joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x419ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x421e94]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x418]
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x409882
call fcn.00406370
mov edi, eax
jmp 0x409964
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40989b
call fcn.00406370
jmp 0x40995b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x4098b6
call fcn.00406370
jmp 0x40995b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x18], edi
cmp eax, edi
jae 0x4098ec
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4098da
lea ecx, [ebp]
call fcn.00406ff0
lea ecx, [ebp - 0x20]
call fcn.00406f90
mov eax, 0x8007000e
jmp 0x409976
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00408560
mov dword [ebp - 4], 1
jmp 0x409918
mov eax, dword [ebp]
test eax, eax
jne 0x409926
mov edi, 0x8007000e
jmp 0x40995d
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40993f
call fcn.00406370
jmp 0x40995b
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409440
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x409974
lea ecx, [ebp]
call fcn.00406ff0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0040dd76
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409ca0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x18
push edi
mov edi, ecx
call fcn.004072b0
test eax, eax
jne 0x409cbb
mov eax, 0x80004005
pop edi
add esp, 0x18
ret 4
mov ecx, dword [0x422e50]
push ebx
lea eax, [esp + 0x10]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [esp + 0x20], 0x41ba48
mov dword [esp + 0x24], str.3163A299_B985_4140_A820_57D8351EFCA1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00409a60
cmp eax, ebx
jl 0x409df5
push esi
push 0x20006
push str.AppID
push SysReAllocString
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.004066e0
cmp eax, ebx
je 0x409d3d
push eax
call fcn.00406390
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
je 0x409d32
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
mov edx, dword [esp + 0x14]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.3163A299_B985_4140_A820_57D8351EFCA1
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00406660
mov esi, eax
cmp esi, ebx
je 0x409d8b
lea ecx, [esp + 0xc]
call fcn.004074d0
lea ecx, [esp + 0x14]
call fcn.004074d0
push esi
call fcn.00406390
add esp, 4
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
mov eax, dword [esp + 0xc]
push str.LocalService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esp + 0x28], bl
je 0x409de0
push 1
lea ecx, [edi + 0x40]
push ecx
push str.LocalService
lea ecx, [esp + 0x18]
call fcn.004067e0
mov ecx, edi
call fcn.00407030
test eax, eax
jne 0x409de0
lea ecx, [esp + 0xc]
call fcn.004074d0
lea ecx, [esp + 0x14]
call fcn.004074d0
pop esi
pop ebx
mov eax, 0x80004005
pop edi
add esp, 0x18
ret 4
lea ecx, [esp + 0xc]
call fcn.004074d0
lea ecx, [esp + 0x14]
call fcn.004074d0
xor eax, eax
pop esi
pop ebx
pop edi
add esp, 0x18
ret 4
Function at 0x409e10
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x14
call fcn.004072b0
test eax, eax
jne 0x409e25
mov eax, 0x80004005
add esp, 0x14
ret
lea eax, [esp]
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409eac
mov eax, dword [esp]
push ebp
push esi
push edi
push 0x20006
push str.3163A299_B985_4140_A820_57D8351EFCA1
mov ebp, eax
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004066e0
test eax, eax
je 0x409eb9
push eax
call fcn.00406390
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x409e9c
push eax
call edi
test ebp, ebp
je 0x409ea3
push ebp
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
push eax
call fcn.00406390
add esp, 4
add esp, 0x14
ret
mov esi, dword [esp + 0x10]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.00409c60
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, eax
test esi, esi
je 0x409edf
push esi
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x409eea
push eax
call edi
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x14
ret

Function at 0x40dd76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421e94]
jne 0x40dd80
repz ret
jmp fcn.00410490

Function at 0x418ebe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x37c], 0
je 0x418ecc
jmp 0x418f81
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x418f25
push 0
lea eax, [ebp - 0x6c4]
push eax
invalid

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x2526249
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x21b54478
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x44b349
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x44b359
push 0xd
pop eax
jmp 0x44b38b
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44b362
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [esp + 0x20]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
ret 0xc

Function at 0x44b38f
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x44b39f
push 0xd
pop eax
jmp 0x44b3e4
push esi
push edi
xor eax, eax
mov edi, edx
mov dword [esp + 0x14], eax
mov esi, eax
push ebp
mov ecx, edi
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x18]
jne 0x44b3b1
sub ecx, ebp
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x44b3ac
pop ebp
push esi
push edx
push 7
xor eax, eax
push eax
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x44b3e8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x79cf48]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.0044b2be
mov esi, eax
test esi, esi
je 0x44b44e
cmp dword [esp + 0xc], ebx
je 0x44b447
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x44b4dd
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44b492
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0044b3e8
mov esi, eax
test esi, esi
jne 0x44b4f4
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x44b469
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x44b4bc
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.0044b16c
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x44b4db
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00628cc2
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x44b43b
Function at 0x44b862
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x674884
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x79cf48]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
xor ebx, ebx
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x44b8fd
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x44b8fd
call fcn.0044ae3e
mov esi, eax
jmp 0x44b9d4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x44b91a
call fcn.0044ae3e
jmp 0x44b9c7
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44b910
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x18], esi
lea ecx, [esi + 1]
cmp ecx, esi
jae 0x44b947
mov esi, 0x8007000e
jmp 0x44b9c9
push 2
mov byte [ebp - 4], 2
pop edx
lfence
call fcn.00450e80
cmp eax, 0x400
jbe 0x44b96b
push eax
lea ecx, [ebp]
lfence
call fcn.00450752
jmp 0x44b981
lea eax, [ebp + 4]
mov dword [ebp], eax
jmp 0x44b981
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp dword [ebp], 0
je 0x44b93d
push esi
lfence
push dword [ebp]
push esi
push eax
push ebx
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x44b910
mov eax, dword [ebp]
xor edx, edx
push dword [ebp + 0x41c]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x24]
push dword [ebp]
call fcn.0044c3e4
mov esi, eax
test edi, edi
je 0x44b9d4
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x44b9e4
lea ecx, [ebp]
call fcn.00450463
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00628cc2
add ebp, 0x408
leave
ret 0x10
Function at 0x44e48f
Capabilities:
Identify system language via api

Disassembly:
push 0x2d4
mov eax, 0x674dae
call fcn.006724e0
mov ebx, ecx
mov dword [ebp - 0x2d0], ebx
xor edi, edi
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2cc], edi
lea eax, [ebp + 0x1a]
mov dword [ebp - 4], 2
push eax
lea edx, [ebp + 0x10]
call fcn.00450b48
mov dword [esp], 0x208
lea eax, [ebp - 0x21c]
push edi
push eax
mov dword [ebp - 0x2cc], 1
call fcn.00640240
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push dword [0x7d71cc]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x294]
call fcn.00489bab
mov dword [ebp - 0x2cc], 3
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 3
call fcn.00490716
mov esi, eax
push 4
pop eax
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], al
call fcn.00491323
push 3
push 0x727ffc
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.004503e9
push eax
lea ecx, [ebp - 0x234]
call fcn.0044fd6b
mov dword [ebp - 0x2cc], 7
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 6
push eax
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x27c]
call fcn.00451244
mov dword [ebp - 0x2cc], 0xf
lea ecx, [ebp - 0x234]
call fcn.0045037b
lea ecx, [ebp - 0x2ac]
call fcn.0045037b
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0xa
call fcn.0045037b
lea ecx, [ebp - 0x264]
call fcn.00491772
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx edx, ax
lea ecx, [ebp - 0x24c]
call fcn.00473cc0
mov dword [ebp - 0x2cc], 0x1f
mov byte [ebp - 4], 0xc
mov edx, 0x728000
mov esi, dword [ebx]
lea ecx, [ebp + 0x50]
call fcn.00450bee
neg eax
mov ecx, esi
sbb al, al
inc al
mov byte [ebp - 0x2c5], al
lea eax, [ebp - 0x2c5]
push eax
lea eax, [ebp + 0x84]
push eax
xor eax, eax
cmp byte [ebp + 0x1b], al
setne al
push eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00471890
mov eax, dword [ebx]
lea ecx, [ebp - 0x2d4]
add eax, 8
push eax
call fcn.0044f288
mov byte [ebp - 4], 0xd
lea edx, [ebp + 8]
mov ecx, dword [ebp - 0x2d4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x50]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x44e672
call fcn.0044d130
mov eax, dword [ebx]
lea ecx, [ebp - 0x2e0]
add eax, 0x18
push eax
call fcn.0044f288
mov byte [ebp - 4], 0xe
cmp dword [ebp + 0x78], 0
mov ecx, dword [ebp - 0x2e0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
je 0x44e6b1
mov eax, dword [ebp + 0x80]
sub eax, 1
je 0x44e6ac
sub eax, 1
jne 0x44e6be
push 3
jmp 0x44e6ae
push 2
pop edi
jmp 0x44e6be
cmp dword [ebp + 0x94], 0
push 4
pop eax
cmovne edi, eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], edi
push eax
call edx
mov ecx, dword [ebp - 0x2dc]
test ecx, ecx
je 0x44e6dc
call fcn.0044d130
lea ecx, [ebp - 0x24c]
call fcn.0045037b
lea ecx, [ebp - 0x264]
call fcn.0045037b
lea ecx, [ebp - 0x27c]
call fcn.0045037b
lea ecx, [ebp - 0x294]
call fcn.0045037b
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x44e714
call fcn.0044d130
lea ecx, [ebp + 0x18]
call fcn.0044e3b8
mov eax, ebx
call fcn.0067248f
ret
Function at 0x44ec27
Capabilities:
Get common file path

