joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd5f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x44]
mov ecx, dword [ebx + 4]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x3c]
test ecx, ecx
jbe 0x4fd61d
mov edx, dword [ebx + 8]
lea esp, [esp]
cmp dword [edx], 0
jne 0x4fd636
inc eax
add edx, 4
cmp eax, ecx
jb 0x4fd610
lea eax, [esp + 0xc]
push eax
call fcn.004fbfe0
push 0x63d9d0
lea ecx, [esp + 0x10]
push ecx
call sub.MSVCR90.dll__CxxThrowException
push esi
push edi
mov eax, ebx
call fcn.004fc060
lea esi, [eax + 0x20]
shr esi, 5
mov edi, ebp
mov dword [esp + 0x10], eax
call fcn.00500140
mov edx, dword [ebp + 4]
mov eax, dword [ebp + 8]
add edx, edx
add edx, edx
push edx
push 0
push eax
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x58]
add esp, 0xc
mov eax, edi
call fcn.00510210
mov esi, eax
mov eax, ebx
call fcn.00510210
cmp esi, eax
jb 0x4fd6ba
mov eax, ebx
call fcn.00510210
mov esi, 0x20
sub esi, eax
mov eax, edi
call fcn.00510210
mov edi, dword [esp + 0x48]
add esi, eax
shr esi, 5
call fcn.00500140
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x58]
jmp 0x4fd6fc
mov ebx, dword [esp + 0x48]
mov eax, dword [ebx + 4]
mov esi, dword [ebx + 8]
test eax, eax
je 0x4fd6e8
add eax, eax
add eax, eax
push eax
push 0
push esi
call sub.MSVCR90.dll_memset
push esi
call dword [sym.imp.MSVCR90.dll_free]
push 0
call fcn.004de400
add esp, 0x14
xor esi, esi
push 0
push 0
push esi
mov dword [ebx + 8], esi
mov dword [ebx + 4], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, edi
call fcn.004fc060
mov ebx, eax
test ebx, ebx
jl 0x4fd7ab
push ebp
call fcn.004fd920
mov eax, dword [esp + 0x4c]
mov edx, dword [ebp + 8]
mov edi, ebx
shr edi, 5
cmp edi, dword [eax + 4]
jae 0x4fd739
mov eax, dword [eax + 8]
mov eax, dword [eax + edi*4]
mov ecx, ebx
and ecx, 0x1f
shr eax, cl
and eax, 1
jmp 0x4fd73b
xor eax, eax
or dword [edx], eax
mov ecx, dword [esp + 0x10]
mov edx, ebp
call fcn.004fc0a0
test eax, eax
je 0x4fd7a2
mov ecx, dword [esp + 0x50]
mov esi, dword [ecx + 4]
push ebp
call fcn.004ff800
mov eax, dword [esp + 0x50]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 8]
test edx, edx
jbe 0x4fd77d
sub ecx, eax
lea esp, [esp]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
sub edx, 1
jne 0x4fd770
mov edx, dword [esp + 0x48]
lea esi, [edi + 1]
push edx
call fcn.004ff800
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 8]
lea eax, [ecx + edi*4]
mov ecx, ebx
and ecx, 0x1f
mov edx, 1
shl edx, cl
or dword [eax], edx
sub ebx, 1
jns 0x4fd710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x4fd880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x560741
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov ecx, esi
mov dword [esp + 0xc], ebx
call fcn.004fc9e0
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
call fcn.004fc9e0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x34], 1
call fcn.004fd5f0
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call fcn.004d7700
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x4fda20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55af03
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.004ff9d0
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x3c], 1
mov edx, dword [eax]
mov edx, dword [edx + 0x64]
push ecx
mov ecx, eax
call edx
push eax
push esi
call fcn.004fcae0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 1
mov byte [esp + 0x3c], 0
call fcn.004fc410
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x4fdcf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55aec4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
call fcn.004ff9d0
push esi
push edi
mov ecx, eax
mov dword [esp + 0x40], 0
call fcn.004fff70
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x3c], 2
call fcn.004fc410
mov dword [edi], vtable.CryptoPP::GF2NP.0
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
test esi, esi
je 0x4fdd6d
