joyce8/EMBER2024-capa huggingface dataset:
Function at 0x82bcd8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x82be28
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x82bcfe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82bcea
add dl, dl
jne 0x82bd09
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82bd5c
xor eax, eax
add dl, dl
jne 0x82bd16
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82bdfd
add dl, dl
jne 0x82bd25
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82bd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82bd3b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82bd46
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x82bd52
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x82bcf5
mov eax, 1
add dl, dl
jne 0x82bd6a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x82bd75
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x82bd61
sub eax, ebx
mov ebx, 1
jne 0x82bda8
mov ecx, 1
add dl, dl
jne 0x82bd8e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x82bd99
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x82bd85
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x82bcf5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x82bdbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x82bdca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x82bdb6
cmp eax, 0x7d00
jae 0x82bded
cmp eax, 0x500
jb 0x82bde8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x82bcf5
cmp eax, 0x7f
ja 0x82bdf0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x82bcf5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x82be1e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x82bcf5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4255e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583860
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00553fc1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0053ef7a
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431980
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x431a7b
xor eax, eax
cmp ax, word [esi]
je 0x431a7b
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4319b0
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x431a7b
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00556260
push 0x5bd3ec
push esi
push 0x5bd3f4
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00435110
add esp, 0x20
lea ecx, [ebp - 0x210]
mov edx, edi
call fcn.00431770
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x431a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x431a38
cmp eax, 0x91
jne 0x431a69
push ecx
mov ecx, esi
call fcn.00431a90
add esp, 4
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x431a67
test eax, eax
je 0x431a67
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
xor edi, edi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00553daa
mov esp, ebp
pop ebp
ret
Function at 0x431a90
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x374
mov eax, dword [0x61094c]
xor eax, esp
mov dword [esp + 0x370], eax
push ebx
push esi
push edi
push 0x110
xor ebx, ebx
lea eax, [esp + 0x18]
push ebx
push eax
mov esi, ecx
call fcn.00556260
add esp, 0xc
mov dword [esp + 0x10], 0x114
test esi, esi
je 0x431bf9
xor eax, eax
cmp ax, word [esi]
je 0x431bf9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x431b06
lea eax, [ebx + 0x11]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [esp + 0x20], 2
push 0x250
sete al
mov dword [esp + 0x10], eax
lea eax, [esp + 0x12c]
push 0
push eax
call fcn.00556260
add esp, 0xc
lea eax, [esp + 0x128]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x431b4b
call edi
test eax, eax
jmp 0x431b5a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [esp + 0x128], 0x10
jne 0x431b6e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esp + 0xc], ebx
je 0x431b9e
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x431be2
call edi
call edi
mov ebx, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [esp + 0x12c]
push 0
push eax
call fcn.00556260
add esp, 0xc
lea eax, [esp + 0x128]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov edx, 0x5bd41c
lea ecx, [esp + 0x128]
call fcn.00431c20
test eax, eax
jne 0x431be2
call edi
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x37c]
mov eax, 0x57
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
Function at 0x437040
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00554640
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x1008]
xor bl, bl
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x437088
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp - 0x1008]
xor esi, esi
shr edi, 2
test edi, edi
je 0x4370bc
nop dword [eax]
mov eax, dword [ebp + esi*4 - 0x1004]
test eax, eax
je 0x4370b7
push eax
call fcn.00436a50
mov bl, al
test bl, bl
jne 0x4370bc
inc esi
cmp esi, edi
jb 0x4370a0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553daa
mov esp, ebp
pop ebp
ret
Function at 0x43f940
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585768
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x2c], edx
mov dword [edx], vtable.external_client_impl.0
mov dword [edx + 4], vtable.external_client_impl.1.0
movq xmm0, qword [0x620678]
movq qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edx + 8], eax
xorps xmm0, xmm0
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], 0xc8
movups xmmword [edx + 0x18], xmm0
