov dword [eax + 0x194], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x198], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0x19c], edx
mov edx, dword [0x772cc8]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004031e0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x1a0]
mov edx, dword [eax + 0x1a4]
mov eax, dword [eax + 0x1a8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
nop
call fcn.00426480
add esp, 0x10
ret
nop
call fcn.00426480
add esp, 0x10
ret
Function at 0x4409a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x440b3f
sub esp, 0x48
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x78]
add ebx, 1
mov edx, dword [edx + 0x54]
mov ebp, dword [ecx + 0x7c]
mov dword [ecx + 0x78], ebx
adc ebp, 0
mov dword [ecx + 0x7c], ebp
mov ebx, edx
mov ebp, dword [edx + 0x950]
cmp ecx, ebp
jne 0x440a75
mov dword [esp + 0x44], ecx
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0044b5fa
mov ecx, dword [esp + 0x44]
mov ebx, dword [ecx + 0x50]
mov ebp, dword [ecx + 0x54]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov ebx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebx
mov ecx, dword [edx + 0x954]
cmp ecx, 3
jae 0x440b38
lea eax, [0x784b94]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
mov byte [esp], 0x29
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0043f770
add esp, 0x48
ret
mov eax, dword [ecx + 0x80]
cmp eax, ebx
jne 0x440ac8
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp], 0x26
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.0043f770
jmp 0x440a71
mov dword [ecx + 0x80], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x54]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov byte [esp], 0xe
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0043f770
jmp 0x440a71
call fcn.00425900
ud2
call fcn.00449da0
jmp fcn.004409a0
Function at 0x443ad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x443b6f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0044b5f7
lea ecx, [0x449760]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00449c80
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00449da0
jmp fcn.00443ad0
Function at 0x44b170
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x44b1b0
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x784f20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x44b1eb
je 0x44b23a
cmp ebx, 0x20
jbe 0x44b240
cmp ebx, 0x40
jbe 0x44b27e
jmp 0x44b30f
test ebx, ebx
je 0x44b230
add eax, 0x10
test ax, 0xff0
je 0x44b21c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x629d00]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x629e00]
jmp 0x44b208
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x44b208
pxor xmm1, xmmword [0x784f30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x784f30]
pxor xmm2, xmmword [0x784f40]
pxor xmm3, xmmword [0x784f50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x784f30]
pxor xmm2, xmmword [0x784f40]
pxor xmm3, xmmword [0x784f50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44b36e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x44c040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x1b8
mov dword [esp], esp
mov dword [esp + 4], 0x1b8
call fcn.0044bb20
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0044bb20
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44c0e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0044b0c0
call fcn.0042aae0
ret
Function at 0x4c57f0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c5a0d
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x4c58a7
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
cmp ecx, 0xe
jne 0x4c5920
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x4c5888
cmp ecx, 0xf
jne 0x4c5999
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x4c5888
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
jmp 0x4c5888
call fcn.00449da0
jmp fcn.004c57f0
Function at 0x4d9db0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d9e58
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4d9e1f
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x4d9e09
call fcn.00449da0
jmp fcn.004d9db0
Function at 0x4ed170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ed2dc
sub esp, 0x40
mov eax, dword [esp + 0x70]
cmp eax, 4
jne 0x4ed2d3
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx]
cmp edx, 0x6c616964
je 0x4ed278
mov edx, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x54]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004ecff0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], eax
call fcn.004f1a30
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], eax
add esp, 0x40
ret
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x60]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4ed29e
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4ed1a8
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x60]
mov dword [esp], ebx
call eax
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
jmp 0x4ed1b0
mov ecx, dword [esp + 0x6c]
jmp 0x4ed1a8
call fcn.00449da0
jmp fcn.004ed170
Function at 0x403ae5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x47e180]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, ecx
cmp byte [esi + 0x2c4], 0
je 0x403b51
push pe_nt_image_headers32
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00440e30
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x403b42
mov ecx, esi
call fcn.004037a5
jmp 0x403b53
cmp dword [esp + 0xc], 6
jb 0x403b51
push esi
call fcn.00402dc8
jmp 0x403b53
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
call fcn.0043d7ed
mov esp, ebp
pop ebp
ret
Function at 0x40593f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45e038
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x47e180]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
mov ecx, dword [esi + 0x16c]
xor ebx, ebx
lea eax, [esp + 0x20]
push eax
push ebx
push str.RobloxProxy.zip
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x34], bl
call fcn.00435ac1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
cmp byte [ebp + 8], bl
je 0x405b31
mov al, byte [esi + 0x61]
mov edi, closesocket
cmp al, bl
jne 0x405a03
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push str.SoftwareClasses
push edi
mov eax, 0x2001f
lea ecx, [esp + 0x30]
mov dword [esp + 0x68], ebx
call fcn.0040bc93
test eax, eax
jl 0x4059ee
lea eax, [esi + 0xc8]
push eax
push 1
push dword [esp + 0x30]
lea ebx, [esi + 0x334]
call fcn.004204f0
xor ebx, ebx
or dword [esp + 0x60], 0xffffffff
cmp dword [esp + 0x28], ebx
je 0x405a03
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0x1c
mov ecx, esp
lea eax, [esi + 0xc8]
mov dword [esp + 0x38], esp
mov dword [esp + 0x30], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esp + 0x30]
lea eax, [esi + 0x170]
push eax
lea ecx, [esi + 0x334]
call fcn.0041faaf
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
push str.76D50904_6780_4c8b_8986_1A7EE0B1716D
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats_siexplore
lea esi, [esp + 0x40]
mov dword [esp + 0x68], 1
call fcn.0042462d
pop ecx
pop ecx
mov byte [esp + 0x60], 2
cmp dword [eax + 0x18], 8
jb 0x405a69
mov eax, dword [eax + 4]
jmp 0x405a6c
add eax, 4
push str.Failed_to_create_key_for_iexplorer_stats
push eax
push edi
lea eax, [esp + 0x28]
call fcn.0040bbea
push eax
call fcn.00420849
pop ecx
pop ecx
push ebx
push 1
lea esi, [esp + 0x40]
mov byte [esp + 0x68], 1
call fcn.00408944
mov edi, dword [esp + 0x1c]
push 4
pop eax
push eax
lea ecx, [esp + 0x18]
push ecx
push eax
push ebx
push str.Flags
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push str.AllowedDomains
lea eax, [esp + 0x30]
push edi
push eax
call fcn.00420a27
push ebx
push str.roblox.com
mov byte [esp + 0x78], 3
push dword [esp + 0x40]
lea eax, [esp + 0x30]
push eax
call fcn.00420a27
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x20
cmp dword [esp + 0x14], ebx
je 0x405af3
push dword [esp + 0x14]
call esi
push ebx
push str.robloxlabs.com
push dword [esp + 0x30]
lea eax, [esp + 0x3c]
push eax
call fcn.00420a27
add esp, 0x10
cmp dword [esp + 0x30], ebx
je 0x405b16
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x28], ebx
je 0x405b26
push dword [esp + 0x28]
call esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp edi, ebx
je 0x405b31
push edi
call esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4