lea eax, [ecx + esi*4 - 4]
lea esp, [esp]
cmp dword [eax], 0
jne 0x4fdd89
dec esi
sub eax, 4
test esi, esi
jne 0x4fdd60
xor eax, eax
dec eax
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret 4
test esi, esi
je 0x4fdd6d
lea eax, [ecx + esi*4 - 4]
call fcn.004e4ff0
dec esi
shl esi, 5
add eax, esi
jmp 0x4fdd6f
Function at 0x4fe540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x560680
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push edi
lea ecx, [esp + 0x14]
push ebx
push ecx
call fcn.004fcce0
add esp, 0x10
push esi
mov ecx, eax
mov dword [esp + 0x24], 0
call fcn.004fdcf0
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.004d7700
mov ecx, dword [esi + 0x3c]
push 0
lea edx, [esi + 0x48]
push edx
mov dword [esi], vtable.CryptoPP::GF2NT.0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], edi
call fcn.004fca40
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0xc

Function at 0x4fff70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5514cd
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi + 4], vtable.CryptoPP::AbstractRing_class_CryptoPP::PolynomialMod2_::MultiplicativeGroupT.0
push eax
mov dword [esi + 8], esi
mov dword [esi], vtable.CryptoPP::QuotientRing_class_CryptoPP::EuclideanDomainOf_class_CryptoPP::PolynomialMod2__.0
call fcn.004fc3a0
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esi + 0x30]
push edx
mov dword [esp + 0x18], 0
call fcn.004fcae0
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x50a8a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x56d952
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
push ecx
mov dword [esp + 0xc], esp
mov dword [esp + 0xc], esp
call fcn.0050d1d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call fcn.004f55d0
push eax
mov eax, dword [esp + 0x38]
push eax
push esi
mov byte [esp + 0x34], 1
call fcn.0050b920
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004d6df0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8
Function at 0x50f790
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x57164b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x24], 0
mov ebx, dword [esp + 0x30]
lea ebp, [esi + esi + 2]
cmp ebp, ebx
mov dword [esp + 0x18], esi
jge 0x50f90b
mov ebx, dword [esp + 0x2c]
lea eax, [ebp + ebp*2]
shl eax, 4
add eax, ebx
lea edx, [eax - 0x14]
add eax, 0x1c
mov edi, 1
cmp dword [eax + 0x10], edi
je 0x50f7fe
cmp dword [edx + 0x10], edi
je 0x50f810
call fcn.004f86b0
jmp 0x50f80a
cmp dword [edx + 0x10], edi
jne 0x50f80e
call fcn.004f86b0
neg eax
test eax, eax
jge 0x50f810
sub ebp, edi
lea edi, [ebp + ebp*2]
shl edi, 4
mov cl, byte [edi + ebx]
lea esi, [esi + esi*2]
add edi, ebx
shl esi, 4
add esi, ebx
mov byte [esi], cl
mov ebx, dword [edi + 8]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp eax, ebx
je 0x50f86c
lea edx, [eax*4]
push edx
push 0
push ecx
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCR90.dll_free]
push ebx
call fcn.004de400
add esp, 0x14
test ebx, ebx
jne 0x50f863
xor eax, eax
jmp 0x50f86a
mov eax, ebx
call fcn.004dda10
mov ecx, eax
lea eax, [ebx*4]
push eax
mov dword [esi + 0xc], ecx
mov dword [esi + 8], ebx
mov edx, dword [edi + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
mov ebx, dword [edi + 0x14]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp eax, ebx
je 0x50f8cc
add eax, eax
add eax, eax
push eax
push 0
push ecx
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
push ebx
call fcn.004de400
add esp, 0x14
test ebx, ebx
jne 0x50f8c3
xor eax, eax
jmp 0x50f8ca
mov eax, ebx
call fcn.004dda10
mov ecx, eax
lea eax, [ebx*4]
push eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], ebx
mov edx, dword [edi + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
add esi, 0x1c
add edi, 0x1c
push esi
call fcn.004f5a90
mov esi, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, dword [esp + 0x30]
jl 0x50f7d5
mov ebx, dword [esp + 0x30]
cmp ebp, ebx
mov ebp, dword [esp + 0x2c]
jne 0x50f939
lea eax, [ebx + ebx*2]
shl eax, 4
lea esi, [esi + esi*2]
lea edi, [eax + ebp - 0x30]
shl esi, 4
push edi
add esi, ebp
push esi
call fcn.004d7b30
add esi, 0x1c
add edi, 0x1c
push esi
call fcn.004f5a90
lea esi, [ebx - 1]
sub esp, 0x30
mov edi, esp
mov dword [esp + 0x60], esp
push edi
lea ecx, [esp + 0x68]
mov dword [esp + 0x48], edi
call fcn.004dd0e0
lea ecx, [esp + 0x80]
push ecx
add edi, 0x1c
mov byte [esp + 0x58], 1
call fcn.004f56b0
mov edx, dword [esp + 0x48]
push edx
mov byte [esp + 0x58], 3
push ebp
mov ecx, esi
mov byte [esp + 0x5c], 0
call fcn.0050fa60
add esp, 0x38
lea ecx, [esp + 0x50]
mov dword [esp + 0x24], 4
call fcn.004d6df0
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x28], 0xffffffff
call fcn.004d7930
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5132a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
shr ecx, 2
xor ebx, ebx
test ecx, ecx
jbe 0x5132d2
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
jmp 0x5132c0
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
sub ecx, 1
jne 0x5132c0
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x5132fb
add edx, eax
add esi, eax
test edi, edi
jbe 0x5132fb
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea ecx, [ecx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x5132f0
pop edi
pop esi
pop ebx
ret
Function at 0x51f600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55a83d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.VMenuToolbarRep.0
mov dword [esp + 0x14], 7
call fcn.0051f6d0
mov byte [esp + 0x14], 6
lea ecx, [esi + 0xb0]
call fcn.00499450
mov byte [esp + 0x14], 5
lea eax, [esi + 0x9c]
call fcn.0051e380
mov byte [esp + 0x14], 4
lea ecx, [esi + 0x68]
call fcn.0049c2c0
mov byte [esp + 0x14], 3
lea eax, [esi + 0x4c]
call fcn.0051fcf0
mov byte [esp + 0x14], 2
lea eax, [esi + 0x30]
call fcn.0051fc00
mov byte [esp + 0x14], 1
lea eax, [esi + 0x14]
call fcn.0051fa20
mov byte [esp + 0x14], 0
lea ecx, [esi + 0xc]
call fcn.00499450
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 8]
call fcn.00499450
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5253b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5673d3
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
or edi, 0xffffffff
lea esi, [esp + 0x10]
call fcn.004993c0
mov dword [esp + 0x38], 0
call fcn.0048a950
mov ecx, eax
lea edi, [esp + 0x1c]
call fcn.004ad4f0
mov byte [esp + 0x38], 1
mov eax, esi
call fcn.00408130
mov ecx, eax
mov eax, edi
call fcn.004665c0
push eax
mov eax, ecx
lea esi, [esp + 0x18]
call fcn.004a8170
mov byte [esp + 0x38], 2
push 0x54
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x38], 3
test eax, eax
je 0x525450
mov edx, dword [ebp + 0xc]
push edx
mov ecx, esi
push ecx
push eax
call fcn.00525720
jmp 0x525452
xor eax, eax
mov byte [esp + 0x38], 2
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x14]
call fcn.004a8190
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x1c]
call fcn.004ad650
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00499450
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x525bc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x567259
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x28], esi
mov ecx, ebp
mov dword [esp + 0x14], esi
call fcn.004992d0
mov dword [esp + 0x28], esi
or edi, 0xffffffff
mov eax, 0x614384
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], 1
call fcn.004993d0
mov esi, eax
mov dword [esp + 0x28], 1
mov ecx, dword [ebx]
lea eax, [esp + 0x18]
push eax
call fcn.00526890
mov byte [esp + 0x2c], 2
push esi
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004a0f20
add esp, 0x10
mov byte [esp + 0x28], 3
push eax
mov edi, ebp
call fcn.00499570
mov byte [esp + 0x28], 2
lea ecx, [esp + 0x34]
call fcn.00499450
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x18]
call fcn.00499450
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x1c]
