joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414795
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9a00
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0xb2da70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
mov dword [esi], vtable.CInFileStreamVol.0
mov dword [esi + 4], vtable.CInFileStreamVol.1.0
mov dword [esi + 8], vtable.CInFileStreamVol.2.0
mov dword [esi + 0xc], vtable.CInFileStreamVol.3.0
cmp dword [esi + 0x30], edx
je 0x4147e8
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0x74]
mov eax, dword [esi + 0x28]
mov byte [ecx + eax], dl
mov ecx, dword [esi + 0x30]
mov dword [ebp - 4], edx
test ecx, ecx
je 0x4147f8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, esi
call fcn.00410c35
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x418708
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x4e961c
call fcn.004d3e5a
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.00418289
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.00409de5
push dword [ebp - 0x18]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040a0f6
push dword [ebp - 0x18]
call fcn.004d3e15
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.004d3e28
ret 8
Function at 0x43a070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.004d4480
mov eax, dword [0xb2da70]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1800
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.004d5ab0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1804]
add esp, 0xc
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x43a0b0
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x1004]
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x43a0d0
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x804]
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x43a0f0
push 0
push 0
lea eax, [ebp - 0x1804]
push eax
push 0x43a140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
je 0x43a128
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3bb9
mov esp, ebp
pop ebp
ret

Function at 0x43a290
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xb2da70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43a2dd
push 0
lea eax, [ebp - 8]
push eax
push edi
push esi
call fcn.00439e80
add esp, 0x10
test al, al
je 0x43a2fb
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp + 0x1c]
push 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3bb9
mov esp, ebp
pop ebp
ret
Function at 0x43a310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0xb2da70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [str.SoftwareClasses]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov ax, word [0x4edcb4]
push edi
mov edi, dword [ebp + 0x20]
mov word [ebp - 8], ax
or edi, 0x2001f
lea eax, [ebp - 0x30]
push eax
push edi
push 0
lea eax, [ebp - 0x28]
push eax
movzx eax, byte [ebp + 8]
movups xmmword [ebp - 0x28], xmm0
sub eax, 0x7fffffff
movups xmm0, xmmword [0x4edca4]
push eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a3c6
push esi
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43a3a5
push dword [ebp + 0x20]
lea eax, [ebp - 0x2c]
push eax
push ebx
push esi
call fcn.00439e80
add esp, 0x10
test al, al
je 0x43a3c5
push dword [ebp + 0x18]
push dword [ebp - 0x34]
push dword [ebp + 0x1c]
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d3bb9
mov esp, ebp
pop ebp
ret
Function at 0x47e790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eab10
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0xb2da70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004d3dce
mov esi, eax
add esp, 4
test esi, esi
je 0x47e7f0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004d520f
add esp, 4
mov dword [esi + 4], eax
jmp 0x47e7f2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaf0d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0xb2da70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004d3dce
mov edi, eax
add esp, 4
test edi, edi
je 0x4b6204
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004d520f
add esp, 4
mov dword [edi + 4], eax
jmp 0x4b6206
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.0047e660
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x10]