Disassembly:
push 0x25c
mov eax, 0x674eed
call fcn.006724e0
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x44ecf7
push 0x208
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.00640240
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x44ecf7
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.0044fc8a
push 0x727a60
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0044fbef
push eax
lea ecx, [ebp - 0x24c]
call fcn.0044fc52
push esi
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 1
call fcn.0044fc14
push eax
lea ecx, [ebp - 0x234]
call fcn.0044fc52
lea ecx, [ebp - 0x24c]
call fcn.00450240
lea ecx, [ebp - 0x264]
call fcn.00450240
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
lea ecx, [ebp - 0x234]
call fcn.00450240
call fcn.0067248f
ret
Function at 0x4550fd
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x455254
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x455254
cmp ecx, 0x29
jne 0x45513d
cmp dword [esi + 0x10], 0
jne 0x455254
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x455258
jmp 0x455212
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x45515b
push 5
lea ecx, [esi + 0x24]
call fcn.0045531f
mov ecx, esi
call fcn.004550d5
jmp 0x455242
cmp ecx, 0x5c
jne 0x4551ac
mov ecx, esi
call fcn.004550d5
test byte [edi], 0x80
je 0x4551a0
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x455189
push 4
lea ecx, [esi + 0x24]
call fcn.0045531f
mov ecx, esi
call fcn.004550d5
jmp 0x455249
cmp al, 0x42
jne 0x4551a0
push 4
lea ecx, [esi + 0x24]
call fcn.0045531f
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x45517d
mov ecx, esi
call fcn.00455c86
jmp 0x455242
cmp ecx, 0x5b
jne 0x4551cc
mov ecx, esi
call fcn.004550d5
mov ecx, esi
call fcn.00455c3a
cmp dword [esi + 0x4c], 0x5d
je 0x45514f
push 4
jmp 0x45525a
cmp ecx, 0x28
jne 0x4551e9
mov ecx, esi
call fcn.004550d5
mov ecx, esi
call fcn.00455d5e
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x455258
jmp 0x455237
cmp ecx, 0x5e
jne 0x4551f2
push 2
jmp 0x455175
cmp ecx, 0x24
jne 0x4551fe
push 3
jmp 0x455175
cmp ecx, 0x2a
je 0x455250
cmp ecx, 0x2b
je 0x455250
cmp ecx, 0x3f
je 0x455250
cmp ecx, 0x7b
je 0x455250
cmp ecx, 0x7d
jne 0x45521f
test dword [edi], edx
jne 0x455228
push 6
jmp 0x45525a
cmp ecx, 0x5d
jne 0x455228
test dword [edi], edx
je 0x4551c5
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00455ec8
mov bl, 1
mov ecx, esi
call fcn.004550d5
test bl, bl
je 0x455249
mov ecx, esi
call fcn.00455de3
mov al, 1
jmp 0x455104
push 0xa
jmp 0x45525a
pop edi
pop esi
pop ebx
ret
push 5
call fcn.0045411d
int3
Function at 0x45a319
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x79cf48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0xc8]
sub eax, 1
je 0x45a37e
sub eax, 1
je 0x45a372
sub eax, 1
jne 0x45a430
xor ecx, ecx
inc ecx
cmp byte [esi + 0xd0], 0
push 3
pop eax
cmovne eax, ecx
mov dword [esi + 0xe0], eax
push 0
push 0
push 0x404
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x45a430
mov dword [esi + 0xe0], 2
jmp 0x45a35b
mov eax, dword [esi + 0xc0]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x45a3a2
mov eax, dword [esi + 0xc0]
push 1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 0xc0]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
sub eax, dword [esi + 0x130]
mov edx, dword [esi + 0x12c]
add edx, dword [ebp - 0x24]
push eax
call fcn.004582de
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
pop ecx
push 8
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov eax, dword [esi + 0xc0]
push dword [ebp - 0x14]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0xc0]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc0]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00628cc2
leave
ret 0x10
Function at 0x45a441
Capabilities:
Create process on windows

Disassembly:
push 0xd4
mov eax, 0x67604c
call fcn.006724e0
call fcn.0047348d
push str.UseWebAppButtonText
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044d973
lea eax, [ebp - 0x28]
xor edi, edi
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.00474a3d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0045037b
call fcn.0047348d
push str.OSNotSupportedHeader
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044d973
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x58]
mov ecx, esi
push eax
call fcn.00474a3d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.0045037b
call fcn.0047348d
push str.OSNotSupportedDetails
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044d973
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00474a3d
lea ecx, [ebp - 0x28]
call fcn.0045037b
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
movaps xmm0, xmmword [0x751dd0]
cmovae eax, dword [ebp - 0x70]
cmp dword [ebp - 0x44], 8
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push 0xc
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x7c]
xorps xmm0, xmm0
mov dword [ebp - 0xe0], 0x60
pop esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], edi
movups xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x8c], edi
movups xmmword [ebp - 0x9c], xmm0
push edi
push edi
lea eax, [ebp - 0x74]
mov dword [ebp - 0x88], edi
push eax
lea eax, [ebp - 0xe0]
mov dword [ebp - 0x84], edi
push eax
mov dword [ebp - 0x74], edi
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp dword [ebp - 0x74], esi
jne 0x45a5b2
push 5
push edi
push edi
push str.https:__web.webex.com_
push 0x72e6b8
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
call fcn.00450240
lea ecx, [ebp - 0x58]
call fcn.00450240
lea ecx, [ebp - 0x70]
call fcn.00450240
call fcn.0067248f
ret

Function at 0x45aa5a
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0xc8]
sub eax, 1
je 0x45aa7f
sub eax, 1
je 0x45aa77
sub eax, 1
jne 0x45aa90
mov eax, dword [ecx + 0xb8]
jmp 0x45aa85
mov eax, dword [ecx + 0xb0]
jmp 0x45aa85
mov eax, dword [ecx + 0xa8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x45b6f0
Capabilities:
Hide graphical window

Disassembly:
push 0x34
mov eax, 0x6762a5
call fcn.006724e0
mov ebx, ecx
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x45b781
add eax, 0x18
lea ecx, [ebp - 0x40]
push eax
call fcn.0044f288
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x40]
mov eax, dword [edi]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__private:_void___thiscall_webinstaller::MainWindow::prepareDestroy_void_::_5::_lambda_1___void__bool_.0
mov dword [ebp - 0x34], ebx
mov esi, dword [eax + 0x30]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], eax
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call dword [0x6a630c]
mov ecx, edi
call esi
lea ecx, [ebp - 0x38]
call fcn.00452ff9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x45b764
call fcn.0044d130
mov ecx, dword [ebx + 0x98]
call fcn.0047256e
push 0
push 0
push 0x40d
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0067248f
ret