joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d0d2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4505f0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov ecx, esi
call fcn.0042592a
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
xor ebx, ebx
mov ecx, esi
push ebx
push dword [edi + 0x4c]
call fcn.004259ec
mov byte [esi + 0x48], bl
mov byte [esi + 0x3d], bl
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [esi + 8], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x4c], ebx
mov eax, dword [0x7f2b60]
mov ecx, dword [0x7f2b64]
mov dword [esi + 0x44], ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], ebx
cmp esi, edi
je 0x44d192
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], esi
mov ecx, esi
call fcn.004267d0
mov esi, dword [ebp - 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.0044d1bc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x45199c
Capabilities:
Resume thread

Disassembly:
push dword [ecx + 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x451a74
Capabilities:
Check for debugger via api

Disassembly:
push esi
push eax
mov eax, dword [ecx + 4]
mov esi, esp
mov dword [esi], 0
push esi
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esi], 0
setne al
add esp, 4
pop esi
ret

Function at 0x451b1a
Capabilities:
Check for debugger via api

Disassembly:
push esi
push eax
mov esi, esp
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esi], 0
sete al
add esp, 4
pop esi
ret

Function at 0x451c98
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ecx + 4]
mov dword [esp + 4], 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
test al, al
je 0x451d22
mov edi, bind
mov ebx, 0xfd050f7f
lea eax, [esp + 0x10]
push eax
call fcn.0041a36c
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp eax, ebx
mov edx, ecx
sbb edx, edi
cmovge ecx, edi
cmovge eax, ebx
add eax, 0x2faf080
adc ecx, 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
lea eax, [esp + 8]
push eax
call fcn.0041a2d4
add esp, 4
lea eax, [esp + 4]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
test al, al
je 0x451d22
cmp dword [esp + 4], 0
jne 0x451cc4
mov eax, dword [esi]
mov ecx, esi
push 0xdb60dead
call dword [eax + 0x30]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x455522
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x455e20
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov dword [ecx], vtable.ProcessHandler.0
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx + 0x14]
mov dword [eax + 8], 0
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [ebp - 0x20]
cmp byte [esi + 0x24], 0
je 0x45558d
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x24], ecx
call fcn.004555ae
mov esi, dword [ebp - 0x20]
cmp byte [esi + 0x24], 0
je 0x45558d
mov ecx, dword [ebp - 0x24]
call fcn.00453168
mov dword [esi], vtable.sciter::om::asset_struct_sciter::om::easset_.0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4576ae
Capabilities:
Create shortcut via ishelllink

Disassembly:
push edi
push esi
sub esp, 8
call fcn.004538e4
test eax, eax
je 0x4577a7
xor eax, eax
mov ecx, esp
mov dword [ecx], eax
push ecx
push 0x7306a8
push 1
push eax
push 0x7306c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
js 0x4577ac
mov eax, dword [esp]
test eax, eax
je 0x4577ac
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], 0
test ecx, ecx
je 0x45770d
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x50]
mov eax, dword [esp]
mov edi, dword [esp + 0x20]
test esi, esi
je 0x45771f
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp]
mov esi, dword [esp + 0x24]
test edi, edi
je 0x457731
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
mov eax, dword [esp]
mov edi, dword [esp + 0x28]
test esi, esi
je 0x457743
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x3c]
mov eax, dword [esp]
mov esi, dword [esp + 0x2c]
test edi, edi
je 0x457755
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
mov eax, dword [esp]
test esi, esi
je 0x457767
mov ecx, dword [eax]
push dword [esp + 0x30]
push esi
push eax
call dword [ecx + 0x44]
mov eax, dword [esp]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x7306d8
push eax
call dword [ecx]
mov esi, eax
test eax, eax
js 0x45779c
mov eax, dword [esp + 4]
test eax, eax
je 0x45779c
mov ecx, dword [eax]
push 1
push dword [esp + 0x18]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4577ac
mov esi, 0x80004005
mov eax, esi
add esp, 8
pop esi
pop edi
ret
Function at 0x45939a
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push esi
mov esi, ecx
call fcn.00457dfa
test al, al
je 0x4593aa
mov al, 1
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.00458960

