joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b460
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4cc95b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov edi, ecx
push 1
mov dword [esp + 0x14], 0
call fcn.0049c7b6
add esp, 4
mov dword [esp + 0x10], eax
mov byte [eax], 0
lea eax, [esp + 0x14]
push 0x11c
push 0
push eax
call fcn.004a1910
add esp, 0xc
mov dword [esp + 0x14], 0x11c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48b4ee
cmp dword [esp + 0x18], 6
mov eax, dword [esp + 0x10]
setae cl
mov byte [eax], cl
mov dword [esp + 0x140], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esp + 0x14]
call fcn.004048c0
test al, al
je 0x48b521
lea ecx, [esp + 0x10]
call fcn.00404190
test al, al
jne 0x48b521
xor bl, bl
jmp 0x48b5bf
lea esi, [edi + 4]
xor ecx, ecx
mov edx, esi
call fcn.0047aa10
test al, al
jne 0x48b545
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x48b540
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x1c]
mov ecx, 0x1a
mov edx, esi
call fcn.0047aa10
test al, al
jne 0x48b56c
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x48b567
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x34]
mov ecx, 2
mov edx, esi
call fcn.0047aa10
test al, al
jne 0x48b593
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x48b58e
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x4c]
mov ecx, 0xb
mov edx, esi
call fcn.0047aa10
test al, al
jne 0x48b5ba
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x48b5b5
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov byte [edi], 1
mov bl, 1
mov dword [esp + 0x140], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004038c0
mov al, bl
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x134
ret
Function at 0x48d490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ccd28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0xdd67c8a7
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 7
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.0048d5c0
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x48d570
cmp esi, dword [esp + 0x18]
je 0x48d567
mov edi, edi
mov ecx, esi
call fcn.004398d0
add esi, 0x94
cmp esi, dword [esp + 0x18]
jne 0x48d550
mov esi, dword [esp + 0x10]
push esi
call fcn.0049c766
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x28
ret
Function at 0x48e460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ccf70
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x48e630
test esi, esi
je 0x48e630
cmp ebx, esi
jg 0x48e561
mov ecx, edi
call fcn.0048d940
cmp ebx, eax
jg 0x48e561
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 0
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x58], 0xffffffff
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.0048e260
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.0048d590
push dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ecx, esi
push ebp
mov edx, ebx
call fcn.00439770
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.0048eaf0
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, edi
call fcn.0048d940
cmp esi, eax
jg 0x48e609
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 1
mov ebx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x34]
call fcn.0048e260
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.0048d590
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push ebx
call fcn.0048eaf0
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebp
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00439770
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov edx, dword [esp + 0x1c]
push ebx
call fcn.0048ea00
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
imul eax, esi, 0x94
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x48e650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4ccfc9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
cmp esi, ebp
je 0x48e6d7
cmp edi, ebx
je 0x48e6d7
push esi
mov ecx, edi
call fcn.00444920
lea ecx, [esp + 0x54]
test al, al
je 0x48e6c7
push edi
call fcn.0048ea40
add edi, 0x94
cmp edi, ebx
jmp 0x48e6d5
push esi
call fcn.0048ea40
add esi, 0x94
cmp esi, ebp
jne 0x48e6a7
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 2
push ebp
mov byte [esp + 0x58], 1
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.0048e260
add esp, 0x18
mov byte [esp + 0x40], 3
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov byte [esp + 0x40], 1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x48e760
cmp esi, dword [esp + 0x2c]
je 0x48e757
lea ebx, [ebx]
mov ecx, esi
call fcn.004398d0
add esi, 0x94
cmp esi, dword [esp + 0x2c]
jne 0x48e740
mov esi, dword [esp + 0x24]
push esi
call fcn.0049c766
add esp, 4
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 4
push ebx
mov byte [esp + 0x58], 1
mov edx, edi
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.0048e260
add esp, 0x18
mov dword [esp + 0x14], 1
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x48e7e1
cmp esi, dword [esp + 0x5c]
je 0x48e7d8
mov ecx, esi
call fcn.004398d0
add esi, 0x94
cmp esi, dword [esp + 0x5c]
jne 0x48e7c1
mov esi, dword [esp + 0x54]
push esi
call fcn.0049c766
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x48ef70
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4cd0be
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [esp + 0xc], esi
call fcn.0049c7b6
mov dword [esi + 4], eax
push 0x11c
push 0
mov byte [eax], 0
lea eax, [esp + 0x18]
push eax
call fcn.004a1910
add esp, 0x10
mov dword [esp + 0xc], 0x11c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48eff3
cmp dword [esp + 0x10], 6
mov ecx, dword [esi + 4]
setae dl
mov byte [ecx], dl
mov dword [esp + 0x134], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x130
ret
Function at 0x490910
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004a1910
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4909a7
cmp dword [esp + 8], 6
jb 0x4909a7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.0049bfa3
add esp, 0x118
ret
Function at 0x4909c0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x4cd2dc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x1c]
push 0x4ded24
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.004024a0
mov dword [esp + 0x50], 0
mov eax, dword [0x4f8910]
test al, 1
jne 0x490a5f
or eax, 1
mov dword [0x4f8910], eax
mov byte [esp + 0x50], 1
mov dword [0x4f890c], 0
call fcn.00407db0
push 0x4cdb80
call fcn.0049c72f
add esp, 4
mov byte [esp + 0x50], 0
lea eax, [esp + 0x18]
mov ecx, 0x4f890c
push eax
call fcn.00407f70
mov edi, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x490a8b
push dword [esp + 0x18]
call fcn.0049c766
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
push 0xb
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], eax
push str.crypt32.dll
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], eax
mov word [esp + 0x38], ax
call fcn.004024a0
mov dword [esp + 0x50], 2
mov eax, dword [0x4f8910]
test al, 1
