joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ef5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, edx
mov dword [esp], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0xc0], eax
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb8], eax
lea esi, [ebx + 0xf]
test ebx, ebx
cmovns esi, ebx
mov eax, esi
sar eax, 4
inc eax
movzx eax, ax
movzx ecx, word [ebp + 8]
push ecx
push eax
push 6
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x423003
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42303c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x423071
mov edi, dword [ebp + 0x10]
and esi, 0xfffffff0
sub ebx, esi
mov ecx, eax
add eax, 2
movzx edx, word [ecx]
test ebx, ebx
jle 0x422f99
lea eax, [eax + edx*2]
add eax, 2
movzx edx, word [eax - 2]
dec ebx
jne 0x422f8c
mov esi, dword [esp]
mov ebx, edi
lea edi, [esp + 0xb0]
mov ecx, edi
push edx
push eax
call fcn.0048eaf6
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x4230fd
movzx eax, byte [esp + 0xbb]
test al, al
jns 0x422fd3
mov edi, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
push 0
push ebx
push eax
push edi
push esi
call fcn.004a8500
add esp, 0x14
cmp byte [esp + 0xbb], 0
jns 0x4230e5
push dword [esp + 0xb0]
call fcn.006417be
add esp, 4
jmp 0x4230e5
push 2
call fcn.00499940
add esp, 4
test al, al
je 0x4230b4
call fcn.0049a360
lea edi, [esp + 4]
mov ecx, edi
push eax
push 2
push 0x38
push str..._.._opera_desktop_windows_l10n_handler_resource_l10n_handler.cc
call fcn.0049a500
lea eax, [esp + 0xc]
push 0x15
push str.Failed_to_find_string
jmp 0x4230a4
push 2
call fcn.00499940
add esp, 4
test al, al
je 0x4230b4
call fcn.0049a360
lea edi, [esp + 4]
mov ecx, edi
push eax
push 2
push 0x3e
push str..._.._opera_desktop_windows_l10n_handler_resource_l10n_handler.cc
call fcn.0049a500
lea eax, [esp + 0xc]
push 0x15
push str.Failed_to_load_string
jmp 0x4230a4
push 2
call fcn.00499940
add esp, 4
test al, al
je 0x4230b4
call fcn.0049a360
lea edi, [esp + 4]
mov ecx, edi
push eax
push 2
push 0x44
push str..._.._opera_desktop_windows_l10n_handler_resource_l10n_handler.cc
call fcn.0049a500
lea eax, [esp + 0xc]
push 0x15
push str.Failed_to_lock_string
push eax
call fcn.0040280c
add esp, 0xc
mov ecx, edi
call fcn.0049a5b0
mov eax, dword [esp + 0xb8]
mov esi, dword [esp]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0xb0]
movsd qword [esi], xmm0
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb8], eax
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.0064180a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0xb8]
jmp 0x4230be
Function at 0x429a78
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x429ac6
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x429aa0
cmp edx, 1
je 0x429ae7
cmp edx, 2
je 0x429ade
cmp edx, 3
jne 0x429af2
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x42fcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm1, xmmword [ecx]
movdqu xmm2, xmmword [ecx + 0x10]
movdqu xmm4, xmmword [ecx + 0x20]
movdqu xmm3, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm1
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x42fd9e
nop word cs:[eax + eax]
nop
movdqa xmm6, xmm0
movdqa xmm1, xmmword [0x6777c0]
pclmulqdq xmm6, xmm1, 0
movdqa xmm5, xmmword [0x6777d0]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm2
movdqa xmm1, xmmword [0x6777c0]
pclmulqdq xmm0, xmm1, 0
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm6, xmm2
pxor xmm6, xmm0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm1, 0
movdqa xmm2, xmm1
pclmulqdq xmm4, xmm5, 0x11
movdqa xmm1, xmm4
pxor xmm1, xmm0
movdqa xmm0, xmm3
pclmulqdq xmm0, xmm2, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm5, xmm3
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm2, xmmword [ecx + 0x10]
pxor xmm2, xmm6
movdqu xmm4, xmmword [ecx + 0x20]
pxor xmm4, xmm1
movdqu xmm3, xmmword [ecx + 0x30]
pxor xmm3, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x42fcf0
movdqa xmm1, xmmword [0x6777e0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm2
movdqa xmm2, xmmword [0x6777f0]
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm4
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
cmp eax, 0x10
jb 0x42fed8
lea edx, [eax - 0x10]
mov esi, edx
shr esi, 4
add esi, 1
and esi, 3
je 0x42fe37
nop
movdqu xmm3, xmmword [ecx]
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
add ecx, 0x10
add eax, 0xfffffff0
add esi, 0xffffffff
jne 0x42fe10
movdqa xmm3, xmm0
cmp edx, 0x30
jb 0x42fedc
nop word cs:[eax + eax]
nop
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pclmulqdq xmm0, xmm2, 0x11
movdqu xmm3, xmmword [ecx]
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x20]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x30]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
add eax, 0xffffffc0
add ecx, 0x40
movdqa xmm0, xmm3
cmp eax, 0xf
ja 0x42fe50
jmp 0x42fedc
movdqa xmm3, xmm0
movdqa xmm0, xmmword [0x6777f0]
pclmulqdq xmm0, xmm3, 1
psrldq xmm3, 8
pxor xmm3, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm3, 3
psrldq xmm3, 4
pclmulqdq xmm1, xmmword [0x677800], 0
pxor xmm1, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm1, 3
pclmulqdq xmm2, xmmword [0x677810], 0x10
pblendw xmm2, xmm0, 0xfc
pclmulqdq xmm2, xmmword [0x677820], 0
pxor xmm2, xmm1
pextrd eax, xmm2, 1
pop esi
pop ebp
ret
Function at 0x4331da
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x43320e
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.004331b4
lea eax, [ebx + 1]
cmp eax, 2
jb 0x433207
mov dword [esi], ebx
call fcn.00499510
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4377c4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov ebx, ecx
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x678b30
cmp byte [ecx + 0x1c], 0
je 0x437832
push 0x4c
push str..._.._opera_desktop_windows_installer_transactions_delete_file_operation.cc
call fcn.00499970
add esp, 8
test eax, eax
jle 0x437874
lea edi, [ebp - 0xb8]
mov ecx, edi
push 0xffffffffffffffff
push 0x25
push str..._.._opera_desktop_windows_installer_transactions_delete_file_operation.cc
call fcn.004999e0
lea eax, [ebp - 0xb0]
push 0x12
push str.Actual_removal_of
push eax
call fcn.0040280c
add esp, 0xc
cmp byte [ebx + 0x1b], 0
jns 0x437860
mov ecx, dword [ebx + 0x10]
jmp 0x437863
cmp dword [ebx + 0x20], 0
je 0x437920
lea esi, [ebx + 0x20]
mov ecx, dword [0x703564]
test ecx, ecx
jne 0x437855
call fcn.00441150
mov ecx, eax
mov dword [0x703564], eax
mov eax, dword [ecx]
push esi
call dword [eax + 0x14]
jmp 0x437920
lea ecx, [ebx + 0x10]
push ecx
push eax
call fcn.0049a650
add esp, 8
mov ecx, edi
call fcn.00499dc0
lea esi, [ebx + 0x10]
push esi
call fcn.004b4eb0
add esp, 4
test al, al
jne 0x43788d
push esi
call fcn.004b4ed0
add esp, 4
cmp byte [ebx + 0x1e], 0
je 0x437920
xor eax, eax
dec eax
lea esi, [ebp - 0xb8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 0xc8], ebx
lea ecx, [ebx + 4]
push esi
call fcn.00496060
cmp byte [esi + 0xb], 0
jns 0x4378c3
mov esi, dword [ebp - 0xb8]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x43790f
lea edi, [ebp - 0xc4]
lea ebx, [ebp - 0xb8]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, ebx
push edi
call fcn.00496060
mov ecx, ebx
push edi
call fcn.004957d0
mov ecx, edi
call fcn.00495790
cmp byte [ebp - 0xad], 0
mov eax, ebx
jns 0x437908
mov eax, dword [ebp - 0xb8]
push eax
call esi
test eax, eax
jne 0x4378e0
lea ecx, [ebp - 0xb8]
call fcn.00495790
mov ebx, dword [ebp - 0xc8]
lea ecx, [ebx + 0x20]
push 0
call fcn.00436572
lea ecx, [ebx + 0x10]
call fcn.00495790
add ebx, 4
mov ecx, ebx
call fcn.00495790
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4391d8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x678eb0
cmp byte [ecx + 0x20], 0
je 0x439267
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 0x2c], edi
lea ecx, [edi + 8]
push esi
call fcn.00496060
cmp byte [esi + 0xb], 0
jns 0x43921c
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x43925c
lea edi, [ebp - 0x28]
lea ebx, [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, ebx
push edi
call fcn.00496060
mov ecx, ebx
push edi
call fcn.004957d0
mov ecx, edi
call fcn.00495790
cmp byte [ebp - 0x11], 0
mov eax, ebx
jns 0x439255
mov eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x439233
lea ecx, [ebp - 0x1c]
call fcn.00495790
mov edi, dword [ebp - 0x2c]
lea ecx, [edi + 0x14]
call fcn.00495790
add edi, 8
mov ecx, edi
call fcn.00495790
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43abb8
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
mov esi, dword [eax]
mov edx, dword [eax + 4]
lea edi, [esi + edx*2]
lea edx, [eax + ecx*2]
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x43ac06
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x43abe0
cmp edx, 1
je 0x43ac27
cmp edx, 2
je 0x43ac1e
cmp edx, 3
jne 0x43ac32
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x43c64a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x414
mov edi, dword [ebp + 8]
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x418], ecx
xor esi, esi
mov dword [ebp - 0x41c], esi
lea ebx, [ebp - 0x410]
push 0x400
push 0xff
push ebx
call fcn.00645dd0
add esp, 0xc
mov dword [ebx - 4], esi
push 0x60
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
jne 0x43c6b2
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
je 0x43c75c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43c73e
mov edi, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43c73e
mov dword [ebp - 0x420], eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, 0x8007000e
cmp eax, 0xffffffff
je 0x43c745
mov ebx, eax
inc eax
lea ecx, [ebp - 0x414]
push eax
call fcn.0043c788
lea eax, [ebp - 0x414]
mov eax, dword [eax]
test eax, eax
je 0x43c745
push ebx
push eax
push ebx
push dword [ebp - 0x420]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x43c73e
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x414]
mov word [ecx + eax*2], 0
lea ecx, [ebp - 0x41c]
push edx
push dword [ebp - 0x414]
call fcn.0043c7bc
jmp 0x43c743
call fcn.0043c37f
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x410]
cmp dword [ebp - 0x414], eax
jne 0x43c763
jmp 0x43c76e
call fcn.0043c37f
mov edi, eax
lea ecx, [ebp - 0x414]
call fcn.0043e2ce
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, edi
add esp, 0x414
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43dba2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x220
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov eax, dword [ecx]
mov dword [ebp - 0x22c], ecx
mov ebx, dword [ecx + 4]
mov ecx, ebx
or ecx, 0x2001f
lea edx, [ebp - 0x210]
mov dword [edx], esi
push edx
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43dbff
mov edi, eax
jmp 0x43dd05
mov edi, dword [ebp - 0x210]
mov dword [ebp - 0x21c], edi
and ebx, 0x300
mov dword [ebp - 0x218], ebx
xor eax, eax
dec eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea ebx, [ebp - 0x228]
mov dword [ebx], 0x100
push 0x200
push 0xff
lea eax, [ebp - 0x210]
push eax
call fcn.00645dd0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
push ebx
lea eax, [ebp - 0x210]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
mov esi, dword [ebp - 0x22c]
jne 0x43dcbf
xor esi, esi
lea ebx, [ebp - 0x210]
lea ecx, [ebp - 0x21c]
push ebx
call fcn.0043dba2
test eax, eax
jne 0x43dce8
mov dword [ebp - 0x228], 0x100
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
push ebx
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x43dc76
mov edi, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x22c]
test edi, edi
je 0x43dcd4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov ecx, esi
push dword [ebp + 8]
call fcn.0043e1f2
mov edi, eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x43dd05
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, edi
add esp, 0x220
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x440990
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea edi, [ebp - 0x212]
push 0x202
push 0xff
push edi
call fcn.00645dd0
add esp, 0xc
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
je 0x4409e2
mov ecx, dword [ebp + 8]
push edi
call fcn.0048f136
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4411c0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
mov dword [esi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44131b
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov dword [ecx], 0
push eax
call fcn.004331da
cmp edi, 1
jne 0x44126d
call fcn.004bc470
cmp eax, 3
jl 0x44126d
xor eax, eax
dec eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea edi, [ebp - 0x24]
mov dword [edi], eax
push edi
push 4
push ecx
push 0x12
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x441333
cmp dword [ebp - 0x18], 3
jne 0x44126d
lea eax, [ebp - 0x28]
mov dword [eax], 0xffffffff
push edi
push 4
push eax
push 0x13
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x441333
lea ecx, [ebp - 0x20]
push dword [ebp - 0x28]
call fcn.004331da
push esi
push 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
xor ebx, ebx
test eax, eax
je 0x441311
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
mov dword [ecx], ebx
push eax
call fcn.004331da
movzx eax, word [0x67a061]
lea ecx, [ebp - 0x18]
mov word [ecx + 4], ax
mov eax, dword [0x67a05d]
mov dword [ecx], eax
lea eax, [ebp - 0x2c]
mov dword [eax], 0xffffffff
sub esp, 0x2c
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [0x679f80]
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x441309
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4412f9
mov dword [ebp - 0x28], 0
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x28], 1
sete bl
lea ecx, [ebp - 0x24]
call fcn.004331b4
lea ecx, [ebp - 0x20]
call fcn.004331b4
jmp 0x44131d
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x441311
Function at 0x442aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xc], ecx
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esi + 0xb8], eax
pxor xmm0, xmm0
movdqu xmmword [esi + 0x84], xmm0
xor eax, eax
mov dword [esi + 0xb4], eax
movdqu xmmword [esi + 0xa4], xmm0
movdqu xmmword [esi + 0x94], xmm0
mov dword [esi + 0x7c], 0x3c
mov dword [esi + 0x80], 0x40
mov dword [esi + 0x88], 0x67a0f0
xor ebx, ebx
dec ebx
lea edi, [esi + 0x70]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [ebp + 0xc]
lea eax, [esi + 0x20]
push eax
call fcn.00491d20
mov ecx, edi
lea eax, [esi + 0x20]
push eax
call fcn.0048e960
lea ecx, [esi + 0x20]
call fcn.00495790
cmp byte [edi + 0xb], 0
jns 0x442b36
mov edi, dword [esi + 0x70]
mov dword [esi + 0x8c], edi
lea edi, [esi + 0x64]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [ebp + 0xc]
push edi
call fcn.004934a0
cmp byte [edi + 0xb], 0
jns 0x442b59
mov edi, dword [esi + 0x64]
lea eax, [esi + 0x7c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], 5
lea edi, [esi + 0x20]
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x10]
push 0x165
push str..._.._opera_desktop_windows_os_operations_os_operations_impl.cc
push str.RunElevatedProcess
push ebx
call fcn.004994e0
add esp, 0x10
mov ecx, edi
xor eax, eax
push eax
push ebx
call fcn.004ab280
lea eax, [esi + 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, esp
sub esp, 0xc
mov ebx, esp
lea ecx, [ebx + 4]
test eax, eax
je 0x442bc7
push dword [esi + 0xb4]
jmp 0x442bc9
push 0
call fcn.004b8ea0
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, eax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov esp, edi
lea ecx, [esi + 0x20]
call fcn.004ab2f0
cmp byte [esi + 0x6f], 0
jns 0x442bf8
push dword [esi + 0x64]
call fcn.006417be
add esp, 4
cmp byte [esi + 0x7b], 0
jns 0x442c09
push dword [esi + 0x70]
call fcn.006417be
add esp, 4
mov ecx, dword [esi + 0xb8]
xor ecx, ebp
call fcn.0064180a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x447adb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, ecx
mov eax, dword [0x7024bc]
xor eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [0x703584]
mov ecx, dword [0x705840]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x447b32
mov eax, dword [0x703580]
mov dword [esi], eax
test eax, eax
je 0x447b1e
lock inc dword [eax]
mov ecx, dword [esp + 0x2c]
xor ecx, ebp
call fcn.0064180a
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x703584
call fcn.00641847
cmp dword [0x703584], 0xffffffff
jne 0x447b10
mov eax, dword [0x703594]
mov ecx, dword [0x705840]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x447c1a
mov dword [esp], 0x25a
mov ecx, 0x703588
call fcn.0048dd20
sub esp, 4
mov edi, 0xfffffda6
movsx eax, byte [edi + 0x67cd94]
xor eax, 0x55
mov dword [esp], eax
mov ecx, 0x703588
call fcn.0048e158
sub esp, 4
inc edi
jne 0x447b81
xor eax, eax
lea edi, [esp + 0x20]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x703588
call fcn.0052c374
test al, al
je 0x447c61
mov byte [esp + 0x18], 1
mov dword [esp + 0x1c], 0x292
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 8], xmm0
mov dword [esp + 4], edi
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.00425964
cmp byte [esp + 0x2b], 0
jns 0x447c00
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.006417be
mov eax, dword [esp + 0x14]
mov dword [0x703580], eax
mov dword [esp], 0x703584
call fcn.006418bd
jmp 0x447b10
mov dword [esp], 0x703594
call fcn.00641847
cmp dword [0x703594], 0xffffffff
jne 0x447b68
xor eax, eax
mov dword [0x70358c], eax
mov dword [0x703588], eax
mov dword [0x703590], eax
mov dword [esp], 0x447c70
call fcn.00641d3d
mov dword [esp], 0x703594
call fcn.006418bd
jmp 0x447b68
int3

Function at 0x447f92
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ecx + 4]
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x447fde
xor eax, eax
push str.oauc_registry_mutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
jne 0x447fde
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x447fdb
push str.oauc_registry_mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 4], eax
jmp 0x447fde
mov eax, dword [esi + 4]
inc eax
xor ecx, ecx
cmp eax, 1
mov eax, 0xffffff04
cmova eax, ecx
pop esi
pop ebp
ret