joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452cc0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5c6c48
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61a654]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x578], 0
je 0x452efa
mov edi, 0x10
cmp dword [esi + 0x5b0], edi
jb 0x452d0b
mov eax, dword [esi + 0x59c]
jmp 0x452d11
lea eax, [esi + 0x59c]
push 0x5dc120
push eax
call fcn.005a1d92
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x452efa
push ebx
push 1
lea eax, [esp + 0x20]
push 4
push eax
mov dword [esp + 0x28], 0x42beef78
call fcn.005a3998
push ebx
push 1
lea ecx, [esp + 0x34]
push 4
push ecx
mov dword [esp + 0x3c], 2
call fcn.005a3998
push ebx
push 1
lea edx, [esi + 8]
push 4
push edx
call fcn.005a3998
movzx eax, word [esi + 0x3e0]
push ebx
push 1
lea ecx, [esp + 0x58]
push 2
push ecx
mov dword [esp + 0x60], eax
call fcn.005a3998
mov eax, dword [esi + 0x3e0]
add esp, 0x40
cmp dword [esi + 0x3e4], edi
jb 0x452d98
mov ecx, dword [esi + 0x3d0]
jmp 0x452d9e
lea ecx, [esi + 0x3d0]
push ebx
push eax
push 1
push ecx
call fcn.005a3998
add esp, 0x10
lea ecx, [esp + 0x30]
call fcn.00477280
mov eax, dword [esi + 0x63c]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x64], 0
call fcn.004792c0
mov eax, dword [esi + 0x638]
mov ebp, dword [eax]
mov edi, dword [esi + 0x624]
lea ebx, [ebx]
mov edx, dword [esi + 0x638]
mov eax, dword [esi + 0x624]
mov dword [esp + 0x2c], edx
test edi, edi
je 0x452df8
cmp edi, eax
je 0x452dfd
call fcn.0059ec50
cmp ebp, dword [esp + 0x2c]
je 0x452e70
test edi, edi
jne 0x452e64
call fcn.0059ec50
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x452e18
call fcn.0059ec50
lea eax, [ebp + 8]
push eax
lea ecx, [esp + 0x34]
call fcn.00479300
test edi, edi
jne 0x452e68
call fcn.0059ec50
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x452e3a
call fcn.0059ec50
mov ecx, dword [ebp + 0x24]
push ecx
lea ecx, [esp + 0x34]
call fcn.004792c0
test edi, edi
jne 0x452e6c
call fcn.0059ec50
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x452e5c
call fcn.0059ec50
mov ebp, dword [ebp]
jmp 0x452de0
mov eax, dword [edi]
jmp 0x452e0e
mov eax, dword [edi]
jmp 0x452e30
mov eax, dword [edi]
jmp 0x452e52
lea ecx, [esp + 0x30]
call fcn.00468d50
push ebx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
mov dword [esp + 0x24], eax
call fcn.005a3998
mov eax, dword [esp + 0x24]
add esp, 0x10
push ebx
push 1
push eax
lea ecx, [esp + 0x3c]
call fcn.004699d0
push eax
call fcn.005a3998
mov ecx, dword [esi + 0x4e4]
push ebx
push 1
lea edx, [esp + 0x3c]
push 4
push edx
mov dword [esp + 0x44], ecx
call fcn.005a3998
add esp, 0x20
add esi, 0x5b4
push ebx
mov ecx, esi
call fcn.00468d50
push eax
push 1
mov ecx, esi
call fcn.004699d0
push eax
call fcn.005a3998
push ebx
call fcn.005a1e20
add esp, 0x14
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], 0xffffffff
call fcn.0046bcc0
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x456e70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5c6df8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x61a654]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040be60
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x456ed0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00452700
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040be60
cmp dword [esp + 0x28], 8
jb 0x456f1d
mov eax, dword [esp + 0x14]
push eax
call fcn.0059e6bb
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x465310
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x360], 0
je 0x465333
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [esi + 0x360]
je 0x465333
mov byte [esi + 0x569], 1
pop esi
ret
cmp byte [esi + 0x365], 0
jne 0x465331
mov al, 1
mov byte [esi + 0x366], al
mov byte [esi + 0x365], al
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
mov ecx, esi
call edx
cmp byte [esi + 0x579], 0
je 0x46538c
mov eax, dword [esi]
fld qword [esi + 0xe0]
mov edx, dword [eax + 0xf4]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call edx
fld qword [esi + 0xe8]
mov eax, dword [esi]
mov edx, dword [eax + 0xf8]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call edx
cmp byte [esi + 0x56a], 0
je 0x4653ae
push edi
mov edi, dword [sym.imp.kernel32.dll_Sleep]
lea esp, [esp]
push 0xa
call edi
cmp byte [esi + 0x56a], 0
jne 0x4653a0
pop edi
mov ecx, dword [esi + 0x3a8]
test ecx, ecx
je 0x4653bf
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
cmp byte [esi + 0x368], 0
jne 0x4653e3
mov eax, dword [esi + 0x3a0]
test eax, eax
je 0x4653e3
cmp dword [eax + 0x58], 0
je 0x4653e3
mov eax, dword [eax + 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x4c]
push eax
call edx
mov eax, dword [esi + 0x374]
test eax, eax
je 0x4653f6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00463c30
cmp byte [esi + 0x3ac], 0
je 0x46540f
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
mov ecx, esi
call edx
pop esi
jmp fcn.004caef0
Function at 0x467df0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x61a654]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x620ae8], 0
jne 0x467e6d
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push 0x5dbebc
push eax
call fcn.005a1299
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x620ae8], eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x620aec], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0059e619
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x620aec]
mov eax, dword [edx]
xor ecx, esp
call fcn.0059e619
add esp, 0x104
ret

Function at 0x468530
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
push 0x1c
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
jne 0x468551
xor al, al
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x468573
pop esi
xor al, al
pop edi
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
push ebx
push ebp
movzx ebp, word [eax + 6]
sub edi, esi
xor ebx, ebx
lea ecx, [ecx + eax + 0x18]
test ebp, ebp
jbe 0x4685b2
lea eax, [ecx + 0x10]
mov ecx, dword [eax]
mov edx, dword [eax - 8]
mov esi, dword [eax - 4]
cmp ecx, edx
ja 0x4685a0
mov ecx, edx
cmp edi, esi
jb 0x4685aa
add ecx, esi
cmp edi, ecx
jbe 0x4685bc
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x468592
pop ebp
pop ebx
pop esi
xor al, al
pop edi
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebx
pop ebp
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov al, 1
pop edi
add esp, 0x1c
ret
Function at 0x4685e0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
sub esp, 0x24
push ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
push 2
mov ebp, eax
call esi
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x468618
pop esi
xor edx, edx
pop ebp
add esp, 0x24
ret
push ebx
push edi
mov edi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0
push 0x64
push edx
push eax
call fcn.005a4660
add dword [esp + 0x14], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], ecx
adc dword [esp + 0x18], edx
mov ebx, dword [esp + 0x10]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea edx, [esp + 0x24]
push edx
call edi
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x18]
jl 0x468655
jg 0x468672
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x14]
jb 0x468655
lea edx, [esp + 0x1c]
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x10]
rdtsc
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
push ebp
call esi
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push 0x64
push eax
push ecx
call fcn.005a4620
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x24
ret

Function at 0x468800
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x46880d
mov eax, 0x1105
mov dword [ecx], eax
mov dword [ecx + 0x9c0], 1
push ebx
lea ebx, [ebx]
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4 - 4]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, eax
mov dword [ecx + eax*4], ebx
inc dword [ecx + 0x9c0]
cmp dword [ecx + 0x9c0], 0x270
jl 0x468820
pop ebx
ret 4
Function at 0x468860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
jl 0x46891c
xor eax, eax
push esi
mov edx, dword [ecx + eax*4 + 4]
xor edx, dword [ecx + eax*4]
inc eax
and edx, 0x7fffffff
xor edx, dword [ecx + eax*4 - 4]
mov esi, edx
shr edx, 1
and esi, 1
xor edx, dword [esi*4 + 0x617d1c]
xor edx, dword [ecx + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [ecx + eax*4 - 4], edx
jl 0x468873
cmp eax, 0x26f
jge 0x4688e2
lea esp, [esp]
mov edx, dword [ecx + eax*4 + 4]
xor edx, dword [ecx + eax*4]
inc eax
and edx, 0x7fffffff
xor edx, dword [ecx + eax*4 - 4]
mov esi, edx
shr edx, 1
and esi, 1
xor edx, dword [esi*4 + 0x617d1c]
xor edx, dword [ecx + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [ecx + eax*4 - 4], edx
jl 0x4688b0
mov eax, dword [ecx + 0x9bc]
xor eax, dword [ecx]
pop esi
and eax, 0x7fffffff
xor eax, dword [ecx + 0x9bc]
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x617d1c]
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov dword [ecx + 0x9c0], 0
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, 0x7fffffff
ret

Function at 0x4689c7
Capabilities:
Get socket status

Disassembly:
sub esp, 0x314
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xf6], bl
jne 0x468ab0
jmp 0x4689e0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x114], ebx
cmp byte [esp + 0x320], bl
je 0x468a06
mov eax, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, 1
mov dword [esp + 0x10], eax
jmp 0x468a0b
mov eax, 1
cmp byte [esp + 0x324], bl
je 0x468a25
mov ecx, dword [esi + 8]
mov dword [esp + 0x118], ecx
mov dword [esp + 0x114], eax
mov edx, dword [esi + 8]
mov dword [esp + 0x218], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x21c]
push ecx
mov dword [esp + 0x224], edx
lea edx, [esp + 0x11c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x40
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x186a0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x468abd
mov edx, dword [esi + 8]
lea ecx, [esp + 0x218]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x468abd
mov ecx, dword [esi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x468ab0
mov eax, dword [esi + 8]
lea edx, [esp + 0x114]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x468ab0
cmp byte [esi + 0xf6], bl
je 0x4689e0
pop esi
mov al, 1
pop ebx
add esp, 0x314
ret 8
push 6
mov ecx, esi
call fcn.004689a0
pop esi
xor al, al
pop ebx
add esp, 0x314
ret 8
Function at 0x468bf0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x61a654]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp byte [0x617d25], 0
push esi
je 0x468c79
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.005a06a0
mov esi, dword [sym.imp.kernel32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x468c66
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x468c66
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0059e619
add esp, 0xa0
ret
cmp dword [esp + 8], 6
mov byte [0x617d25], 0
setae byte [0x6216d9]
mov ecx, dword [esp + 0xa0]
mov al, byte [0x6216d9]
pop esi
xor ecx, esp
call fcn.0059e619
add esp, 0xa0
ret
Function at 0x4753f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x14
push ebx
lea eax, [esp + 0x10]
push esi
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor esi, esi
cmp dword [0x620b50], esi
jle 0x475465
push edi
xor edi, edi
jmp 0x475420
mov ecx, dword [0x621554]
sub ecx, dword [0x621550]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp esi, ecx
jb 0x475446
call fcn.0059ec50
mov edx, dword [0x621550]
lea eax, [edi + edx]
push eax
call fcn.00475250
inc esi
add esp, 4
add edi, 0x18
cmp esi, dword [0x620b50]
jl 0x475420
pop edi
lea ecx, [esp + 0xc]
mov dword [0x620b50], 0
mov dword [esp + 8], ecx
mov ebx, dword [esp + 8]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov edx, dword [esp + 0xc]
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
sbb eax, dword [esp + 0x18]
add dword [0x6206e0], edx
pop esi
pop ebx
adc dword [0x6206e4], eax
add esp, 0x14
ret

Function at 0x4755b0
Capabilities:
Access peb ldr_data
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x5c9568
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x61a654]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x61a654]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x54]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.00472470
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x5c], 0
call fcn.00470d20
add esp, 0x14
cmp dword [esp + 0x1c], 8
jb 0x47561c
mov ecx, dword [esp + 8]
push ecx
call fcn.0059e6bb
add esp, 4
cmp dword [esp + 0x38], 0x10
mov eax, dword [esp + 0x24]
jae 0x47562b
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [esp + 0x38], 0x10
jb 0x475646
mov edx, dword [esp + 0x24]
push edx
call fcn.0059e6bb
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0059e619
add esp, 0x48
ret

Function at 0x478860
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1c
cmp byte [0x620aff], 0
je 0x4788aa
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x10]
push esi
mov dword [esp + 0xc], eax
mov byte [esp + 0x1c], 0
mov dword [esp + 8], ecx
mov ebx, dword [esp + 8]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea esi, [esp + 0xc]
call fcn.00478790
sub dword [0x620b3c], 1
pop esi
pop ebx
jne 0x4788aa
add esp, 0x1c
jmp fcn.004753f0
add esp, 0x1c
ret

Function at 0x4790d0
Capabilities:
Create thread

Disassembly:
mov dl, 1
mov byte [ecx + 0xf4], dl
mov eax, dword [0x620598]
test eax, eax
je 0x4790ea
cmp byte [eax + 0x579], 0
jne 0x479100
push ecx
push 0
push 0x4790c0
mov byte [ecx + 0xf5], dl
call fcn.005a273c
add esp, 0xc
ret
Function at 0x4a0d90
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4a0e71
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.Version
push eax
mov dword [esp + 0x20], 2
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0xb0]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.MinVidMemory
push ecx
mov dword [esp + 0x24], edx
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0xb4]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.RecVidMemory
push ecx
mov dword [esp + 0x28], edx
call edi
mov eax, dword [esi + 0x1c]
push 0x10
lea edx, [esi + 0x20]
push edx
push 3
push 0
push str.DisplayGUID
push eax
call edi
mov eax, dword [esi + 0x8c]
inc eax
cmp dword [esi + 0x90], 0x10
jb 0x4a0e2d
mov ecx, dword [esi + 0x7c]
jmp 0x4a0e30
lea ecx, [esi + 0x7c]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
push 1
push 0
push str.FailureReason
push ecx
call edi
mov eax, dword [esi + 0xa8]
inc eax
cmp dword [esi + 0xac], 0x10
jb 0x4a0e59
mov ecx, dword [esi + 0x98]
jmp 0x4a0e5f
lea ecx, [esi + 0x98]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push 1
push 0
push 0x5dfca4
push edx
call edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x4a2900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5caade
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61a654]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00484d10
mov dword [esi], 0x5dfd68
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
lea ecx, [esi + 0x80]
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
call fcn.005943b0
lea ecx, [esi + 0xa4]
call fcn.004a22d0
fldz
mov eax, dword [esp + 0x28]
fst dword [esi + 8]
fst dword [esi + 0xc]
mov dword [esp + 0x20], ebx
fld1
mov dword [esi + 0x40], ebx
fst dword [esi + 0x10]
mov dword [esi + 4], eax
fstp dword [esi + 0x14]
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
mov byte [esi + 0x4a], 1
fst dword [esi + 0x18]
mov byte [esi + 0x4b], bl
fstp dword [esi + 0x1c]
cmp eax, ebx
jne 0x4a29b9
mov dword [esi + 4], 0x621f2c
mov byte [esi + 0x4c], bl
jmp 0x4a29c5
push eax
call fcn.004988a0
add esp, 4
mov byte [esi + 0x4c], al
mov ecx, dword [esi + 4]
xor edx, edx
xor edi, edi
call fcn.00490b40
mov ebp, eax
call fcn.00490b50
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], eax
xor eax, eax
mov dword [esi + 0x70], eax
xor ecx, ecx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], edx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x7c], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4a65f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1028
