joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4495e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477848
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], edi
mov dword [edi], vtable.MObject.0
mov dword [edi + 4], 1
mov dword [ebp - 4], 0
mov dword [edi], vtable.ISelMoveSubscriber.0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi], vtable.SelectionInfoView.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 7
mov word [edi + 0x14], ax
mov byte [ebp - 4], 2
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], 7
mov word [edi + 0x2c], ax
mov byte [ebp - 4], 3
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], 7
mov word [edi + 0x44], ax
mov byte [ebp - 4], 4
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], 7
mov word [edi + 0x5c], ax
mov byte [ebp - 4], 5
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], 7
mov word [edi + 0x74], ax
mov byte [ebp - 4], 6
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], 7
mov word [edi + 0x8c], ax
mov byte [ebp - 4], 7
mov dword [edi + 0xb4], eax
mov dword [edi + 0xb8], 7
mov word [edi + 0xa4], ax
mov byte [ebp - 4], 8
mov dword [edi + 0xbc], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x4496f9
inc dword [eax + 8]
push 5
xor eax, eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x60]
push 0x480ae8
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
call fcn.00404600
mov byte [ebp - 4], 9
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407a80
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x30], 0x10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x60]
call fcn.00404570
call fcn.004099b0
mov esi, eax
call fcn.0042f5b0
lea ecx, [ebp - 0x48]
push ecx
mov ecx, esi
mov eax, dword [eax + 0x30]
push eax
call fcn.00409880
mov dword [edi + 0xc], eax
lea ecx, [ebp - 0x78]
push 5
xor eax, eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
push 0x480ae8
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.00404600
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407a80
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x14], 0x20
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x78]
call fcn.00404570
call fcn.004099b0
mov esi, eax
call fcn.0042f5b0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
mov eax, dword [eax + 0x30]
push eax
call fcn.00409880
mov dword [edi + 0x10], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2c]
call fcn.00404570
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x48]
call fcn.00404570
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c079
mov esp, ebp
pop ebp
ret 4
Function at 0x452a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478c28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.IResponder.0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.MResponder.0
mov dword [ebp - 4], 1
mov dword [ebx + 4], vtable.IMD3DObject.0
mov dword [ebx + 8], vtable.MObject.0
mov dword [ebx + 0xc], 1
mov byte [ebp - 4], 2
mov dword [ebx], vtable.IBaseController.1.0
mov dword [ebx + 4], vtable.IBaseController.2.0
mov dword [ebx + 8], vtable.IBaseController.0
mov dword [ebp - 4], 3
mov dword [ebx], vtable.ITransController.1.0
mov dword [ebx + 4], vtable.ITransController.0
mov dword [ebx + 8], vtable.ITransController.2.0
push 0xc
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
call fcn.0046c08a
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 0x10], eax
mov byte [ebp - 4], 4
mov byte [ebx + 0x18], 1
mov dword [ebp - 4], 5
mov dword [ebx], vtable.TransController.2.0
mov dword [ebx + 4], vtable.TransController.0
mov dword [ebx + 8], vtable.TransController.1.0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
push 0xc
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
call fcn.0046c08a
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 0x30], eax
mov byte [ebp - 4], 6
push 0x170
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov byte [ebx + 0x44], 0
call fcn.0046c08a
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 7
push 0x170
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov ecx, esi
push ebx
call fcn.00425180
mov byte [ebp - 4], 6
mov edi, dword [0x6daa3e]
push 0x484fac
mov dword [ebx + 0x20], eax
jmp fcn.008e15e7
Function at 0x459a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479ac3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], ecx
push pe_nt_image_headers32
mov dword [ebp - 0x20], 0
call fcn.0046c08a
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movq qword [eax], xmm0
lea edi, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_class_AcceptCommand_.0
mov dword [ebp - 0x2c], edi
mov eax, dword [esi]
mov dword [edi], vtable.MUndoRedoCommand.0
mov byte [ebp - 4], 2
mov dword [edi + 4], eax
lea eax, [edi + 8]
mov dword [edi], vtable.AcceptCommand.0
push 0xc
mov dword [ebp - 0x18], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0046c08a
mov ecx, dword [ebp - 0x18]
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ecx], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
movq xmm0, qword [eax]
movq qword [edi + 0x10], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [eax]
movq qword [edi + 0x1c], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x10]
movq xmm0, qword [eax]
movq qword [edi + 0x28], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 0x14]
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x34], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [edi + 0x44], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [edi + 0x54], xmm0
movups xmm0, xmmword [eax + 0x30]
mov eax, dword [edi + 4]
movups xmmword [edi + 0x64], xmm0
test eax, eax
je 0x459b72
inc dword [eax + 0xc]
mov edi, dword [ebp + 0x18]
mov edi, dword [edi]
mov esi, dword [edi]
cmp esi, edi
je 0x459b9f
nop dword [eax]
mov eax, dword [esi + 8]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x459b8d
inc dword [eax + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.0041ccb0
mov esi, dword [esi]
mov ecx, dword [ebp - 0x18]
cmp esi, edi
jne 0x459b80
mov byte [ebp - 4], 0
xorps xmm0, xmm0
mov eax, dword [ebp - 0x1c]
movq qword [eax], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], 1
mov dword [eax + 4], edx
lea ecx, [edx + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c079
mov esp, ebp
pop ebp
ret
Function at 0x46a360
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c555
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x49c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0
mov dword [edi], vtable.MObject.0
mov dword [edi + 4], 1
mov dword [ebp - 4], 0
mov dword [edi], vtable.ILibrary.0
mov dword [ebp - 4], 1
mov dword [edi], vtable.TrussStructureLibrary.0
mov dword [edi + 8], 0
mov byte [ebp - 4], 2
call fcn.0042f5b0
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.0042f890
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x46a3eb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00404570
push 0x486690
lea ecx, [ebp - 0x2c]
call fcn.004047c0
mov byte [ebp - 4], 4
push 0x40
call fcn.0046c08a
mov esi, eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 5
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push str._cover.png
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x50]
call fcn.00413400
add esp, 0x14
mov byte [ebp - 4], 6
mov dword [ebp - 0x30], 1
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.004351c0
mov esi, eax
mov dword [ebp - 4], 4
mov ecx, 1
mov dword [ebp - 0x30], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x50]
call fcn.00404570
mov dword [edi + 8], esi
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.0046a6c0
call fcn.0042f5b0
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.0042f890
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x46a49b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
call fcn.00404570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00404570
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046c079
mov esp, ebp
pop ebp
ret
Function at 0x4a7c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a7d8c
test eax, eax
je 0x4a7d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x4c2ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4a7d73
lea edi, [eax + 4]
jmp 0x4a7cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4a7cec
mov dword [ebp - 4], 2
jmp 0x4a7d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4a7d03
mov dword [ebp - 4], 1
jmp 0x4a7d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4a7d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4a7d46
mov byte [ecx], 0x3d
jmp 0x4a7d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4a7d5d
mov byte [ecx], 0x3d
jmp 0x4a7d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4a7cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x993de1
Capabilities:
Set current directory

Disassembly:
xchg dword [esp], esi
jmp fcn.00421990
mov dword [esp + 4], esi
mov esi, 0x436a65
jmp 0x9b5df4
push 0xbbc690db
call fcn.00945f8b
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 1]
jmp 0x85b369
mov esi, dword [esi + 0x48b06f]
lea esi, [esi + 0x4f0f2c05]
jmp 0x55046d

Function at 0xa32134
Capabilities:
Check for software breakpoints

Disassembly:
xor ebx, edx
add edi, edx
jmp 0xa03ff2
jmp fcn.00776a84
jmp edi
movzx esi, cx
inc eax
sbb dh, dh
sal esi, 0xca
pop esi
clc
dec eax
arpl bp, bp
dec esp
cmp ecx, edx
inc ecx
cmp dl, 0xcc
inc esp
test ch, dl
dec esp
add edx, ebp
jmp 0x7c93f1
call 0xd39b2110
jmp 0x64b87a
push 0xb62088ce
call fcn.0054282c
xchg ebx, eax
call dword [esi - 0x108de624]
fdivr dword [eax - 0x5627982f]
cmpsb byte [esi], byte es:[edi]
push edi
jno 0xa321a5
pop edi
in al, 0x4c
salc
or al, 0xa7
leave
jp 0xa32102
xchg esi, eax
adc al, bl
xor edx, edi
jnp 0xa32169
mov dword [0x7d8fdb36], eax
mov bh, 0xc5
jl 0xa3212a
mov dl, al
push ecx
and al, 0x69
test edi, edi
dec ecx
daa
imul edi, esi, 0x27
ret 0x49f5
mov dh, 0x86
fcmovb st(0), st(5)
xchg byte [ebx + 1], bh
push ds
dec dword [edx]
insd dword es:[edi], dx
nop
inc ecx
jne 0xa321ad
fst qword [eax]
xor bl, ch
adc esp, dword [ebp - 0x4c16b4b8]
sub dword [edi - 0x1662a10d], ebp
invalid
Function at 0x6c71b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006c7140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006c7140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006c7140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006c7140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6c7bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6c7c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6d987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6c7c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6c7c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x401cf0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push 0xf01ff
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401d1a
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esp + 8]
push 1
push str.SeDebugPrivilege
push ecx
call fcn.00401ca0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x401d38
pop edi
pop esi
pop ecx
ret
mov edx, dword [esp + 0x10]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x401d56
mov eax, edi
pop edi
pop esi
pop ecx
ret
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x401d67
pop edi
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4032c8
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x4032d4
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x4032ed
push eax
je 0x4032ee
call dword [0x4050cc]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x4050cc]
ret
Function at 0x55528c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x5552a6
add esp, 0xfffffff0
call fcn.00404370
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004071fc
mov eax, dword [ebp + 0xc]
call fcn.004071fc
mov eax, dword [ebp + 8]
call fcn.004071fc
xor eax, eax
push ebp
push 0x55539e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
call fcn.004d2740
lea edx, [ebp - 0xc]
mov eax, dword [0x5523d4]
call fcn.005524f4
mov edx, dword [ebp - 0xc]
lea eax, [edi + 0x30]
call fcn.004071a0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.0040730c
push 0x5553cc
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0040730c
push 1
mov eax, dword [edi + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
call fcn.0040730c
xor eax, eax
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
jle 0x555370
mov ebx, 1
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x55536c
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
add al, 0xfe
sub al, 4
jae 0x55536c
mov dword [edi + 0x34], ebx
jmp 0x555370
inc ebx
dec esi
jne 0x555349
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5553a5
lea eax, [ebp - 0xc]
call fcn.00407188
lea eax, [ebp - 4]
call fcn.00407188
lea eax, [ebp + 8]
call fcn.00407188
lea eax, [ebp + 0xc]
call fcn.00407188
ret
Function at 0x58396c
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x583b2d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x87], 0
je 0x5839bc
cmp dword [ebx + 0x5c], 0
je 0x5839bc
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.0057ade0
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x583b17
cmp dword [ebx + 0x7c], 0
jne 0x5839e2
mov dl, 1
mov eax, dword [0x41cbb0]
call fcn.00403fdc
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x583af0
lea eax, [ebp - 8]
mov edx, dword [ebx + 0xc]
call fcn.00405968
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [0x583b3c]
push eax
movzx eax, byte [0x583b40]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x591d20]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x57293c]
call fcn.00574a80
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x583ae9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0057ade0
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.0057ade0
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x577f88]
call fcn.00406984
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1b
jge 0x583abc
mov edx, dword [0x592518]
movzx eax, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x583acd
cmp eax, 0x1007
jne 0x583ac9
mov byte [ebx + 0x74], 0x18
jmp 0x583acd
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583b17
mov eax, dword [ebp - 4]
call fcn.0040400c
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1b0]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0057ade0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583b34
lea eax, [ebp - 8]
call fcn.00405790
ret

Function at 0x585494
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004038b0
ret
Function at 0x401011
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov dword [section..data], esp
call 0x401011
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffff9d8
jmp 0x4010ad
lea eax, [ebp - 0x514]
push eax
call fcn.004012c4
push 0x40101f
lea eax, [ebp - 0x514]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x40122f
lea eax, [ebp - 0x620]
push eax
push 0x20019
push 0
push 0x40102f
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x401177
mov dword [ebp - 0x624], 0x513
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x514]
push eax
push 0
push 0
push 0x40104c
push dword [ebp - 0x620]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x620]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x401177
lea eax, [ebp - 0x514]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x514]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x401158
mov word [ebx + 1], 0x5c
push 0x40101f
lea eax, [ebp - 0x514]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x40122f
push 0x514
lea eax, [ebp - 0x514]
push eax
push 0x401051
call sub.KERNEL32.dll_GetEnvironmentVariableA
cmp eax, 0
je 0x401223
cmp eax, 0x514
jae 0x401223
mov dword [ebp - 0x628], 0
lea ebx, [ebp - 0x514]
cmp dword [ebp - 0x628], 0
jne 0x401223
mov edx, ebx
mov al, byte [ebx]
cmp al, 0x3b
je 0x4011d9
cmp al, 0x2c
je 0x4011d9
cmp al, 0
jne 0x4011d6
mov dword [ebp - 0x628], 1
jmp 0x4011d9
inc ebx
jmp 0x4011bc
mov ecx, ebx
sub ecx, edx
je 0x401220
push ebx
push ecx
push ecx
push edx
lea eax, [ebp - 0x618]
push eax
call sub.KERNEL32.dll_RtlMoveMemory
pop ecx
lea ebx, [ebp - 0x618]
add ebx, ecx
dec ebx
cmp byte [ebx], 0x5c
je 0x4011ff
inc ebx
mov word [ebx], 0x5c
push 0x40101f
lea eax, [ebp - 0x618]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
pop ebx
test eax, eax
jne 0x40122f
inc ebx
jmp 0x4011b1
push 0x40101f
call sub.KERNEL32.dll_LoadLibraryA
je 0x401272
mov dword [ebp - 0x61c], eax
push 0x401028
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x401267
mov esp, dword [section..data]
push 0
push 0
call 0x401253
add dword [esp], 0x2dad
cld
call eax
add esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x61c]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x4010a7
push 0x40105c
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret