joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42294c
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x422954
push ecx
push ebx
xor eax, eax
push ebp
push 0x422b73
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 0x422b88
call fcn.0040d108
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x422b98
call fcn.0040488c
pop edx
call fcn.0040488c
call fcn.004030f4
mov eax, dword [0x425ddc]
cmp byte [eax], 0
je 0x422b58
call fcn.004225d4
test al, al
je 0x4229db
lea edx, [ebp - 0x14]
mov eax, 0x422b88
call fcn.0040d108
mov eax, dword [ebp - 0x14]
mov edx, 0x422bb8
call fcn.004045bc
jne 0x422b58
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.0040733c
lea edx, [ebp - 0x1c]
mov eax, dword [0x425d70]
mov eax, dword [eax]
call fcn.00413348
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0040c45c
test al, al
je 0x422b58
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
call fcn.00404dc8
mov edx, 0x422bc4
call fcn.0040488c
call fcn.004030f4
push 0
push 0
mov eax, 0x422be4
call fcn.0040d2e8
imul eax, eax, 0x3e8
xor edx, edx
call fcn.0040be24
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004072b4
push dword [ebp - 0x20]
push 0x422bf4
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404530
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404670
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x28]
call fcn.00404670
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 4]
call fcn.004041cc
lea edx, [ebp - 8]
mov eax, 0x422c00
call fcn.0040d108
cmp dword [ebp - 8], 0
je 0x422aca
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0x422c14
call fcn.004044bc
lea edx, [ebp - 8]
mov eax, 0x422c2c
call fcn.0040d108
cmp dword [ebp - 8], 0
je 0x422aed
lea eax, [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, 0x422c3c
call fcn.004044bc
push 0
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004044bc
mov eax, dword [ebp - 0x2c]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
call fcn.004027c0
test eax, eax
jle 0x422b58
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
add ebx, 0xbb8
xor edx, edx
mov eax, 0xc8
call fcn.0040be24
mov eax, dword [ebp - 0xc]
call fcn.0041d678
test al, al
jne 0x422b58
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x422b54
cmp eax, dword [esp]
pop edx
pop eax
jae 0x422b21
jmp 0x422b58
pop edx
pop eax
jge 0x422b21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422b7a
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.004041f0
ret
Function at 0x404e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x184
lea eax, [ebp - 0x18]
lea esi, [ebp - 0x18c]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x495650
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push 0xc8
push 0
push esi
call fcn.00496e90
add esp, 0xc
xorps xmm0, xmm0
lea eax, [0x49a859]
lea edi, [ebp - 0xc4]
mov dword [esi - 4], 0xcc
mov dword [esi + 0x28], 1
movups xmmword [ebp - 0x34], xmm0
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xe5ea38f
mov edx, dword [edi]
call fcn.00404248
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [edi + 0x20], xmm0
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
cmp ecx, 0x2f
ja 0x404ebe
mov edx, dword [ecx + 0x4aa160]
xor edx, dword [eax + ecx]
mov dword [ebp + ecx - 0xc4], edx
add ecx, 4
jmp 0x404ea4
movzx ecx, byte [eax + 0x32]
movzx eax, word [eax + 0x30]
lea ebx, [ebp - 0xc4]
xor eax, 0x33dc
xor cl, 0x8d
mov word [ebx + 0x30], ax
mov byte [ebx + 0x32], cl
push 0x33
pop esi
lea eax, [ebp - 0x84]
push esi
push edi
push eax
call fcn.00496910
add esp, 0xc
mov ecx, esi
call fcn.004192de
mov edi, eax
mov dword [ebp - 0x24], edx
push esi
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00496910
add esp, 0xc
add esi, edi
mov dword [ebx + 4], edi
mov edx, ebx
mov dword [ebx + 8], esi
and word [ebx + 0xc], 0
lea esi, [ebp - 0x84]
mov dword [ebx], 1
mov ecx, esi
call fcn.00402ad7
mov ebx, dword [esi]
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x190]
push eax
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push ebx
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x404f81
push dword [ebp - 0x34]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x30]
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 0x80]
mov ecx, ebx
call fcn.00476be3
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.0041930f
xor esi, esi
jmp 0x405005
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x38]
lea esi, [ebp - 0x50]
lea edx, [ebp - 0xc4]
mov dword [esi], ecx
mov dword [ecx], eax
xor ecx, ecx
mov dword [edx], str.Failed_to_start_process:
mov dword [esi + 4], fcn.00412720
inc ecx
mov dword [edx + 4], ecx
and dword [edx + 0x10], 0
mov dword [edx + 8], esi
lea esi, [ebp - 0x90]
mov dword [edx + 0xc], ecx
mov ecx, esi
call fcn.00402ef6
mov eax, dword [esi]
movsd xmm0, qword [esi + 4]
mov dword [ebp - 0x20], eax
movups xmmword [ebp - 0x48], xmm0
mov al, byte [0x506aa0]
push 0xc
pop ecx
push 4
pop edx
call fcn.0040ed70
test eax, eax
je 0x40501b
mov esi, eax
mov eax, dword [ebp - 0x20]
movups xmm0, xmmword [ebp - 0x48]
mov ecx, ebx
mov dword [esi], eax
movlps qword [esi + 4], xmm0
mov edx, dword [ebp - 0x80]
call fcn.00476be3
mov edx, dword [ebp - 0x24]
mov ecx, edi
call fcn.0041930f
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x184
pop esi
pop edi
pop ebx
pop ebp
ret
and dword [ebp - 0x10], 0
push 4
pop ecx
push 0xc
pop edx
call fcn.004a4fb0
ud2
Function at 0x409a51
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x180
mov dword [esp + 0xc], ecx
lea esi, [esp + 0xe8]
push 0x10
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov byte [esi + 0x40], 0
push 8
pop ecx
lea eax, [esp + 0xc0]
mov esi, 0x4aa140
mov ebx, dword [ebp + 8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
cmp ebx, 0x3f
ja 0x409ac7
mov esi, edx
push 0x40
pop edx
lea ecx, [esp + 0xe8]
push 0x4a99c0
push ebx
call fcn.00402cbd
pop ecx
pop ecx
mov ecx, eax
push 0x4a99d0
push ebx
push esi
call fcn.00479457
add esp, 0xc
jmp 0x409b15
lea ecx, [esp + 0xc0]
mov edi, ebx
mov esi, ebx
shr ebx, 6
and dword [ecx + 0x24], 0
and edi, 0xffffffc0
and esi, 0x3f
mov dword [ecx + 0x20], ebx
add edi, edx
push ebx
call fcn.0047750c
pop eax
push 0x40
pop edx
lea ecx, [esp + 0xe8]
push 0x4a99a0
push esi
call fcn.00402cbd
pop ecx
pop ecx
mov ecx, eax
push 0x4a99b0
push esi
push edi
call fcn.00479457
add esp, 0xc
mov ebx, esi
lea esi, [esp + 0xc0]
mov byte [esi + 0x68], bl
push 0x1c
pop ecx
lea eax, [esp + 0x50]
xorps xmm0, xmm0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x78]
mov dword [esp], eax
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movzx eax, byte [esi + 0x40]
mov ebx, dword [esi - 8]
mov edi, dword [esi - 4]
lea ecx, [eax*8]
mov byte [esp + eax + 0x78], 0x80
mov dword [esp + 8], eax
inc eax
mov dword [esp + 4], ecx
push 0x40
pop edx
mov ecx, esi
push 0x4a99e0
push eax
call fcn.00402c9e
pop ecx
pop ecx
test edx, edx
je 0x409b84
mov byte [eax], 0
inc eax
dec edx
jmp 0x409b79
shld edi, ebx, 9
shl ebx, 9
mov eax, dword [esp + 8]
or ebx, dword [esp + 4]
bswap edi
not eax
bswap ebx
test al, 0x38
jne 0x409bcd
mov ecx, esp
mov edx, esi
call fcn.00404d29
lea edx, [esp + 0x130]
xorps xmm0, xmm0
mov ecx, esp
and dword [edx + 0x34], 0
and dword [edx + 0x30], 0
movaps xmmword [edx + 0x20], xmm0
movaps xmmword [edx + 0x10], xmm0
movaps xmmword [edx], xmm0
mov dword [edx + 0x3c], ebx
mov dword [edx + 0x38], edi
jmp 0x409bdf
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], ebx
mov ecx, esp
mov edx, esi
call fcn.00404d29
mov byte [esp + 0xb8], 0
push 0xffffffffffffffe0
pop eax
mov ecx, dword [esp]
test eax, eax
je 0x409c05
mov edx, dword [ecx + eax + 0x20]
bswap edx
mov dword [esp + eax + 0x30], edx
add eax, 4
jmp 0x409bf2
lea eax, [esp + 0x10]
lea esi, [esp + 0x30]
push 0x20
pop edx
mov ecx, esi
push 0x4a992c
push 0x20
push eax
call fcn.00479457
add esp, 0xc
movaps xmm0, xmmword [esi]
movaps xmm1, xmmword [esi + 0x10]
lea eax, [esp + 0x130]
lea esi, [esp + 0x50]
movaps xmmword [eax], xmm0
xorps xmm0, xmm0
movaps xmmword [eax + 0x10], xmm1
movaps xmmword [esi], xmm0
push 0x10
pop edx
mov ecx, esi
push 0x4aa498
push 0x10
push eax
call fcn.00479457
add esp, 0xc
movaps xmm0, xmmword [esi]
mov eax, dword [esp + 0xc]
movups xmmword [eax], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x417420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x417470
cmp esi, edi
ja 0x4174d8
cmp edi, dword [esp + 0x1c]
ja 0x4174eb
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x417472
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x417460
jmp 0x4174cf
ja 0x417478
cmp eax, edx
mov esi, edi
jne 0x417433
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x4174b0
mov ebp, esi
sub ecx, edx
jns 0x4174c7
jmp 0x4174d1
cmp esi, edi
je 0x417500
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4174d1
xor al, 1
cmp ebp, edi
jne 0x417490
jmp 0x4174d1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x4ac1cc
call fcn.004a54e0
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x4ac1cc
call fcn.004a52d0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x4ac1bc
call fcn.004a5340
add esp, 4
ud2
Function at 0x4191fb
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push eax
mov edi, esp
mov esi, ecx
and dword [edi], 0
push edi
push 0
push 0
push 0x4acb60
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
mov eax, dword [edi]
je 0x419219
push eax
call sub.ole32.dll_CoTaskMemFree
mov byte [esi + 0xc], 2
jmp 0x419233
push eax
call sub.kernel32.dll_lstrlenW
mov edx, dword [esp]
mov ecx, esi
push eax
call fcn.0047e820
pop eax
push dword [esp]
call sub.ole32.dll_CoTaskMemFree
add esp, 4
pop esi
pop edi
ret
Function at 0x43170c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x130
mov edi, dword [esp + 0x148]
mov ebx, dword [esp + 0x144]
call fcn.00431729

Function at 0x436e77
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [0x5069b8]
mov esi, ecx
test ebp, ebp
jne 0x436f6f
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x436eca
mov ebx, eax
push str.WaitOnAddress
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436eca
mov edi, eax
push str.WakeByAddressSingle
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436eca
mov ebx, eax
mov dword [esp], 0
jmp 0x436f31
push 0x4cb0a0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x436f7d
mov edi, eax
push str.NtCreateKeyedEvent
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436f7d
mov ebp, eax
push str.NtReleaseKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436f7d
mov ebx, eax
push str.NtWaitForKeyedEvent
push edi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x436f7d
mov edi, eax
mov dword [esp], ebx
lea eax, [esp + 4]
push 0
push 0
push 0xc0000000
push eax
call ebp
test eax, eax
jne 0x436f7d
mov ebx, dword [esp + 4]
push 0xc
pop ecx
call fcn.00436b45
mov ebp, eax
mov eax, dword [esp]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ebx
xor eax, eax
lock cmpxchg dword [0x5069b8], ebp
je 0x436f6f
cmp dword [ebp], 0
mov edi, eax
je 0x436f63
push dword [ebp + 8]
call sub.kernel32.dll_CloseHandle
push 4
pop edx
mov ecx, ebp
call fcn.0040edd0
mov ebp, edi
and dword [esi + 4], 0
mov dword [esi], ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5b
pop edx
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
push 0x4cb1a0
call fcn.004a6406
pop eax
ud2
Function at 0x43fef4
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x58]
mov edx, dword [edx + 0x60]
push 0x4cf14c
push dword [edi + 0x50]
call fcn.0043fcde
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x80]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x44002d
test eax, eax
je 0x43ffc3
cmp eax, 0x90317
je 0x440026
cmp eax, 0x90321
jne 0x44003a
mov dword [edi + 0x20], 0x10000
mov byte [edi + 0x24], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x43ffae
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0043fea9
and dword [edi + 0xa0], 0
jmp 0x44004b
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x58]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x60]
and dword [edi + 0x48], 0
lea ebx, [edi + 0x40]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.00440063
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.0048fc4e
pop eax
and dword [edi + 0x3c], 0
and dword [edi + 0x38], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x44000a
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0043fea9
mov eax, dword [edi + 0x50]
xor ecx, ecx
or eax, dword [edi + 0x54]
sete cl
mov dword [edi + 0xa0], ecx
jmp 0x44004b
mov word [esi], 0x104
jmp 0x440050
cmp dword [esp + 0x10], 4
jne 0x440042
mov eax, dword [esp + 0xc]
jmp 0x440045
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x440050
xor eax, eax
inc eax
mov dword [edi + 0xa0], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440319
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x100]
mov edx, dword [edx + 0x108]
push 0x4cf14c
push dword [edi + 0xf8]
call fcn.0043fcde
pop ecx
pop ecx
test eax, eax
mov ecx, esp
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [esp + 0x30]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x128]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x44047f
test eax, eax
je 0x4403fa
cmp eax, 0x90317
je 0x440478
cmp eax, 0x90321
jne 0x44048c
mov dword [edi + 0xc8], 0x10000
mov byte [edi + 0xcc], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x4403e5
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004402c2
and dword [edi + 0x148], 0
jmp 0x44049d
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x100]
mov ebp, dword [esp + 0xc]
mov edx, dword [edi + 0x108]
and dword [edi + 0xf0], 0
lea ebx, [edi + 0xe8]
sub eax, ecx
add ebp, eax
push ebp
push eax
call fcn.00440063
pop ecx
pop ecx
mov ebp, edx
mov edx, eax
mov ecx, ebx
push ebp
call fcn.0048fc4e
pop eax
and dword [edi + 0xe4], 0
and dword [edi + 0xe0], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x440456
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.004402c2
mov eax, dword [edi + 0xf8]
xor ecx, ecx
or eax, dword [edi + 0xfc]
sete cl
mov dword [edi + 0x148], ecx
jmp 0x44049d
mov word [esi], 0x104
jmp 0x4404a2
cmp dword [esp + 0x10], 4
jne 0x440494
mov eax, dword [esp + 0xc]
jmp 0x440497
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4404a2
xor eax, eax
inc eax
mov dword [edi + 0x148], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4493d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x890
mov dword [esp + 0x30], ecx
mov ecx, dword [edx]
mov ebx, dword [ebp + 8]
call fcn.004493ed
Function at 0x465258
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x150
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x78], 2
and dword [esp + 0x88], 0
mov ecx, dword [esi + 0x100]
mov dword [esi + 0x100], 3
cmp ecx, 3
je 0x4653c1
lea eax, [esp + 0x3c]
add esi, 0x104
mov dword [eax - 4], ecx
push 0xd
pop ecx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x20]
mov eax, dword [ebx + 0x3c]
and dword [ebx + 0x3c], 0
cmp eax, 1
je 0x4652cd
cmp eax, 2
jne 0x4653df
lea ecx, [esp + 0x38]
jmp 0x4653bc
mov al, byte [esp + 0x60]
movsd xmm1, qword [esp + 0x40]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 8], edx
movsd xmm0, qword [esp + 0x38]
mov esi, dword [esp + 0x68]
movzx edx, word [esp + 0x6c]
mov byte [esp + 3], al
mov al, byte [esp + 0x6e]
movsd qword [ecx + 8], xmm1
movsd xmm1, qword [esp + 0x48]
movsd qword [ecx], xmm0
movsd qword [ecx + 0x10], xmm1
mov dword [ecx + 0x18], esi
mov byte [ecx + 0x1e], al
mov byte [esp + 2], al
mov word [ecx + 0x1c], dx
call fcn.00448835
test eax, eax
je 0x4653b8
mov ecx, dword [esp + 4]
cmp byte [esp + 3], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], eax
je 0x46534d
mov al, byte [esp + 2]
or al, 1
mov byte [esp + 0x36], al
movsd xmm1, qword [esp + 0x28]
lea edi, [esp + 0x90]
movsd xmm0, qword [esp + 0x30]
movsd xmm2, qword [esp + 0x18]
lea esi, [esp + 0xc]
mov ecx, esi
movsd qword [edi + 0x18], xmm1
movsd xmm1, qword [esp + 0x20]
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 8], xmm2
movsd qword [edi + 0x10], xmm1
mov byte [edi], 0
call fcn.0041fbf6
mov edx, dword [esp + 8]
lea ecx, [eax + 0x64]
push edi
call fcn.004653f4
pop eax
mov ecx, esi
call fcn.0041fb83
cmp dword [eax + 0x3c], 0
jle 0x4653b4
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.004205b4
mov bl, 1
jmp 0x4653c3
lea ecx, [esp + 0x18]
call fcn.0044809c
xor ebx, ebx
lea esi, [esp + 0x70]
mov ecx, esi
call fcn.0041c88f
mov ecx, esi
call fcn.0044892e
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x23
pop edx
mov ecx, str.wasnt_expecting_a_frame_to_reclaim
push 0x4cc648
call fcn.004a826b
pop eax
ud2
Function at 0x46d32c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, edx
mov edx, dword [esp + 0x38]
lea edi, [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, edi
push 0xb
call fcn.0046d303
pop eax
mov eax, esp
mov ecx, 0x800
mov dword [eax], 0x800
lea eax, [esp + 8]
and dword [eax], 0
call fcn.004192de
lea esi, [esp + 0xc]
mov edi, dword [edi]
mov ebx, eax
mov dword [esi], eax
mov dword [esi + 4], edx
and dword [esi + 8], 0
mov eax, esp
push eax
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push edi
push ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x46d39f
mov edx, dword [esp]
mov ecx, esi
call fcn.0041924d
mov ebx, dword [esp + 0xc]
jmp 0x46d375
test eax, eax
jne 0x46d3be
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
jbe 0x46d3da
mov eax, 0xde
jmp 0x46d3c2
mov edx, dword [esp + 4]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], eax
mov byte [edx + 0xc], 0xc
mov edx, dword [esp + 0x10]
mov ecx, ebx
call fcn.0041930f
jmp 0x46d3ee
mov ecx, dword [esp + 0x14]
movsd xmm0, qword [esp + 0xc]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
mov edx, dword [esp + 0x1c]
mov ecx, edi
call fcn.00476be3
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x476f04
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [edx + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
and dword [esp + 0x20], 0
and dword [esp + 0x1c], 0
and dword [esp + 0x28], 0
and dword [esp + 0x24], 0
and dword [esp + 0x30], 0
and dword [esp + 0x2c], 0
and dword [esp + 0x38], 0
and dword [esp + 0x34], 0
and dword [esp + 0x3c], 0
and dword [esp + 0x44], 0
mov dword [esp + 0x10], 4
mov dword [esp], ecx
mov dword [esp + 0x40], 0x400010
test eax, eax
je 0x476f6c
mov ecx, dword [edx + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x18]
test eax, eax
je 0x476f8e
mov edi, dword [edx + 0x20]
xor ecx, ecx
test edi, edi
je 0x476f8a
movzx esi, byte [eax]
inc eax
or ecx, dword [esi*4 + 0x4fa968]
dec edi
jne 0x476f7c
mov dword [esp + 0x30], ecx
mov ebp, dword [edx + 8]
lea edi, [ebp*4]
test ebp, ebp
je 0x476fcf
cmp ebp, 0x20000000
jae 0x477051
mov esi, dword [edx]
push 4
pop ecx
mov edx, edi
call fcn.004119d4
test eax, eax
je 0x477058
mov ebx, eax
xor eax, eax
mov ecx, dword [esi + eax*4]
mov dword [ebx + eax*4], ecx
inc eax
cmp ebp, eax
jne 0x476fc0
mov eax, ebp
jmp 0x476fd4
xor eax, eax
push 4
pop ebx
lea ecx, [esp + 0x10]
mov dword [ecx + 4], eax
lea eax, [esp + 4]
mov dword [ecx + 8], ebx
push 0
push eax
push 0
push 0
push ecx
push 0
push 2
push 0x4d0ae7
push 0
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x47700a
mov ecx, dword [esp]
and dword [ecx], 0
mov dword [ecx + 4], eax
jmp 0x477039
mov dword [esp + 0xc], edi
mov edi, dword [esp + 8]
mov esi, dword [esp + 4]
push 0x10
pop ecx
call fcn.00411a7b
xor ecx, ecx
mov edx, dword [esp]
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov edi, dword [esp + 0xc]
mov dword [edx + 4], eax
mov byte [edx], 4
test ebp, ebp
je 0x477049
push 4
pop edx
mov ecx, ebx
push edi
call fcn.0040416c
pop eax
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004102c0
ud2
push 4
pop ecx
mov edx, edi
call fcn.004a4fb0
ud2

Function at 0x4774c9
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov eax, esp
mov esi, ecx
and dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x4774e8
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4774f1
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 4
pop esi
ret