mov bl, al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x4b6260
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4b6260
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x4b627c
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4b629f
cmp byte [ebp + 0xc], 0
je 0x4b628b
push esi
call fcn.004d568b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4b62ab
mov esi, str.ios_base::badbit_set
jmp 0x4b62bb
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004b62f0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.0047ec30
push 0x4ff738
lea eax, [ebp - 0x28]
push eax
call fcn.004d695b
int3
Function at 0x4cdbe0
Capabilities:
Access peb ldr_data
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb160
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xb2da70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
push 0x4eed48
mov dword [ebp - 4], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.004b5720
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d2d33
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push eax
push esi
push 0x4d0473
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
pop esi
pop ebp
ret 4
Function at 0x4d3769
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x14
test eax, eax
je 0x4d37c8
mov ecx, dword [ebp + 8]
dec eax
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
lea edx, [ecx + 0xf0]
inc eax
push edi
mov dword [ebp - 4], edx
mov dword [ebp + 0x10], eax
mov esi, ebx
lea edi, [ebp - 0x14]
push ecx
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004d381a
mov edi, dword [ebp - 4]
pop ecx
pop ecx
push 0x10
mov ecx, edi
pop edx
mov al, byte [ecx]
xor byte [ebx], al
inc ecx
inc ebx
sub edx, 1
jne 0x4d37aa
sub dword [ebp + 0x10], 1
lea esi, [ebp - 0x14]
mov ecx, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jne 0x4d3790
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d37ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx ecx, byte [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
push edi
shl ecx, 4
add ecx, dword [ebp + 0x10]
push 4
pop edi
push 4
pop esi
mov al, byte [ecx]
xor byte [edx], al
inc ecx
inc edx
sub esi, 1
jne 0x4d3806
sub edi, 1
jne 0x4d3803
pop edi
pop esi
pop ebp
ret

Function at 0x4d381a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
push 0xe
call fcn.004d37ee
add esp, 0xc
mov bl, 0xd
push 4
mov byte [ebp - 4], bl
mov edx, esi
pop edi
push 4
mov ecx, edx
pop esi
movzx eax, byte [ecx]
mov al, byte [eax + 0x4f00d8]
mov byte [ecx], al
lea ecx, [ecx + 4]
sub esi, 1
jne 0x4d3841
inc edx
sub edi, 1
jne 0x4d383c
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
mov al, byte [esi + 9]
mov cl, byte [esi + 0xd]
push dword [ebp - 4]
mov byte [esi + 0xd], al
mov al, byte [esi + 5]
mov byte [esi + 9], al
mov al, byte [esi + 1]
mov byte [esi + 5], al
mov al, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
mov al, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
mov al, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
mov al, byte [esi + 0xb]
mov byte [esi + 7], al
mov al, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
call fcn.004d37ee
add esp, 0xc
test bl, bl
je 0x4d38c6
push esi
call fcn.004d38cb
pop ecx
dec bl
jmp 0x4d3834
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d3ac6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 8
pop esi
lea ecx, [ebx + 1]
lea edx, [edi + 3]
sub edi, ebx
mov ebx, esi
mov al, byte [edx - 3]
mov byte [ecx - 1], al
mov al, byte [edi + ecx]
mov byte [ecx], al
mov al, byte [edx - 1]
mov byte [ecx + 1], al
mov al, byte [edx]
lea edx, [edx + 4]
mov byte [ecx + 2], al
add ecx, 4
sub ebx, 1
jne 0x4d3ae0
mov ebx, dword [ebp + 8]
lea edx, [ebx + 0x1d]
mov cl, byte [edx + 1]
mov eax, esi
mov ch, byte [edx + 2]
mov bl, byte [edx - 1]
mov bh, byte [edx]
mov byte [ebp - 1], cl
mov byte [ebp - 2], ch
and eax, 7
jne 0x4d3b5e
movzx eax, byte [ebp - 1]
movzx ecx, bh
mov bh, byte [eax + 0x4effd8]
movzx eax, byte [ebp - 2]
mov al, byte [eax + 0x4effd8]
mov byte [ebp - 1], al
movzx eax, bl
mov al, byte [eax + 0x4effd8]
mov byte [ebp - 2], al
mov eax, esi
shr eax, 3
mov bl, byte [eax + 0x4f01d8]
xor bl, byte [ecx + 0x4effd8]
mov cl, byte [ebp - 1]
mov ch, byte [ebp - 2]
jmp 0x4d3b87
cmp eax, 4
jne 0x4d3b87
movzx eax, bl
mov bl, byte [eax + 0x4effd8]
movzx eax, bh
mov bh, byte [eax + 0x4effd8]
movzx eax, cl
mov cl, byte [eax + 0x4effd8]
movzx eax, ch
mov ch, byte [eax + 0x4effd8]
mov al, byte [edx - 0x1d]
xor al, bl
mov byte [edx + 3], al
mov al, byte [edx - 0x1c]
xor al, bh
mov byte [edx + 4], al
mov al, byte [edx - 0x1b]
xor al, cl
mov byte [edx + 5], al
mov al, byte [edx - 0x1a]
xor al, ch
inc esi
mov byte [edx + 6], al
add edx, 4
cmp esi, 0x3c
jb 0x4d3b07
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4dffa7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4f2e44
push 0x4f2e3c
push str.FlsAlloc
push 0x1e
call fcn.004dfe31
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4dffdb
push dword [ebp + 8]
mov ecx, esi
call dword [0x4ec2a0]
call esi
jmp 0x4dffe1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4e0025
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4f2e54
push 0x4f2e4c
push str.FlsGetValue
push 0x20
call fcn.004dfe31
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e005c
push dword [ebp + 8]
mov ecx, esi
call dword [0x4ec2a0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4e1f3c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4e1fd9
push ebx
push esi
call fcn.004e1f05
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004e0a68
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4e1f86
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e1fd8
push edi
push eax
call fcn.004df4bc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4e1fa6
call fcn.004df482
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e1fd7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004e0a68
add esp, 0x20
test eax, eax
jne 0x4e1fc5
push edi
call fcn.004df482
jmp 0x4e1fcd
push ebx
call fcn.004df482
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4203d6
pop dword [ebp - 0x48]
mov eax, 0xd168a651
sub eax, 0xd126a27b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x9f0a4664
sub dword [ebp - 0x58], 0x50b80119
mov dword [ebp - 0x54], 0xb282e94c
add dword [ebp - 0x54], 0x7fb062f9
mov dword [ebp - 0x50], 0x4a84a45c
add dword [ebp - 0x50], 0x1c79fd2
mov dword [ebp - 0x4c], 0x5d617ef1
add dword [ebp - 0x4c], 0xa29e810f
lea eax, [ebp - 0x58]
push eax
mov eax, 0x84f6e081
sub eax, 0x84b4b00d
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x4fac38bb
sub dword [ebp - 0x58], 0xdb39cf65
mov dword [ebp - 0x54], 0x6a9e2c55
sub dword [ebp - 0x54], 0x2931cae0
mov dword [ebp - 0x50], 0x26f0fa2c
sub dword [ebp - 0x50], 0xc3818dc0
mov dword [ebp - 0x4c], 0xbcb2fdb8
sub dword [ebp - 0x4c], 0xbcb2fdb8
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7ae99f12
add eax, 0x85589212
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3e6f2
push 0
call eax
mov ecx, 0x7e4882dd
add ecx, 0x81b7c716
xor ebx, ebx
add ebx, eax
mov esi, 0x7fac7f7d
add esi, 0x8096c483
add esi, dword [ebp - 0x48]
mov edx, 0xb5a03880
add dword [ebp - 0x18], 0x48fd9f31
mov edi, dword [esi]
add dword [ebp - 0x18], eax
add edi, edx
xor dword [ebp - 0x10], esi
mov dword [ebx], edi
add dword [ebp - 4], 0x6731afbd
add ebx, 4
add esi, 4
loop 0x4204f4
add eax, 0x11a9f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xea01bc08
sub ecx, 0xe9c1bc08
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10011c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
push 5
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.10009480
mov esi, dword [ebx]
mov edi, 1
mov dword [esi + 8], 0
lea eax, [esi + 0x28]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebx + 4], eax
nop
movd xmm0, edi
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10044840]
divsd xmm0, qword [0x10044888]
movsd qword [esp + 0x10], xmm0
call fcn.10034520
xorps xmm0, xmmword [0x10044a20]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x10]
movss dword [esi], xmm1
call fcn.10032ff0
cvtsd2ss xmm0, xmm0
add edi, 2
lea esi, [esi + 8]
movss dword [esi - 4], xmm0
cmp edi, 0xb
jl 0x10011cf0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014bc0
Capabilities:
Terminate process