call fcn.005a0860
mov eax, dword [0x61a654]
xor eax, esp
mov dword [esp + 0x1024], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
xor ebx, ebx
mov byte [esi + 0xba], 1
cmp eax, ebx
jne 0x4a6635
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.0059e619
add esp, 0x1028
ret
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.Version
mov ebp, 4
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x4a67b8
cmp dword [esp + 0x20], 2
jne 0x4a67b8
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.MinVidMemory
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x4a67b8
mov eax, dword [esp + 0x18]
cmp eax, dword [esi + 0xb0]
jne 0x4a67b8
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push str.RecVidMemory
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x4a67b8
mov edx, dword [esp + 0x1c]
cmp edx, dword [esi + 0xb4]
jne 0x4a67b8
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.DisplayGUID
push eax
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], 3
call edi
test eax, eax
jne 0x4a67b8
mov ecx, 0x10
cmp dword [esp + 0x10], ecx
jne 0x4a67b8
lea eax, [esi + 0x20]
lea edx, [esp + 0x24]
sub edx, eax
mov ebx, dword [edx + eax]
cmp ebx, dword [eax]
jne 0x4a67b8
sub ecx, ebp
add eax, ebp
cmp ecx, ebp
jae 0x4a6742
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.FailureReason
mov ebx, 1
mov ebp, 0x1000
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
jne 0x4a67b8
lea edx, [esp + 0x34]
push edx
lea ecx, [esi + 0x78]
call fcn.0040ad00
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x1c]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x5dfca4
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
je 0x4a67bc
xor al, al
jmp 0x4a67dd
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esi + 0x94]
call fcn.0040ad00
cmp dword [esi + 0x8c], 0
mov byte [esi + 0xba], 0
sete al
mov ecx, dword [esp + 0x1034]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.0059e619
add esp, 0x1028
ret
Function at 0x4ab830
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x620598]
cmp byte [eax + 0x579], 0
push esi
mov esi, ecx
jne 0x4ab8b8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
mov ecx, esi
mov byte [esi + 0xb9], 0
call fcn.004aa1e0
test al, al
je 0x4ab866
mov ecx, esi
call fcn.004ab7f0
jmp 0x4ab8a1
cmp byte [esi + 0xb8], 0
je 0x4ab8a1
cmp byte [esi + 0xb9], 0
jne 0x4ab8aa
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0
push 0
push str.FailureReason
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
setne cl
mov byte [esi + 0xba], cl
mov byte [esi + 0xb9], 1
cmp byte [esi + 0xb9], 0
je 0x4ab8b1
mov ecx, esi
call fcn.004a0d90
mov ecx, esi
call fcn.004860c0
mov ecx, dword [0x620598]
lea edx, [esi + 0x78]
push edx
call fcn.00457810
mov ecx, dword [0x620598]
lea eax, [esi + 0x94]
push eax
call fcn.00457810
mov ecx, dword [0x620598]
add esi, 0xba
push esi
call fcn.00450bb0
pop esi
ret 8
Function at 0x4ad970
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5cb5bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x61a654]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x5e06ac
mov eax, dword [esi + 0xc0]
push eax
mov dword [esp + 0x18], 3
call fcn.005a2f45
mov eax, dword [esi + 0xc4]
push eax
call fcn.005a2f45
mov eax, dword [esi + 0xc8]
push eax
call fcn.005a2f45
add esp, 0xc
mov ecx, esi
call fcn.004acd90
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4ad9e3
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4ad9f2
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
cmp dword [esi + 0xd4c], 0x10
jb 0x4ada0a
mov eax, dword [esi + 0xd38]
push eax
call fcn.0059e6bb
add esp, 4
mov dword [esi + 0xd4c], 0xf
mov dword [esi + 0xd48], 0
lea ecx, [esi + 0xcdc]
mov byte [esi + 0xd38], 0
mov byte [esp + 0x14], 1
call fcn.0045bf50
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 0
call fcn.00468b00
mov ecx, esi
call fcn.00490b30
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret