joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4183b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x418435
call fcn.0042e170
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x418435
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41840e
xor eax, eax
jmp 0x418466
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x418435
push 0x1047
push 0x4c38f0
call fcn.0043a1a0
test eax, eax
je 0x418435
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00418470
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x418463
cmp dword [ebp - 0xc], 0
je 0x418463
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00452790
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x41f830
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac908
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4eafb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41f888
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x50], 0
jne 0x41f888
push 0x100
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.0043a1a0
test eax, eax
je 0x41f888
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x50], 0
jne 0x41f8aa
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41f90d
lea ecx, [ebp - 0x10]
call fcn.00406e9c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x50]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x50]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00405c4b
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041f920
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406eb0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x42b6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x42b7d8
call fcn.0042e170
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42b76b
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42b742
push str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
push 0
mov ecx, 0x4f0eb8
call fcn.00405c4b
push eax
push 0x16f
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x20]
call fcn.004046d5
push eax
call fcn.004046e7
add esp, 0x10
xor eax, eax
jmp 0x42b846
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b769
push 0x175
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.0043a1a0
test eax, eax
je 0x42b769
int3
jmp 0x42b7d8
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x42b78e
push 0x17d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.0043a1a0
test eax, eax
je 0x42b78e
int3
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xffffffff
je 0x42b7d8
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x42b7cd
push str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
push 0
mov ecx, 0x4f0eb8
call fcn.00405c4b
push eax
push 0x183
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x28]
call fcn.004046d5
push eax
call fcn.004046e7
add esp, 0x10
jmp 0x42b7d8
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x42b78e
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0
je 0x42b801
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x42b820
cmp dword [ebp - 0xc], 0
je 0x42b820
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00452790
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
je 0x42b843
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [eax]
mov eax, dword [edx + 0xa8]
call eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x437210
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abc78
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4eafb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041bb90
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CInternetSession.0
mov ecx, dword [ebp + 0x1c]
and ecx, 0x10000000
je 0x43726f
push 0x1c2
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0043a1a0
test eax, eax
je 0x43726f
int3
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
cmp dword [ebp + 8], 0
jne 0x43729a
call fcn.0042e1d0
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
jne 0x4372d3
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call fcn.004395a0
jmp 0x4372e8
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
mov ecx, 0x4f0e60
call fcn.00437310
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x437b60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab313
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4eafb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00434090
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CInternetFile.0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x18]
mov dword [ecx + 0x1c], edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00406e9c
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov eax, dword [ebp + 0x14]
push eax
call fcn.0043eb50
test eax, eax
jne 0x437bdb
push 0x306
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0043a1a0
test eax, eax
je 0x437bdb
int3
push 0xffffffffffffffff
mov edx, dword [ebp + 0x10]
push edx
call fcn.0043eb50
test eax, eax
jne 0x437bfe
push 0x307
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0043a1a0
test eax, eax
je 0x437bfe
int3
cmp dword [ebp + 8], 0
jne 0x437c18
push 0x308
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcinet.cpp
call fcn.0043a1a0
test eax, eax
je 0x437c18
int3
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0041b3f0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0041b3f0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x46be30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4eafb0]
jne 0x46be3a
repz ret
jmp fcn.00480110
Function at 0x402800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x4028db
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x402876
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00402440
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x402844
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x402994
call fcn.00402888
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x402933
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00402440
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4028ec
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x402994
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00402440
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x40298f
jmp 0x402994
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x402ae4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x402a7f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004025a0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x402a4d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x402b9d
call fcn.00402a91
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x402b3c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004026d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x402af5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x402b9d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004026d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x402b98
jmp 0x402b9d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x442340
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x442860
test edx, edx
je 0x442860
call fcn.00442357
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4428a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00442340
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x442911
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4428d6
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x443220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x4432a4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x44327c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x443284
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.004432a9

Function at 0x44c420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57543f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x605580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.004810b8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x44c4d1
push eax
push esi
call fcn.00481536
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004812ac
int3
Function at 0x459660
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
push 0x40
mov dword [esp + 0x18], esi
call fcn.00488c0b
lea edi, [esi + 0x6c]
mov dword [edi], eax
push 0x40
call fcn.00488c0b
push 0x40
push 0
push dword [edi]
lea ebx, [esi + 0x70]
mov dword [ebx], eax
call fcn.00492cb0
push 0x40
push 0
push dword [ebx]
call fcn.00492cb0
mov ebp, dword [esp + 0x40]
add esp, 0x20
cmp ebp, 0x40
jbe 0x459701
mov eax, dword [esi + 4]
add esi, 4
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
push ebp
push dword [esp + 0x14]
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [edi]
mov edx, 0x40
mov ebp, dword [ebx]
mov dword [esp + 0x10], eax
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x45971a
mov eax, edx
dec edx
test eax, eax
jle 0x45971a
movzx eax, byte [ecx]
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
mov byte [ebp], al
inc ebp
mov eax, dword [esp + 0x10]
cmp ecx, dword [eax + 4]
jne 0x4596e1
jmp 0x45971a
mov esi, dword [esp + 0x10]
push ebp
push esi
push dword [edi]
call fcn.00492730
push ebp
push esi
push dword [ebx]
call fcn.00492730
add esp, 0x18
mov eax, dword [edi]
xor ecx, ecx
mov edx, dword [ebx]
lea ebp, [eax + 0x3f]
lea esi, [edx + 0x3f]
cmp edx, ebp
ja 0x45972e
cmp esi, eax
jae 0x459750
cmp edx, edi
ja 0x459736
cmp esi, edi
jae 0x459750
cmp edx, ebx
ja 0x45973e
cmp esi, ebx
jae 0x459750
cmp eax, edi
ja 0x459746
cmp ebp, edi
jae 0x459750
cmp eax, ebx
ja 0x459775
cmp ebp, ebx
jb 0x459775
nop
mov eax, dword [edi]
xor byte [eax + ecx], 0x36
mov eax, dword [ebx]
xor byte [eax + ecx], 0x5c
inc ecx
cmp ecx, 0x40
jl 0x459750
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
movups xmm0, xmmword [eax]
mov ecx, dword [esp + 0x14]
movaps xmm2, xmmword [0x5f86c0]
movaps xmm3, xmmword [0x5f86d0]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax], xmm1
movups xmm0, xmmword [edx]
movaps xmm1, xmm2
xorps xmm0, xmm3
movups xmmword [edx], xmm0
movups xmm0, xmmword [eax + 0x10]
xorps xmm1, xmm0
movups xmmword [eax + 0x10], xmm1
movups xmm0, xmmword [edx + 0x10]
movaps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
movups xmm0, xmmword [eax + 0x20]
xorps xmm0, xmm2
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [edx + 0x20]
xorps xmm0, xmm3
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
xorps xmm2, xmm0
movups xmmword [eax + 0x30], xmm2
movups xmm0, xmmword [edx + 0x30]
xorps xmm3, xmm0
movups xmmword [edx + 0x30], xmm3
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x45bcd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x605580]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x208
lea eax, [esp + 8]
mov esi, ecx
push 0
push eax
call fcn.00492cb0
add esp, 0xc
lea eax, [esp + 4]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x45bd28
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004883ab
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45bd30
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
call fcn.00453a60
mov ecx, dword [esp + 0x20c]
mov al, 1
pop esi
xor ecx, esp
call fcn.004883ab
add esp, 0x20c
ret
Function at 0x45d2d0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x605580]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x30]
mov eax, dword [esi]
test eax, eax
je 0x45d2f9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
lea eax, [esp + 0x14]
mov word [esi + 4], 0
push 1
push eax
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [edi + 0x10], 0
je 0x45d341
cmp dword [edi + 0x14], 7
jbe 0x45d343
mov edi, dword [edi]
jmp 0x45d343
xor edi, edi
push edi
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x45d368
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x45d368
mov byte [esi + 5], 1
cmp dword [esi], 0
mov ecx, dword [esp + 0x28]
pop edi
setne al
pop esi
xor ecx, esp
call fcn.004883ab
add esp, 0x24
ret 4

Function at 0x45d390
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x605580]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov byte [esi], 0
call fcn.00492cb0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x45d3e1
cmp dword [esp + 8], 6
jb 0x45d3e1
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004883ab
add esp, 0x118
ret