joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490590
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce8bb
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 8
mov edx, dword [ebp + 8]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x490600
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x4906dc
push 0xfa0
call dword [sym.imp.Dbglog.dll_struct_boost::logging::level::holder_no_ts____cdecl_g_l_filter_void_]
mov ecx, eax
call fcn.0040a130
movzx eax, al
test eax, eax
jne 0x49061e
jmp 0x4906dc
push 0x5e5ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x416260
push str.WTSQuerySessionInformation_failed__0x
push 0x5e5ed4
push str.CAgentSvc::sGetSessionConnectState
push 0x5e5f04
push 0x5e5f0c
lea ecx, [ebp - 0xcc]
push ecx
call dword [sym.imp.Dbglog.dll_struct_boost::logging::logger_holder_struct_boost::logging::logger_format_write_struct_boost::logging::default___struct_boost::logging::default___struct_boost::logging::writer::threading::ts_write__struct_boost::logging::default___struct_boost::logging::lock_resource_finder::single_thread______cdecl_g_l_void_]
push eax
call fcn.004048b0
add esp, 4
mov ecx, eax
call fcn.00402ad0
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call fcn.00402a30
mov ecx, eax
call fcn.00402d20
push eax
call fcn.00409d00
add esp, 8
push eax
call fcn.00409d00
add esp, 8
push eax
call fcn.00409d00
add esp, 8
push eax
call fcn.00409d00
add esp, 8
push eax
call fcn.00409d00
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push eax
call fcn.00409d00
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.00402a50
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x4b2c60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d13d1
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x23c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push 1
mov eax, dword [ebp - 0x28]
add eax, 0xe4
push eax
lea ecx, [ebp - 0x1c]
call fcn.00493f10
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
add ecx, 0x80
call fcn.004d9940
mov ecx, dword [ebp - 0x28]
call fcn.004b0750
mov ecx, dword [ebp - 0x28]
add ecx, 8
call fcn.0040bfe0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x28]
add ecx, 8
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.004b4e30
lea ecx, [ebp - 0x1c]
call fcn.00498920
push 1
mov edx, dword [ebp - 0x28]
add edx, 0xfc
push edx
lea ecx, [ebp - 0x24]
call fcn.00493f10
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x28]
call fcn.004b08e0
mov ecx, dword [ebp - 0x28]
add ecx, 0x20
call fcn.0040bfe0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x28]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x28]
call fcn.004bae40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00494390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00494390
jmp 0x4b2fa8
mov dword [ebp - 4], 0xffffffff
jmp 0x4b2fba
jmp 0x4b2fc5
jmp 0x4b2fce
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x4b9bc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1f6e
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
push 1
mov eax, dword [ebp - 0x28]
add eax, 0xe4
push eax
lea ecx, [ebp - 0x1c]
call fcn.00493f10
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x28]
call fcn.004b0750
mov ecx, dword [ebp - 0x28]
add ecx, 8
call fcn.0040bfe0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0x114
call fcn.00431200
mov edx, dword [ebp - 0x28]
add edx, 8
push edx
mov ecx, dword [ebp - 0x28]
call fcn.004b4e30
lea ecx, [ebp - 0x1c]
call fcn.00498920
push 1
mov eax, dword [ebp - 0x28]
add eax, 0xfc
push eax
lea ecx, [ebp - 0x24]
call fcn.00493f10
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x28]
add ecx, 0x114
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0x40
call fcn.005c5420
mov byte [ebp - 0x29], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00494390
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00494390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00418b40
mov al, byte [ebp - 0x29]
jmp 0x4b9e6e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ca8e0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2f60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x671330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [ebp + 0x10]
push eax
call fcn.004cbf80
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
call fcn.004ca7e0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.0040f210
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x30], 0
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp + 8]
call fcn.0040f610
movzx eax, al
test eax, eax
je 0x4ca97b
mov ecx, dword [ebp - 0x10]
call fcn.004cd070
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004cc130
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4d47f0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3c8b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc8
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jbe 0x4d4870
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 6
mov edx, dword [ebp + 8]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4d4870
mov byte [ebp - 0x1d], 1
cmp dword [ebp - 0x1c], 0
je 0x4d4870
mov eax, dword [ebp - 0x1c]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x4d4903
mov dword [ebp - 4], 0xffffffff
jmp 0x4d4913
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret 4
Function at 0x4d9940
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d44b9
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1e4
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x58]
add eax, 4
push eax
lea ecx, [ebp - 0x34]
call fcn.00408360
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00416470
movzx ecx, al
test ecx, ecx
je 0x4d99ed
push 0x5ecefc
lea ecx, [ebp - 0xa4]
call fcn.0040bdb0
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x8c]
call fcn.0040b380
push 0x638088
lea ecx, [ebp - 0x8c]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
call fcn.0040b3b0
push 0x5ecf1c
lea ecx, [ebp - 0x34]
call fcn.00416420
push 0
lea ecx, [ebp - 0x34]
call fcn.00416300
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x54], 0
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x38], dx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 3
lea ecx, [ebp - 0x34]
call fcn.0040bfe0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0
mov eax, 0x414
mov word [ebp - 0x44], ax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x42], ecx
mov dword [ebp - 0x3e], 0
mov dword [ebp - 0x3a], 0
push 1
mov edx, dword [ebp - 0x58]
add edx, 0x20
push edx
lea ecx, [ebp - 0x1c]
call fcn.004d92b0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea ecx, [ebp - 0x1c]
call fcn.004d95d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0040a7f0
jmp 0x4d9c37
mov dword [ebp - 4], 0xffffffff
jmp 0x4d9c49
jmp 0x4d9c52
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x4dab00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004da190
movzx ecx, al
test ecx, ecx
je 0x4dab9b
cmp dword [ebp - 0x10], 0
jl 0x4dab9b
jg 0x4dab46
cmp dword [ebp - 0x14], 0
jbe 0x4dab9b
mov dword [ebp - 0xc], 0
xor edx, edx
mov dword [ebp - 8], edx
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.0040bfe0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x671054]
ja 0x4dab9b
jb 0x4dab84
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x671050]
jae 0x4dab9b
mov eax, dword [0x671050]
sub eax, dword [ebp - 0xc]
mov ecx, dword [0x671054]
sbb ecx, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x4de550
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x4de5b5
lea edx, [ebp - 0x194]
push edx
movzx eax, byte [ebp + 0xc]
and eax, 0xff
movzx ecx, al
movzx edx, byte [ebp + 0x10]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp + 8]
add edx, 4
xchg dword [edx], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret

Function at 0x4de6a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4de6f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
push 8
lea ecx, [ebp - 0xc]
call fcn.004029d0
call fcn.004de060
push eax
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040f510
push 0x5ef0fc
lea ecx, [ebp - 0xc]
push ecx
call fcn.004de5f0
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret
Function at 0x4e89d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d57fc
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x484
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe8], 0
lea ecx, [ebp - 0x48]
call fcn.00409640
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.00416470
movzx eax, al
test eax, eax
je 0x4e8a8c
push 0x5f000c
lea ecx, [ebp - 0x168]
call fcn.0040bdb0
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x128]
push edx
lea ecx, [ebp - 0x144]
call fcn.0040bfb0
push 0x638098
lea eax, [ebp - 0x144]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x168]
call fcn.0040b3b0
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
call fcn.00416be0
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x4e8b00
push 0x5f00ac
lea ecx, [ebp - 0x180]
call fcn.0040bdb0
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0xf0], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x150]
call fcn.0040b380
push 0x638088
lea ecx, [ebp - 0x150]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x180]
call fcn.0040b3b0
push 4
lea ecx, [ebp - 0x18]
call fcn.004029d0
lea ecx, [ebp - 0x18]
call fcn.00404b40
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0xc]
call fcn.0040bfe0
push eax
push str.SELECT_Comp_FROM_User_WHERE_Name_S_LIMIT_1
lea edx, [ebp - 0x18]
push edx
call fcn.004f7100
add esp, 0xc
push 0x18
lea ecx, [ebp - 0x30]
call fcn.004029d0
lea ecx, [ebp - 0x18]
call fcn.00402d50
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx]
call fcn.005c4f00
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 5
push 0x5efefd
push 0
lea ecx, [ebp - 0x30]
call fcn.005c5220
mov dword [ebp - 0xf4], eax
push 0xfde9
mov edx, dword [ebp - 0xf4]
push edx
lea ecx, [ebp - 0x494]
call fcn.0042bc00
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xfc]
call fcn.00402d50
push eax
lea ecx, [ebp - 0x48]
call fcn.00414b50
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x494]
call fcn.0042f9f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
call fcn.005c4580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402d30
jmp 0x4e8ee0
mov dword [ebp - 4], 0
jmp 0x4e8ef2
jmp 0x4e8efd
jmp 0x4e8f06
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
call fcn.004097b0
mov ecx, dword [ebp - 0xe8]
or ecx, 1
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0040a7f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret 8
Function at 0x4f3930
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d67a9
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x671330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00408360
mov dword [ebp - 4], 0
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push 1
mov edx, dword [ebp + 0xc]
push edx
push ecx
call fcn.004efb60
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004f4390
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
push 1
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x20], esp
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call fcn.004efb60
add esp, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004f4390
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
push 0
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0x2c], esp
push 1
mov eax, dword [ebp + 0xc]
push eax
push edx
call fcn.004efde0
add esp, 0xc
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004f4390
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 3
push 0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0
mov edx, dword [ebp + 0xc]
push edx
push ecx
call fcn.004efde0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004f4390
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fec80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d72e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x671330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x4fecf9
push 0x5f3b34
lea ecx, [ebp - 0x28]
call fcn.0040b2a0
mov dword [ebp - 4], 0
push str._x32_
lea ecx, [ebp - 0x28]
call fcn.00416420
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00416420
lea ecx, [ebp - 0x28]
call fcn.0040bfe0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a7f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544286
mov esp, ebp
pop ebp
ret

Function at 0x5032e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d795b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x671330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push edi
call fcn.005049e0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x24]
mov dword [edi + 0x18], 0
mov ecx, esi
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0051d3c0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x51b4e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
sub edi, ecx
xor esi, esi
cmp ecx, dword [esp + 0x14]
cmova edi, ebx
test edi, edi
je 0x51b528
nop
movsx eax, byte [ecx]
lea ecx, [ecx + 1]
imul eax, eax, 0xcc9e2d51
inc esi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
cmp esi, edi
jne 0x51b500
pop edi
pop esi
mov eax, edx
pop ebx
ret
Function at 0x52a200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x671330]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x6091d8
mov dword [esp + 4], 0x5f730c
mov dword [esp + 8], 0x5f7310
mov dword [esp + 0xc], 0x5f7314
mov dword [esp + 0x10], 0x5f7318
mov dword [esp + 0x14], 0x608e70
mov dword [esp + 0x18], 0x6091dc
mov dword [esp + 0x1c], 0x5f731c
mov dword [esp + 0x20], 0x5f5590
mov dword [esp + 0x24], 0x609154
mov dword [esp + 0x28], 0x6090bc
mov dword [esp + 0x2c], 0x5f7320
mov dword [esp + 0x30], 0x5f7324
mov dword [esp + 0x34], 0x5f7328
mov dword [esp + 0x38], 0x5f732c
mov dword [esp + 0x3c], 0x5f7330
mov dword [esp + 0x40], 0x5f7334
mov dword [esp + 0x44], 0x5f7338
mov dword [esp + 0x48], 0x5f6f24
mov dword [esp + 0x4c], 0x5f6f28
mov dword [esp + 0x50], 0x5f7344
mov dword [esp + 0x54], 0x5f7348
mov dword [esp + 0x58], 0x6091d8
mov dword [esp + 0x5c], 0x6091d8
mov dword [esp + 0x60], 0x5f734c
mov dword [esp + 0x64], 0x5f7350
mov dword [esp + 0x68], 0x5f7354
mov dword [esp + 0x6c], 0x5f7358
mov dword [esp + 0x70], 0x5f6f2c
mov dword [esp + 0x74], 0x5f6f30
mov dword [esp + 0x78], 0x5f6f34
mov dword [esp + 0x7c], 0x5f6f38
mov dword [esp + 0x80], 0x5f6f3c
mov dword [esp + 0x84], 0x5f6f40
mov dword [esp + 0x88], 0x5f6f44
mov dword [esp + 0x8c], 0x5f6f48
mov dword [esp + 0x90], 0x608e6c
mov dword [esp + 0x94], 0x60915c
mov dword [esp + 0x98], 0x5f6f4c
mov dword [esp + 0x9c], 0x6091d8
mov dword [esp + 0xa0], 0x6091d8
mov dword [esp + 0xa4], 0x6091d8
mov dword [esp + 0xa8], 0x6091d8
mov dword [esp + 0xac], 0x6091d8
mov dword [esp + 0xb0], 0x6091d8
mov dword [esp + 0xb4], 0x6091d8
mov dword [esp + 0xb8], 0x6091d8
mov dword [esp + 0xbc], 0x5f6f50
mov dword [esp + 0xc0], 0x5f6f54
mov dword [esp + 0xc4], 0x5f6f58
mov dword [esp + 0xc8], 0x5f6f20
mov dword [esp + 0xcc], 0x5f6f5c
mov dword [esp + 0xd0], 0x5f6f60
mov dword [esp + 0xd4], 0x5f735c
mov dword [esp + 0xd8], 0x5f6f64
mov dword [esp + 0xdc], 0x5f6f68
mov dword [esp + 0xe0], 0x5f6f6c
mov dword [esp + 0xe4], 0x5f7360
mov dword [esp + 0xe8], 0x5f6f70
mov dword [esp + 0xec], 0x5f6f74
cmp cl, 0x3c
jb 0x52a466
mov eax, 0x6091d8
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.00544286
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.00544286
add esp, 0xf4
ret