joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421240
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x44d08c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x421380
cmp dword [esp + 0x28], ebp
je 0x421380
push ebx
push 0x2800
call fcn.00425716
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x4212a3
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00425271
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x4212b0
push edi
push str..PhysicalDrive_d
mov ecx, 0x2800
call fcn.0041f210
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x421356
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004253c0
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x421349
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x421349
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00420ff0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x421360
inc edi
cmp edi, 0x10
jl 0x4212b0
push ebx
call fcn.004257e0
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00425271
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.00425271
add esp, 0x1c
ret
Function at 0x421430
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x42146a
cmp dword [esp + 0x34], esi
je 0x42146a
push 0x200
call fcn.00425716
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x421475
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4215d4
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x42156a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4214cd
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421543
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x421538
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.004213a0
cmp edx, edi
jb 0x421538
ja 0x421532
cmp eax, dword [esp + 0x24]
jbe 0x421538
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x4214c0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x421580
cmp dword [esp + 0x24], 0
jbe 0x4215d4
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.0041f210
add esp, 0xc
test eax, eax
jne 0x4215b9
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.004257e0
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.00420ff0
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.004257e0
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4245a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43caf0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x44d08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x455380]
xor edi, edi
cmp ecx, edi
jne 0x4245eb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x4245f8
mov dword [ebp - 0x14], edi
jmp 0x424610
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x4246a6
mov ecx, dword [0x455380]
mov eax, dword [ecx]
cmp eax, edi
je 0x4245d7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4245d7
mov ebx, 0x455380
mov dword [ebp - 4], edi
call fcn.004246c0
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x42464e
push 0x448434
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.004297ec
mov ecx, dword [0x455380]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x424668
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x424692
push 0x448434
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.004297ec
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x424689
call fcn.004249d0
mov eax, 0x42468f
ret
mov eax, dword [0x455380]
mov eax, dword [eax]
test eax, eax
je 0x4246a4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4246c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x4246ed
xor ecx, ecx
jmp 0x4246f9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x4247ad
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x424720
mov dword [esp + 0xc], esi
jmp 0x424780
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x424779
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42476c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x424780
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x424780
push 0x446890
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x424780
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x4247a3
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x424712
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x4247c1
mov ecx, dword [ebx]
add ecx, 8
call fcn.00424900
test eax, eax
je 0x4247c1
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x4247d0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x43cbab
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44d08c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.004253c0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x424868
push 0x448434
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.004297ec
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x424e13
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x451a48], 0
push esi
jne 0x424d86
call fcn.00424cac
test eax, eax
je 0x424dc9
mov eax, dword [0x451a48]
cmp eax, 1
jne 0x424da7
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x424dc9
pop esi
ret
push eax
call dword [0x451a50]
test eax, eax
jne 0x424e11
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x424dcd
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x451a48]
call dword [0x451a50]
mov edi, eax
test edi, edi
je 0x424df2
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x424e0e
mov edi, esi
add esi, 0xff0
push edi
push dword [0x451a48]
call dword [0x451a4c]
add edi, 0x10
cmp edi, esi
jb 0x424dfa
mov eax, edi
pop edi
pop esi
ret
jmp 0x424d73

Function at 0x425271
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d08c]
jne 0x42527b
repz ret
jmp fcn.0042a8a0

