joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409063
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x15fc], 0
jne 0x408fdb
mov dword [ebp - 0x31c], 0
jmp 0x409282
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push esi
or esi, 0xc647
pop esi
push eax
push edi
add esp, 4
sub eax, 0x13af1
pop eax
push edi
push edi
add esp, 4
add edi, 0x6cac
sub edi, 0x145f7
inc ebp
add dword [eax], eax
or edi, 0x15024
or edi, 0xabe9
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x409037
mov dword [ebp - 0x31c], 0
jmp 0x409282
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push esi
xor esi, 0x46f5
pop esi
push edi
push edi
add esp, 4
sub edi, 0x4bb5
call 0x409063
add byte [ebx + eax*2 + 0x3a], cl
inc eax
dec esi
dec edi
inc ecx
add esp, 4
pop edi
push esi
sub esi, 0x1006b
add esi, 0x10c6d
pop esi
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax

Function at 0x40909b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x34], ax
push ecx
or ecx, 0x14db6
sub ecx, 0xbff2
add ecx, 0x7309
pop ecx
push ecx
xor ecx, 0xf6
add byte [eax], al
add byte [ecx + 0x57], bl
or edi, 0x15626
jmp 0x4090ca
add edi, 0x16906
pop edi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
invalid
xchg ebp, eax
push eax
invalid

Function at 0x409135
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and eax, 0x810000df
out 0xf5, al
xor eax, dword [eax]
add byte [esi + 0x50], bl
pop esi
push eax
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x40909f
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x40909f
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4091bb
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x4091c5
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x40921a
push edx
add edx, 0x83a2
jmp 0x4091e9
jmp 0x4091f1
pop edx
push ecx
xor ecx, 0x11534
add ecx, 0x12860
sub ecx, 0x13cc2
xor ecx, 0xb645
pop ecx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x409282
push edi
push eax
add esp, 4
sub edi, 0xe39b
or edi, 0xa4a7
sub edi, 0x1220e
pop edi
push edi
or edi, 0x3952
or edi, 0x12e0d
xor edi, 0xc67f
or edi, 0x100b9
pop edi
mov edx, dword [ebp - 0x50c]
invalid
dec dword [ebx - 0xb7a76fe]
cli
invalid
dec dword [ebx - 0x50b73]
invalid
cmp ecx, dword [ebp - 0xcb4]
je 0x409278
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x409043
mov dword [ebp - 0x31c], 0
Function at 0x40913f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop esi
push eax
or eax, 0x10e33
pop eax
push edi
push ebx
add esp, 4
sub edi, 0xa6b9
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
add edi, 0x14e18
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x409177
invalid
mov bh, 0x8d
invalid
std

Function at 0x409298
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ebx + ebp*8]
add eax, 0x4441504a
cmp dword [ecx + 0x77b4e7], eax
add byte [edi - 0x7d], bl
invalid
push eax
or eax, 0x13b21
call 0x409298
add byte [0x493c4a3e], dh
push eax
cmp edi, dword [edi]
aas
add esp, 4
add eax, 0x15fbb
pop eax
push esi
push esi
add esp, 4
add esi, 0x4617
add byte [eax], al
and esi, 0x3941
pop esi
mov eax, dword [ebp - 0x31c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x324], ecx
push eax
sub eax, 0xefdf
sub eax, 0x39dc
sub eax, 0x327b
or eax, 0x1500b
pop eax
push esi
push ecx
add esp, 4
sub esi, 0x76fb
xor esi, 0xaf7f
xor esi, 0x177c
pop esi
mov dword [ebp - 0x770], 0
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1608], 0
jne 0x409325
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x409616
mov ecx, dword [ebp - 0x1608]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x160c], edx
jne 0x40934d
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x409616
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x160c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1610], ecx
cmp dword [ebp - 0x1610], 0
jne 0x40937f
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
jmp 0x409616
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x1610]
mov dword [ebp - 0x764], eax
jne 0x4093a4
mov ecx, dword [ebp - 0x770]
mov dword [ebp - 0x510], ecx
jmp 0x409616
mov edx, dword [ebp - 0x764]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + 0x20]
inc edx
and byte [ecx - 0x19837b], cl
dec dword [ebx - 0x76373]
dec dword [ebx - 0x3236b]
inc dword [ebx]
push ecx
and al, 0x89
xchg ebp, eax
js 0x4093b2
invalid
dec dword [ebx - 0x7637b]
dec dword [ebx - 0x32373]
inc dword [ebx]
dec eax
sbb al, 0x89
invalid
invalid
loop 0x4093e1
inc edi
test dword [eax + 0xfffff8], ebx
add byte [eax], al
add bl, ch
invalid
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40960a
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
invalid
Function at 0x4092ab
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ebx + ebp*8]
add eax, 0x4441504a
cmp dword [ecx + 0x77b4e7], eax
add byte [edi - 0x7d], bl
invalid
push eax
or eax, 0x13b21
call 0x409298
add byte [0x493c4a3e], dh
push eax
cmp edi, dword [edi]
aas
add esp, 4
add eax, 0x15fbb
pop eax
push esi
push esi
add esp, 4
add esi, 0x4617
add byte [eax], al
and esi, 0x3941
pop esi
mov eax, dword [ebp - 0x31c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x324], ecx
push eax
sub eax, 0xefdf
sub eax, 0x39dc
sub eax, 0x327b
or eax, 0x1500b
pop eax
push esi
push ecx
add esp, 4
sub esi, 0x76fb
xor esi, 0xaf7f
xor esi, 0x177c
pop esi
mov dword [ebp - 0x770], 0
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1608], 0
jne 0x409325
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x409616
mov ecx, dword [ebp - 0x1608]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x160c], edx
jne 0x40934d
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x409616
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x160c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1610], ecx
cmp dword [ebp - 0x1610], 0
jne 0x40937f
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
jmp 0x409616
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x1610]
mov dword [ebp - 0x764], eax
jne 0x4093a4
mov ecx, dword [ebp - 0x770]
mov dword [ebp - 0x510], ecx
jmp 0x409616
mov edx, dword [ebp - 0x764]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + 0x20]
inc edx
and byte [ecx - 0x19837b], cl
dec dword [ebx - 0x76373]
dec dword [ebx - 0x3236b]
inc dword [ebx]
push ecx
and al, 0x89
xchg ebp, eax
js 0x4093b2
invalid
dec dword [ebx - 0x7637b]
dec dword [ebx - 0x32373]
inc dword [ebx]
dec eax
sbb al, 0x89
invalid
invalid
loop 0x4093e1
inc edi
test dword [eax + 0xfffff8], ebx
add byte [eax], al
add bl, ch
invalid
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40960a
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
invalid
Function at 0x40a258
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x40a291
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x40a298
jmp 0x40a1de
jmp 0x40a29f
Function at 0x40a3f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0xfc02e3], al
add byte [ebx + 0x56], bl

Function at 0x40a424
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call dword [ebp - 0x19b8]
test eax, eax
jne 0x40a470
push esi
push esi
add esp, 4
call 0x40a444
add byte [eax + ecx*2 + 0x4e], cl
xor bh, byte [edi]
aaa
dec esi
cmp al, 0x4b
Function at 0x40a6cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x40a5d8
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x40a6f4
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x40a6fe
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
mov eax, dword [ebp - 0x78c]
add eax, 1
mov dword [ebp - 0x78c], eax
Function at 0x40a776
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x1066f
pop edx
push eax
push esi
add esp, 4
and eax, 0xb817
and eax, 0x77d6
add byte [ecx + 0xa1cac0], al
add byte [eax + 0x56], bl
push eax
add esp, 4
jmp 0x40a5a7
and esi, 0x134ed
pop esi
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
and ecx, 0x599b
jmp 0x40a784
pop ecx
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x40a7b1
mov eax, dword [ebp - 0x51c]
invalid
js 0x40a7da

Function at 0x42ecf0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
mov esi, eax
je 0x42ed92
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
jne 0x42ed1a
mov esi, dword [edi + 0x30]
push ebx
push esi
xor eax, eax
call fcn.0042f27f
mov ebx, dword [edi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ed61
mov eax, ebx
lea ecx, [edi + 4]
call fcn.0042ef23
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0x103
jne 0x42ed5c
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 4]
call esi
dec ebx
jns 0x42ed2e
push dword [edi + 0x40]
call esi
push dword [ebp - 0x10]
and dword [edi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [edi + 0x14]
push eax
mov byte [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call esi
lea ecx, [ebp - 0x10]
call fcn.00409150
pop ebx
pop edi
pop esi
leave
ret

Function at 0x430d3b
Capabilities:
Create thread

Disassembly:
push dword [esp + 0xc]
push 0
push dword [esp + 0x10]
push 0x42f955
push dword [esp + 0x14]
push 0
call fcn.004af4b1
add esp, 0x18
ret

Function at 0x432170
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
push edi
mov esi, eax
mov edi, 4
lea esp, [esp]
mov eax, esi
mov ecx, 4
jmp 0x432190
movzx edx, byte [eax]
mov dl, byte [edx + str.cw]
mov byte [eax], dl
add eax, 4
sub ecx, 1
jne 0x432190
inc esi
sub edi, 1
jne 0x432180
pop edi
pop esi
ret
Function at 0x432220
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
add ecx, 2
mov esi, 4
jmp 0x432230
mov al, byte [ecx - 2]
mov dl, byte [ecx + 1]
xor dl, byte [ecx]
mov bl, byte [ecx - 1]
mov byte [esp + 0xb], al
mov byte [esp + 0xa], dl
xor dl, al
xor al, bl
mov byte [esp + 9], al
xor dl, bl
shr al, 7
mov bl, 0x1b
imul bl
mov bl, al
mov al, byte [esp + 9]
add al, al
xor bl, al
xor bl, byte [esp + 0xb]
mov al, byte [ecx - 1]
xor al, byte [ecx]
xor bl, dl
mov byte [ecx - 2], bl
mov byte [esp + 9], al
shr al, 7
mov bl, 0x1b
imul bl
mov bl, al
mov al, byte [esp + 9]
add al, al
xor bl, al
xor bl, byte [ecx - 1]
movzx eax, byte [esp + 0xa]
xor bl, dl
mov byte [ecx - 1], bl
shr al, 7
mov bl, 0x1b
imul bl
mov bl, al
mov al, byte [esp + 0xa]
add al, al
xor bl, al
xor bl, byte [ecx]
mov al, byte [ecx + 1]
xor al, byte [esp + 0xb]
xor bl, dl
mov byte [ecx], bl
mov byte [esp + 9], al
shr al, 7
mov bl, 0x1b
imul bl
mov bl, al
mov al, byte [esp + 9]
add al, al
xor bl, al
xor bl, byte [ecx + 1]
add ecx, 4
xor bl, dl
sub esi, 1
mov byte [ecx - 3], bl
jne 0x432230
pop esi
pop ebx
pop ecx
ret

Function at 0x432740
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov esi, eax
mov edi, edx
sub edi, esi
mov ebp, 4
mov ecx, 4
mov bl, byte [edi + eax]
xor byte [eax], bl
inc eax
sub ecx, 1
jne 0x432758
sub ebp, 1
jne 0x432753
lea edi, [edx + 0x10]
lea ebx, [ecx + 9]
mov edi, edi
mov eax, esi
call fcn.00432170
movzx ecx, byte [esi + 5]
movzx edx, byte [esi + 9]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
movzx ecx, byte [esi + 0xd]
mov byte [esi + 5], dl
movzx edx, byte [esi + 0xa]
mov byte [esi + 0xd], al
mov al, byte [esi + 2]
mov byte [esi + 9], cl
movzx ecx, byte [esi + 0xe]
mov byte [esi + 2], dl
movzx edx, byte [esi + 0xf]
mov byte [esi + 0xa], al
mov al, byte [esi + 6]
mov byte [esi + 6], cl
movzx ecx, byte [esi + 0xb]
mov byte [esi + 0xe], al
mov al, byte [esi + 3]
mov byte [esi + 3], dl
movzx edx, byte [esi + 7]
mov byte [esi + 0xf], cl
mov ecx, esi
mov byte [esi + 0xb], dl
mov byte [esi + 7], al
call fcn.00432220
mov eax, esi
mov ecx, edi
mov ebp, 4
mov edi, 4
lea esp, [esp]
mov dl, byte [ecx]
xor byte [eax], dl
inc ecx
inc eax
sub edi, 1
jne 0x4327e0
sub ebp, 1
jne 0x4327d7
sub ebx, 1
mov edi, ecx
jne 0x432770
mov eax, esi
call fcn.00432170
movzx ecx, byte [esi + 5]
mov al, byte [esi + 1]
movzx edx, byte [esi + 9]
mov byte [esi + 1], cl
movzx ecx, byte [esi + 0xd]
mov byte [esi + 5], dl
movzx edx, byte [esi + 0xa]
mov byte [esi + 9], cl
movzx ecx, byte [esi + 0xe]
mov byte [esi + 0xd], al
mov al, byte [esi + 2]
mov byte [esi + 0xa], al
mov al, byte [esi + 6]
mov byte [esi + 2], dl
movzx edx, byte [esi + 0xf]
mov byte [esi + 6], cl
movzx ecx, byte [esi + 0xb]
mov byte [esi + 0xe], al
mov al, byte [esi + 3]
mov byte [esi + 3], dl
movzx edx, byte [esi + 7]
mov byte [esi + 0xf], cl
mov ecx, dword [esp + 0x14]
mov byte [esi + 7], al
mov byte [esi + 0xb], dl
mov eax, esi
add ecx, 0xa0
lea edi, [ebp + 4]
mov esi, 4
mov dl, byte [ecx]
xor byte [eax], dl
inc ecx
inc eax
sub esi, 1
jne 0x432866
sub edi, 1
jne 0x432861
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x447ef1
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.00447df9
add esp, 0xc
push dword [eax]
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov dword [esi + 0x10], eax
call fcn.00403d95
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x447f5d
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x14], eax
cmp eax, edi
je 0x447f5d
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 8]
add eax, 0xc
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop ebp
ret 8

Function at 0x448966
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea esi, [eax + 0xc]
mov dword [ebp - 0x14], eax
push edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], ebx
call fcn.00447e88
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4489eb
push esi
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x4489eb
mov ecx, esi
mov edx, edi
lea eax, [ebp - 0x18]
call fcn.00447e62
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00447d6b
push eax
push dword [ebp + 8]
cmp byte [ebp + 0x10], bl
je 0x4489e5
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4489eb
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc
Function at 0x44db45
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x120
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.004ae3b0
add esp, 0xc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x44dba8
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
test eax, eax
je 0x44dc52
mov eax, dword [ebp - 0x98]
sub eax, 0
je 0x44dc4c
dec eax
je 0x44dc1f
dec eax
je 0x44dbc4
xor edi, edi
jmp 0x44dc4f
mov ecx, dword [ebp - 0xa4]
cmp ecx, 4
ja 0x44dbd2
push 4
pop edi
mov eax, dword [ebp - 0xa0]
cmp ecx, 5
jne 0x44dbec
test eax, eax
jne 0x44dbe4
push 5
pop edi
cmp eax, 1
jne 0x44dc4f
push 6
pop edi
cmp ecx, 6
jne 0x44dc10
test eax, eax
jne 0x44dbf8
push 7
pop edi
cmp eax, 1
jne 0x44dc00
push 8
pop edi
cmp eax, 2
jne 0x44dc08
push 9
pop edi
cmp eax, 3
jne 0x44dc4f
push 0xa
pop edi
cmp ecx, 8
jne 0x44dc4f
cmp eax, 4
jne 0x44dc4f
push 0xb
pop edi
jmp 0x44dc4f
cmp dword [ebp - 0xa4], 4
jne 0x44dc4f
cmp dword [ebp - 0xa0], edi
jne 0x44dc33
push 2
pop edi
cmp dword [ebp - 0xa0], 0xa
jne 0x44dc3f
push 2
pop edi
cmp dword [ebp - 0xa0], 0x5a
jne 0x44dc4f
push 3
jmp 0x44dc1c
xor edi, edi
inc edi
mov ax, di
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.004ab7a8
add ebp, 0x78
leave
ret

Function at 0x44dc63
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
push 4
pop eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push str.EnableLUA
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x78], 1
call esi
cmp dword [ebp - 0x78], 0
jne 0x44dcc0
xor eax, eax
jmp 0x44dd3e
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push str.ConsentPromptBehaviorAdmin
push ebx
push edi
call esi
test eax, eax
jne 0x44dcfc
cmp dword [ebp - 0x78], eax
jne 0x44dcfc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push str.PromptOnSecureDesktop
push ebx
push edi
call esi
test eax, eax
jne 0x44dcfc
cmp dword [ebp - 0x78], eax
je 0x44dcbc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0
push 0x1c
lea eax, [ebp - 0x74]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44dd3b
push str.UsersAdministratorAppDataLocal
lea eax, [ebp - 0x6e]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44dcbc
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ab7a8
add ebp, 0x198
leave
ret
Function at 0x44dd77
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp + 0x94], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004ae3b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44ddc3
cmp dword [ebp - 0x7c], 6
sbb esi, esi
inc esi
mov ecx, dword [ebp + 0x94]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004ab7a8
add ebp, 0x98
leave
ret

Function at 0x44e0b1
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x4de38e
call fcn.004b5adc
mov esi, 0x5127f4
push esi
lea ecx, [ebp - 0x10]
call fcn.00402db8
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x14]
call fcn.00402db8
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0044da3d
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00402e68
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00403d95
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.0044da3d
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00402e68
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00403d95
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.004ae3b0
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x14]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], esi
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x50], 0x1040
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
call fcn.0044dd77
test eax, eax
je 0x44e16f
mov dword [ebp - 0x48], str.runas
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [edi - 0x10]
call fcn.00403d95
lea ecx, [esi - 0x10]
call fcn.00403d95
xor eax, eax
inc eax
call fcn.004b5bb4
ret

Function at 0x450ea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e01f8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x50ab8c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esp + 0x14], ebx
push eax
mov dword [esi], vtable.Json::StyledWriter.0
call fcn.00436e80
mov dword [esi + 0x30], ebx
mov eax, 0xf
mov dword [esi + 0x34], eax
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x54], 0x4a
mov dword [esi + 0x58], 3
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4