joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edx, dword [0x582e50]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x430c38
mov eax, dword [ebp - 0x10]
mov esi, 0x3f4
add eax, 0xfffffffd
cmp eax, 1
ja 0x430c38
cmp dword [ebp - 0x14], 4
jne 0x430c38
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ed5a1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x430c50
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.004eda40
mov edx, dword [0x582e50]
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x810]
lea esi, [ebp - 0x1018]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x101c], 0x800
push edx
push ebx
push esi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x430d81
mov eax, dword [ebp - 0x1018]
mov esi, dword [ebp + 0xc]
cmp eax, 2
je 0x430ced
mov edi, 0x3f4
cmp eax, 1
jne 0x430d81
push ebx
call fcn.0051c564
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x14]
cmp eax, edi
jae 0x430d4a
sub esp, 0xc
mov al, byte [ebp - 0x1010]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
jmp 0x430d3e
lea eax, [ebp - 0x1010]
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x101c], eax
dec eax
mov edi, 0xea
cmp eax, 0x3ff
ja 0x430d81
lea ebx, [ebp - 0x1010]
push ebx
call fcn.0051c564
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x14]
mov ecx, ebx
cmp eax, edi
jae 0x430d5e
sub esp, 0xc
mov al, byte [ebp - 0x1014]
mov byte [esp + 4], al
mov dword [esp + 8], ecx
mov ecx, esi
mov dword [esp], edi
call fcn.00401752
jmp 0x430d7f
cmp eax, 8
mov eax, esi
jb 0x430d53
mov esi, dword [eax]
mov ecx, edi
mov dword [eax + 0x10], edi
add ecx, edi
push ecx
push ebx
jmp 0x430d70
cmp eax, 8
mov eax, esi
jb 0x430d67
mov esi, dword [eax]
mov edx, edi
mov dword [eax + 0x10], edi
add edx, edi
push edx
push ecx
push esi
call fcn.0050b940
add esp, 0xc
mov word [esi + edi*2], 0
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x431ca0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x582e50]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x5854a0]
ucomisd xmm1, xmm0
jne 0x431e24
jp 0x431e24
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x5854b0]
mov ecx, dword [0x5875cc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x431e49
mov eax, dword [0x5854c0]
mov ecx, dword [0x5875cc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x431e83
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x5854b8]
movsd xmm2, qword [0x532db8]
sbb ebx, dword [0x5854bc]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x5302f0]
subpd xmm1, xmmword [0x530300]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addpd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x431e24
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x5854a8]
sbb ecx, dword [0x5854ac]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x5302f0]
subpd xmm2, xmmword [0x530300]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addpd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x5854a0], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004ed5a1
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5854b0
call fcn.004ed5e7
add esp, 4
mov eax, dword [0x5854b0]
cmp eax, 0xffffffff
jne 0x431d12
rdtsc
mov dword [0x5854ac], edx
mov dword [0x5854a8], eax
push 0x5854b0
call fcn.004ed639
add esp, 4
jmp 0x431d12
push 0x5854c0
call fcn.004ed5e7
add esp, 4
mov eax, dword [0x5854c0]
cmp eax, 0xffffffff
jne 0x431d33
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [esp + 0x28]
movsd qword [0x5854b8], xmm0
push 0x5854c0
call fcn.004ed639
add esp, 4
jmp 0x431d33
Function at 0x436950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
call fcn.0040106c
xor byte [eax + 0x5854dc3d], al
add byte [ecx], al
jne 0x43698f
push dword [0x5854e0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43698f
push eax
call fcn.00407f30
add esp, 4
push 0
push dword [0x5854e0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
ret 0xc

Function at 0x439ab8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 0xf
jbe 0x439ad3
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov ebx, 0x811c9dc5
test eax, eax
je 0x439aeb
movzx edx, byte [ecx]
inc ecx
xor edx, ebx
imul ebx, edx, 0x1000193
dec eax
jne 0x439adc
mov eax, dword [ebp - 0x10]
and ebx, dword [eax + 0x18]
mov edi, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + ebx*8]
lea edx, [ebx + ebx]
cmp esi, edi
je 0x439b32
lea ecx, [edx*4]
or ecx, 4
mov eax, dword [eax + ecx]
mov edi, dword [eax]
jmp 0x439b32
mov edi, dword [edi + 4]
mov ecx, dword [ebp + 0xc]
mov esi, edx
lea eax, [edi + 8]
push eax
call fcn.0040a066
test al, al
jne 0x439b8c
mov eax, dword [ebp - 0x10]
mov edx, esi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + esi*4]