call fcn.00499450
push 0x684454
call fcn.00499570
lea ecx, [esp + 0x34]
call fcn.004992d0
mov dword [esp + 0x28], 4
or edi, 0xffffffff
mov eax, 0x614384
lea esi, [esp + 0x18]
call fcn.004993d0
mov byte [esp + 0x28], 5
push eax
lea edx, [ebx + 8]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004a0f20
add esp, 0xc
mov byte [esp + 0x28], 6
lea edi, [esp + 0x34]
call fcn.00499530
mov byte [esp + 0x28], 5
lea ecx, [esp + 0x1c]
call fcn.00499450
mov byte [esp + 0x28], 4
mov ecx, esi
call fcn.00499450
push 0x628a44
push 0x5fd988
mov ecx, edi
push ecx
call fcn.00499eb0
mov edx, edi
push edx
mov edi, ebp
call fcn.00499570
push 0x684454
call fcn.00499570
or edi, 0xffffffff
mov eax, 0x614384
lea esi, [esp + 0x18]
call fcn.004993d0
mov byte [esp + 0x28], 7
push eax
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004a0f20
add esp, 0xc
mov byte [esp + 0x28], 8
push eax
mov edi, ebp
call fcn.00499570
mov byte [esp + 0x28], 7
lea ecx, [esp + 0x1c]
call fcn.00499450
mov byte [esp + 0x28], 4
mov ecx, esi
call fcn.00499450
push 0x684454
call fcn.00499570
or edi, 0xffffffff
mov eax, 0x614384
lea esi, [esp + 0x18]
call fcn.004993d0
mov byte [esp + 0x28], 9
push eax
lea edx, [ebx + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004a0f20
add esp, 0xc
mov byte [esp + 0x28], 0xa
push eax
mov edi, ebp
call fcn.00499570
mov byte [esp + 0x28], 9
lea ecx, [esp + 0x1c]
call fcn.00499450
mov byte [esp + 0x28], 4
mov ecx, esi
call fcn.00499450
push 0x684454
call fcn.00499570
or edi, 0xffffffff
mov eax, 0x614384
lea esi, [esp + 0x18]
call fcn.004993d0
mov byte [esp + 0x28], 0xb
push eax
add ebx, 0x14
lea ecx, [esp + 0x20]
push ebx
push ecx
call fcn.004a0f20
add esp, 0xc
mov byte [esp + 0x28], 0xc
push eax
mov edi, ebp
call fcn.00499570
mov byte [esp + 0x28], 0xb
lea ecx, [esp + 0x1c]
call fcn.00499450
mov byte [esp + 0x28], 4
mov ecx, esi
call fcn.00499450
push 0x684454
call fcn.00499570
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x34]
call fcn.00499450
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x53cfb0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x56b3fc
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x668038]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x198]
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x70], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
cmp dword [esp + 0x70], 6
jb 0x53d0db
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x24]
lea ecx, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], str.SHGetKnownFolderPath
mov byte [esp + 0x64], 1
mov byte [esp + 0x65], 1
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x70], 1
mov byte [esp + 0x71], bl
call fcn.004c5720
add esp, 8
mov dword [esp + 0x190], ebx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov esi, eax
mov dword [esp + 0x190], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0049c2c0
cmp esi, ebx
jne 0x53d0db
mov eax, 0x668dd4
cmp byte [esp + 0x19c], bl
jne 0x53d090
mov eax, 0x668de4
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x54], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x64], ecx
push ebx
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x70], edx
call dword [esp + 0x2c]
cmp eax, ebx
jne 0x53d0db
mov edx, dword [esp + 0x18]
push edx
mov eax, ebp
call fcn.00499510
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x53d18d
call fcn.004ab890
test al, al
je 0x53d10a
push ebx
or edi, 0xffffffff
mov eax, str._u3doc_
lea esi, [esp + 0x1c]
call fcn.004993c0
mov dword [esp + 0x190], 1
mov edi, ebp
call fcn.00499530
jmp 0x53d179
mov esi, ebp
call fcn.004a85e0
test al, al
jne 0x53d18d
lea ecx, [esp + 0x18]
push ecx
call fcn.004ac6e0
add esp, 4
mov dword [esp + 0x190], 2
mov edi, ebp
call fcn.00499530
or edi, 0xffffffff
mov dword [esp + 0x190], edi
lea ecx, [esp + 0x18]
call fcn.00499450
mov eax, str.download
cmp byte [esp + 0x19c], bl
jne 0x53d15a
mov eax, str.upload
push ebx
lea esi, [esp + 0x1c]
call fcn.004993c0
mov dword [esp + 0x190], 3
mov edx, esi
push edx
mov edi, ebp
call fcn.00499570
mov dword [esp + 0x190], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00499450
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.0054eee2
add esp, 0x180
ret 8
Function at 0x53d3e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55a233
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov ecx, edi
mov dword [esp + 0xc], ebx
call fcn.004992d0
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], 1
call fcn.00437290
mov dword [esp + 0x30], 1
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
call fcn.004375d0
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x20]
call fcn.004375f0
test al, al
je 0x53d4b4
xor eax, eax
cmp byte [esp + 0x10], bl
mov ecx, edi
setne al
add eax, 0x30
call fcn.00499600
mov eax, 0x1f
mov ecx, edi
call fcn.00499600
lea edx, [esp + 0x14]
push edx
call fcn.00499570
mov eax, 0x1f
mov ecx, edi
call fcn.00499600
lea eax, [esp + 0x18]
push eax
call fcn.00499570
mov eax, 0x1f
mov ecx, edi
call fcn.00499600
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x20]
call fcn.004375f0
test al, al
jne 0x53d457
mov byte [esp + 0x30], bl
lea edx, [esp + 0x10]
push edx
call fcn.00528420
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x28
ret 8
Function at 0x53faf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55f66a
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
push esi
call fcn.00548140
xor eax, eax
mov dword [esp + 0x10], eax
mov byte [esi + 0xc], al
mov ecx, 0xffffff
mov dl, 1
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], dl
mov byte [esi + 0xf], dl
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x4c], ecx
mov dword [esi], vtable.VProfile2_struct_ColorScheme__class_VProfileBinary_.0
mov byte [esi + 0x50], al
mov byte [esi + 0x51], dl
mov byte [esi + 0x52], dl
mov byte [esi + 0x53], dl
mov dword [esi + 0x54], eax
mov dword [esi + 0x74], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x78], ecx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x60], eax
mov dword [esi + 0x80], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x84], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x88], ecx
mov dword [esi + 0x6c], eax
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x90], ecx
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x540cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56b368
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x88]
mov eax, edi
call fcn.00499c50
test al, al
je 0x540dfe
lea eax, [esi + 0xa8]
mov dword [esp + 0x18], eax
call fcn.00499c50
test al, al
je 0x540dfe
push esi
call fcn.00540b90
shl eax, 4
cmp byte [eax + 0x668bb4], 0
je 0x540dfe
lea eax, [esp + 0x1c]
push eax
call fcn.0049a2f0
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 0xb0]
push ecx
lea edx, [esp + 0x1b]
push edx
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x23], 0
call sub.ClientConfigUI67U.dll_bool___cdecl_LaunchFirewallUsernameDialog_class_IString___bool___class_IParentable__
add esp, 0xc
cmp byte [esp + 0x17], 0
mov bl, al
lea eax, [esp + 0x20]
je 0x540db7
lea ecx, [esi + 0x7c]
call fcn.004080d0
lea ecx, [esp + 0x17]
push ecx
call fcn.00523680
push esi
call fcn.00524bb0
jmp 0x540dc0
mov edi, dword [esp + 0x18]
call fcn.00499530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push 0
lea eax, [esp + 0x24]
call fcn.00408130
push eax
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0049a440
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esi + 0xa8]
mov eax, ecx
call fcn.00499c50
test al, al
je 0x540e1a
lea eax, [esi + 0x7c]
neg eax
sbb eax, eax
and eax, edi
jmp 0x540e1c
mov eax, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push 0
call fcn.00408130
push eax
mov eax, dword [edx + 0xc]
call eax
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4