Disassembly:
push ecx
push dword [esp + 8]
push str.D:update_systemworkspacepurple_box_ncs_node_rtvc_rtvcexternals_speexdsplibspeexdspkiss_fft.c
push str.Fatal__internal__error_in__s__line__d:__s_n
push 2
call fcn.1001f7b4
add esp, 4
push eax
call fcn.10014b90
add esp, 0x14
push 1
call fcn.1001f6d6
int3
Function at 0x42b23b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
test eax, 0x8ca71f00
mov dl, 0x77
neg byte [edi + 0xd043f6e]
jne 0x42b258
int1
mov ah, 0xbd
lahf
adc eax, 0xf1e125ad

Function at 0x44bad0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44bba5
lea ecx, [esp + 0x20]
push ebp
mov eax, 4
push ecx
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebp
test eax, eax
jne 0x44bb52
mov edi, dword [esp + 0x1c]
xor esi, esi
test ebx, ebx
je 0x44bb67
mov eax, dword [0x760dfc]
push 0x760b18
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
call ebp
test eax, eax
pop ebp
jne 0x44bb9a
or esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x5747f3
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
inc ebp
das
dec edi
sbb dword [edx + 0x4db77d6d], 0xffffffd1
sahf
inc edx
push edi
jp 0x574848
test eax, 0x7a3f4d42
aas
adc cl, byte [esp + ebx]
and ch, byte [edx + 0x7ce769d9]
and dword [0xd2bc96a7], esi
fldcw word [ecx - 0x19]
jl 0x574834
xor eax, 0xd2bc96a7
cmc
cmc
fmul qword [ecx + 0x9b53260]
or dl, ah
mov edi, 0xf67c2ca
adc byte [ebx - 0x54], bh
lea ebx, [edi + 0x5f]
or dword [edx - 0x6e], edi
jl 0x57480e
pop ebx
sbb ebx, dword [ebp - 2]
mov edi, 0xd3f7ec49
retf
pop ebp
invalid
mov ch, 0x1b
test dword [eax + 0x5814557c], eax
pop ebx
or bl, bl
invalid
Function at 0x5c4c73
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
add byte [eax], al
add byte [eax + 0xd508d23], al
add byte [eax], al
xor eax, eax
nop dword [eax + eax]
mov edx, dword [ebp + eax*4 + 0xd54]
mov esi, edx
and esi, 0x7ffffffe
or esi, ecx
shr esi, 1
mov ecx, edx
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [ebp + eax*4 + 4]
xor edx, esi
mov dword [ebp + eax*4 + 0x390], edx
and ecx, 0x80000000
inc eax
cmp eax, 0x18c
jne 0x5c4c87
mov eax, dword [ebp + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, ecx

Function at 0x5c4ccf
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
shr edx, 1
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ebp + 0x634]
xor eax, edx
mov dword [ebp + 0x9c0], eax
mov dword [ebp], 0
xor eax, eax
lea ecx, [eax + 1]
mov dword [ebp], ecx
mov eax, dword [ebp + eax*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [ebp + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add eax, edi
xor eax, 0x80000000
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40611c
pop dword [ebp - 0x50]
mov eax, 0x40611c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x25e061f2
sub dword [ebp - 0x60], 0xd78e1ca7
mov dword [ebp - 0x5c], 0x9236af0d
add dword [ebp - 0x5c], 0x9ffc9d38
mov dword [ebp - 0x58], 0x108cd8
add dword [ebp - 0x58], 0x4c3bb756
mov dword [ebp - 0x54], 0x4cd4d2db
sub dword [ebp - 0x54], 0x4cd4d2db
lea eax, [ebp - 0x60]
push eax
mov eax, 0xb5750e62
sub eax, 0xb5349e02
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x196675cb
sub dword [ebp - 0x60], 0xa4f40c75
mov dword [ebp - 0x5c], 0x80a77b45
add dword [ebp - 0x5c], 0xc0c4e630
mov dword [ebp - 0x58], 0x88342310
add dword [ebp - 0x58], 0xdb3b495c
mov dword [ebp - 0x54], 0x383b81ed
sub dword [ebp - 0x54], 0x383b81ed
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x2a936ea2
add eax, 0xd5ad025e
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x37203
push 0
call eax
mov ecx, 0x4a12
mov edi, eax
mov edx, 0xa5398ffa
add edx, 0x5b077006
add edx, dword [ebp - 0x50]
mov esi, 0x71334437
add esi, 0xbf32e143
xor dword [ebp - 0x24], edx
mov ebx, dword [edx]
sub dword [ebp - 0x48], 0x5ac3a073
sub ebx, esi
sub dword [ebp - 0x38], ebx
mov dword [edi], ebx
add dword [ebp - 0x4c], ecx
add edi, 0x7d10ef0b
add edi, 0x82ef10f9
add edx, 0x9d8fb7a0
sub edx, 0x9d8fb79c
loop 0x406233
add eax, 0xf5b14b23
sub eax, 0xf5b03008
mov ebx, eax
add eax, 0x82b592ce
sub eax, 0x82b592c9
mov ecx, 0x4fc84203
add ecx, 0xb077bdfd
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941