joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10077000
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100dbe80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 0x48], eax
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10077021
sub esi, ecx
cmp byte [edi], 0x5b
jne 0x100771c6
cmp esi, 4
jb 0x100771b0
inc edi
sub esi, 2
cmp byte [edi + esi], 0x5d
jne 0x100771b0
push str.0123456789abcdefABCDEF:.
push edi
call fcn.100a15b0
add esp, 8
cmp esi, eax
je 0x10077111
mov esi, eax
add eax, edi
mov dword [ebp - 0x4c], eax
cmp byte [eax], 0x25
jne 0x100771b0
push 2
lea ebx, [eax + 1]
push 0x100c1004
push ebx
call fcn.1009f7b0
add esp, 0xc
test eax, eax
jne 0x10077097
mov cl, byte [ebx + 2]
lea eax, [ebx + 2]
test cl, cl
je 0x10077097
cmp cl, 0x5d
cmovne ebx, eax
mov al, byte [ebx]
test al, al
je 0x1007719a
lea edx, [ebp - 0x14]
sub edx, ebx
xor ecx, ecx
cmp al, 0x5d
je 0x100770bd
cmp ecx, 0xf
jge 0x100770bd
mov byte [edx + ebx], al
inc ecx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x100770a8
test ecx, ecx
je 0x1007719a
cmp byte [ebx], 0x5d
jne 0x1007719a
cmp ecx, 0x10
jae 0x100771ee
lea eax, [ebp - 0x14]
mov byte [ebp + ecx - 0x14], 0
push eax
call dword [0x100dbe44]
mov ecx, dword [ebp - 0x48]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x10077109
pop edi
pop esi
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov word [eax], 0x5d
lea eax, [ebp - 0x14]
mov byte [edi + esi], 0
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x100771b0
push 0x2e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17
call fcn.10079ba0
add esp, 0x10
test eax, eax
je 0x10077179
lea edx, [ebp - 0x44]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10077150
sub edx, ecx
cmp edx, esi
jae 0x10077179
lea ecx, [ebp - 0x44]
mov esi, edi
mov eax, ecx
sub esi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x10077166
mov byte [edx + edi + 1], al
mov esi, edx
mov byte [edi + esi], 0x5d
xor eax, eax
mov ecx, 0xe
cmp byte [edi], al
pop edi
pop esi
cmove eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
push str.__r_n_t_:___
push edi
call fcn.10097d60
add esp, 8
cmp esi, eax
je 0x1007717d
mov ecx, dword [ebp - 4]
mov eax, 0x15
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
call fcn.1008c47d
int3
Function at 0x10084a70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x10084aa3
push 0x2e
push edi
call fcn.1008e500
add esp, 8
test eax, eax
je 0x10084aa1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x10085bf0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100dbe80]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10085cde
push esi
mov esi, dword [ebp + 0x10]
push 8
mov dword [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [ebp - 0xc], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [ebp - 0xb], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [ebp - 0xa], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [ebp - 9], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [ebp - 8], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [ebp - 7], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [ebp - 0x10], 8
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 5], cl
call fcn.10087b60
add esp, 8
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x10085cef
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [edi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
Function at 0x10086250
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100dbe38]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1008627d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0x100862c8
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x100862ce
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10086329
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
nop
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x100862f0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0x10086359
mov eax, dword [edi]
push 1
push 0x100c2a18
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x100c2a19
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0x10086331
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10086370
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 0x10]
call fcn.1004f210
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x100dbe38]
mov esi, eax
add esp, 8
test esi, esi
je 0x100864d2
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0x100863f0
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp - 8]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10086449
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp - 8], 1
jne 0x10086410
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0x10086479
mov eax, dword [edi]
push 1
push 0x100c2a18
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x100c2a19
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0x10086451
push dword [ebp + 0x18]
call fcn.1004f210
mov ecx, dword [esi]
push eax
push dword [ebp + 0x14]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x100864a1
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x100dbe3c]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10086580
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100865b5
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.1004f210
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x20
jne 0x10086603
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10086611
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10086621
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10087b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x10087bad
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x10087b72
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10087bc0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10087c03
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.1004f210
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x10
jne 0x10087c51
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10087c5f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10087c6f
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret
Function at 0x100898a0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100898b0

Function at 0x10089b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10089b40

Function at 0x1008b9c2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1008b9e9
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1008b9ec
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1008b99e
pop esi
leave
ret 8

Function at 0x100aab19
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100aa98f

Function at 0x100adcb9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ad936

Function at 0x100b5050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b507d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b507d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x47c000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x5dd91c
call fcn.0047c21c
mov edi, 0x94
mov eax, edi
call fcn.0047c1dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x5dd91c], ecx
mov eax, dword [esi + 4]
mov dword [0x5dd920], eax
mov edx, dword [esi + 8]
mov dword [0x5dd924], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x5dd928], esi
cmp ecx, 2
je 0x47c060
or esi, 0x8000
mov dword [0x5dd92c], esi
shl eax, 8
add eax, edx
mov dword [0x5dd91c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x47c09b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47c09b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x47c0b3
cmp eax, 0x20b
je 0x47c0a0
mov dword [ebp - 0x1c], esi
jmp 0x47c0c7
cmp dword [ecx + 0x84], 0xe
jbe 0x47c09b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x47c0c1
cmp dword [ecx + 0x74], 0xe
jbe 0x47c09b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0047c224
pop ecx
test eax, eax
jne 0x47c0f3
cmp dword [0x5dd91c], 1
jne 0x47c0e0
call fcn.0047c224
push 0x1c
call fcn.0047c224
push 0xff
call fcn.0047c224
pop ecx
pop ecx
call fcn.0047c224
mov dword [ebp - 4], esi
call fcn.0047c224
test eax, eax
jge 0x47c10c
push 0x1b
call fcn.0047c224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x5dd91c], eax
call fcn.0047c224
mov dword [0x5dd920], eax
call fcn.0047c224
test eax, eax
jge 0x47c132
push 8
call fcn.0047c224
pop ecx
call fcn.0047c224
test eax, eax
jge 0x47c143
push 9
call fcn.0047c224
pop ecx
push 1
call fcn.0047c224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x47c159
push eax
call fcn.0047c224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0047c224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x47c17a
movzx eax, word [ebp - 0x40]
jmp 0x47c17d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0047c228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x47c19b
push edi
call fcn.0047c220
call fcn.0047c224
jmp 0x47c1cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0047c224
ret

Function at 0x47c228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x111000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x47c252
push 0x4cd404
jmp 0x47c25e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x407d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x498068]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.AllFilesystemObjects_shellexContextMenuHandlersQQShellExt
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407e3c
push 0x200
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00452050
add esp, 0xc
mov dword [esp + 8], 0x1ff
lea eax, [esp + 8]
mov dword [esp + 4], 4
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x484954
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407e3c
cmp dword [esp + 4], 1
jne 0x407e3c
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 7
lea edx, [ecx + 2]
mov word [esp + 0x10], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407dc0
sub ecx, edx
lea eax, [esp + 0x28]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00401a50
push str.53D2405C_48AB_4C8A_8F59_CE0610F13BBC
lea ecx, [esp + 0x14]
call fcn.00407e70
mov edx, dword [esp + 0x24]
movzx esi, al
cmp edx, 8
jb 0x407e27
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407e1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407e51
push edx
push ecx
call fcn.0044f7c7
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0044f786
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x22c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0044f786
mov esp, ebp
pop ebp
ret
call fcn.00454bbf
int3
Function at 0x407ed0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x498068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 1
call fcn.00401900
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x5c], esp
push 0x12
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x484cf8
mov byte [ecx], 0
call fcn.00405f80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00441670
add esp, 0x18
test al, al
je 0x407fd0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401920
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x58]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.00401a50
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00401850
mov dl, 1
lea ecx, [ebp - 0x58]
call fcn.004274b0
test al, al
jne 0x407fd0
lea ecx, [ebp - 0x58]
call fcn.00405f50
cmp eax, 0x104
jae 0x407fd0
push 5
push 0
call fcn.00401810
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00401850
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x408019
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40800f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40804f
push edx
push ecx
call fcn.0044f7c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f786
mov esp, ebp
pop ebp
ret 4
call fcn.00454bbf
int3
Function at 0x411f00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473698
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x498068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str._TXQQ0824
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x411f87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x411f87
push 0x40
push 0x487338
push 0x487340
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.ResultCancel
mov byte [ecx], 0
call fcn.00405f80
mov dword [ebp - 4], 0
jmp 0x411fe1
push 0x44
push 0x487338
push 0x487364
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x18
mov dword [ebp - 0x14], esp
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
cmp eax, 6
jne 0x411fce
push 8
push str.ResultOK
call fcn.00405f80
mov dword [ebp - 4], 1
jmp 0x411fe1
push 0xc
push str.ResultCancel
call fcn.00405f80
mov dword [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
push 0xb
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.CheckResult
mov byte [ecx], 0
call fcn.00405f80
mov dword [ebp - 4], 0xffffffff
call fcn.004410f0
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4