Function at 0x459a10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x459be0
mov edi, dword fs:[0]
mov dword [esi], edi
mov dword fs:[0], esi
mov esi, dword [edx + 0x10]
cmp dword [edx + 0x14], 8
jb 0x459a4e
mov edx, dword [edx]
lea esi, [esi*2 + 2]
cmp dword [eax + 0x14], 8
jb 0x459a5d
mov eax, dword [eax]
mov ecx, dword [ecx]
xor edi, edi
mov dword [ebp - 0x10], edi
push esi
push edx
push 1
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x45da29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x45dce0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor ebx, ebx
test esi, esi
je 0x45db65
cmp word [esi], 0
je 0x45db65
push 4
push 0x79b5fc
push esi
call fcn.00715f5e
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
lea esi, [esi + ecx*8]
push 2
push 0x79b69a
push esi
call fcn.00715f5e
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
lea esi, [esi + ecx*4]
lea edi, [ebp - 0x226]
push 0x20a
push ebx
push edi
call fcn.006fba50
add esp, 0xc
mov dword [ebp - 0x10], ebx
push 0x104
push esi
push 0x105
push edi
call fcn.00715f98
add esp, 0x10
mov dword [ebp - 0x10], 0xffffffff
push 0x2e
lea eax, [ebp - 0x226]
mov edi, eax
push eax
call fcn.006fc08b
add esp, 8
mov ebx, 0x17
test eax, eax
je 0x45db21
mov esi, eax
add esi, 2
mov word [eax], 0
push str.HTML
push esi
call fcn.0070fe56
add esp, 8
test eax, eax
je 0x45db21
push 0x79b582
push esi
call fcn.0070fe56
add esp, 8
test eax, eax
cmovne ebx, esi
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45db63
mov esi, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45db63
mov ebx, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
test eax, eax
je 0x45db63
mov ebx, dword [ebp + 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
test eax, eax
setne bl
jmp 0x45db65
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x463434
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x467dd0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x30]
mov dword [eax], 0
lea edi, [ebp - 0x2c]
mov ecx, ebx
push eax
push dword [ebp + 0xc]
push edi
call fcn.0046721a
mov eax, dword [edi + 4]
test eax, eax
je 0x4634e7
mov cl, byte [ebp + 0x10]
cmp eax, 1
jne 0x4634f5
test cl, cl
je 0x4634c6
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4634c6
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push eax
push ecx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [ebp + 8]
test eax, eax
je 0x4634c6
push 0
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
xorps xmm0, xmm0
movsd qword [esi + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov edx, dword [eax + 0x20]
cmp dword [eax + 0x24], 8
jb 0x463536
mov eax, dword [eax + 0x10]
jmp 0x463539
mov dword [ebp - 0x24], ebx
mov eax, str.Please_launch_original_game_as_you_usually_do_and_then_press_OK._n_nThis_is_required_to_know_where_your_game_is_installed._nNext_launches_will_start_the_game_automatically.
mov byte [ebp - 0x1d], 1
jmp 0x463500
mov byte [ebp - 0x1d], cl
mov dword [ebp - 0x24], ebx
mov eax, str.Please_leave_only_one_game_opened_and_then_press_OK._n_nThis_is_required_to_know_where_your_game_is_installed._nNext_launches_will_start_the_game_automatically.
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0x41
push 0x793b9f
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [ebp + 8]
cmp eax, 1
mov ecx, dword [ebp - 0x24]
jne 0x463532
movzx eax, byte [ebp - 0x1d]
push eax
push dword [ebp + 0xc]
push esi
call fcn.00463434
mov esi, dword [ebp + 8]
jmp 0x463551
xor eax, eax
jmp 0x46354e
add eax, 0x10
mov dword [ebp - 0x10], 0
mov ecx, esi
push edx
push eax
call fcn.00405036
mov al, 1
mov esi, dword [ebp + 8]
mov byte [esi + 0x18], al
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
push dword [eax + 4]
push ecx
call fcn.00467bc6
push 0x28
push dword [ebp - 0x2c]
call fcn.0053e531
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4663ec
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x467ee0
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x4664bc
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x466480
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret
Function at 0x467914
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
push edi
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x467956
mov esi, eax
mov edi, dword [esp + 0x18]
mov dword [edi], 0x22c
push edi
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x46795a
mov ebp, dword [esp + 0x14]
cmp dword [edi + 8], ebp
sete bl
je 0x46795c
push edi
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x467941
jmp 0x46795c
xor ebx, ebx
jmp 0x467963
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x46b752
Capabilities:
Access peb ldr_data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [ecx + 0xc]
push 0
push 0x2c
push dword [eax]
call fcn.0049caca
add esp, 0xc
cmp byte [esi + 8], 0
jne 0x46b789
cmp dword [esi + 0xac], 0
je 0x46b789
mov eax, dword [esi + 0xc]
push 0
push 0x271f
push dword [eax]
call fcn.0049caca
add esp, 0xc
mov eax, dword [esi + 0xc]
push 0x7977e0
push 0x2734
push dword [eax]
call fcn.0049caca
add esp, 0xc
mov eax, dword [esi + 0xc]
push 0
push 0x2717
push dword [eax]
call fcn.0049caca
add esp, 0xc
mov ecx, esi
pop esi
jmp fcn.0046917e
Function at 0x47088a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [esp], ecx
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
cmp ecx, esi
je 0x4708ae
mov eax, dword [ecx + 0x18]
cmp dword [ecx + 0x1c], 0x10
jb 0x4708b5
mov edx, dword [ecx + 8]
jmp 0x4708b8
mov esi, ecx
jmp 0x470a1e
lea edx, [ecx + 8]
mov ecx, dword [esp]
mov ebp, dword [ecx + 0xc]
mov ecx, 0x811c9dc5
test eax, eax
je 0x4708da
xor edi, edi
movzx ebx, byte [edx + edi]
xor ebx, ecx
imul ecx, ebx, 0x1000193
inc edi
cmp eax, edi
jne 0x4708c9
mov eax, dword [esp]
lea edx, [eax + 4]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], edx
and ecx, dword [eax + 0x18]
lea eax, [ecx + ecx]
lea edx, [ecx*8]
add edx, ebp
lea ecx, [ecx + ecx + 1]
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], edx
mov ecx, dword [edx]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
mov edi, dword [ebp + eax*4 + 4]
mov ebp, ebx
mov ebx, ebp
mov ebp, dword [ebp]
push ebx
push dword [esp + 0x1c]
call fcn.0045745a
add esp, 8
mov eax, dword [esp]
dec dword [eax + 8]
cmp ebx, edi
je 0x470958
cmp ebp, esi
jne 0x47094f
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x34]
je 0x470a0f
cmp ebp, esi
jne 0x470921
jmp 0x470a15
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
cmp ecx, dword [esp + 0x34]
jne 0x470970
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [ecx + edx*4], eax
cmp ebp, esi
je 0x470a15
cmp dword [ebp + 0x1c], 0x10
jb 0x47098e
mov eax, dword [ebp + 8]
jmp 0x470991
lea eax, [ebp + 8]
mov edx, dword [ebp + 0x18]
mov ecx, 0x811c9dc5
test edx, edx
je 0x4709b0
xor edi, edi
movzx ebx, byte [eax + edi]
xor ebx, ecx
imul ecx, ebx, 0x1000193
inc edi
cmp edx, edi
jne 0x47099f
mov eax, dword [esp]
and ecx, dword [eax + 0x18]
lea eax, [ecx + ecx]
mov edx, dword [esp + 0xc]
lea edi, [edx + ecx*8]
mov dword [esp + 4], edi
lea ecx, [ecx*2 + 1]
mov dword [esp + 8], ecx
mov edi, dword [edx + eax*4 + 4]
mov ebx, ebp
mov ebp, dword [ebp]
push ebx
push dword [esp + 0x1c]
call fcn.0045745a
add esp, 8
mov eax, dword [esp]
dec dword [eax + 8]
cmp ebx, edi
je 0x4709f5
cmp ebp, esi
jne 0x4709d3
jmp 0x470a0f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [eax + edx*4], ecx
jmp 0x47097b
mov eax, dword [esp + 4]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x470f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x472040
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
xorps xmm0, xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x20], 0xf
xor edx, edx
mov dword [ecx + 0x24], edx
mov dword [ebp - 0x20], ecx
mov dword [ecx + 0x28], edx
mov dword [eax + 8], edx
push 0x40
call fcn.0053e4fc
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x24], eax
xorps xmm1, xmm1
movups xmmword [ecx + 0x30], xmm1
xor edx, edx
mov dword [ecx + 0x40], edx
mov eax, 0xf
mov dword [ecx + 0x44], eax
mov dword [ecx + 0x2c], vtable.cpr::Url.0
xorps xmm0, xmm0
movsd qword [ecx + 0x48], xmm0
mov byte [ecx + 0x50], 1
movups xmmword [ecx + 0x54], xmm1
movups xmmword [ecx + 0x64], xmm1
mov dword [ecx + 0x74], edx
mov dword [ecx + 0x78], eax
movups xmmword [ecx + 0x7c], xmm1
mov dword [ecx + 0x8c], edx
mov dword [ecx + 0x90], eax
movups xmmword [ecx + 0x94], xmm1
mov dword [ecx + 0xa4], edx
mov dword [ecx + 0xa8], eax
mov dword [ecx + 0xbc], edx
movups xmmword [ecx + 0xac], xmm1
mov dword [ecx + 0xc0], eax
mov dword [ecx + 0xd8], edx
movups xmmword [ecx + 0xc8], xmm1
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4748da
Capabilities:
Hash data via bcrypt

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov eax, 0xffffff9a
test esi, esi
je 0x47492b
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x47492b
mov edi, dword [esp + 0x14]
test edi, edi
js 0x47492b
mov eax, 0xffffff93
cmp word [esi + 0x10], 0x16
je 0x47492b
mov edx, dword [esi + 4]
mov eax, 0xffffff9a
test edx, edx
je 0x47492b
push 0
push edi
push ecx
push edx
call sub.bcrypt.dll_BCryptHashData
mov ecx, eax
mov eax, edi
test ecx, ecx
jns 0x47492b
mov dword [esi + 0xc], ecx
mov eax, 0xffffff92
pop esi
pop edi
ret
Function at 0x474a7e
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov dword [esp], 0
mov eax, 0xffffff9a
test esi, esi
je 0x474b2b
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x474b2b
mov edi, dword [esp + 0x28]
mov edx, edi
and edx, 0xf
jne 0x474b2b
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esi + 0xc]
test ebx, ebx
je 0x474aca
test edx, edx
jle 0x474aca
cmp ebp, 2
jne 0x474b2b
cmp ebp, 2
jne 0x474ad5
cmp dword [esi + 0x50], 0
je 0x474b2b
mov eax, dword [esi + 0x50]
test ebx, ebx
je 0x474af0
test eax, eax
je 0x474aee
test byte [eax + 0x38], 2
jne 0x474af0
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edx
jmp 0x474af0
xor eax, eax
mov edx, esp
push 0
push edx
push edi
push ecx
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
push edi
push ecx
push dword [esi + 4]
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, eax
test ebx, ebx
je 0x474b1d
mov eax, dword [esi + 0x50]
test eax, eax
je 0x474b1d
xor edx, edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov eax, edi
test ecx, ecx
jns 0x474b2b
mov dword [esi + 0x10], ecx
mov eax, 0xffffff96
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x475110
Capabilities:
Hash data via bcrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, 0xffffff9a
test esi, esi
je 0x47514a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x47514a
mov edx, dword [esi + 8]
test edx, edx
je 0x47514a
push 0
push dword [esp + 0x14]
push ecx
push edx
call sub.bcrypt.dll_BCryptHashData
mov ecx, eax
xor eax, eax
test ecx, ecx
jns 0x47514a
mov dword [esi + 0x10], ecx
mov eax, 0xffffff92
pop esi
ret
Function at 0x4756f8
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov edi, ecx
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
xor eax, eax
dec eax
mov dword [esi + 8], eax
mov dword [esi + 4], 0x485290
mov ecx, dword fs:[0]
mov dword [esi], ecx
mov dword fs:[0], esi
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
lea eax, [edi + 0x14]
lea ebx, [edi + 0x18]
xor ecx, ecx
push 0x4c4
push ecx
push eax
call fcn.006fba50
add esp, 0xc
mov dword [edi + 0x4d8], ebx
xor ecx, ecx
mov dword [edi + 0x4dc], ecx
mov dword [edi + 0x4e0], 0x10
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x4e4], xmm0
xorps xmm0, xmm0
movups xmmword [edi + 0x50d], xmm0
movups xmmword [edi + 0x504], xmm0
movups xmmword [edi + 0x4f4], xmm0
mov dword [edi + 0x550], ecx
mov ecx, 0
movups xmmword [edi + 0x540], xmm0
movups xmmword [edi + 0x530], xmm0
mov dword [ebp - 0x24], edi
movups xmmword [edi + 0x520], xmm0
lea eax, [ebp - 0x70]
movups xmmword [eax + 0x3c], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [esi + 8], ecx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
push eax
call fcn.0048533c
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0x4d8]
imul ecx, dword [eax + 0x4dc], 0x4c
add ecx, edx
add ecx, 0xffffffb4
mov dword [eax + 0x4f4], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48f89e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x138
mov esi, ecx
lea ebx, [esp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.00490274
mov edi, dword [ebx + 8]
xor ecx, ecx
mov edx, 8
cmp edx, edi
sbb ecx, dword [ebx + 0xc]
jb case.0x48f4d3.8
xor eax, eax
dec eax
mov dword [esp], esi
jmp dword [edi*4 + 0x72e730]