movq qword [edx + 0x28], xmm0
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [ebp - 4], 0
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov dword [edx + 0x48], 0
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
lea eax, [edx + 0x60]
mov dword [edx + 0x58], 0
mov byte [edx + 0x5c], 0
mov dword [ebp - 0x20], eax
mov dword [eax], edx
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 3
lea ebx, [eax + 0x1c]
push 0x3c
mov dword [eax + 0x18], 0
mov dword [ebp - 0x14], ebx
call fcn.00553fc1
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
xorps xmm0, xmm0
movq qword [edi], xmm0
lea esi, [edi + 0xc]
mov dword [edi + 8], 0
push 2
push esi
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_obj2_class_std::mutex_.0
call fcn.0053fbd9
xorps xmm0, xmm0
lea eax, [ebx + 8]
movq qword [ebx], xmm0
push eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
call fcn.0053f7cc
add esp, 0xc
mov edi, dword [ebp - 0x1c]
lea esi, [edi + 0x60]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x7c], 0
xorps xmm0, xmm0
mov word [esi + 0x80], 0
movq qword [esi + 0x84], xmm0
mov byte [ebp - 4], 7
cmp byte [0x61141f], 6
ja 0x43fae9
push 6
push 0x5be1f8
call fcn.00443e90
add esp, 8
push 4
call fcn.00553fc1
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x448500
push 0
push 0
call fcn.00567cbd
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x43fb71
cmp dword [esi + 0x88], 0
jne 0x43fb7f
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x84], ecx
mov dword [esi + 0x88], eax
mov al, byte [0x61141f]
cmp al, 6
ja 0x43fb53
push dword [edi + 0xc]
push dword [edi + 8]
push 6
push 0x5be328
call fcn.00443e90
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x24], 0
call fcn.0053fc77
call fcn.005602b1
int3
Function at 0x448b90
Capabilities:
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5863ad
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x7ffe026c]
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
cmp ax, 6
jb 0x448bdd
ja 0x448bd9
jne 0x448bdd
cmp word [0x7ffe0270], 2
jb 0x448bdd
mov al, 1
jmp 0x448bdf
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret
Function at 0x44a950
Capabilities:
Get file version info

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x208]
mov esi, ecx
push eax
push 0x200
push 0
push edx
push 2
mov dword [ebp - 0x20c], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x44ab48
lea eax, [ebp - 0x214]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0
push eax
push 0x5bd3e8
lea eax, [ebp - 0x208]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44ab48
cmp dword [ebp - 0x214], 0x34
jne 0x44ab64
mov edi, dword [ebp - 0x210]
cmp dword [edi], 0xfeef04bd
jne 0x44ab7f
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 0x20]
mov esi, dword [edi + 0x24]
mov dword [ebp - 0x218], eax
movzx eax, ax
mov dword [ebp - 0x21c], eax
movzx eax, cx
shr ecx, 0x10
mov dword [ebp - 0x220], ecx
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x23c], edx
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x224], eax
movzx eax, cx
shr ecx, 0x10
mov dword [ebp - 0x228], ecx
mov ecx, dword [edi + 0x14]
mov dword [ebp - 0x22c], eax
movzx eax, cx
mov dword [ebp - 0x234], eax
mov eax, dword [edi + 0x1c]
and eax, dword [edi + 0x18]
mov edi, dword [edi + 0x28]
shr ecx, 0x10
mov dword [ebp - 0x230], ecx
mov ecx, dword [edx + 0x2c]
mov dword [ebp - 0x238], eax
movzx eax, cx
shr ecx, 0x10
mov dword [ebp - 0x244], ecx
mov ecx, dword [edx + 0x30]
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 0x240], esi
mov esi, dword [ebp - 0x20c]
mov dword [ebp - 0x248], eax
mov byte [edx + 0x28], 1
mov edx, dword [ebp - 0x218]
movzx eax, cx
shr ecx, 0x10
shr edx, 0x10
mov word [esi], dx
mov edx, dword [ebp - 0x21c]
mov word [esi + 2], dx
mov edx, dword [ebp - 0x220]
mov word [esi + 4], dx
mov edx, dword [ebp - 0x224]
mov word [esi + 6], dx
mov edx, dword [ebp - 0x228]
mov word [esi + 8], dx
mov edx, dword [ebp - 0x22c]
mov word [esi + 0xa], dx
mov edx, dword [ebp - 0x230]
mov word [esi + 0xc], dx
mov edx, dword [ebp - 0x234]
mov word [esi + 0xe], dx
mov edx, dword [ebp - 0x238]
mov dword [esi + 0x10], edx
mov edx, dword [ebp - 0x23c]
mov dword [esi + 0x14], edx
mov edx, dword [ebp - 0x20c]
mov esi, dword [ebp - 0x240]
mov dword [edx + 0x18], esi
mov esi, edx
mov edx, dword [ebp - 0x244]
mov dword [esi + 0x1c], edi
mov word [esi + 0x20], dx
mov edx, dword [ebp - 0x248]
mov word [esi + 0x22], dx
mov word [esi + 0x24], cx
mov word [esi + 0x26], ax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00553daa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi + 0x28], 0
mov dword [esi], eax
mov dword [esi + 4], 0x6206c0
mov dword [esi + 8], 0
jmp 0x44ab33
mov eax, dword [0x620684]
mov byte [esi + 0x28], 0
mov dword [esi], 0x73
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jmp 0x44ab33
mov eax, dword [0x620684]
mov byte [esi + 0x28], 0
mov dword [esi], 0x68
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jmp 0x44ab33
Function at 0x44b4a0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586690
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x240
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x244], edi
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x200
push 0x100
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x44b572
nop
mov ecx, dword [ebp - 0x38]
mov eax, ecx
shr eax, 1
cmp edx, eax
jb 0x44b5c3
lea esi, [edx + edx]
cmp esi, ecx
jbe 0x44b55f
push esi
call fcn.00553fc1
mov ecx, dword [ebp - 0x40]
add esp, 4
mov dword [ebp - 0x40], eax
test ecx, ecx
je 0x44b555
push ecx
call fcn.00553da5
mov eax, dword [ebp - 0x40]
add esp, 4
mov ecx, esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
jmp 0x44b562
mov eax, dword [ebp - 0x3c]
shr ecx, 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
jne 0x44b520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [edi + 0x18], 0
mov dword [edi], eax
mov dword [edi + 4], 0x6206c0
mov dword [edi + 8], 0
mov dword [edi + 8], 0
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x44b5a3
push eax
call fcn.00553da5
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x24c]
mov byte [ebp - 0x244], 0
push dword [ebp - 0x244]
mov dword [ebp - 0x248], edx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044a4c0
movups xmm0, xmmword [ebp - 0x2c]
mov byte [edi + 0x18], 1
add esp, 0xc
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [edi + 0x10], xmm0
jmp 0x44b593
Function at 0x44b7e0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586718
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x260
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x26c], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x260]
mov ecx, 0x200
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
mov byte [ebp - 4], 1
shr ecx, 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
mov edx, eax
test edx, edx
je 0x44b9ea
mov ecx, dword [ebp - 0x58]
mov eax, ecx
shr eax, 1
cmp edx, eax
jae 0x44b94b
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x274]
mov byte [ebp - 0x26c], 0
push dword [ebp - 0x26c]
mov dword [ebp - 0x270], edx
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044a4c0
movups xmm0, xmmword [ebp - 0x50]
add esp, 0xc
mov byte [ebp - 0x20], 1
movups xmmword [ebp - 0x38], xmm0
movq xmm0, qword [ebp - 0x40]
movq qword [ebp - 0x28], xmm0
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x44b8d8
push eax
call fcn.00553da5
add esp, 4
lea edx, [ebp - 0x38]
mov byte [ebp - 4], 2
mov ecx, edi
call fcn.0044b620
movzx eax, byte [ebp - 0x20]
sub eax, 0
je 0x44b935
sub eax, 1
jne 0x44b944
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x44b944
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44b924
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ba23
push edx
push ecx
call fcn.00554242
add esp, 8
mov eax, edi
jmp 0x44b9cc
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x44b944
mov edx, dword [ecx]
push 1
mov edx, dword [edx]
call edx
mov eax, edi
jmp 0x44b9cc
lea esi, [edx + edx]
cmp esi, ecx
ja 0x44b95a
mov eax, dword [ebp - 0x5c]
jmp 0x44b860
push esi
call fcn.00553fc1
mov ecx, dword [ebp - 0x60]
add esp, 4
or dword [ebp - 0x264], 0x10
mov dword [ebp - 0x60], eax
test ecx, ecx
je 0x44b980
push ecx
call fcn.00553da5
mov eax, dword [ebp - 0x60]
add esp, 4
mov ecx, esi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
jmp 0x44b860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x44ba02
lea ecx, [ebp - 0x38]
call fcn.0044b4a0
jmp 0x44b8c8
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0x6206c0
mov dword [ebp - 0x30], 0
jmp 0x44b8c8
call fcn.0055ec17
int3
Function at 0x45fff0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x46015a
cmp dword [ebp - 0x1c], 0
mov dl, 1
mov ecx, dword [ebp - 0xc]
setne al
mov byte [ebp - 0x14], al
movzx eax, dl
mov byte [ebp - 8], dl
sub eax, 0
jne 0x46005a
test ecx, ecx
je 0x46005a
mov eax, dword [ecx]
push 1
mov eax, dword [eax]
call eax
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process2]
test eax, eax
je 0x46017d
mov ax, word [ebp - 0x18]
movzx esi, word [ebp - 0x1c]
test ax, ax
movzx ecx, ax
mov edx, esi
cmovne edx, ecx
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0xc]
mov al, 1
mov byte [ebp - 8], al
mov dword [ebp - 0x14], edx
movzx eax, al
sub eax, 0
jne 0x4600b6
test ecx, ecx
je 0x4600b6
mov eax, dword [ecx]
push 1
mov eax, dword [eax]
call eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x4601a5
mov eax, 0x7ffe0030
push 0
push 0x2000000
push 3
push 0
push 7
push 0x100080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x460111
push 0
push 0x100
push 0x611e38
push esi
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
jne 0x460125
test esi, esi
je 0x460111
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 0x100
jae 0x460106
mov dword [0x612038], 0x611e38
mov dword [0x61203c], eax
test esi, esi
je 0x460146
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00553daa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor dl, dl
mov dword [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x6206c0
mov dword [ebp - 0xc], ecx
jmp 0x460043
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov byte [ebp - 8], 0
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x6206c0
mov dword [ebp - 0xc], ecx
jmp 0x4600a2
add eax, 0x1e
jmp 0x4600cf
Function at 0x469100
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f4130
push 0x583075
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x24], esi
mov eax, dword [edx + 0xc]
push dword [eax]
mov eax, dword [edx + 8]
push dword [eax]
mov ecx, dword [edx + 4]
push dword [ecx]
mov ecx, dword [edx]
push dword [ecx]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret