joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466050
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd799
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x53d058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.004697d0
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x464]
mov eax, dword [ebp + 8]
mov dword [ebx], vtable.upgrade_view.0
mov dword [ebx + 0x14], vtable.upgrade_view.1.0
mov dword [ebx + 0x460], eax
call fcn.00409e00
mov byte [ebp - 4], 1
lea edi, [ebx + 0x498]
mov dword [ebp + 8], edi
lea esi, [edi + 0xc]
mov eax, dword [0x545524]
mov dword [edi], vtable.sciter::behavior_factory.0
mov dword [edi + 8], str.drag_window
mov dword [edi + 4], eax
mov dword [ebp + 8], esi
mov dword [0x545524], edi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0xc
lfence
call fcn.00498569
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi], eax
mov dword [edi], vtable.sciter::drag_window_factory.0
lea esi, [ebx + 0x4ac]
xor eax, eax
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 5
call fcn.0040b2c0
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 6
mov dword [ebx + 0x500], eax
xor eax, eax
mov dword [ebx + 0x504], 0
mov word [ebx + 0x504], ax
mov eax, edi
mov dword [ebx + 0x514], 0
mov dword [ebx + 0x518], 7
lea ecx, [eax + 2]
mov dword [ebp + 8], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x466180
sub eax, dword [ebp + 8]
lea ecx, [ebx + 0x504]
sar eax, 1
push eax
push edi
call fcn.004034d0
mov dword [ebx + 0x520], 0
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebx + 0x24], reloc.OLEAUT32.dll_VariantClear
mov dword [ebx + 0x28], 0xc0000
mov dword [ebp + 8], esp
call fcn.00407730
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
call fcn.00407580
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 8
call fcn.00407f90
add esp, 0x30
mov ecx, esi
push eax
call fcn.0040a9e0
lea ecx, [ebp - 0x30]
call fcn.004064a0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x466208
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x4c]
call fcn.004033a0
lea ecx, [ebp - 0x64]
call fcn.004033a0
mov eax, dword [ebx + 0x4dc]
lea ecx, [ebx + 0x478]
mov dword [0x5457f0], eax
mov dword [0x5457e8], eax
lea eax, [ebx + 0x4e0]
push eax
call fcn.0040b200
mov dword [ebx + 0x51c], 0
mov eax, ebx
mov byte [ebx + 0x524], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4697d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdc78
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53d058]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.bdHtmlEventHandler.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 0xc
lfence
call fcn.00498569
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 4], eax
mov dword [ebp - 4], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
push 0xc
lfence
call fcn.00498569
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], 1
lea eax, [ebx + 0x254]
mov dword [ebx + 0x14], vtable.IPluginDlg.0
push str.bdHtmlDlg_sc
push 0x100
push eax
mov dword [ebx], vtable.bdHtmlDlg.1.0
mov dword [ebx + 0x14], vtable.bdHtmlDlg.0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0x400b
mov dword [ebx + 0x24], 0x96ce0000
mov dword [ebx + 0x28], 1
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x24c], 0
mov dword [ebx + 0x250], 0
mov byte [ebx + 0x454], 0
mov word [ebx + 0x45c], 1
call fcn.004d0eb1
add esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea esi, [ebx + 0x34]
mov dword [ebx + 0x23c], eax
test esi, esi
je 0x46991d
mov ecx, 0x5455c0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4698f0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jge 0x46991d
push 0x5455c0
push 0x104
push esi
lfence
call fcn.004d0eb1
add esp, 0xc
mov eax, dword [0x5457f0]
mov esi, dword [0x53ed04]
mov dword [ebx + 0x240], eax
mov eax, dword [0x5457e0]
mov dword [ebx + 0x248], eax
mov eax, dword [0x5457e8]
mov dword [ebx + 0x244], eax
call fcn.00404140
push esi
push 9
push 0
mov edi, dword [eax + 0x54]
mov ecx, edi
call dword [0x506524]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4699d0
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0xc], 4
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov dword [esi + 0x444], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.debug
push str.SoftwareBitdefender_bdhtml
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
jne 0x469a26
mov byte [esi + 0x449], 1
movzx eax, word [esi + 0x444]
push 0x17
push eax
push dword [esi + 0x22c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x469a58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x238], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push edi
push dword [esi + 0x22c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x469a42
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x469a8a
push edi
push dword [esi + 0x22c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x469aa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov dword [esi + 0x238], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
lea eax, [edi + 2]
push eax
mov dword [esi + 0x1c], eax
call fcn.004d990e
push dword [esi + 0x1c]
mov dword [esi + 0x18], eax
push 0
push eax
call fcn.004cdf10
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
push edi
push ebx
call fcn.004691f0
add dword [esi + 0x1c], 0xfffffffe
add esp, 0x18
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x469ae8
push eax
push 0x104
lea eax, [esi + 0x20]
push eax
jmp 0x469b2b
cmp word [0x5455c0], 0
jne 0x469af7
call fcn.0046ac90
lea edx, [esi + 0x20]
test edx, edx
je 0x469b33
mov ecx, 0x5455c0
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469b06
sub ecx, edi
sar ecx, 1
cmp ecx, 0x104
jge 0x469b33
push 0x5455c0
push 0x104
lfence
push edx
call fcn.004d0eb1
add esp, 0xc
lea ecx, [esi - 0x14]
call fcn.00469b50
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46a160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
push esi
mov esi, ecx
push edi
test ebx, ebx
je 0x46a2e1
cmp word [ebx], 0
je 0x46a2e1
push str.sciter:
push ebx
call fcn.004cd4c1
add esp, 8
cmp eax, ebx
je 0x46a2cc
push 0x2f
push ebx
call fcn.004cd41d
mov edi, eax
add esp, 8
test edi, edi
je 0x46a2e1
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004cdf10
push 0xffffffffffffffff
lea eax, [edi + 2]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d0fe0
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.004cd41d
mov edi, eax
add esp, 0x24
test edi, edi
je 0x46a260
xor eax, eax
mov word [edi], ax
add edi, 2
je 0x46a260
push 0x520408
push edi
call fcn.004dbea6
add esp, 8
test eax, eax
je 0x46a260
push 0x520510
push edi
call fcn.004dbea6
add esp, 8
test eax, eax
lea eax, [ebp - 0x20c]
jne 0x46a25d
push 0x520510
push eax
push dword [esi + 0x244]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x46a256
mov esi, dword [esi + 0x244]
jmp 0x46a281
push 0x520510
jmp 0x46a262
push edi
jmp 0x46a268
push 0x17
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x240]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x46a2cc
mov esi, dword [esi + 0x240]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46a2e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x46a2e1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x46a2e1
call fcn.00404140
push edi
push dword [ebp - 0x210]
mov esi, dword [eax + 0xc]
mov ecx, esi
push ebx
push dword [ebp - 0x214]
call dword [0x506524]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049852a
mov esp, ebp
pop ebp
ret 8
Function at 0x46b010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fddb5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], eax
mov esi, SysReAllocString
call fcn.004695b0
mov byte [ebp - 4], 1
mov al, byte [ebp - 0x38]
test al, al
je 0x46b0ac
cmp dword [ebp - 0x3c], 8
lea edx, [ebp - 0x50]
mov esi, SysStringLen
cmovae edx, dword [ebp - 0x50]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b086
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004034d0
push 0x5c
lea ecx, [ebp - 0x28]
call fcn.0040b850
mov al, byte [ebp - 0x38]
mov byte [ebp - 4], 0
test al, al
je 0x46b0bc
lea ecx, [ebp - 0x50]
call fcn.004033a0
push 0x1b
push str.SoftwareBitdefender_bdhtml
lea ecx, [ebp - 0x28]
call fcn.0040ba70
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push esi
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b135
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push str.dark
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x2c]
test eax, eax
push dword [ebp - 0x30]
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x28]
sete bl
call fcn.004033a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x46b190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0x20019
push 0
xorps xmm0, xmm0
mov esi, ecx
push str..DEFAULTSoftwareSetId
push SysStringLen
xor bl, bl
movq qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x46b20a
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 1
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], 0x26
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push str.wslibsite_lang
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x46b218
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x46b28c
cmp dword [esi + 0x14], 8
jb 0x46b224
mov esi, dword [esi]
lea eax, [ebp - 0x2c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x46b269
test cx, cx
je 0x46b249
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x46b269
add esi, 4
add eax, 4
test cx, cx
jne 0x46b227
xor ecx, ecx
movzx eax, bl
pop edi
test ecx, ecx
mov edx, 1
pop esi
cmove eax, edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
sbb ecx, ecx
movzx eax, bl
or ecx, 1
mov edx, 1
pop edi
test ecx, ecx
pop esi
cmove eax, edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x471520
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe44e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xbc
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x545b10
mov dword [0x545b10], 0
mov dword [0x545b20], 0
mov dword [0x545b24], 7
mov dword [0x545b28], 0
mov dword [0x545b38], 0
mov dword [0x545b3c], 7
mov dword [0x545b40], 0
mov dword [0x545b50], 0
mov dword [0x545b54], 7
mov dword [0x545b58], 0
mov dword [0x545b68], 0
mov dword [0x545b6c], 7
mov dword [ebp - 4], 0
mov dword [0x545b70], 0
mov dword [0x545b74], 0
push 0x2c
lfence
call fcn.00498569
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [0x545b70], eax
mov byte [ebp - 4], 1
mov dword [0x545b78], 0
mov dword [0x545b7c], 0
push 0x2c
lfence
call fcn.00498569
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [0x545b78], eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 2
call fcn.00470dd0
mov ecx, eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x64], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp byte [ecx + 0x30], 0
lea eax, [ebp - 0x64]
cmove eax, ecx
lea ecx, [ebp - 0x94]
push eax
call fcn.00420250
cmp dword [ebp - 0x68], 0x10
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x7c]
call fcn.0041ed60
lea ecx, [ebp - 0x94]
call fcn.004201c0
lea ecx, [ebp - 0x64]
call fcn.004201c0
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 7
call fcn.00473690
sub esp, 0x60
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x545824
mov dword [ebp - 0x30], ecx
call fcn.0040bca0
movups xmm0, xmmword [ebp - 0x2c]
sub esp, 0x18
mov ecx, esi
mov eax, esp
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [eax + 0x10], xmm0
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00470ff0
call fcn.004717c0
lea ecx, [ebp - 0x2c]
call fcn.004033a0
mov eax, 0x545b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4770e0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fea2d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push eax
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47714a
call ebx
mov ecx, 0x53ed5c
jmp 0x477152
mov eax, dword [ebp - 0x18]
mov ecx, 0x53ece0
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
test eax, eax
je 0x477171
mov dword [edi], eax
mov dword [edi + 4], ecx
mov byte [edi + 0x18], 1
jmp 0x47726f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0
push 0
push 0x800c
push esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x477199
call ebx
mov ecx, 0x53ed5c
jmp 0x4771a0
xor eax, eax
mov ecx, 0x53ece0
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x4771bc
mov dword [edi], eax
mov dword [edi + 4], ecx
mov byte [edi + 0x18], 1
jmp 0x477264
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4771f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x53ed5c
test eax, eax
je 0x477200
mov dword [edi], eax
mov dword [edi + 4], 0x53ed5c
mov byte [edi + 0x18], 1
jmp 0x477264
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x53ece0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x28], ebx
push ecx
lea edx, [ebp - 0x28]
movq qword [ebp - 0x24], xmm0
lea ecx, [ebp - 0x24]
call fcn.00476fa0
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x47723e
mov eax, dword [ebp - 0x14]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov byte [edi + 0x18], 1
jmp 0x477254
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.00477dd0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x477264
push eax
call fcn.004987f3
add esp, 4
test ebx, ebx
je 0x47726f
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test esi, esi
je 0x47727c
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x4776b0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fea2d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53d058]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push eax
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47771a
call ebx
mov ecx, 0x53ed5c
jmp 0x477722
mov eax, dword [ebp - 0x18]
mov ecx, 0x53ece0
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
test eax, eax
je 0x477741
mov dword [edi], eax
mov dword [edi + 4], ecx
mov byte [edi + 0x18], 1
jmp 0x47783f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0
push 0
push 0x8004
push esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x477769
call ebx
mov ecx, 0x53ed5c
jmp 0x477770
xor eax, eax
mov ecx, 0x53ece0
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x47778c
mov dword [edi], eax
mov dword [edi + 4], ecx
mov byte [edi + 0x18], 1
jmp 0x477834
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4777c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x53ed5c
test eax, eax
je 0x4777d0
mov dword [edi], eax
mov dword [edi + 4], 0x53ed5c
mov byte [edi + 0x18], 1
jmp 0x477834
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x53ece0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x28], ebx
push ecx
lea edx, [ebp - 0x28]
movq qword [ebp - 0x24], xmm0
lea ecx, [ebp - 0x24]
call fcn.00476fa0
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x47780e
mov eax, dword [ebp - 0x14]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov byte [edi + 0x18], 1
jmp 0x477824
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.00477dd0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x477834
push eax
call fcn.004987f3
add esp, 4
test ebx, ebx
je 0x47783f
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test esi, esi
je 0x47784c
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049852a
mov esp, ebp
pop ebp
ret
Function at 0x477c10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x477c30
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x478290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4782ee
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4782b0
mov eax, dword [edi]
jmp 0x4783d9
cmp eax, 0x4e0
jb 0x4783d9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x478310
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x478360
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x478420
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x53d058]
xor eax, esp
mov dword [esp + 0x44], eax
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 8]
xor ecx, esp
mov edx, dword [esp + 0xc]
call fcn.0049852a
mov esp, ebp
pop ebp
ret