joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423cd5
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x4cd4c0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0042289f
push 0x41582c
lea ecx, [esp + 0x1c]
call fcn.004227c4
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x423d59
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x423d93
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x4157c8
call fcn.004239fe
mov edi, eax
jmp 0x423d93
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.00423bb5
mov ebx, eax
test ebx, ebx
jns 0x423d85
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x4157c8
call fcn.004239e1
mov edi, ebx
jmp 0x423d93
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x423d9d
push esi
call fcn.00423a6c
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049d0f0
mov esp, ebp
pop ebp
ret 8

Function at 0x4250ea
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push edi
mov edx, dword [ebx]
mov edi, dword [ebx + 4]
add edi, 0x1608
mov ecx, dword [edx + 0x167c]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x425148
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], edx
lea eax, [ebp - 4]
mov esi, dword [ecx]
push edi
push eax
lea eax, [ebp - 8]
mov esi, dword [esi + 8]
mov ecx, esi
push eax
call dword [0x4d06a8]
mov ecx, dword [ebp - 0xc]
call esi
pop esi
test al, al
jne 0x42516a
cmp dword [edi + 0x14], 8
jb 0x425150
mov edi, dword [edi]
mov eax, dword [ebx]
push 1
push 0
push 0
push edi
push 0x415be8
push dword [eax + 0x8c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop ebx
leave
ret 4

Function at 0x42a43e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
or dword [ecx + 0x1384], 0xffffffff
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x42a45e
pop edi
pop esi
mov dword [ecx], ebx
mov eax, ecx
pop ebx
pop ebp
ret 4
Function at 0x42a603
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4a2ed9
call fcn.004a0640
mov esi, ecx
push 0x48
call fcn.0049d5bc
pop ecx
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
xor ebx, ebx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0042b84f
mov dword [ebp - 0x10], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 1
push edi
push ebx
push eax
push 0x42b090
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42a65b
mov eax, esi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [edi], ebx
call fcn.00483cc3
int3

Function at 0x42b6f1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x42b73b
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x42b703
jmp 0x42b748
cmp dword [esi], 0x4e0
jb 0x42b748
call fcn.0042b782
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x42b782
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x42b796
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x42b7db
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret
Function at 0x430f2e
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push 0x30
mov eax, 0x4a35bb
call fcn.004a0700
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x30], 0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
push ecx
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
mov esi, eax
test esi, esi
je 0x430fe0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
push ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.00432e18
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
jb 0x430f8f
mov eax, dword [ebp - 0x2c]
push 0
push 0
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x30]
push esi
push 0x400
push 0x4e4
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
jb 0x430fb7
mov ecx, dword [ebp - 0x2c]
call fcn.00432aaa
mov ecx, dword [ebx]
mov edi, 0x90
mov dword [ebx], eax
test ecx, ecx
je 0x430fd2
push edi
push ecx
call fcn.0049d3ab
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004300bf
jmp 0x43101e
mov edi, 0x90
push edi
call fcn.0049d5bc
pop ecx
mov ecx, eax
call fcn.0043314e
lea ecx, [ebp - 0x3c]
mov esi, eax
cmp ebx, ecx
je 0x431011
mov ecx, dword [ebx]
xor esi, esi
mov dword [ebx], eax
test ecx, ecx
je 0x43101e
push edi
push ecx
call fcn.0049d3ab
pop ecx
pop ecx
xor eax, eax
test eax, eax
je 0x43101e
push edi
push esi
call fcn.0049d3ab
pop ecx
pop ecx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 4]
call fcn.00432849
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebx + 8]
call fcn.00432849
push ecx
lea esi, [ebx + 0x10]
push 0x55
mov ecx, esi
call fcn.0042a482
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43104d
mov eax, dword [esi]
push 0
push dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
test eax, eax
jne 0x43107b
mov edx, 0x83
mov ecx, dword [ebp + 4]
push 0x417fe8
call fcn.004239fe
jmp 0x4310db
push ecx
push eax
mov ecx, esi
call fcn.0042a482
push ecx
add ebx, 0x28
push 0x55
mov ecx, ebx
call fcn.0042a482
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x43109b
mov eax, dword [ebx]
push 0x55
push eax
push 0x5c
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x4310b0
mov edx, edi
jmp 0x43106c
push ecx
push eax
mov ecx, ebx
call fcn.0042a482
xor eax, eax
jmp 0x4310db
call fcn.004a0620
ret 0xc
Function at 0x431d8b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea esi, [ecx + 0x40]
xor ebx, ebx
cmp dword [esi + 0x14], 8
mov eax, esi
push edi
mov dword [esi + 0x10], ebx
jb 0x431da6
mov eax, dword [esi]
xor ecx, ecx
mov edi, 0x418088
mov word [eax], cx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
push edi
push 0x418050
push SysReAllocStringLen
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x431de1
push eax
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0x1e9
call fcn.00432811
jmp 0x431e4c
mov eax, dword [ebp - 4]
push ecx
shr eax, 1
mov ecx, esi
push eax
call fcn.0042a482
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x431df9
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push 2
push edi
push 0x418050
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test edi, edi
je 0x431e3d
push edi
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0x1f8
call fcn.00432811
test edi, edi
je 0x431e3d
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x431e36
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
jmp 0x431e4c
mov eax, dword [ebp - 4]
shr eax, 1
push ecx
dec eax
mov ecx, esi
push eax
call fcn.0042a482
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4327b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + edx]
xor eax, esi
imul esi, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x4327c6
mov eax, esi
pop esi
leave
ret 4
Function at 0x432f8e
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
mov eax, edx
xor edx, edx
mov dword [ebp - 4], ebx
push 3
pop ecx
div ecx
xor ecx, ecx
cmp edx, 1
mov dword [ebp - 0xc], edx
mov edi, eax
mov esi, edx
setne cl
mov dword [ebp - 8], edi
add ecx, 2
neg esi
sbb esi, esi
lea eax, [edi*4 + 1]
and esi, ecx
add eax, esi
cmp eax, 0x81
ja 0x4330d8
xor esi, esi
test edi, edi
mov edi, dword [ebp + 8]
je 0x433053
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov bl, byte [eax + 1]
mov dl, byte [eax + 2]
add eax, 3
mov dword [ebp - 4], eax
movzx eax, cl
and cl, 3
shr eax, 2
shl cl, 4
movzx ecx, cl
movzx edx, dl
mov al, byte [eax + 0x4180d0]
mov byte [esi + edi], al
movzx eax, bl
and bl, 0xf
shr eax, 4
or ecx, eax
shl bl, 2
mov al, byte [ecx + 0x4180d0]
mov byte [esi + edi + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
movzx ecx, bl
or ecx, eax
mov al, byte [ecx + 0x4180d0]
mov byte [esi + edi + 2], al
mov al, byte [edx + 0x4180d0]
mov byte [esi + edi + 3], al
add esi, 4
sub dword [ebp - 8], 1
jne 0x432fdf
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
sub edx, 1
je 0x4330a6
sub edx, 1
jne 0x4330d4
mov cl, byte [ebx]
mov dl, byte [ebx + 1]
movzx eax, cl
and cl, 3
shr eax, 2
shl cl, 4
movzx ecx, cl
mov al, byte [eax + 0x4180d0]
mov byte [esi + edi], al
movzx eax, dl
and dl, 0xf
shr eax, 4
or ecx, eax
shl dl, 2
mov al, byte [ecx + 0x4180d0]
mov byte [esi + edi + 1], al
movzx eax, dl
mov al, byte [eax + 0x4180d0]
mov byte [esi + edi + 2], al
mov byte [esi + edi + 3], 0x3d
jmp 0x4330d1
mov cl, byte [ebx]
movzx eax, cl
and cl, 3
shr eax, 2
shl cl, 4
mov al, byte [eax + 0x4180d0]
mov byte [esi + edi], al
movzx eax, cl
mov al, byte [eax + 0x4180d0]
mov byte [esi + edi + 1], al
mov word [esi + edi + 2], 0x3d3d
add esi, 4
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4360b2
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4a3cde
call fcn.004a0640
mov esi, ecx
push 8
call fcn.0049d5bc
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov dword [edx], ebx
mov dword [edx + 4], ebx
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x436220
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x436117
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.004361f7
mov eax, esi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [edi], ebx
call fcn.00483cc3
int3
Function at 0x436122
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4a3d01
call fcn.004a0640
mov ebx, ecx
push 0x38
call fcn.0049d5bc
mov esi, dword [ebp + 8]
mov edi, eax
xor eax, eax
pop ecx
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
lea ecx, [edi + 8]
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call fcn.004262fb
lea eax, [esi + 0x20]
push eax
lea ecx, [edi + 0x20]
call fcn.004262fb
mov dword [ebp - 0x10], edi
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x4362d0
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x436199
mov eax, ebx
call fcn.004a05e0
ret 4
and dword [esi], 0
push 6
pop ecx
call fcn.00483cc3
int3

Function at 0x446778
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 0x418bbc
push 3
mov edi, 0x4b7090
mov esi, ecx
push edi
call fcn.00499e19
add esp, 0xc
mov ecx, 0x4cd7b0
call fcn.0047fdac
xor ebx, ebx
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], bl
call fcn.00478832
test eax, eax
js 0x4467eb
cmp byte [esp + 0x13], bl
je 0x4467eb
push 0x41d9dc
push 4
push 0x4b70d8
call fcn.00499e19
add esp, 0xc
push 1
push ebx
push ebx
push 0x41d888
push 0x415be8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4467ff
push 0x41da00
push 1
push 0x4b70d8
call fcn.00499e19
add esp, 0xc
mov ecx, dword [esi]
call fcn.00446942
mov ecx, dword [esi]
mov cl, byte [ecx + 0x15d0]
nop
test cl, cl
jne 0x44687e
test al, al
mov ebx, 0x15d1
mov eax, dword [esi]
setne cl
add eax, ebx
xchg byte [eax], cl
mov eax, dword [esi]
sub esp, 0x28
mov ecx, esp
mov dword [ecx], 0x403800
mov dword [ecx + 4], eax
mov dword [ecx + 0x24], ecx
mov ecx, dword [esi]
call fcn.0049792a
mov eax, dword [esi]
mov al, byte [eax + ebx]
nop
mov edx, 0x418be0
test al, al
jne 0x446851
mov edx, 0x418bec
mov ecx, 0x4cd7b0
call fcn.0047fe02
mov eax, dword [esi]
mov al, byte [eax + ebx]
nop
test al, al
je 0x44686e
push 0x418c00
push 3
jmp 0x446875
push 0x418c48
push 1
push edi
call fcn.00499e19
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448ac5
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4a4e21
call fcn.004a0640
mov edi, ecx
push 8
call fcn.0049d5bc
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [esi]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
xor ebx, ebx
lea esi, [edi + 4]
push esi
push ebx
push eax
push 0x448fd0
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x448b15
mov eax, edi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [esi], ebx
call fcn.00483cc3
int3
Function at 0x452fa7
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x4a59b9
call fcn.004a06c0
mov dword [ebp - 0x20], edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.00432849
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], ebx
push 8
mov byte [ebp - 4], 2
call fcn.0049d5bc
pop ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
mov dword [eax], esi
mov dword [eax + 4], edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
push ecx
push ebx
push eax
push 0x4530f0
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x28], eax
test eax, eax
je 0x453068
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
call fcn.004530bf
push ebx
mov byte [ebp - 4], 5
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
lea ecx, [ebp - 0x28]
call fcn.0042ca63
cmp dword [ebp - 0x24], ebx
je 0x453039
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
xor eax, eax
jmp 0x453062
call fcn.004a05e0
ret
push 6
pop ecx
mov dword [ebp - 0x24], ebx
call fcn.00483cc3
int3

Function at 0x4570bd
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4a6243
call fcn.004a0640
mov esi, ecx
push 8
call fcn.0049d5bc
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov dword [edx], ebx
mov dword [edx + 4], ebx
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x457470
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x457122
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00457344
mov eax, esi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [edi], ebx
call fcn.00483cc3
int3

Function at 0x457189
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4a629a
call fcn.004a0640
mov esi, ecx
push 8
call fcn.0049d5bc
mov edx, dword [ebp + 8]
xor ebx, ebx
pop ecx
mov dword [ebp - 0x10], eax
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov dword [edx], ebx
mov dword [edx + 4], ebx
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x4574c0
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4571ef
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00457344
mov eax, esi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [edi], ebx
call fcn.00483cc3
int3
Function at 0x46290f
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4a71c0
call fcn.004a0640
mov esi, ecx
push 0x40
call fcn.0049d5bc
pop ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.0046355b
mov dword [ebp - 0x10], ecx
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push ecx
push 0x462aa0
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x46295d
mov eax, esi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [edi], ebx
call fcn.00483cc3
int3

Function at 0x4629d7
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4a71e3
call fcn.004a0640
mov edi, ecx
push 8
call fcn.0049d5bc
mov esi, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x10], eax
mov edx, dword [esi]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
xor ebx, ebx
lea esi, [edi + 4]
push esi
push ebx
push eax
push 0x462b00
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x462a28
mov eax, edi
call fcn.004a05e0
ret 4
push 6
pop ecx
mov dword [esi], ebx
call fcn.00483cc3
int3

Function at 0x463e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov ecx, dword [0x4cdd60]
mov dword [edi + 8], 1
mov dword [edi], 0x40566c
test ecx, ecx
je 0x463ec0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4d06a8]
call esi
movzx eax, word [ebp + 8]
and dword [edi + 0xc], 0
and dword [edi + 0x10], 0
push 8
push eax
push dword [0x4cdffc]
mov dword [edi], 0x405690
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x463f16
push esi
push dword [0x4cdffc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x463f16
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi + 0xc], eax
test eax, eax
je 0x463f16
push esi
push dword [0x4cdffc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [edi + 0x10], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x46cea5
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0xf0000040
push 0x18
push 0x41bc60
mov esi, ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x46cedb
mov edx, 0x1f0
mov ecx, dword [ebp + 4]
push 0x41bb40
call fcn.004239fe
jmp 0x46cefd
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x46cefb
mov edx, 0x1f2
jmp 0x46cecc
xor eax, eax
pop esi
pop ecx
pop ebp
ret

Function at 0x46cff9
Capabilities:
Hash data via wincrypt

Disassembly:
push 0x44
mov eax, 0x4a7c05
call fcn.004a0680
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], eax
call fcn.0046cea5
mov esi, eax
test esi, esi
jns 0x46d044
mov ecx, dword [ebp + 4]
mov edx, 0x21f
push esi
push 0x41bb40
call fcn.004239e1
jmp 0x46d11b
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [esi]
add eax, 0x12
mov dword [ebp - 0x4c], 1
push eax
call fcn.004573e1
cmp dword [edi + 0x14], 8
jb 0x46d079
mov edi, dword [edi]
push dword [esi]
lea ecx, [ebp - 0x28]
push edi
call fcn.00427590
push 0x41c968
lea ecx, [ebp - 0x28]
call fcn.0044adcf
push dword [ebp - 0x50]
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00450968
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004258b7
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
jb 0x46d0b7
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
push 0
add eax, eax
push eax
push ecx
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edi, 0x41bb40
test eax, eax
jne 0x46d0e4
mov ecx, dword [ebp + 4]
mov edx, 0x1fd
push edi
call fcn.004239fe
mov esi, eax
jmp 0x46d0e6
xor esi, esi
test esi, esi
jns 0x46d0f1
mov edx, 0x222
jmp 0x46d105
push ebx
lea ecx, [ebp - 0x48]
call fcn.0046cf01
mov esi, eax
test esi, esi
jns 0x46d111
mov edx, 0x224
mov ecx, dword [ebp + 4]
push esi
push edi
call fcn.004239e1
jmp 0x46d113
xor esi, esi
lea ecx, [ebp - 0x40]
call fcn.004258b7
lea ecx, [ebp - 0x48]
call fcn.0046ce51
mov eax, esi
call fcn.004a0600
ret 8