jne 0x490b0a
or eax, 1
mov dword [0x4f8910], eax
mov byte [esp + 0x50], 3
mov dword [0x4f890c], 0
call fcn.00407db0
push 0x4cdb80
call fcn.0049c72f
add esp, 4
mov byte [esp + 0x50], 2
lea eax, [esp + 0x30]
mov ecx, 0x4f890c
push eax
call fcn.00407f70
mov ebp, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x490b36
push dword [esp + 0x30]
call fcn.0049c766
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
test edi, edi
je 0x490bc9
test ebp, ebp
je 0x490bc9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push ebp
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x491e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd44e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00401fd0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00401fd0
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.00401fd0
mov byte [esp + 0x18], 2
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov al, byte [esi + 0x64]
mov byte [edi + 0x64], al
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x493140
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4cd538
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x24]
mov edi, dword [esp + 0x54]
push esi
push eax
call fcn.00493840
mov dword [esp + 0x48], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov byte [esp + 0x48], 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.00443370
xorps xmm0, xmm0
lea eax, [esp + 0x14]
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov byte [esp + 0x20], 0
test eax, eax
jne 0x4931d9
xor bl, bl
jmp 0x4931f8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4931f1
cmp eax, 0x80
je 0x4931f1
xor bl, bl
jmp 0x4931f8
mov byte [esp + 0x18], 1
mov bl, 1
mov byte [esp + 0x20], bl
mov byte [esp + 0x48], 2
lea eax, [esp + 0x13]
push eax
push edi
push esi
mov byte [esp + 0x1f], 0
call fcn.004932d0
test al, al
jne 0x49322b
cmp byte [esp + 0x13], al
je 0x49322b
cmp dword [esi + 0x14], 8
jb 0x493224
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x48], 1
test bl, bl
je 0x493248
mov eax, dword [esp + 0x14]
test eax, eax
je 0x493243
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x48], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49326c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp + 0x48], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x49328e
push dword [esp + 0x24]
call fcn.0049c766
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x3c
ret 8
Function at 0x494bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cd8a6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.RC::RCFileHash.0
mov dword [edi + 4], 0
mov dword [esp + 0x14], edi
mov byte [edi + 8], 0
mov dword [esp + 0x38], 0
mov dword [edi], vtable.RC::RCFileHashCalc.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [esp + 0x38], 2
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x20], 0
mov dword [edi], vtable.RC::RCMD5.0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 3
push 8
movq qword [esp + 0x28], xmm0
call fcn.0049c7b6
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x38], 4
test eax, eax
je 0x494c94
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
call fcn.004906c0
jmp 0x494c96
xor eax, eax
mov byte [esp + 0x38], 3
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.0048b0f0
mov byte [esp + 0x38], 5
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.00494e60
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.00495540
mov byte [esp + 0x38], 3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x494d07
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x494d07
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x494d07
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [esp + 0x38], 2
mov esi, dword [esp + 0x18]
test esi, esi
je 0x494d45
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.004944e0
push esi
call fcn.0049c766
add esp, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x2c
ret
Function at 0x497a80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x497a8b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00497aa0
Function at 0x4aec36
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f55dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004a1b6b
mov dword [ebp - 0x14], eax
cmp dword [0x4f8328], esi
jne 0x4aed29
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4aecb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4aee09
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4aee09
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4aee09
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4f8328], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4f832c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4f8330], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f8338], eax
test eax, eax
je 0x4aed26
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f8334], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4aed4e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4aed41
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4aed63
push 4
pop eax
jmp 0x4aee0b
cmp dword [ebp - 0x14], esi
je 0x4aed63
push dword [0x4f8328]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4aed48
mov eax, dword [0x4f8334]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4aedc1
cmp dword [0x4f8338], edi
je 0x4aedc1
push eax
call ebx
push dword [0x4f8338]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4aedc1
test eax, eax
je 0x4aedc1
call ecx
test eax, eax
je 0x4aedb6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4aedb6
test byte [ebp - 8], 1
jne 0x4aedc1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4aedf1
mov eax, dword [0x4f832c]
cmp eax, edi
je 0x4aedee
push eax
call ebx
test eax, eax
je 0x4aedee
call eax
mov esi, eax
test esi, esi
je 0x4aedee
mov eax, dword [0x4f8330]
cmp eax, edi
je 0x4aedee
push eax
call ebx
test eax, eax
je 0x4aedee
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4f8328]
call ebx
test eax, eax
je 0x4aee09
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4aee0b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049bfa3
mov esp, ebp
pop ebp
ret
Function at 0x1000d66c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000d67b
pop dword [ebp - 0x48]
mov eax, 0x9b3d95be
add eax, 0x74c340bd
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3e614
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xc8ecb159
add ecx, 0x3713a74c
xor edi, edi
add edi, eax
mov esi, 0x10024400
add esi, dword [ebp - 0x48]
mov ebx, 0x2dfa4511
sub ebx, 0x1946076c
add dword [ebp - 0x30], eax
mov edx, dword [esi]
mov dword [ebp - 0x14], 0x353ff755
xor edx, ebx
xor dword [ebp - 0x2c], esi
mov dword [edi], edx
sub dword [ebp - 0x40], 0x236ac51b
add edi, 0x812e297f
sub edi, 0x812e297b
add esi, 4
loop 0x1000d6d1
add eax, 0x1afef354
add eax, 0xe5026213
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc2ab76c2
sub ecx, 0xb2ab76c2
add ecx, dword [ebp - 0x48]
call ebx
leave
ret