joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5202
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a52ff
call fcn.004a490f
test al, al
je 0x4a52ff
call fcn.004a3adf
test al, al
je 0x4a5238
mov al, 1
jmp 0x4a5301
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSCloseWindows
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a52b9
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a52b9
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a52b0
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a52fb
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a52f2
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
mov al, bl
jmp 0x4a5301
xor al, al
call fcn.004e85f6
ret
Function at 0x4a5307
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a5404
call fcn.004a490f
test al, al
je 0x4a5404
call fcn.004a3adf
test al, al
je 0x4a533d
mov al, 1
jmp 0x4a5406
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSDomPaste
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a53be
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a53be
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a53b5
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5400
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a53f7
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
mov al, bl
jmp 0x4a5406
xor al, al
call fcn.004e85f6
ret
Function at 0x4a540c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a550f
call fcn.004a490f
test al, al
je 0x4a550f
call fcn.004a3adf
test al, al
jne 0x4a550f
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableLocalStorage
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a54c9
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a54c9
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a54c0
cmp dword [ebp - 0x30], esi
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a550b
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5502
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
mov al, bl
jmp 0x4a5511
mov al, 1
call fcn.004e85f6
ret
Function at 0x4a5627
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x559786
call fcn.004e864c
call fcn.004a459e
test al, al
jne 0x4a5649
call fcn.004a4738
test al, al
je 0x4a57ae
call fcn.004a490f
test al, al
je 0x4a57ae
call fcn.004a3adf
test al, al
jne 0x4a57aa
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableNetworkAccess
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4835
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a56e0
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a56d0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004e815d
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a57aa
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a5764
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5764
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a575b
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a57a6
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a579d
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
mov al, bl
jmp 0x4a57b0
mov al, 1
jmp 0x4a57b0
xor al, al
call fcn.004e85f6
ret
Function at 0x4a57b6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x559786
call fcn.004e864c
call fcn.004a490f
test al, al
je 0x4a5927
call fcn.004a3adf
test al, al
jne 0x4a5923
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableDebugInterface
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4835
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5859
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5849
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004e815d
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a5923
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a58dd
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a58dd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a58d4
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a591f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a5916
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
mov al, bl
jmp 0x4a5929
mov al, 1
jmp 0x4a5929
xor al, al
call fcn.004e85f6
ret
Function at 0x4a592f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a5a2c
call fcn.004a490f
test al, al
je 0x4a5a2c
call fcn.004a3adf
test al, al
je 0x4a5965
mov al, 1
jmp 0x4a5a2e
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUniAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a59e6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a59e6
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a59dd
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5a28
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5a1f
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
mov al, bl
jmp 0x4a5a2e
xor al, al
call fcn.004e85f6
ret
Function at 0x4b3601
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x55b2c0
call fcn.004e864c
call fcn.004b39e6
test al, al
je 0x4b3828
xor ebx, ebx
mov esi, 0x5dfdc0
cmp byte [0x5dfdbf], bl
jne 0x4b367b
lea eax, [ebp - 0x9c]
mov byte [0x5dfdbf], 1
push eax
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0xa0]
push eax
push esi
lea eax, [ebp - 0xa4]
push eax
push ebx
push str.tOutputDir
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [0x5dfdbe], bl
lea ecx, [ebp - 0x38]
mov eax, 0x58cf8c
mov dword [ebp - 0x28], ebx
mov edi, 0x58cf90
mov dword [ebp - 0x24], 0xf
push str.AcroCEF_TimeInfo
cmove edi, eax
mov byte [ebp - 0x38], bl
call fcn.0045446b
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x98]
mov byte [ebp - 0x20], bl
push esi
push eax
call fcn.00432940
add esp, 0xc
mov esi, eax
push 0xa
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004f8afc
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00451ce6
push edi
push eax
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
push eax
call fcn.00451ce6
push str..log
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
call fcn.00451ce6
lea ecx, [ebp - 0x38]
add esp, 0x30
cmp ecx, eax
je 0x4b3723
mov byte [ebp - 0xa0], bl
push dword [ebp - 0xa0]
push eax
call fcn.00454112
lea ecx, [ebp - 0x50]
call fcn.00454280
lea ecx, [ebp - 0x68]
call fcn.00454280
lea ecx, [ebp - 0x80]
call fcn.00454280
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00454280
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
push 0x58cfb0
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004f56a4
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4b37d4
call fcn.004b3977
mov edi, eax
mov edx, dword [edi]
mov ecx, dword [edx]
mov dword [ebp - 0x9c], ecx
cmp ecx, edx
je 0x4b37cd
movsd xmm0, qword [ecx + 0x28]
ucomisd xmm0, qword [0x56f2b8]
lahf
test ah, 0x44
jnp 0x4b37b8
add ecx, 0x10
cmp dword [ecx + 0x14], 0x10
jb 0x4b379a
mov ecx, dword [ecx]
divsd xmm0, qword [0x58a5a0]
push ecx
push ecx
push ecx
movsd qword [esp], xmm0
push str._lf_t_s_n
push esi
call fcn.004b3b71
add esp, 0x14
lea ecx, [ebp - 0x9c]
call fcn.00453133
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [edi]
jne 0x4b377c
push esi
call fcn.004f6be9
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x4b3828
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], 4
cmp eax, 0x1000
jb 0x4b381f
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x9c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xa0]
push eax
push ecx
call fcn.004e815d
pop ecx
pop ecx
call fcn.004e85f6
ret
Function at 0x4b39e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5d32a4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5dfdbd], 0
jne 0x4b3a72
cmp byte [0x5dfdbe], 0
mov byte [0x5dfdbd], 1
je 0x4b3a72
push esi
push edi
push 0xc
pop ecx
lea eax, [ebp - 0x38]
mov esi, 0x58cf1c
push eax
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 1
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x38], esi
je 0x4b3a70
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], esi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 4
push eax
push esi
push esi
push str.bLaunchTiming
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x3c], esi
push dword [ebp - 0x38]
setne byte [0x5dfdbc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [0x5dfdbc]
xor ecx, ebp
call fcn.004e85d0
leave
ret

Function at 0x4be521
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5555eb
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d32a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.rna::messaging::NamedPipeChannelServer.0
call fcn.00518db0
cmp dword [edi + 0xc], 0xffffffff
je 0x4be57b
push 0xfa
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0xac]
test ebx, ebx
je 0x4be597
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x56942c]
mov ecx, ebx
call esi
mov ebx, dword [edi + 0xb0]
test ebx, ebx
je 0x4be5b3
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x56942c]
mov ecx, ebx
call esi
lea ecx, [edi + 0xb4]
call fcn.00456630
lea esi, [edi + 0x94]
lea ecx, [esi + 0x14]
call fcn.00456630
mov ecx, esi
call fcn.004a7178
lea ecx, [edi + 0x50]
call fcn.004a7387
lea ecx, [edi + 0x38]
call fcn.004542a6
lea ecx, [edi + 0x20]
call fcn.004542a6
mov dword [edi], vtable.rna::messaging::IpcChannelBase.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c7800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4c795f
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x4c795f
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x4c787f
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x4c796e
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x4c789c
mov dl, bl
xor edi, edi
jmp 0x4c78cc
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x4c786e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x4c7871
mov edx, ebx
cmp ebx, 0x800
jae 0x4c78b1
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x4c78cc
cmp ebx, 0x10000
jae 0x4c78c3
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x4c78cb
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x4c795f
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x4c7903
cmp edi, 3
jae 0x4c790e
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x4c7911
mov eax, dword [ebp - 8]
test eax, eax
je 0x4c7936
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x4c7918
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4c7829
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x4c7967
Function at 0x4d0270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5e0054], 0x12c
push ebx
push esi
push edi
mov esi, ecx
jg 0x4d033b
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.0051961a
add esp, 0xc
lea edi, [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4d0300
cmp dword [ebp - 4], 0
jne 0x4d0300
cmp byte [esi + 0x48], 0
lea eax, [ebp - 4]
je 0x4d02c5
push eax
push edi
call fcn.005197ab
pop ecx
pop ecx
test al, al
jne 0x4d02d8
jmp 0x4d0300
push 0x493e0
push eax
push edi
call fcn.005197f7
add esp, 0xc
test al, al
je 0x4d033b
and dword [0x5e0054], 0
mov ebx, dword [esi + 0x14]
mov byte [esi + 0x48], 1
test ebx, ebx
je 0x4d0300
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x56942c]
mov ecx, ebx
call esi
test al, al
jne 0x4d0336
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4d031f
cmp dword [ebp - 4], 0
jne 0x4d031a
push edi
call fcn.00519513
or dword [edi], 0xffffffff
or eax, 0xffffffff
pop ecx
cmp eax, 0xffffffff
jne 0x4d0336
cmp dword [ebp - 4], 0
je 0x4d0336
inc dword [0x5e0054]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
leave
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x507cad
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00507b23

Function at 0x508293
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00508215

Function at 0x514e2a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x514eb0
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x51538e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5d32a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, str.Proxy_object_acquired_for_write_by_thread__d._n
mov dword [esi], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 4], al
test al, al
jne 0x5153bb
mov edi, str.Proxy_object_acquired_for_read__by_thread__d._n
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.00514867
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esi + 4], 1
mov ecx, dword [esi]
jne 0x5153e8
call fcn.00456657
jmp 0x5153ed
call fcn.00456641
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004e85d0
leave
ret 8
Function at 0x5154c3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56137a
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5d32a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
mov edi, str.Thread__d_releasing_Proxy_object_acquired_for_write._n
jne 0x5154ff
mov edi, str.Thread__d_releasing_Proxy_object_acquired_for_read._n
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.00514867
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esi + 4], 1
mov ecx, dword [esi]
jne 0x51552c
call fcn.00456662
jmp 0x515531
call fcn.0045664c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e85d0
leave
ret

Function at 0x519126
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x519240
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
leave
ret

Function at 0x51956d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
jne 0x51958d
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
or eax, 0xffffffff
jmp 0x519617
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0xfa
mov dword [edi], 7
mov eax, dword [eax]
div ecx
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x5195b3
mov ecx, dword [esi]
push 0
push 0x4110100
push 3
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x519610
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp eax, 2
je 0x5195e8
cmp eax, 0xe7
jne 0x519602
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 4]
mov eax, edx
dec edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x5195a9
jmp 0x519613
lea eax, [ebp - 8]
push eax
call fcn.00519488
pop ecx
mov dword [edi], eax
jmp 0x519613
and dword [edi], 0
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret