joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, 0x80
mov dword [ebp - 4], esi
lea eax, [edi*8]
cmp eax, 0x400
cmova edi, ecx
cmp edi, dword [esi]
jne 0x448f21
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x647f50]
test eax, eax
je 0x448f2c
call eax
lea eax, [edi*8]
push 0
push eax
call fcn.00444710
mov ecx, dword [0x647f54]
add esp, 8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ecx, ecx
je 0x448f4f
call ecx
test ebx, ebx
je 0x448f18
push dword [esi + 0xc]
call fcn.00444a30
add esp, 4
mov dword [esi + 0xc], ebx
push ebx
call dword [0x5c17a0]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [esi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.00525d00
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [esi + 8], 0
test ecx, ecx
je 0x449032
mov edi, dword [ecx + 0xc]
xor ebx, ebx
mov al, byte [edi]
test al, al
je 0x448fc1
movzx eax, al
lea edx, [ebx*8]
lea edi, [edi + 1]
movzx esi, byte [eax + 0x585cb0]
mov al, byte [edi]
xor esi, edx
xor ebx, esi
test al, al
jne 0x448fa3
xor edx, edx
mov edi, dword [ecx]
mov eax, ebx
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x44900c
mov eax, dword [esi]
test eax, eax
je 0x448fdf
mov edx, dword [esi + 4]
jmp 0x448fe1
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x44900c
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x449001
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x449028
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x449028
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x44901e
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [esi + 8], ecx
mov ecx, edi
test edi, edi
jne 0x448f98
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
mov ecx, dword [eax + 0xc]
mov ebx, edx
mov dword [ebp - 4], eax
test ecx, ecx
je 0x449093
mov al, byte [ebx]
xor esi, esi
mov edi, ebx
test al, al
je 0x44907e
nop
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x585cb0]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x449060
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
div dword [ecx]
mov edi, dword [ecx + 0xc]
mov esi, dword [edi + edx*8 + 4]
mov edi, dword [edi + edx*8]
jmp 0x44909b
mov esi, dword [eax + 8]
xor edx, edx
mov edi, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
test edi, edi
je 0x4490bb
push ebx
push dword [esi + 0xc]
dec edi
call fcn.00447940
add esp, 8
test eax, eax
je 0x4490c4
mov esi, dword [esi]
test edi, edi
jne 0x4490a4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x5bf500]

Function at 0x44e55e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44e5bb
mov eax, dword [edi + 0x3c]
xor esi, esi
mov ecx, dword [eax + edi + 0x78]
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov ebp, dword [ecx + 0x18]
test ebp, ebp
je 0x44e5bb
mov ebx, dword [esp + 0x1c]
mov ch, byte [ebx]
mov edx, dword [eax + esi*4]
add edx, edi
mov cl, byte [edx]
cmp cl, ch
jne 0x44e5b6
mov eax, ebx
sub edx, ebx
test cl, cl
je 0x44e5c3
cmp byte [eax], 0
je 0x44e5c3
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x44e5a0
mov eax, dword [esp + 0x18]
inc esi
cmp esi, ebp
jb 0x44e591
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44e5ee
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
add ebp, 0xc
push edi
mov ebp, dword [ebp]
mov ebx, dword [ebp + 0x30]
test ebx, ebx
je 0x44e602
test eax, eax
je 0x44e64d
movzx eax, word [ebx]
xor edi, edi
xor esi, esi
mov ecx, eax
test ax, ax
je 0x44e645
movzx ecx, ax
lea esi, [esi + 1]
movzx eax, ax
lea edx, [ecx - 0x41]
add ecx, 0x20
cmp dx, 0x19
movzx ecx, cx
cmova ecx, eax
movzx eax, cx
add edi, eax
movzx eax, word [ebx + esi*2]
test ax, ax
jne 0x44e61e
mov eax, dword [esp + 0x14]
cmp eax, edi
jne 0x44e602
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x44e65e
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
mov eax, dword fs:[0x30]
sub esp, 0xc
mov eax, dword [eax + 0xc]
add eax, 0xc
nop
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x44e66e
push ebx
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [0x5c51dc]
push esi
push edi
push eax
mov dword [esp + 0x1c], ebp
call fcn.0044e5ee
mov ecx, dword [0x5c51b0]
add esp, 4
mov ebx, eax
mov dword [esp + 0x14], ebx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x104
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor esi, esi
nop word [eax + eax]
movzx ecx, word [edi + edx*2]
mov eax, edx
cmp ecx, 0x5c
cmovne eax, esi
mov esi, eax
test cx, cx
je 0x44e6d4
inc edx
jmp 0x44e6be
lea esi, [edi + esi*2]
mov edi, dword [0x5c51a4]
mov ecx, dword [edi]
test ecx, ecx
je 0x44e739
movzx ebx, word [esi + 2]
xor eax, eax
mov ebp, ebx
test bx, bx
je 0x44e6f9
inc eax
cmp word [esi + eax*2 + 2], 0
jne 0x44e6f0
cmp al, cl
je 0x44e706
cmp al, byte [edi + 1]
jne fcn.0044e810
xor edx, edx
xor ecx, ecx
test bx, bx
je 0x44e723
mov eax, ebp
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2 + 2]
test ax, ax
jne 0x44e711
cmp edx, dword [edi + 4]
je 0x44e731
cmp edx, dword [edi + 8]
jne fcn.0044e810
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [0x5c51b0]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x5c51c0], edx

Function at 0x44e6c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0x30]
sub esp, 0xc
mov eax, dword [eax + 0xc]
add eax, 0xc
nop
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x44e66e
push ebx
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [0x5c51dc]
push esi
push edi
push eax
mov dword [esp + 0x1c], ebp
call fcn.0044e5ee
mov ecx, dword [0x5c51b0]
add esp, 4
mov ebx, eax
mov dword [esp + 0x14], ebx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x104
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor esi, esi
nop word [eax + eax]
movzx ecx, word [edi + edx*2]
mov eax, edx
cmp ecx, 0x5c
cmovne eax, esi
mov esi, eax
test cx, cx
je 0x44e6d4
inc edx
jmp 0x44e6be
lea esi, [edi + esi*2]
mov edi, dword [0x5c51a4]
mov ecx, dword [edi]
test ecx, ecx
je 0x44e739
movzx ebx, word [esi + 2]
xor eax, eax
mov ebp, ebx
test bx, bx
je 0x44e6f9
inc eax
cmp word [esi + eax*2 + 2], 0
jne 0x44e6f0
cmp al, cl
je 0x44e706
cmp al, byte [edi + 1]
jne fcn.0044e810
xor edx, edx
xor ecx, ecx
test bx, bx
je 0x44e723
mov eax, ebp
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [esi + ecx*2 + 2]
test ax, ax
jne 0x44e711
cmp edx, dword [edi + 4]
je 0x44e731
cmp edx, dword [edi + 8]
jne fcn.0044e810
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword [0x5c51b0]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov esi, eax
cmp dword [0x5c51c0], edx
Function at 0x44e760
Capabilities:
Terminate process

Disassembly:
jbe 0x44e77d
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x5c51b4]
add edx, eax
cmp edx, dword [0x5c51c0]
jb 0x44e762
push esi
push ebx
call fcn.0044e55e
mov ebx, eax
add esp, 8
test ebx, ebx
je fcn.0044e810
mov esi, dword [0x5c519c]
lea eax, [esp + 0x10]
mov ecx, dword [0x5c51c0]
push eax
push ecx
mov ecx, dword [0x5c51c8]
push ecx
push esi
call ebx
mov edx, dword [0x5c51d0]
mov ecx, 8
mov edi, dword [edx + ebp + 4]
add edx, ebp
cmp dword [0x5c51c8], ecx
jbe 0x44e7dd
mov eax, dword [edx + ecx]
add eax, edi
mov dword [esi + ecx], eax
mov eax, dword [0x5c51b4]
add ecx, eax
cmp ecx, dword [0x5c51c8]
jb 0x44e7c6
mov eax, dword [0x5c51a0]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
mov eax, dword [0x5c51c8]
push eax
push esi
call ebx
mov eax, dword [0x5c51a8]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x5c51a8]
add ecx, esi
add esi, eax
push esi
call ecx
add esp, 4
Function at 0x45a080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x14], edx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x45a1ea
cmp byte [ebx + 9], 0
je 0x45a0b8
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], 0
jne 0x45a0b8
call fcn.00456630
mov eax, dword [ebx + 4]
mov esi, dword [eax + 8]
test esi, esi
je 0x45a1d8
cmp dword [ebp + 8], 0
je 0x45a10d
test byte [esi + 0x40], 1
jne 0x45a10d
mov al, byte [esi + 0x42]
cmp al, 1
je 0x45a0e1
cmp al, 2
jne 0x45a17e
mov ecx, esi
call fcn.00456a90
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x45a17e
mov ebx, dword [esp + 0x10]
mov edx, edi
push 0
mov ecx, ebx
call fcn.0045a080
add esp, 4
jmp 0x45a1d8
mov edi, dword [esi + 0x30]
test edi, edi
je 0x45a16c
cmp dword [0x5c1770], 0
je 0x45a162
mov eax, dword [0x647f28]
test eax, eax
je 0x45a130
push eax
call dword [0x5c17c4]
add esp, 4
push edi
call dword [0x5c17a0]
sub dword [0x647f68], eax
add esp, 4
dec dword [0x647f8c]
push edi
call dword [0x5c1798]
mov eax, dword [0x647f28]
add esp, 4
test eax, eax
je 0x45a16c
push eax
call dword [0x5c17cc]
jmp 0x45a169
push edi
call dword [0x5c1798]
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x45a1c5
lea edi, [esi + 0x78]
mov ecx, dword [edi]
test ecx, ecx
je 0x45a1b3
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x45a1a5
call fcn.004513a0
jmp 0x45a1aa
call fcn.0044d2a0
mov ecx, dword [esp + 0x1c]
call fcn.00452430
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x45a188
mov esi, dword [esi + 8]
test esi, esi
jne 0x45a0c6
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [ebx + 9], 0
je 0x45a1ea
dec dword [ebx + 0xc]
jne 0x45a1ea
mov ecx, ebx
call fcn.004565f0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x45b491
cmp al, 3
jb 0x45b46b
call fcn.00456d90
test eax, eax
jne 0x45b479
cmp byte [esi + 0x42], 0
jne 0x45b47d
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45b491
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
jg 0x45b477
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
inc word [esi + eax*2 + 0x50]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [edx + 0x12]
jb 0x45b54a
cmp byte [edx + 5], 0
jne 0x45b4d5
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
call fcn.0045abd0
test eax, eax
jne 0x45b479
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.0045ad90
mov cl, byte [esi + 0x44]
xor eax, eax
test cl, cl
je 0x45b53c
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x45b505
call fcn.004513a0
jmp 0x45b50a
call fcn.0044d2a0
mov ecx, edi
call fcn.00452430
movsx eax, byte [esi + 0x44]
mov ecx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [ecx + 0x12]
jae 0x45b4d5
cmp byte [ecx + 2], 0
je 0x45b477
push ebx
push esi
call fcn.0045b560
add esp, 8
pop edi
pop esi
pop ebx
ret
mov dword [ebx], 1
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
ret
cmp byte [edx + 5], 0
je 0x45b4cb
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x45b5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x45b611
cmp al, 3
jb 0x45b5eb
call fcn.00456d90
test eax, eax
jne 0x45b5f9
cmp byte [esi + 0x42], 0
jne 0x45b5fd
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45b611
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x45b5f7
movsx eax, byte [esi + 0x44]
mov edi, dword [esi + eax*4 + 0x78]
cmp byte [edi + 5], 0
jne 0x45b655
movzx ecx, word [esi + eax*2 + 0x50]
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.0045abd0
test eax, eax
jne 0x45b5f9
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.0045ae40
cmp word [esi + eax*2 + 0x50], 0
jne 0x45b6a8
lea ecx, [ecx]
mov cl, byte [esi + 0x44]
xor eax, eax
test cl, cl
je 0x45b6e0
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x45b690
call fcn.004513a0
jmp 0x45b695
call fcn.0044d2a0
mov ecx, edi
call fcn.00452430
movsx eax, byte [esi + 0x44]
cmp word [esi + eax*2 + 0x50], 0
je 0x45b660
movsx eax, byte [esi + 0x44]
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x45b5f7
cmp byte [eax + 5], 0
jne 0x45b5f7
push ebx
push esi
call fcn.0045b6f0
add esp, 8
pop edi
pop esi
pop ebx
ret
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [ebx], 1
pop ebx
ret
Function at 0x467720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.0045a6b0
mov edi, dword [esi + 0x10]
mov edx, edi
mov eax, dword [esi + 0x14]
add edx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x4677ef
jb 0x46775b
cmp edx, 0x7ffffffe
ja 0x4677ef
mov esi, dword [ebx]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [esi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovb ecx, eax
cmp edi, ecx
ja 0x46779e
mov eax, 0x1010
mov dword [ebp - 0x20], edx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x24], edi
jmp 0x4677bb
lea eax, [ebp - 0x30]
xor edx, edx
push eax
push 1
push edi
mov ecx, esi
call fcn.00462af0
add esp, 0xc
test eax, eax
jne 0x467816
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.00466d50
mov ecx, dword [ebp + 0xc]
add esp, 8
test dword [ebp - 0x28], 0x2460
mov dword [ecx], eax
jne 0x4677de
cmp dword [ebp - 0x18], 0
je 0x4677e6
lea ecx, [ebp - 0x30]
call fcn.00462130
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0x598b4c
push 0x11195
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.00446b80
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbe50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00525d00
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4bbeb6
cmp dword [ebp - 0x110], 2
jne 0x4bbeb6
cmp dword [ebp - 0x11c], 6
jb 0x4bbeb6
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret

Function at 0x4bbed0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.wlanapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x648138], eax
test eax, eax
jne 0x4bbeee
xor al, al
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WlanFreeMemory
push eax
call esi
push str.WlanCloseHandle
push dword [0x648138]
mov dword [0x648134], eax
call esi
push str.WlanEnumInterfaces
push dword [0x648138]
mov dword [0x64812c], eax
call esi
push str.WlanOpenHandle
push dword [0x648138]
mov dword [0x64811c], eax
call esi
push str.WlanAllocateMemory
push dword [0x648138]
mov dword [0x648130], eax
call esi
push str.WlanGetProfile
push dword [0x648138]
mov dword [0x64813c], eax
call esi
push str.WlanSetProfile
push dword [0x648138]
mov dword [0x648118], eax
call esi
push str.WlanGetProfileList
push dword [0x648138]
mov dword [0x648120], eax
call esi
cmp dword [0x648134], 0
mov dword [0x648124], eax
je 0x4bc05c
cmp dword [0x64812c], 0
je 0x4bc05c
cmp dword [0x64811c], 0
je 0x4bc05c
cmp dword [0x648130], 0
je 0x4bc05c
cmp dword [0x64813c], 0
je 0x4bc05c
cmp dword [0x648118], 0
je 0x4bc05c
cmp dword [0x648120], 0
je 0x4bc05c
test eax, eax
je 0x4bc05c
mov dword [ebp - 4], 0
mov esi, 1
call fcn.004bbe50
test al, al
mov ecx, 2
push 0x21c
cmovne esi, ecx
call dword [0x64813c]
push 0x21c
push 0
push eax
mov dword [0x648114], eax
call fcn.00525d00
add esp, 0xc
push 0x20c
call dword [0x64813c]
push 0x648128
mov dword [0x648110], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
call dword [0x648130]
test eax, eax
jne 0x4bc05c
push 0x648114
push eax
push dword [0x648128]
call dword [0x64811c]
test eax, eax
pop esi
sete al
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bc070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563d93
mov eax, dword fs:[0]
push eax
mov eax, 0x105c
call fcn.00535d00
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1064], 0
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1068], esi
mov dword [ebp - 0x1014], 7
mov dword [ebp - 0x1018], 0
mov word [ebp - 0x1028], ax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1040]
push 0x11
mov dword [ebp - 0x1030], eax
mov dword [ebp - 0x102c], eax
push str.SoftwareLastPass
mov dword [ebp - 0x102c], 7
mov dword [ebp - 0x1030], eax
mov word [ebp - 0x1040], ax
call fcn.00404140
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1060]
cmp dword [ebp - 0x102c], 8
lea eax, [ebp - 0x1040]
push ecx
cmovae eax, dword [ebp - 0x1040]
push 0x2001f
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bc286
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x105c], 0x800
push eax
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push str.LPInstallDir
push dword [ebp - 0x1060]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bc27a
mov eax, dword [ebp - 0x105c]
xor ecx, ecx
shr eax, 1
dec eax
mov word [ebp - 0x1058], cx
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1044], 0
lea ecx, [ebp - 0x1058]
push eax
mov dword [ebp - 0x1044], 7
mov dword [ebp - 0x1048], 0
call fcn.00404140
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1014], 8
jb 0x4bc1f6
push dword [ebp - 0x1028]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
lea ecx, [ebp - 0x1028]
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1018], 0
push eax
call fcn.00404450
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1044], 8
jb 0x4bc240
push dword [ebp - 0x1058]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], eax
mov ecx, esi
mov word [ebp - 0x1058], ax
mov word [esi], ax
lea eax, [ebp - 0x1028]
push eax
mov dword [ebp - 0x1044], 7
mov dword [ebp - 0x1048], 0
call fcn.00404450
jmp 0x4bc2a6
push dword [ebp - 0x1060]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x58d0e4
mov word [esi], ax
call fcn.00404140
mov dword [ebp - 0x1064], 1
mov byte [ebp - 4], 1
cmp dword [ebp - 0x102c], 8
jb 0x4bc2cb
push dword [ebp - 0x1040]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x102c], 7
mov dword [ebp - 0x1030], eax
mov word [ebp - 0x1040], ax
mov byte [ebp - 4], al
cmp dword [ebp - 0x1014], 8
jb 0x4bc2fe
push dword [ebp - 0x1028]
call fcn.00443e80
add esp, 4
xor eax, eax
mov dword [ebp - 0x1014], 7
mov dword [ebp - 0x1018], eax
mov word [ebp - 0x1028], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret