joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7f28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f7f30
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x4f823e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405de0
xor eax, eax
push ebp
push 0x4f7f9f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x4f8258
call fcn.0040629c
mov eax, dword [ebp - 0x14]
mov ecx, 0x4f8288
mov edx, 6
call fcn.004dc0ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f7fdb
cmp dword [ebp - 8], 0
je 0x4f8050
mov edx, dword [ebp - 8]
mov eax, dword [0x4d7a08]
call fcn.004d8794
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4f8050
xor eax, eax
push ebp
push 0x4f8049
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4f8330
mov eax, dword [ebp - 0x10]
call fcn.004d82e8
test eax, eax
jl 0x4f8033
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4f8330
mov eax, dword [ebp - 0x10]
call fcn.004d8718
call fcn.004048ac
jmp 0x4f8216
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8050
mov eax, dword [ebp - 0x10]
call fcn.00403ddc
ret
xor eax, eax
push ebp
push 0x4f808e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x4f834c
call fcn.0040629c
mov eax, dword [ebp - 0x1c]
mov ecx, 0x4f8288
mov edx, 6
call fcn.004dc0ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f80ca
cmp dword [ebp - 8], 0
je 0x4f813f
mov edx, dword [ebp - 8]
mov eax, dword [0x4d7a08]
call fcn.004d8794
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4f813f
xor eax, eax
push ebp
push 0x4f8138
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4f8404
mov eax, dword [ebp - 0x10]
call fcn.004d82e8
test eax, eax
jl 0x4f8122
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4f8404
mov eax, dword [ebp - 0x10]
call fcn.004d8718
call fcn.004048ac
jmp 0x4f8216
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f813f
mov eax, dword [ebp - 0x10]
call fcn.00403ddc
ret
cmp dword [ebp - 4], 0
jne 0x4f8216
xor eax, eax
push ebp
push 0x4f8179
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x4f8288
mov edx, 6
mov eax, 0x4f8428
call fcn.004dc0ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f81b5
cmp dword [ebp - 8], 0
je 0x4f8216
mov edx, dword [ebp - 8]
mov eax, dword [0x4d7a08]
call fcn.004d8794
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4f8216
xor eax, eax
push ebp
push 0x4f820f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4f8528
mov eax, dword [ebp - 0x10]
call fcn.004d8718
call fcn.004048ac
jmp 0x4f8216
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8245
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00405dd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret
Function at 0x4faa38
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4fab53
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x4fab38
mov eax, esi
and eax, 1
dec eax
jne 0x4faabd
call sub.kernel32.dll_GetSystemDefaultLangID
mov edi, eax
call sub.kernel32.dll_GetUserDefaultLangID
mov word [ebp - 2], ax
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp di, 0x419
je 0x4faabb
cmp word [ebp - 2], 0x419
je 0x4faabb
cmp ax, 0x419
je 0x4faabb
cmp di, 0x423
je 0x4faabb
cmp word [ebp - 2], 0x423
je 0x4faabb
cmp ax, 0x423
je 0x4faabb
cmp di, 0x422
je 0x4faabb
cmp word [ebp - 2], 0x422
je 0x4faabb
cmp ax, 0x422
jne 0x4faabd
mov bl, 1
test bl, bl
jne 0x4fab38
and esi, 2
cmp esi, 2
jne 0x4fab38
lea ecx, [ebp - 8]
mov dl, 1
xor eax, eax
call fcn.004f8b54
mov edx, dword [ebp - 8]
mov eax, 0x53ffa8
call fcn.00405de0
lea edx, [ebp - 0xc]
mov eax, dword [0x53ffa8]
call fcn.0040bbd4
mov eax, dword [ebp - 0xc]
mov edx, 0x4fab70
call fcn.0040656c
je 0x4fab36
lea edx, [ebp - 0x10]
mov eax, dword [0x53ffa8]
call fcn.0040bbd4
mov eax, dword [ebp - 0x10]
mov edx, 0x4fab84
call fcn.0040656c
je 0x4fab36
lea edx, [ebp - 0x14]
mov eax, dword [0x53ffa8]
call fcn.0040bbd4
mov eax, dword [ebp - 0x14]
mov edx, 0x4fab98
call fcn.0040656c
jne 0x4fab38
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fab5a
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405dd8
ret

Function at 0x4facf4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405e6c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4fad0d
test al, 0x10
jne 0x4fad11
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4fb47c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x417d1c]
call fcn.00406ac4
xor eax, eax
push ebp
push 0x4fb63d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x54000c], 0
jne 0x4fb4d0
mov ecx, dword [0x54061c]
mov dl, 1
mov eax, dword [0x40a538]
call fcn.00413c1c
call fcn.004047b8
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.0040369c
mov eax, ebx
call fcn.00405bc8
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x4fb64c
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.004080bc
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x4fb517
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4fb5e3
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4fb5cf
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.00405fc8
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406030
mov eax, dword [ebp - 4]
test eax, eax
je 0x4fb572
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4fb572
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040524c
mov ebx, eax
test ebx, ebx
je 0x4fb57d
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4fb59a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4fb59a
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.0040524c
mov edi, eax
test edi, edi
je 0x4fb5a5
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.00405e6c
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
sete al
jmp 0x4fb5d1
xor eax, eax
test al, al
je 0x4fb5dc
mov ebx, 0x15
jmp 0x4fb5e8
mov ebx, 0x10
jmp 0x4fb5e8
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x54000c]
call fcn.004fb2e8
mov eax, dword [ebp - 0xc]
call fcn.004fb2e8
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.004080d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb644
lea eax, [ebp - 0x14]
mov edx, dword [0x417d1c]
call fcn.00406b9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret
Function at 0x50ced0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x50cf2a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0050cec4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004f76c8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004f722c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cf31
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x5235f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x523652
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1f4
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 4]
mov edx, 0x523668
call fcn.00405e34
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
push 0x5236b0
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x32
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523659
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x524688
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x524799
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405fc8
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 4]
mov ecx, 0x5247b4
call fcn.0040629c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 4]
mov ecx, 0x524810
call fcn.0040629c
mov eax, dword [ebp - 4]
call fcn.0040cf58
test al, al
je 0x52476e
mov dl, 1
mov eax, dword [0x43c8f4]
call fcn.0043c9b8
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043d1e4
push 0x524834
lea eax, [ebp - 8]
push eax
mov ecx, 0x524844
mov edx, 0x524860
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040cae8
mov esi, eax
mov eax, ebx
call fcn.00403ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5247a0
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00405dd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret

Function at 0x524880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5249af
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x524984
lea eax, [ebx + 0x864]
push eax
call fcn.005245d8
dec eax
jne 0x524984
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405fc8
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 4]
mov ecx, 0x5249cc
call fcn.0040629c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 4]
mov ecx, 0x524a28
call fcn.0040629c
mov eax, dword [ebp - 4]
call fcn.0040cf58
test al, al
je 0x524984
mov dl, 1
mov eax, dword [0x43c8f4]
call fcn.0043c9b8
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043d1e4
push 0x524a4c
lea eax, [ebp - 8]
push eax
mov ecx, 0x524a5c
mov edx, 0x524a80
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040cae8
mov esi, eax
mov eax, ebx
call fcn.00403ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5249b6
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00405dd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret
Function at 0x401c59
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4070a8], 0
jne 0x401cd4
and dword [ebp - 4], 0
jmp 0x401c75
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x401cca
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 8
jmp 0x401c94
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x401cbb
mov eax, dword [ebp - 8]
and eax, 1
je 0x401cb1
mov eax, dword [ebp - 8]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 8], eax
jmp 0x401cb9
mov eax, dword [ebp - 8]
shr eax, 1
mov dword [ebp - 8], eax
jmp 0x401c8d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax*4 + 0x406ca8], ecx
jmp 0x401c6e
mov dword [0x4070a8], 1
or dword [ebp - 0xc], 0xffffffff
and dword [ebp - 4], 0
jmp 0x401ce5
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x401d11
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx ecx, byte [ecx]
xor ecx, dword [ebp - 0xc]
and ecx, 0xff
xor eax, dword [ecx*4 + 0x406ca8]
mov dword [ebp - 0xc], eax
jmp 0x401cde
mov eax, dword [ebp - 0xc]
not eax
leave
ret

Function at 0x4022b8
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x40232d
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x2c]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x30]
call fcn.00403f60
pop ecx
pop ecx
mov dword [ebp - 8], eax
push dword [ebp - 8]
call fcn.00403f2d
pop ecx
shl eax, 1
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.00401c59
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x402323
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
jmp 0x40232f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x4022d4
xor eax, eax
leave
ret
Function at 0x402560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
jne 0x402573
xor eax, eax
jmp 0x402638
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax]
mov dword [ebp - 8], ecx
and dword [ebp - 4], 0
jmp 0x4025a7
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x402636
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax]
mov dword [ebp - 0x10], ecx
push dword [ebp - 0x10]
call fcn.00403efb
pop ecx
push eax
push dword [ebp - 0x10]
call fcn.00401c59
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc], 0
je 0x402631
cmp dword [ebp - 0x10], 0
je 0x402631
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jne 0x402631
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax]
mov eax, ecx
jmp 0x402638
jmp 0x4025a0
xor eax, eax
leave
ret
Function at 0x5ddcc8
Capabilities:
Encode data using xor

Disassembly:
add al, 0xd
sal al, 0x23
mov word [edx - 0x57], fs
test al, 0xc4
aaa
lahf
stosd dword es:[edi], eax
mov cl, 0xcc
js 0x50595b
dec esi
add eax, 0xdf6c638f
fst dword es:[ebp - 0x3e4e5ac0]
insb byte es:[edi], dx
fbld tbyte [esi]
fst dword [ebp - 0x3e4e5ac0]
mov ebp, ss
and cl, bl
invalid
lea esp, [esp + 0x24]
je fcn.0052b782
pushal
call int.005d8bae
jne 0x505945
cdq
dec eax
iretd
jmp 0x5e1e4e
pushfd
mov byte [esp], bh
mov byte [esp], dl
lea esp, [esp + 4]
jae fcn.0052b782
stc
add ecx, 1
jmp 0x5e1c7b
cmc
clc
cmp al, cl
cmp ecx, dword [ebp - 4]
jl 0x5d8f43
jae fcn.0052b782
stc
cmp sp, ax
push ebx
add ecx, 1
pushfd
lea esp, [esp + 8]
ja 0x5d840e
mov dword [ebp - 8], ecx
push esi
push dword [esp]
lea esp, [esp + 8]
jmp 0x507809
cmp bp, cx
test edi, edi
jmp 0x5059ab
pop eax
setns ah
lea edi, [edi + 1]
movzx eax, cl
bswap ax
pop eax
pushfd
mov eax, dword [esp + 8]
mov word [esp + 4], 0x6f2f
lea esp, [esp + 0xc]
ja 0x5da0e5
push 0xdf2bbbba
mov byte [esp], 0x25
lea esp, [esp + 4]
jb 0x5077d0
cmp bl, 0x50
stc
cmp byte [edi - 1], 0
push 0xd87182a3
lea esp, [esp + 4]
jne 0x52b93c
bts edi, 0x16
btr di, 0xc
mov edi, dword [edx + 0x24]
clc
add edi, eax
cmp ah, 0x7e
movzx ecx, word [edi + ecx*2]
adc di, ax
and di, 0xbc91
pushal
push dword [esp]
mov edi, dword [edx + 0x1c]
mov dword [esp], 0x1ce3317d
add edi, eax
clc
mov edi, dword [edi + ecx*4]
jmp 0x5dc7c3
pushal
mov dword [ebp - 8], ecx
mov word [esp + 4], 0x3129
pushfd
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp 0x507809
mov dword [ebp - 8], ecx
push 0x1aa7c4ab
lea esp, [esp + 4]
jmp 0x507809
Function at 0x4051f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x429008]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0x124
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0
push 0
push eax
call fcn.00408e60
add esp, 0xc
mov dword [esp + 0x10], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405259
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.00407876
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40529b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
push str.360chromex.exe
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
je 0x405293
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x405275
jmp 0x40529b
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407876
mov esp, ebp
pop ebp
ret
Function at 0x4052c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ae95
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x429008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.004071e0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0x45
push str.709afabe13a883c8f226fcfc82a39616_nce19dcda5d2d890c1b2c3544520b74fd
cmp eax, 0x45
jb 0x40533a
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0x45]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.0040a2f0
add esp, 0xc
mov byte [esi + 0x45], 0
jmp 0x40534b
mov byte [ebp - 0x48], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x48]
push 0x45
call fcn.00407430
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00404c20
add esp, 4
lea eax, [ebp - 0x44]
push eax
push 0xf003f
push 0
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40538e
push str.erro_1_n
call fcn.004051c0
add esp, 4
jmp 0x4053aa
push str.homepage
push str.Default
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueA]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4053de
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4053d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40547d
push edx
push ecx
call fcn.00407d02
add esp, 8
mov edx, dword [ebp - 0x14]
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
cmp edx, 0x10
jb 0x405420
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405416
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40547d
push edx
push ecx
call fcn.00407d02
add esp, 8
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x405462
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405458
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40547d
push edx
push ecx
call fcn.00407d02
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407876
mov esp, ebp
pop ebp
ret
call fcn.0040abee
int3
Function at 0x40ebc0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41dae8
push 0x41dae0
push str.FlsAlloc
push 0x1e
call fcn.0040ea81
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ebf4
push dword [ebp + 8]
mov ecx, esi
call dword [0x41c15c]
call esi
jmp 0x40ebfa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ec3e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41daf8
push 0x41daf0
push str.FlsGetValue
push 0x20
call fcn.0040ea81
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ec75
push dword [ebp + 8]
mov ecx, esi
call dword [0x41c15c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x411a42
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x411adf
push ebx
push esi
call fcn.00411a0b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00411954
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x411a8c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x411ade
push edi
push eax
call fcn.0040f373
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x411aac
call fcn.0040e914
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x411add
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00411954
add esp, 0x20
test eax, eax
jne 0x411acb
push edi
call fcn.0040e914
jmp 0x411ad3
push ebx
call fcn.0040e914
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret