joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c610
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
mov esi, edx
push eax
push 0x5ed468
push reloc.WS2_32.dll_bind
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40c661
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c635
sub eax, edx
sar eax, 1
add eax, eax
push eax
push esi
push 1
push 0
push edi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x40e330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x40]
sub eax, ecx
sar eax, 3
mov dword [esp + 0x10], ebx
lea esi, [eax - 1]
cmp esi, eax
jae 0x40e360
lea eax, [ecx + esi*8]
test eax, eax
jne 0x40e365
mov eax, 0x5ee574
mov ecx, 0xfff8
cmp word [eax + 6], cx
jne 0x40e50f
mov ebp, dword [eax]
test ebp, ebp
je 0x40e50f
mov edi, dword [ebp + 0x14]
mov ecx, ebx
push 1
mov edx, edi
call fcn.00414f10
mov ecx, ebx
add esp, 4
mov eax, dword [ecx + 0x44]
mov edx, dword [eax - 8]
mov dword [esp + 0x3c], edx
mov esi, dword [edx + 0x14]
mov eax, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
lea ebx, [esi + edi]
lea edi, [ebp + 0x1c]
mov dword [esp + 0x38], ebx
mov ebp, dword [ebp + 0x14]
add ebp, edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
or edi, 0xffffffff
mov dword [esp + 0x18], ebp
or ebp, edi
mov dword [esp + 0x14], edx
nop dword [eax]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], edi
mov edi, ebp
or ebp, 0xffffffff
cmp dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
jae 0x40e41e
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
lea edx, [esp + 0x24]
push dword [esp + 0x28]
call fcn.0040db30
add esp, 0xc
test eax, eax
je 0x40e4e3
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
test edi, edi
js 0x40e3d0
mov ecx, dword [esp + 0x10]
jmp 0x40e422
test edi, edi
js 0x40e48a
sub ebx, esi
cmp ebx, 0x38
jae 0x40e45f
sub esi, eax
mov eax, esi
shr eax, 2
lea ebx, [esi + 0x78]
add ebx, eax
cmp ebx, esi
jb 0x40e4fb
push ebx
call fcn.00430070
mov ecx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x34], ecx
lea eax, [ecx + esi]
mov dword [esp + 0x30], eax
lea eax, [ecx + ebx]
mov dword [esp + 0x38], eax
push dword [esp + 0x28]
lea edx, [esp + 0x34]
push ebp
push dword [esp + 0x34]
push edi
call fcn.0040e250
mov edx, dword [esp + 0x4c]
add esp, 0x10
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
jmp 0x40e3c8
sub esi, eax
push esi
call fcn.00430070
mov ebx, dword [esp + 0x14]
add esp, 4
or edx, 0xffffffff
mov ecx, ebx
call fcn.00411150
mov esi, eax
mov ecx, ebx
lea eax, [esp + 0x2c]
mov edx, esi
push eax
call fcn.00412170
add esp, 4
mov edx, eax
mov ecx, ebx
push dword [esp + 0x2c]
call fcn.004140e0
add esp, 4
mov edx, esi
mov ecx, ebx
call fcn.00411a80
mov edx, 0xfffffffe
mov ecx, ebx
call fcn.00411bd0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
mov edx, str.duk_unicode_support.c
push str.internal_error
push 0x100011a
call fcn.0040d970
push str.buffer_too_long
push 0x3000040
mov edx, str.duk_util_bufwriter.c
call fcn.0040d970
push 0x605778
push 0xffffffffffffffff
push 0x835
mov edx, 0x605780
mov ecx, ebx
call fcn.0040d990
int3
Function at 0x40eac0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov eax, 0xaaaaaaab
mul edi
mov esi, ecx
shr edx, 1
lea eax, [edx + edx*2]
lea ebx, [eax + esi]
sub edi, eax
mov eax, dword [esp + 0x10]
cmp esi, ebx
je 0x40eb3e
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add esi, 3
add edx, ecx
mov ecx, edx
shr ecx, 0x12
movzx ecx, byte [ecx + 0x5f1088]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x5f1088]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + 0x5f1088]
mov byte [eax + 2], cl
movzx ecx, byte [edx + 0x5f1088]
mov byte [eax + 3], cl
add eax, 4
cmp esi, ebx
jne 0x40eae0
sub edi, 1
je 0x40eb8a
sub edi, 1
jne 0x40ebb1
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
mov ecx, edx
shr ecx, 0xa
pop edi
pop esi
pop ebx
movzx ecx, byte [ecx + 0x5f1088]
mov byte [eax], cl
mov ecx, edx
shr ecx, 4
and ecx, 0x3f
and edx, 0xf
movzx ecx, byte [ecx + 0x5f1088]
mov byte [eax + 1], cl
movzx ecx, byte [edx*4 + 0x5f1088]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
ret
movzx edx, byte [esi]
mov ecx, edx
and edx, 3
shr ecx, 2
shl edx, 4
movzx ecx, byte [ecx + 0x5f1088]
mov byte [eax], cl
movzx ecx, byte [edx + 0x5f1088]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
pop edi
pop esi
pop ebx
ret
Function at 0x4128e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00411150
mov edx, dword [ebx + 0x44]
mov esi, eax
mov edi, dword [ebx + 0x40]
sub edx, edi
sar edx, 3
test esi, esi
jns 0x412907
lea eax, [edx + esi]
cmp eax, edx
jae 0x412912
lea ecx, [edi + eax*8]
test ecx, ecx
jne 0x412917
mov ecx, 0x5ee574
call fcn.00413b20
test eax, 0x2c0
je 0x4129cf
lea eax, [edx + esi]
test esi, esi
js 0x412930
mov eax, esi
cmp eax, edx
jae 0x41293b
lea ecx, [edi + eax*8]
test ecx, ecx
jne 0x412940
mov ecx, 0x5ee574
movzx eax, word [ecx + 6]
sub eax, 0xfff7
je 0x4129d6
sub eax, 2
je 0x412964
sub eax, 1
je 0x41295d
xor edi, edi
jmp 0x4129db
mov edi, 0x16
jmp 0x4129db
mov eax, dword [ecx]
mov edi, dword [eax]
shr edi, 0x1b
cmp edi, 0xe
jne 0x4129db
test esi, esi
jns 0x412979
mov eax, dword [ebx + 0x44]
jmp 0x41297c
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax + esi*8]
lea eax, [eax + esi*8]
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0x18]
mov edx, ecx
push eax
mov eax, dword [ebx + 0x2c]
push dword [eax + 0x398]
call fcn.00434640
add esp, 0xc
test eax, eax
je 0x4129db
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [edx + 0x18]
lea ecx, [ecx + eax*2]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x4129db
mov ecx, ebx
call fcn.00415130
mov edx, esi
mov ecx, ebx
call fcn.00411a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 3
mov eax, dword [ebp + 8]
mov ecx, 0x28
test eax, eax
jne 0x412a15
cmp edi, 6
je 0x412a1a
mov edi, 0x4e
push ecx
mov edx, esi
mov ecx, ebx
call fcn.00412720
add esp, 4
test eax, eax
jne 0x4129cf
push edi
mov edx, esi
mov ecx, ebx
call fcn.00412720
add esp, 4
test eax, eax
jne 0x4129cf
jmp 0x412a24
cmp eax, 1
jne 0x4129ec
mov ecx, 0x4e
lea edi, [ecx - 0x26]
jmp 0x4129f1
push 0xab9
push 0x6058f4
push str.coercion_to_primitive_failed
mov edx, 6
mov ecx, ebx
call fcn.0042fde0
int3
Function at 0x42c610
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x1c], eax
movzx eax, word [edx + 6]
push esi
add eax, 0xffff000e
mov esi, ecx
push edi
cmp eax, 8
ja case.default.0x42c63a
jmp dword [eax*4 + 0x42c804]
push 1
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x16
call fcn.0042c180
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x15
call fcn.0042c180
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
push 1
lea edx, [esp + 0xc]
mov byte [esp + 0xc], 0x17
call fcn.0042c180
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
cmp word [edx + 4], 0
lea edx, [esp + 8]
push 1
sete al
add al, 0x18
mov byte [esp + 0xc], al
call fcn.0042c180
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
call fcn.0042c4f0
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
movzx ecx, word [edx + 4]
mov eax, dword [edx]
lea edx, [esp + 0xc]
mov dword [esp + 0x18], eax
mov eax, ecx
shr eax, 8
mov byte [esp + 0xe], cl
mov ecx, esi
push 4
mov byte [esp + 0x10], 0x1d
mov byte [esp + 0x11], al
mov byte [esp + 0x13], 4
call fcn.0042c180
push 4
lea edx, [esp + 0x20]
jmp 0x42c7e9
mov edx, dword [edx]
call fcn.0042c390
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
call fcn.0042c5b0
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
call fcn.0042c450
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [edx]
lea ecx, [esp + 0x10]
cvttsd2si edx, xmm0
lea edi, [esp + 0x18]
movsd qword [esp + 0x10], xmm0
mov eax, dword [ecx]
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
cmp eax, dword [edi]
jne 0x42c7bd
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 4]
jne 0x42c7bd
mov ecx, esi
call fcn.0042c260
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 8]
mov eax, dword [esp + 0x14]
bswap ecx
bswap eax
mov dword [esp + 0x14], ecx
mov ecx, esi
push 1
mov dword [esp + 0x14], eax
mov byte [esp + 0xc], 0x1a
call fcn.0042c180
push 8
lea edx, [esp + 0x18]
mov ecx, esi
call fcn.0042c180
mov ecx, dword [esp + 0x2c]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
Function at 0x455a20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, ecx
mov dword [esp + 4], 0
push ebx
push ebp
mov dword [esp + 0x10], eax
mov eax, dword [eax + 0x2c]
push esi
push edi
mov ebx, dword [eax + 0x88]
mov ebp, dword [eax + 0x8c]
nop dword [eax]
nop dword [eax + eax]
add ebx, 0x7f4a7c15
mov ecx, ebx
adc ebp, 0x9e3779b9
mov eax, ebp
shrd ecx, eax, 0x1e
push 0xbf58476d
shr eax, 0x1e
xor ecx, ebx
push 0x1ce4e5b9
xor eax, ebp
push eax
push ecx
call fcn.00585f30
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1b
push 0x94d049bb
shr ecx, 0x1b
xor esi, eax
push 0x133111eb
xor ecx, edx
push ecx
push esi
call fcn.00585f30
mov esi, eax
mov edi, edx
shrd esi, edi, 0x1f
xor esi, eax
shr edi, 0x1f
mov eax, dword [esp + 0x18]
xor edi, edx
mov edx, dword [esp + 0x14]
mov ecx, edx
and ecx, 1
inc edx
mov dword [esp + 0x14], edx
mov eax, dword [eax + 0x2c]
mov dword [eax + ecx*8 + 0x88], esi
mov dword [eax + ecx*8 + 0x8c], edi
cmp edx, 0x40
jb 0x455a50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45cc80
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
mov eax, dword [esi + 0x44]
cmp eax, dword [esi + 0x38]
jae 0x45cdc7
mov ecx, dword [esi + 0x2c]
lea eax, [esp + 0x14]
push eax
push 0
mov edx, 0x34
call fcn.0042ff40
mov edx, eax
add esp, 8
test edx, edx
je 0x45cddb
mov eax, dword [esi + 0x44]
xor ecx, ecx
mov edi, dword [esp + 0x14]
or ecx, 0xfffa0000
mov dword [eax], edx
mov dword [eax + 4], ecx
inc dword [edx + 4]
add dword [esi + 0x44], 8
test edi, edi
je 0x45cdf1
push 0x34
push 0
push edi
call fcn.00587250
add esp, 0xc
mov dword [edi], 0x24
mov dword [edi + 4], 0
mov edx, 0xfffffffe
mov eax, dword [0x624130]
mov ecx, esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], 2
add edi, 0x10
push 0x6095a8
call fcn.00410110
mov eax, dword [esp + 0x30]
add esp, 4
mov ebx, dword [esp + 0x28]
mov ecx, 0x45cc60
mov dword [edi + 0xc], eax
mov edx, 0x45cbd0
xor eax, eax
test ebx, ebx
push edi
cmovne eax, ecx
mov ecx, esi
push eax
push 0x45cbf0
call fcn.0049a6d0
add esp, 0xc
mov dword [edi], eax
mov edx, 0x45cc10
mov ecx, esi
push edi
push 0x45cc40
call fcn.004a9c10
mov dword [edi + 4], eax
add esp, 8
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x14], ebp
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
sub eax, ecx
sar eax, 3
lea edx, [eax - 1]
cmp edx, eax
jae 0x45cd93
lea eax, [ecx + edx*8]
test eax, eax
jne 0x45cd98
mov eax, 0x5ee574
mov ecx, 0xfff8
cmp word [eax + 6], cx
jae 0x45cdb5
xor eax, eax
mov dword [edi + 8], ebx
mov dword [edi + 0x10], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [eax]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push str.cannot_push_beyond_allocated_stack
push 0x3001475
mov edx, 0x605bf8
call fcn.0040d970
push str.alloc_failed
push 0x100147e
mov edx, 0x605c28
mov ecx, esi
call fcn.0040d970
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x46d
mov edx, 0x6240d4
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x46d
push 0x6240f0
push 0x62410c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x464f40
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x424], eax
push esi
push edi
lea eax, [esp + 0x1c]
mov esi, ecx
push eax
push 0x400
lea eax, [esp + 0x30]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x4650c2
cmp byte [esp + 0x28], 0
je 0x4650c2
mov ecx, esi
call fcn.00414830
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.00414170
push 0x60a8d4
mov edx, 0xfffffffe
mov ecx, esi
call fcn.00410110
add esp, 4
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x465028
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
call fcn.00585e40
movaps xmm1, xmm0
mov ecx, esi
call fcn.00413fc0
push 0x60a8dc
mov edx, 0xfffffffe
mov ecx, esi
call fcn.00410110
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [esp + 0x10]
call fcn.00585e40
movaps xmm1, xmm0
mov ecx, esi
call fcn.00413fc0
push str.free
mov edx, 0xfffffffe
mov ecx, esi
call fcn.00410110
add esp, 4
lea eax, [edi - 2]
cmp eax, 4
ja case.default.0x465030
jmp dword [eax*4 + 0x4650dc]
mov edx, str.REMOVABLE
jmp 0x46505f
mov edx, str.FIXED
jmp 0x46505f
mov edx, str.REMOTE
jmp 0x46505f
mov edx, str.CDROM
jmp 0x46505f
mov edx, str.RAMDISK
jmp 0x46505f
mov edx, 0x60a918
mov ecx, esi
call fcn.00414170
push 0x60a920
mov edx, 0xfffffffe
mov ecx, esi
call fcn.00410110
add esp, 4
mov edx, 0x464ed0
mov ecx, esi
push 6
push 0x18075380
push 0
call fcn.00414b50
add esp, 0xc
mov edx, 0xfffffffe
mov ecx, esi
push 0x60a928
call fcn.00410110
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.005852a8
add esp, 0x42c
ret
mov ecx, dword [esp + 0x42c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.005852a8
add esp, 0x42c
ret
Function at 0x46d930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6019e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x12
xor esi, esi
push esi
push esi
push 0x5f1de4
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46d971
xor eax, eax
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
xor edi, edi
push edi
push 0x5f1de4
push edi
push ebx
mov dword [ebp - 0x28], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x46da72
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
jne 0x46d9bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x46da53
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
lea esi, [eax + 0x24]
mov eax, esi
call fcn.00585a60
mov edi, esp
test edi, edi
je 0x46dab9
push esi
push 0
push edi
call fcn.00587250
mov eax, dword [ebp - 0x2c]
lea esi, [edi + 0x10]
mov dword [edi], eax
add esp, 0xc
mov dword [edi + 4], 4
mov eax, dword [0x624130]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 1
cmp dword [esi - 0xc], 0
jbe 0x46da10
mov ecx, dword [esi - 0x10]
add ecx, esi
jmp 0x46da15
mov ecx, 0xfffffff0
push 0
mov dword [ecx], 4
mov dword [ecx + 4], 0
mov eax, dword [0x624138]
push 0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x20]
mov dword [ecx + 0xc], 2
mov dword [esi], 5
push dword [ebp - 0x24]
push esi
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
jne 0x46da72
mov edi, dword [ebp - 0x28]
xor esi, esi
lea eax, [ebp - 0x20]
inc edi
push eax
push edi
push 0x5f1de4
push 0
push ebx
mov dword [ebp - 0x28], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
jne 0x46d997
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test esi, esi
je 0x46d95b
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005852a8
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x46d
mov edx, 0x6240d4
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x46d
push 0x6240f0
push 0x62410c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x46ded0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
xor ebx, ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], ebx
jne 0x46def5
mov eax, dword [esi + 0x40]
cmp dword [eax + 4], 0
jle 0x46df48
mov eax, dword [esi + 0x40]
xor edi, edi
mov eax, dword [eax + 0xc]
test eax, eax
je 0x46df03
mov edi, dword [eax]
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
lea eax, [ecx + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push dword [edi + 8]
lea eax, [edi + 0xc]
push eax
push dword [ecx + 0x38]
call ebp
cmp eax, 1
jne 0x46df6a
cmp dword [esi + 4], 0
jne 0x46df91
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x46df39
call fcn.004b3660
push edi
call fcn.0058c812
add esp, 4
cmp dword [esi + 4], 0
je 0x46deec
cmp dword [esi + 4], 0
jne 0x46df91
test ebx, ebx
je 0x46df5d
push esi
push dword [esi]
call fcn.0046dde0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x46df48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x46df9b
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 0x46de40
push esi
push 0
call fcn.004b53f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [esi]
call fcn.0046dca0
add esp, 8
mov eax, 0xfffffffc
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497280
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebx, ecx
mov dword [esp + 0x10], edx
lea ebp, [edi + 0xc]
push ebp
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x4972ef
push ebp
push 0
push esi
call fcn.00587250
mov eax, dword [esp + 0x1c]
lea ecx, [esi + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
mov edx, edi
mov dword [esi + 4], edi
push edi
push dword [esp + 0x1c]
call fcn.00401000
mov eax, dword [ebx + 0x38]
add esp, 8
test eax, eax
jne 0x4972d9
mov dword [ebx + 0x38], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp dword [eax], 0
je 0x4972e7
nop
mov eax, dword [eax]
cmp dword [eax], 0
jne 0x4972e0
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x49a9e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
or edx, 0xffffffff
mov esi, ecx
call fcn.0040f230
mov edx, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
sub edx, ecx
sar edx, 3
mov dword [esp + 0x14], eax
lea edi, [edx - 1]
cmp edi, edx
jae 0x49aa0e
lea eax, [ecx + edi*8]
test eax, eax
jne 0x49aa13
mov eax, 0x5ee574
mov ecx, 0xfff8
cmp word [eax + 6], cx
jne 0x49aa29
mov edi, dword [eax]
test edi, edi
je 0x49aa29
mov edi, dword [edi + 0x14]
jmp 0x49aa2b
xor edi, edi
mov ecx, esi
call fcn.00414690
push 0x61e6f8
or edx, 0xffffffff
mov ecx, esi
xor ebx, ebx
call fcn.00410720
add esp, 4
test eax, eax
je 0x49aa6f
push 0x61e6f8
or edx, 0xffffffff
mov ecx, esi
call fcn.0040fe40
add esp, 4
or edx, 0xffffffff
mov ecx, esi
call fcn.00413790
mov ecx, esi
mov ebx, eax
call fcn.00415510
mov ecx, esi
call fcn.00415510
test ebx, ebx
je 0x49aaf8
lea ebp, [edi + 5]
push ebp
call fcn.0058db11
mov esi, eax
add esp, 4
test esi, esi
je 0x49ab5a
push ebp
push 0
push esi
call fcn.00587250
add esp, 0xc
mov dword [esi], ebx
lea ecx, [esi + 4]
mov edx, edi
push edi
push dword [esp + 0x18]
call fcn.00401000
mov byte [esi + edi + 4], 0
add esp, 8
mov edi, dword [ebx + 0xc]
cmp dword [edi + 8], 0
je 0x49aae4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
je 0x49aae4
mov ecx, dword [ebx + 0xc]
mov edx, fcn.004a0ca0
push esi
push 1
call fcn.004af160
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
push dword [ebx + 0xc]
call fcn.004a0ca0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea ebp, [edi + 4]
push ebp
call fcn.0058db11
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x49ab5a
push ebp
push 0
push ebx
call fcn.00587250
add esp, 0xc
mov dword [ebx], ebp
lea ecx, [ebx + 4]
mov edx, edi
push edi
push dword [esp + 0x18]
call fcn.00401000
add esp, 8
lea eax, [esp + 0x18]
push 0
push eax
push ebp
push ebx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, esi
call fcn.00415510
push ebx
call fcn.0058c812
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x4c4
mov edx, 0x624148
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x4c4
push 0x624164
push 0x624180
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3
Function at 0x49d970
Capabilities:
Terminate process

Disassembly:
push ecx
push 0x49cea0
push ecx
push 0x49ce40
mov edx, 0x49cd30
mov ecx, 0x49cca0
call fcn.00430610
add esp, 0xc
test eax, eax
je 0x49d99b
mov eax, dword [eax + 0x70]
test eax, eax
je 0x49d99b
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x784
mov edx, 0x6219bc
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x784
push 0x6219ec
push 0x621a1c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3