cmp esi, edi
jne 0x439b12
mov eax, dword [ebp - 0x10]
lea edi, [eax + 4]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0xc]
push dword [eax]
call fcn.0040ba36
mov eax, dword [edi]
mov edi, dword [eax]
mov eax, dword [edi]
cmp eax, esi
je 0x439b75
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [eax + 4]
mov ecx, dword [esi + 4]
mov dword [esi + 4], edx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x10]
push ebx
push esi
push edi
call fcn.0040baa2
mov ecx, dword [ebp - 0x10]
call fcn.0040baf4
mov cl, 1
jmp 0x439b8e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], cl
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x442190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.004eda40
mov eax, dword [0x582e50]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x582e70]
cmp eax, 0xffffffff
je 0x4422f0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4422f0
mov esi, eax
cmp eax, 1
jne 0x4421db
push 0
push dword [0x582e70]
jmp 0x4422e8
lea edi, [ebp - 0x810]
push 0x800
push esi
push edi
call fcn.0050b3c0
add esp, 0xc
mov eax, dword [0x582e70]
push edi
mov dword [ebp - 0x1414], eax
push eax
call fcn.00469740
add esp, 8
push esi
call fcn.004ed59c
add esp, 4
mov eax, dword [0x588500]
mov ecx, dword [0x5875cc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x442305
mov esi, dword [0x5884fc]
mov ecx, esi
call fcn.0043ae20
lea eax, [ebp - 0x1410]
push 0xc00
push 0x5878fc
push eax
call fcn.0050b3c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, 0x100
mov al, 1
nop word cs:[eax + eax]
nop dword [eax]
test al, 1
je 0x4422e0
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x4422d0
cmp dword [ebp + ebx - 0x810], 0
je 0x4422d0
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x4422d0
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x4422d0
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
nop word cs:[eax + eax]
nop
add edi, 8
add ebx, 0xc
jne 0x442290
cmp esi, 2
lea esi, [esi - 1]
jae 0x442270
push 1
push dword [ebp - 0x1414]
call fcn.00469740
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x588500
call fcn.004ed5e7
add esp, 4
mov eax, dword [0x588500]
cmp eax, 0xffffffff
jne 0x44222f
push 4
call fcn.004ed52c
add esp, 4
mov ecx, eax
mov esi, eax
call fcn.0043ae10
mov dword [0x5884fc], esi
push 0x588500
call fcn.004ed639
add esp, 4
jmp 0x44222f
Function at 0x442370
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [0x582e50]
mov esi, ecx
xor eax, ebp
mov dword [esp + 0xc0], eax
mov eax, dword [0x582e70]
cmp eax, 0xffffffff
je 0x4423a4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4423a9
call fcn.00442530
mov eax, dword [0x588500]
mov ecx, dword [0x5875cc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x4424e5
mov edi, dword [0x5884fc]
mov ecx, edi
call fcn.0043ae20
mov eax, dword [0x5878f8]
xor ecx, ecx
inc eax
nop
lea edx, [eax + ecx]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x5878fc], 0
je 0x4423fe
inc ecx
cmp ecx, 0xff
jbe 0x4423e0
jmp 0x44242e
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x5878fc]
mov dword [0x5878f8], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x587900], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x587904]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
mov dword [esp + 8], 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x442480
lea eax, [esp + 8]
lea ecx, [esp + 4]
push str.slot____kInvalidSlotValue
push eax
push ecx
call fcn.0041b260
add esp, 0xc
test eax, eax
je 0x442480
lea edi, [esp + 8]
mov ecx, edi
push eax
push 0x159
push str..._.._base_threading_thread_local_storage.cc
call fcn.0041a440
mov ecx, edi
call fcn.00419550
mov eax, dword [esi]
mov dword [esp + 8], 0x100
cmp eax, 0xff
mov dword [esp + 4], eax
jle 0x4424cd
lea eax, [esp + 8]
lea ecx, [esp + 4]
push str.slot____kThreadLocalStorageSize
push eax
push ecx
call fcn.0041b260
add esp, 0xc
test eax, eax
je 0x4424cd
lea esi, [esp + 8]
mov ecx, esi
push eax
push 0x15a
push str..._.._base_threading_thread_local_storage.cc
call fcn.0041a440
mov ecx, esi
call fcn.00419550
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.004ed5a1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x588500
call fcn.004ed5e7
add esp, 4
mov eax, dword [0x588500]
cmp eax, 0xffffffff
jne 0x4423ca
push 4
call fcn.004ed52c
add esp, 4
mov ecx, eax
mov edi, eax
call fcn.0043ae10
mov dword [0x5884fc], edi
push 0x588500
call fcn.004ed639
add esp, 4
jmp 0x4423ca
Function at 0x442530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x810
mov eax, dword [0x582e50]
xor eax, ebp
mov dword [esp + 0x80c], eax
mov eax, dword [0x582e70]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x442601
lea edi, [esp + 4]
push edi
call fcn.00469710
add esp, 4
test al, al
jne 0x442590
lea esi, [esp + 8]
mov ecx, esi
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0x99
push str..._.._base_threading_thread_local_storage.cc
call int.00419410
mov ecx, esi
call fcn.00419550
mov ecx, dword [esp + 4]
cmp ecx, 0xffffffff
jne 0x4425dc
push edi
call fcn.00469710
add esp, 4
test al, al
je 0x4425ad
cmp dword [esp + 4], 0xffffffff
jne 0x4425ce
lea esi, [esp + 8]
mov ecx, esi
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0xa3
push str..._.._base_threading_thread_local_storage.cc
call int.00419410
mov ecx, esi
call fcn.00419550
push 0xffffffffffffffff
call fcn.00469730
add esp, 4
mov ecx, dword [esp + 4]
mov eax, 0xffffffff
lock cmpxchg dword [0x582e70], ecx
mov eax, dword [esp + 4]
je 0x442601
push eax
call fcn.00469730
add esp, 4
mov eax, dword [0x582e70]
mov dword [esp + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [esp + 8], eax
je 0x442648
lea eax, [esp + 8]
push str.PlatformThreadLocalStorage::GetTLSValue_key___kUninitialized
push 0x536d60
push eax
call fcn.0040ccb0
add esp, 0xc
test eax, eax
je 0x442648
lea esi, [esp + 8]
mov ecx, esi
push eax
push 0xb5
push str..._.._base_threading_thread_local_storage.cc
call fcn.0041a440
mov ecx, esi
call fcn.00419550
lea edi, [esp + 8]
push 0x800
push 0
push edi
call fcn.0050bec0
add esp, 0xc
push edi
push dword [esp + 8]
call fcn.00469740
add esp, 8
push 0x800
call fcn.004ed593
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.0050b3c0
add esp, 0xc
push esi
push dword [esp + 8]
call fcn.00469740
add esp, 8
mov ecx, dword [esp + 0x80c]
xor ecx, ebp
call fcn.004ed5a1
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x4552b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x582e50]
xor eax, ebp
mov dword [esp + 0x20], eax
mov edi, dword [ecx + 0x30]
test edi, edi
jne 0x455379
mov esi, ecx
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x48
call fcn.004ed52c
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.00455160
mov ecx, ebx
push edi
push dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
call fcn.00456430
mov edi, dword [esi + 0x30]
mov dword [esi + 0x30], ebx
test edi, edi
je 0x455340
mov ecx, edi
call fcn.00456520
push edi
call fcn.004ed55c
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
jb 0x455376
mov ecx, dword [esp + 8]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x45536c
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x45538e
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.004ed561
add esp, 8
mov edi, dword [esi + 0x30]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.004ed5a1
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00515650
int3
Function at 0x45b870
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx + 0x10]
cmp dword [ebx + 0x14], 0xf
jbe 0x45b887
mov ebx, dword [ebx]
test edx, edx
mov eax, 0x811c9dc5
mov dword [ebp - 0x10], edx
je 0x45b8af
mov esi, ebx
nop word cs:[eax + eax]
nop
movzx edi, byte [esi]
inc esi
xor edi, eax
imul eax, edi, 0x1000193
dec edx
jne 0x45b8a0
and eax, dword [ecx + 0x18]
mov edi, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + eax*8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], edi
jne 0x45b8e7
jmp 0x45b910
mov esi, dword [esi]
cmp dword [ebp - 0x1c], edi
je 0x45b910
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, esi
je 0x45b9aa
cmp dword [esi + 0x18], ecx
jne 0x45b8e0
cmp dword [esi + 0x1c], 0xf
jbe 0x45b920
mov eax, dword [esi + 8]
jmp 0x45b923
mov eax, edi
cmp eax, esi
jne 0x45b8fa
jmp 0x45b9aa
lea eax, [esi + 8]
push ecx
push ebx
push eax
call fcn.0050979d
mov ecx, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
jne 0x45b8e0
mov dword [ebp - 0x20], ebx
mov ebx, esi
cmp dword [ebp - 0x1c], edi
jne 0x45b957
jmp 0x45b9a0
mov ebx, dword [ebx]
cmp dword [ebp - 0x1c], edi
je 0x45b9a0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, ebx
je 0x45b9a6
cmp ecx, dword [ebx + 0x18]
jne 0x45b9a6
cmp dword [ebx + 0x1c], 0xf
jbe 0x45b980
mov eax, dword [ebx + 8]
jmp 0x45b983
lea eax, [ebx + 8]
push ecx
push eax
push dword [ebp - 0x20]
call fcn.0050979d
mov ecx, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
je 0x45b950
jmp 0x45b9a6
mov eax, edi
cmp eax, ebx
jne 0x45b966
cmp esi, ebx
jne 0x45b9ae
mov esi, edi
mov ebx, edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x45c550
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x582e50]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x588f00]
mov ecx, dword [0x5875cc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x45c59d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, 0x588efc
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x588f00
call fcn.004ed5e7
add esp, 4
mov eax, dword [0x588f00]
cmp eax, 0xffffffff
jne 0x45c583
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.0050bec0
add esp, 0xc
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x130], 0
cmp eax, 0xa
je 0x45c5fd
xor ebx, ebx
cmp eax, 6
jne 0x45c633
push 0x532d60
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x130]
push ecx
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call eax
mov ebx, dword [ebp - 0x130]
push 0x5c
call fcn.004ed52c
add esp, 4
mov esi, eax
push 0x588f04
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, esi
push ebx
push 0x588f04
push edi
call fcn.0045c6c0
mov dword [0x588efc], esi
push 0x588f00
call fcn.004ed639
add esp, 4
jmp 0x45c583

Function at 0x45c680
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0x588f04
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [0x588f04]
cmp ecx, 0xc
ja case.0x45c69c.1
xor eax, eax
jmp dword [ecx*4 + 0x537c94]
mov eax, 2
pop ebp
ret
mov eax, 4
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 3
pop ebp
ret
Function at 0x45d7bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x582e50]
mov edi, edx
lea esi, [ebp - 0x218]
xor ebx, ebx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov word [esi], 0
push esi
push ebx
push ebx
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x45d833
cmp word [ebp - 0x218], 0
mov dword [ebp - 0x234], edi
je 0x45d80f
xor ebx, ebx
cmp word [ebp + ebx*2 - 0x216], 0
lea ebx, [ebx + 1]
jne 0x45d801
lea edi, [ebp - 0x230]
mov ecx, edi
push ebx
push esi
call fcn.00412b90
mov ecx, dword [ebp - 0x234]
push edi
call fcn.00412d20
mov ecx, edi
call fcn.00412c40
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x462790
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x582e50]
mov ebx, ecx
lea esi, [ebp - 0x28]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], edx
push edx
push ecx
push esi
call fcn.00426f30
add esp, 0xc
cmp dword [ebp - 0x14], 7
jbe 0x4627bf
mov esi, dword [ebp - 0x28]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x14]
mov edi, eax
cmp ecx, 8
jb 0x462807
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x4627fd
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x46298b
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.004ed561
add esp, 8
test edi, edi
je 0x4628ad
cmp dword [ebp + 8], 0
mov dword [ebp - 0x2c], ebx
mov bl, 1
je 0x462977
mov eax, edi
mov ecx, 0xffffffff
add eax, edi
cmovae ecx, eax
push ecx
call fcn.004ed593
add esp, 4
mov esi, eax
lea ebx, [ebp - 0x28]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push ebx
call fcn.00426f30
add esp, 0xc
cmp dword [ebp - 0x14], 7
jbe 0x462850
mov ebx, dword [ebp - 0x28]
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x14]
mov bl, 1
cmp ecx, 8
jb 0x462896
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x46288c
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x46298b
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.004ed561
add esp, 8
cmp word [esi], 0
je 0x4628b4
xor eax, eax
nop
cmp word [esi + eax*2 + 2], 0
lea eax, [eax + 1]
jne 0x4628a0
jmp 0x4628b6
xor ebx, ebx
jmp 0x462977
xor eax, eax
lea edi, [ebp - 0x28]
push eax
push esi
push edi
call fcn.00427330
add esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x14]
cmp edi, ecx
je 0x462936
cmp eax, 0x10
jb 0x462905
mov ecx, dword [ecx]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x4628f8
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x46298b
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.004ed561
add esp, 8
mov ecx, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x18]
movsd qword [ecx + 0x10], xmm0
movsd xmm0, qword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x20]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
jmp 0x462967
cmp eax, 0x10
jb 0x462967
mov ecx, dword [ebp - 0x28]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x46295d
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x46298b
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.004ed561
add esp, 8
mov dword [ebp - 0x14], 0xf
push esi
call fcn.004ed59c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00515650
Function at 0x465a12
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
jle 0x465a58
mov edx, dword [eax + 8]
xor eax, eax
add edx, 8
mov esi, dword [edx]
mov edi, dword [edx + 4]
xor ebx, ebx
or esi, 1
test edi, edi
setne bl
cmovne esi, edi
add edx, 8
shl ebx, 5
bsr esi, esi
or ebx, 0x1f
xor esi, ebx
xor esi, 0x1f
lea esi, [esi + esi*8 + 0x49]
shr esi, 6
add eax, esi
dec ecx
jne 0x465a27
jmp 0x465a5a
xor eax, eax
pop esi
pop edi
pop ebx
ret