joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f1b6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045d755
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045b034
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d530
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x40d57c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40d55f
cmp edi, 2
jb 0x40d55f
cmp byte [esi], cl
jne 0x40d55f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4b2f70]
test edi, edi
jne 0x40d545
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40d5ab
cmp cl, 0x23
jne 0x40d592
cmp byte [esi], cl
jne 0x40d592
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4b2f70]
test cl, cl
jne 0x40d583
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x40d6f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40d703
mov dword [edi], 0
mov edx, 0x4b2c88
call fcn.0040d5c0
mov esi, eax
test esi, esi
je 0x40d72b
mov ecx, esi
call fcn.0040d690
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x40d732
push esi
call fcn.004797c7
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [0x4e40a0]
test ecx, ecx
je 0x40d742
inc dword [ecx + 0xb0]
push eax
call fcn.00482f17
add esp, 4
mov ebx, eax
push esi
test ebx, ebx
je 0x40d723
push dword [ebp + 8]
push 1
push ebx
call fcn.0047e442
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40d78d
call fcn.004797c7
mov eax, dword [0x4e40a0]
add esp, 4
test eax, eax
je 0x40d77d
dec dword [eax + 0xb0]
push ebx
call fcn.0047ce48
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.004797c7
add esp, 4
test edi, edi
je 0x40d79e
mov eax, dword [ebp + 8]
mov dword [edi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x40e9f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f8ae
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x4e40a0]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
or eax, 0xffffffff
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x40], str.Window
mov cl, 0x57
movups xmmword [ebp - 0x30], xmm0
mov esi, 0x4b22b5
or edi, 0xffffffff
cmp cl, 0x23
jne 0x40ea51
cmp byte [esi], cl
jne 0x40ea51
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4b2f70]
test cl, cl
jne 0x40ea42
mov esi, dword [ebp - 0x1c]
not eax
add esi, 0x5a00
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x41f120
mov dword [ebp - 0x30], 0x41f190
mov dword [ebp - 0x2c], 0x41f1b0
mov edi, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x28], 0x41f280
mov dword [ebp - 0x24], 0x41f2f0
cmp ecx, edi
jne 0x40eac6
inc ecx
test edi, edi
je 0x40eab4
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x40eab9
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00420a50
mov eax, dword [esi]
movups xmm0, xmmword [ebp - 0x40]
lea ecx, [eax + eax*8]
mov eax, dword [esi + 8]
movups xmmword [eax + ecx*4], xmm0
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
inc dword [esi]
call fcn.00434960
mov ecx, dword [0x4e40a0]
mov eax, dword [str.Size_column_to_fitSizeOne]
mov dword [ecx + 0x5a34], eax
mov eax, dword [str.Size_all_columns_to_fitSizeAll]
mov dword [ecx + 0x5a38], eax
mov eax, dword [str.Size_all_columns_to_defaultSizeAll]
mov dword [ecx + 0x5a3c], eax
mov eax, dword [str.Reset_orderResetOrder]
mov dword [ecx + 0x5a40], eax
mov eax, dword [str._Main_menu_bar_]
mov dword [ecx + 0x5a44], eax
mov eax, dword [str._Popup_]
mov dword [ecx + 0x5a48], eax
mov eax, dword [str._Untitled_]
mov dword [ecx + 0x5a4c], eax
test ecx, ecx
je 0x40eb4b
inc dword [ecx + 0xb0]
push 0x9c
call fcn.00482f17
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x18], eax
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
test eax, eax
je 0x40eb78
mov ecx, eax
call fcn.0040b290
mov dword [ebp - 0x18], eax
jmp 0x40eb7f
mov dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x1c]
add esi, 0x479c
mov ecx, dword [esi + 4]
mov edi, dword [esi]
cmp edi, ecx
jne 0x40ebb3
inc edi
test ecx, ecx
je 0x40eba1
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x40eba6
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.00420540
mov ecx, dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x18]
mov byte [ebp - 0x11], 0
mov dword [eax + ecx*4], edx
lea eax, [ebp - 0x11]
inc dword [esi]
mov esi, dword [ebp - 0x1c]
push eax
push ecx
lea ecx, [esi + 0x5be4]
call fcn.00420930
mov byte [esi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d520
mov esp, ebp
pop ebp
ret
Function at 0x41ecd0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x41ed0c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x41ecf2
cmp byte [esi], al
jne 0x41ecf2
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x4b2f70]
test al, al
jne 0x41ece4
pop ebx
not ecx
call fcn.0041ec80
test eax, eax
jne 0x41ed20
mov ecx, edi
pop edi
pop esi
jmp fcn.0041ebb0
pop edi
pop esi
ret

Function at 0x41ed30
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4e40a0]
test bl, bl
je 0x41ed76
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41ed57
cmp byte [esi], bl
jne 0x41ed57
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4b2f70]
test bl, bl
jne 0x41ed48
mov edi, dword [0x4e40a0]
mov esi, dword [edi + 0x5a00]
xor ecx, ecx
not eax
test esi, esi
jle 0x41ed9c
mov edi, dword [edi + 0x5a08]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x41eda2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x41ed90
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret

Function at 0x4295a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4295d6
mov eax, dword [0x4e40a0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x4295c6
dec dword [eax + 0xb0]
push ecx
call fcn.0047ce48
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42960a
mov eax, dword [0x4e40a0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x4295fa
dec dword [eax + 0xb0]
push ecx
call fcn.0047ce48
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42963e
mov eax, dword [0x4e40a0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42962e
dec dword [eax + 0xb0]
push ecx
call fcn.0047ce48
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x42968e
mov eax, dword [0x4e40a0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x42967e
dec dword [eax + 0xb0]
push ecx
call fcn.0047ce48
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x4296c2
mov eax, dword [0x4e40a0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x4296b2
dec dword [eax + 0xb0]
push ecx
call fcn.0047ce48
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4296f6
mov eax, dword [0x4e40a0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x4296e6
dec dword [eax + 0xb0]
push ecx
call fcn.0047ce48
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042bf60
Function at 0x430860
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5e6ea9af
push esi
mov esi, edx
mov ecx, 1
mul ebx
push edi
shr edx, 0xb
xor edi, edi
imul eax, edx, 0x15b0
mov edx, ebx
mov dword [ebp - 0x10], edi
sub edx, eax
mov dword [ebp - 4], edx
test ebx, ebx
je 0x43099a
xor ebx, ebx
cmp edx, 7
jbe 0x4308f9
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
add ebx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, edx
jb 0x4308a8
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp ebx, eax
jae 0x43095f
sub eax, ebx
cmp eax, 2
jb 0x43094b
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 8]
mov edi, ebx
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x430925
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jae 0x430958
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
mov eax, dword [ebp - 0xc]
add eax, edx
add edi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [ebp - 4]
add edi, eax
sub dword [ebp + 8], edx
mov edx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edx
jne 0x430897
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432a30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4e40a0]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
lea esi, [eax + 8]
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3761], 0
mov byte [ebp - 4], al
je 0x432a7b
test al, al
je 0x432a69
movss xmm3, dword [0x4d378c]
jmp 0x432a6c
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x1000
call fcn.0040cf40
push 0x10
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3761], 0
mov byte [ebp - 4], al
je 0x432ab0
test al, al
je 0x432a9e
movss xmm3, dword [0x4d378c]
jmp 0x432aa1
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x2000
call fcn.0040cf40
push 0x12
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3761], 0
mov byte [ebp - 4], al
je 0x432ae5
test al, al
je 0x432ad3
movss xmm3, dword [0x4d378c]
jmp 0x432ad6
xorps xmm3, xmm3
push dword [ebp - 4]
mov ecx, esi
push 0x4000
call fcn.0040cf40
push 0x5d
call edi
shr eax, 0xf
and al, 1
cmp byte [esi + 0x3761], 0
mov byte [ebp - 4], al
je 0x432b1d
test al, al
je 0x432b08
movss xmm0, dword [0x4d378c]
jmp 0x432b0b
xorps xmm0, xmm0
push dword [ebp - 4]
movaps xmm3, xmm0
mov ecx, esi
push 0x8000
call fcn.0040cf40
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434960
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
push esi
xorps xmm0, xmm0
or eax, 0xffffffff
push edi
movaps xmmword [ebp - 0x30], xmm0
mov cl, 0x54
movaps xmmword [ebp - 0x20], xmm0
mov esi, 0x4d16d1
mov dword [ebp - 0x30], str.Table
or edi, 0xffffffff
nop word [eax + eax]
cmp cl, 0x23
jne 0x4349af
cmp byte [esi], cl
jne 0x4349af
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4b2f70]
test cl, cl
jne 0x4349a0
mov esi, dword [0x4e40a0]
not eax
add esi, 0x5a00
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x434240
mov dword [ebp - 0x20], 0x434320
mov dword [ebp - 0x1c], 0x4343d0
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x18], 0x4342d0
mov dword [ebp - 0x14], 0x434640
cmp ecx, edi
jne 0x434a27
inc ecx
test edi, edi
je 0x434a15
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
jmp 0x434a1a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00420a50
mov eax, dword [esi]
movups xmm0, xmmword [ebp - 0x30]
pop edi
lea ecx, [eax + eax*8]
mov eax, dword [esi + 8]
movups xmmword [eax + ecx*4], xmm0
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
inc dword [esi]
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x43a260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f1b6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0045d755
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045b034
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x442483
cmp eax, edi
jge 0x44247b
call fcn.00441d80
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4424a8
mov edi, dword [esi + 0xc]
nop
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx - 4], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x442490
mov dword [esi + 8], edx
cmp dword [esi + 8], 0
jge 0x4424c8
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [eax + 8], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, 4
jge 0x4424ea
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4424da
xor edx, edx
jmp 0x4424e0
movzx edx, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x4424d2
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
jne 0x4424ae
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x442533
mov eax, dword fs:[0x2c]
pop edi
pop esi
mov eax, dword [eax]
mov dword [eax + 8], str.read_past_buffer
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x442551
push edi
mov ecx, esi
call fcn.00441eb0
add esp, 4
test eax, eax
je 0x4424c0
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00476050
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44b170
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e0070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x44b1c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d520
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax + eax]
lea eax, [ebp - 0x20c]
push str.sonoyuncuclient.exe
push eax
call fcn.0048576a
add esp, 8
test eax, eax
je 0x44b20f
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x44b1d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d520
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0045d520
mov esp, ebp
pop ebp
ret
Function at 0x44ba30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fff9
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x4e0070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
cmp dword [ebp + 0x1c], 8
push 0
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44bb88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44bb88
push 0x98
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.00476640
add esp, 4
lea ecx, [ebp - 0xac]
call fcn.00406560
mov edx, str.error_code:
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.0043a6c0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.00406be0
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0xac]
call fcn.00406480
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x44bafc
mov eax, dword [eax]
mov dword [ebp - 0xb4], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xbc]
mov dword [ebp - 0xc0], vtable.std::exception.0
push eax
lea eax, [ebp - 0xb4]
movq qword [ebp - 0xbc], xmm0
push eax
mov byte [ebp - 0xb0], 1
call fcn.00474593
add esp, 8
mov dword [ebp - 0xc0], vtable.std::runtime_error.0
lea eax, [ebp - 0xc0]
push 0x4de344
push eax
call fcn.004765c4
lea eax, [ebp + 8]
mov edx, str.Error_while_creating_directory
push eax
lea ecx, [ebp - 0xdc]
call fcn.0044fb80
add esp, 4
mov byte [ebp - 4], 5
mov ecx, eax
mov edx, dword [ebp - 0xc4]
call fcn.004385b0
lea ecx, [ebp - 0xdc]
call fcn.00405860
mov eax, 0x44bb88
ret
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x44bb9d
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00409b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045d520
mov esp, ebp
pop ebp
ret
Function at 0x44bbc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4e0070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0x20], 0
push eax
push 0
push 0x8000
mov esi, ecx
push 0x4a33b0
mov dword [ebp - 8], esi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x44bc40
mov edx, dword [ebp - 8]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], eax
mov word [esi], ax
cmp word [edx], ax
jne 0x44bc10
xor ecx, ecx
jmp 0x44bc26
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44bc16
sub ecx, edi
sar ecx, 1
pop edi
push ecx
push edx
mov ecx, esi
call fcn.00439aa0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045d520
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.std::exception.0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], str.problem_getting_appdata_folder
xorps xmm0, xmm0
mov byte [ebp - 0xc], 1
push eax
movq qword [ebp - 0x18], xmm0
call fcn.00474593
add esp, 8
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea eax, [ebp - 0x1c]
push 0x4de344
push eax
call fcn.004765c4
int3
Function at 0x450c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a082d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
lea ebx, [edi + 0x10]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push 0
mov ecx, ebx
mov dword [ebp - 0x14], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.004528f0
mov dword [ebx + 0xc], 0
lea esi, [edi + 0x20]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
push 0
mov ecx, esi
mov dword [ebp - 0x14], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004528f0
mov dword [esi + 0xc], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x450d3e
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.0044e6c0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
mov ecx, ebx
mov byte [ebp - 0xd], 1
call fcn.00451640
mov dword [ebp - 4], 7
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x450d88
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30

Function at 0x4602a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret