joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444810
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x44493b
test ebx, ebx
je 0x4448e7
cmp word [ebx], 0
je 0x4448e7
cmp byte [esi + 0x128], 0
je 0x444879
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x444880
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00438300
mov esi, eax
call fcn.00438b40
mov ecx, ebp
call fcn.00438300
mov esi, eax
push 0x52a70c
push 0x51f1f4
mov edx, esi
call fcn.00439710
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x51f1f4
mov edx, esi
call fcn.00439710
push 0x51f14c
push 0x51f1f4
mov edx, esi
call fcn.00439710
push ebx
push 0x51f1f4
mov edx, esi
call fcn.00439710
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4448f6
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00438300
mov esi, eax
call fcn.00438b40
mov ecx, ebp
call fcn.00438300
mov esi, eax
push 0x52a70c
push 0x51f1f4
mov edx, esi
call fcn.00439710
add ebx, 4
push ebx
push 0x51f1f4
mov edx, esi
call fcn.00439710
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x444a1c
test ebx, ebx
je 0x4449d4
cmp word [ebx], 0
je 0x4449d4
cmp byte [esi + 0x128], 0
je 0x444969
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x444970
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.00438300
xor edi, edi
mov esi, eax
call fcn.00438b40
mov ecx, ebp
call fcn.00438300
mov esi, eax
push 0x52a71c
push 0x51f1f4
mov edx, esi
call fcn.00439710
mov ecx, dword [esp + 0x28]
add ecx, 4
add esp, 8
push ecx
mov ecx, esi
call fcn.00438c70
mov esi, eax
push 0x51f14c
push 0x51f1f4
mov edx, esi
call fcn.00439710
add esp, 8
push ebx
mov ecx, esi
call fcn.00438c70
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
je 0x4449e2
add esi, 0x18
jmp 0x4449e5
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.00438300
mov edi, eax
push 0x52a71c
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esi, 4
push esi
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4458e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44594e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x44591f
cmp eax, 2
jne 0x44593a
mov eax, dword [esp]
test esi, esi
je 0x445948
test eax, eax
je 0x445943
test al, 1
jne 0x44593a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x445948
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x445af0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x509568
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x11
mov esi, ecx
xor ebx, ebx
xor eax, eax
push str.SoftwareClasses_
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
call fcn.00446450
mov eax, esi
mov dword [esp + 0x38], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x445b50
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.00446340
push 6
push str.Shell
call fcn.00446340
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00446240
push reloc.WS2_32.dll_accept
push edi
call fcn.00445cd0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x445bbe
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004ce6dd
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x30
ret
Function at 0x445be0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x509568
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x445c30
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00446450
push 6
push str.Shell
lea esi, [esp + 0x18]
mov dword [esp + 0x40], ebx
call fcn.00446340
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00446240
push accept
push edi
call fcn.00445cd0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x445ca6
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004ce6dd
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x30
ret
Function at 0x445f40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x509ef6
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x3e
xor ebx, ebx
mov word [esp + 0x30], cx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
call fcn.00446450
mov eax, str.http
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x445fc0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x445fc0
sub eax, edx
sar eax, 1
push eax
push str.http
lea esi, [esp + 0x30]
call fcn.00446340
push 0xb
push 0x52a86c
call fcn.00446340
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x446009
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4460e7
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.004d3360
add esp, 0xc
push str.Progid
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.004458e0
test eax, eax
jne 0x4460d8
xor ecx, ecx
cmp cx, word [esp + 0x44]
jne 0x446095
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x44608a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call fcn.0043b900
jmp 0x4460fb
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x44]
call fcn.00445af0
test al, al
jne 0x4460b5
lea ecx, [esp + 0x44]
call fcn.00445be0
mov byte [esp + 0x13], al
jmp 0x4460ba
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4460c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call fcn.0043b900
mov al, byte [esp + 0x13]
jmp 0x4460fd
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4460e7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x4460fb
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ce6dd
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004cc2b1
mov esp, ebp
pop ebp
ret

Function at 0x446b90
Capabilities:
Get file size

Disassembly:
push ecx
push esi
push 0
push eax
mov eax, dword [esp + 0x14]
push edi
call fcn.00441af0
test al, al
jne 0x446ba8
pop esi
pop ecx
ret 4
mov edx, dword [edi + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x446bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x446bd2
xor esi, esi
mov dword [edi + 0x350], esi
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x448090
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.00447b60
test eax, eax
jl 0x4482c8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4480fd
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4480c0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4482c4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x525930]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525930]
and esi, 0xff
mov esi, dword [esi*4 + 0x526530]
and edi, 0xff
xor esi, dword [edi*4 + 0x526d30]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525930]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527130]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x525930]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x526930]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x525930]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525930]
and esi, 0xff
mov esi, dword [esi*4 + 0x526530]
and edi, 0xff
xor esi, dword [edi*4 + 0x526d30]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x525930]
and edi, 0xff
xor esi, dword [edi*4 + 0x526930]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525930]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527130]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x525930]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525930]
and esi, 0xff
mov esi, dword [esi*4 + 0x526530]
and edi, 0xff
xor esi, dword [edi*4 + 0x526d30]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x525930]
and edi, 0xff
xor esi, dword [edi*4 + 0x526930]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525930]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527130]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x525930]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x525930]
and esi, 0xff
mov esi, dword [esi*4 + 0x526530]
and edi, 0xff
xor esi, dword [edi*4 + 0x526d30]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x525930]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x525930]
and edi, 0xff
xor esi, dword [edi*4 + 0x526930]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x527130]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x448111
pop edi
xor eax, eax
pop esi
ret
Function at 0x448e10
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x448ea1
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
mov edi, edi
movzx eax, byte [esi]
shr eax, 2
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + 2], ax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
add ecx, 2
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 2
mov word [ecx], ax
movzx eax, byte [esi + 2]
and eax, 0x3f
movsx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 2
mov word [ecx], ax
add ecx, 2
add esi, 3
sub edx, 1
jne 0x448e30
pop ebx
test edi, edi
jle 0x448f12
movzx edx, byte [esi]
shr edx, 2
movsx ax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
mov al, byte [esi]
and al, 3
add ecx, 2
shl al, 4
cmp edi, 1
jle 0x448ecd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
movsx dx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], dx
add ecx, 2
cmp edi, 2
jge 0x448eea
mov eax, 0x3d
jmp 0x448ef9
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add ecx, 2
mov edx, 0x3d
mov word [ecx], dx
add ecx, 2
xor eax, eax
pop edi
mov word [ecx], ax
pop esi
ret
xor edx, edx
pop edi
mov word [ecx], dx
pop esi
ret
Function at 0x448f20
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x448fa5
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x448f40
pop ebx
test edi, edi
jle 0x449005
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x448fcd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x448fef
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x449180
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x449192
mov esi, 0x545a68
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00447110
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.004473b0
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x449d40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x508658
mov eax, dword fs:[0]
push eax
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cc39d
mov dword [eax + 0x24], fcn.004ce4c2
mov dword [eax + 0x28], fcn.004cc2c0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0xc

Function at 0x44b930
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [esp + 0x80c]
push esi
lea eax, [esp + 0x814]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [0x5466bc]
lea ecx, [esi + esi]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004cc2b1
add esp, 0x808
ret
Function at 0x44b9a0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x474
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x46c], eax
push esi
push edi
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.004d3360
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push 0x51f230
lea edx, [esp + 0x64]
push edx
call esi
push 0x546cd8
lea eax, [esp + 0x64]
push eax
call esi
push 0x546cd8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
jbe 0x44bb95
push 0x546cd8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp word [edi*2 + 0x546cd6], 0x5c
je 0x44ba25
push 0x51f14c
lea ecx, [esp + 0x64]
push ecx
call esi
push str.crashrpt.exe
lea edx, [esp + 0x64]
push edx
call esi
push 0x52b4e8
lea eax, [esp + 0x64]
push eax
call esi
push 0x546ad0
lea ecx, [esp + 0x64]
push ecx
call esi
push 0x52b4e8
lea edx, [esp + 0x64]
push edx
call esi
push str.sogoupy
lea eax, [esp + 0x64]
push eax
call esi
push 0x52b4e8
lea ecx, [esp + 0x64]
push ecx
call esi
cmp byte [0x540b61], 0
mov eax, 0x529f04
jne 0x44ba80
mov eax, 0x51fe9c
push eax
lea edx, [esp + 0x64]
push edx
call esi
push 0x51f230
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x5468c8
call fcn.004cd196
mov edi, eax
add esp, 8
test edi, edi
je 0x44bacc
push 0x52b4f0
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x51f230
lea eax, [esp + 0x64]
push eax
call esi
push 0x5c
push 0x5466c0
call fcn.004cd196
mov edi, eax
add esp, 8
test edi, edi
je 0x44bb04
push 0x52b4f0
lea ecx, [esp + 0x64]
push ecx
call esi
add edi, 2
push edi
lea edx, [esp + 0x64]
push edx
call esi
push 0x51f230
lea eax, [esp + 0x64]
push eax
call esi
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004d3360
add esp, 0xc
cmp byte [0x540b61], 0
mov dword [esp + 0x18], 0x44
je 0x44bb38
mov edx, 5
mov dword [esp + 0x44], 1
mov word [esp + 0x48], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.0043e400
add eax, 0xc
cmp dword [eax + 4], 0
jne 0x44bb5c
xor eax, eax
jmp 0x44bb70
cmp byte [eax + 0x11c], 0
je 0x44bb6a
add eax, 0xc
jmp 0x44bb6d
mov eax, dword [eax + 8]
add eax, 4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x474]
pop edi
pop esi
xor ecx, esp
call fcn.004cc2b1
add esp, 0x474
ret
Function at 0x44dc10
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x5423e4], 0
je 0x44dc65
mov eax, dword [0x5423ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44dc65
cmp dword [eax], 3
jbe 0x44dc65
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x44dc65
push 0
push 0x543d48
push 0x543d28
push 0
push eax
call fcn.00506fff
add esp, 0x14
test eax, eax
je 0x44dc65
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov al, 1
ret
xor al, al
ret

Function at 0x44dc70
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x5423e4], 0
push esi
push edi
mov esi, eax
je 0x44dcb9
mov eax, dword [0x5423ec]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x44dcb9
cmp dword [eax], 3
jbe 0x44dcb9
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x44dce6
push 8
call fcn.004cf9e8
add esp, 4
test eax, eax
je 0x44dcbe
mov dword [eax + 4], esi
mov dword [eax], vtable.t_visualDataItemPtr_struct_t_cuResourceManagerWrap_.0
mov esi, eax
jmp 0x44dcc0
pop edi
xor al, al
pop esi
ret
xor esi, esi
cmp dword [0x5423e4], 0
je 0x44dcee
mov edx, dword [0x5423ec]
push edx
call edi
test eax, eax
je 0x44dcee
cmp dword [eax], 3
jbe 0x44dcee
mov eax, dword [eax + 8]
mov dword [eax + 0xc], esi
pop edi
mov al, 1
pop esi
ret
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
pop edi
mov al, 1
pop esi
ret
Function at 0x4514a0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x68
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x4514e5
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4514e5
push 2
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MonitorFromRect]
cmp eax, ebp
jne 0x451516
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x451504
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 2
push ecx
push edx
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x48]
push ecx
push eax
mov dword [esp + 0x50], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x451550
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], edx
mov edx, dword [esp + 0x68]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebp
pop ebx
add esp, 0x68
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
call edi
push 1
mov ebx, eax
call edi
xor ecx, ecx
xor edx, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
push ebp
mov dword [esi + 8], ebx
push str.Shell_TrayWnd
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebp
je 0x4515c0
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebp
pop ebx
add esp, 0x68
ret