Function at 0x4357d3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042aa18
and dword [ebp - 4], 0
cmp dword [0x452670], 0
mov ebx, eax
jne 0x435884
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x435935
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x435935
push eax
call fcn.0042a9a6
mov dword [esp], 0x440b60
push edi
mov dword [0x452670], eax
call esi
push eax
call fcn.0042a9a6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x452674], eax
call esi
push eax
call fcn.0042a9a6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x452678], eax
call esi
push eax
call fcn.0042a9a6
pop ecx
mov dword [0x452680], eax
test eax, eax
je 0x435884
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042a9a6
pop ecx
mov dword [0x45267c], eax
mov eax, dword [0x45267c]
cmp eax, ebx
je 0x4358dc
cmp dword [0x452680], ebx
je 0x4358dc
push eax
call fcn.0042aa21
push dword [0x452680]
mov esi, eax
call fcn.0042aa21
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4358dc
test edi, edi
je 0x4358dc
call esi
test eax, eax
je 0x4358d3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4358d3
test byte [ebp - 0xc], 1
jne 0x4358dc
or dword [ebp + 0x10], 0x200000
jmp 0x435915
mov eax, dword [0x452674]
cmp eax, ebx
je 0x435915
push eax
call fcn.0042aa21
pop ecx
test eax, eax
je 0x435915
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x435915
mov eax, dword [0x452678]
cmp eax, ebx
je 0x435915
push eax
call fcn.0042aa21
pop ecx
test eax, eax
je 0x435915
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x452670]
call fcn.0042aa21
pop ecx
test eax, eax
je 0x435935
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x435937
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x458cd0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0x28], eax
cmp dword [ebp + 8], 0
je 0x458ea3
cmp dword [0x58cc98], 0xe69e32f3
jne 0x458ea6
mov ecx, 0x308
mov esi, dword [ebp + 8]
add ecx, dword [esi + 0xc]
mov byte [esp + 0xf], 0xff
movzx eax, byte [esi + 2]
push eax
mov dword [esp + 8], ecx
push ecx
call fcn.004962f0
add esp, 8
movzx ebx, ax
shl ebx, 5
lea edi, [esi + ebx]
add edi, 0x48
add esi, 0x40
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x458e6b
mov dword [esp + 8], esi
mov eax, dword [edi]
mov esi, dword [eax]
test esi, esi
je 0x458e1a
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x458e10
mov edi, dword [ebp + 8]
add ebx, edi
mov ebx, dword [ebx + 0x54]
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x458e77
mov edx, ecx
and edx, 0x1fc000
je 0x458e77
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x1180]
mov dword [edi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.004a8750
push esi
push dword [0x59df30]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x58e4fc]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.004babe3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov edi, dword [ebp + 8]
jmp 0x458d8b
lea eax, [esp + 0xf]
mov ecx, edi
push eax
push 0x4000
push dword [esp + 0xc]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.004a9580
test eax, eax
je 0x458ea9
mov esi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x458da4
mov ecx, esi
call fcn.004a9420
jmp 0x458d41
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push 0
push dword [esi]
push str.first
call fcn.00503ac0
push edi
call fcn.0042a720
add esp, 4
mov ecx, ebx
call fcn.0050d1b0
int3
int3
xor esi, esi
jmp 0x458dc7
Function at 0x45ddc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x59f4c0]
mov ecx, dword [0x58e4fc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x45ddf1
movzx eax, word [0x59f49c]
cmp eax, 9
jne 0x45de3c
xor eax, eax
inc eax
pop ebp
ret
push 0x59f4c0
call fcn.004ba267
add esp, 4
cmp dword [0x59f4c0], 0xffffffff
jne 0x45dde0
xorps xmm0, xmm0
movups xmmword [0x59f4ac], xmm0
movups xmmword [0x59f49c], xmm0
mov dword [0x59f4bc], 0
push 0x59f49c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x59f4c0
call fcn.004ba2dd
add esp, 4
jmp 0x45dde0
test eax, eax
je 0x45ddef
cmp eax, 6
jne 0x45de4c
mov eax, 2
jmp 0x45ddef
cmp eax, 0xc
jne 0x45de58
mov eax, 3
jmp 0x45ddef
mov eax, 4
jmp 0x45ddef
Function at 0x4dd9b1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4dda4e
push ebx
push esi
call fcn.004dda9f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004dd8fa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4dd9fb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4dda4d
push edi
push eax
call fcn.00449a50
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4dda1b
call fcn.0049e7e0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4dda4c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004dd8fa
add esp, 0x20
test eax, eax
jne 0x4dda3a
push edi
call fcn.0049e7e0
jmp 0x4dda42
push ebx
call fcn.0049e7e0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4dda51
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4dda62
pop esi
ret
push ebx
push edi
push esi
call fcn.004dda9f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00449a50
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4dda8a
push ebx
push esi
push edi
call fcn.004bd2f0
add esp, 0xc
push 0
call fcn.0049e7e0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4ddae1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ddd4a

Function at 0x4e166d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4e16a8
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4e168f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4e16a0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4e16aa
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4e1685
xor eax, eax
pop edi
pop esi
ret
Function at 0x4e18ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 0xc6
inc ebp
mov dl, 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004e162d
fistp qword [ebp + 0x458d0a2e]
test al, 0x50
call fcn.004e163d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004e15f2
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4e191b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
invalid
inc ebp
invalid
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40345b
pop dword [ebp - 0x38]
mov eax, 0x26b45d45
sub eax, 0x267428ea
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xb51287fd
sub dword [ebp - 0x48], 0x66c042b2
mov dword [ebp - 0x44], 0x6fdb27f1
sub dword [ebp - 0x44], 0x3da7dbac
mov dword [ebp - 0x40], 0xd2b91b79
add dword [ebp - 0x40], 0x799328b5
mov dword [ebp - 0x3c], 0xed96cd67
add dword [ebp - 0x3c], 0x12693299
lea eax, [ebp - 0x48]
push eax
mov eax, 0x605f25
add eax, 0xffdfe12f
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8e22d874
sub dword [ebp - 0x48], 0x19b06f1e
mov dword [ebp - 0x44], 0xf54f2dee
sub dword [ebp - 0x44], 0xb3e2cc79
mov dword [ebp - 0x40], 0x4c078a02
sub dword [ebp - 0x40], 0xe8981d96
mov dword [ebp - 0x3c], 0xac17dca4
sub dword [ebp - 0x3c], 0xac17dca4
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x1d806542
add eax, 0xe2bfdb0e
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x31637
push 0
call eax
mov ecx, 0x3218
mov edx, eax
mov edi, 0x4e49dd6f
add edi, 0xb1f6a691
add edi, dword [ebp - 0x38]
mov esi, 0x5b0c13cf
xor dword [ebp - 0x10], esi
mov ebx, dword [edi]
sub dword [ebp - 4], 0xf5b032e1
xor ebx, esi
sub dword [ebp - 0x2c], 0xe4f0095e
mov dword [edx], ebx
xor dword [ebp - 0x30], 0xb81b2226
add edx, 0x3cc0052
sub edx, 0x3cc004e
add edi, 0xd9bdc57f
sub edi, 0xd9bdc57b
loop 0x403571
add eax, 0xd05fb358
add eax, 0x2fa107db
xor ebx, ebx
add ebx, eax
add eax, 0xa347959
sub eax, 0xa347954
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401440
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x43ee10]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407960
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00410a3d
add esp, 0x68
ret

Function at 0x4014b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x43ee10]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407960
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.00410a3d
add esp, 0x68
ret

Function at 0x401da0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x43ee10]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00405820
add esp, 8
test eax, eax
jne 0x401e0b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00410a3d
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x401e20
push esi
lea ecx, [esp + 0x14]
call fcn.00407960
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00407a00
test edi, edi
je 0x401e3e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00410a3d
add esp, 0x6c
ret

Function at 0x401ed0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x43ee10]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405a20
add esp, 4
test eax, eax
jne 0x401f2e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00410a3d
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00407a00
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00410a3d
add esp, 0x64
ret
Function at 0x401f50
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x43ee10]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00405b10
add esp, 8
test eax, eax
jne 0x401fcf
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00410a3d
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00407010
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00410a3d
add esp, 0x74
ret