joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455860
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
test ecx, ecx
je 0x4558bc
or eax, 0x20006
lea esi, [esp + 8]
call fcn.0040df10
test eax, eax
jne 0x4558b8
mov eax, dword [esp + 0x1c]
mov esi, dword [eax]
test esi, esi
je 0x4558b8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x18]
lea ecx, [eax + eax + 2]
push ecx
push esi
mov esi, dword [esp + 0x10]
push 1
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4558bc
mov bl, 1
jmp 0x4558be
mov esi, dword [esp + 8]
xor bl, bl
test esi, esi
je 0x4558c9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x4559f0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x455a3a
mov esi, dword [esp + 4]
push eax
push eax
push 3
push eax
push str.MPChangeFromWhite
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x455a3a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x456230
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, dword [ebp + 4]
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push eax
xor eax, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.00455540
test al, al
jne 0x456275
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x456269
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
mov esi, dword [esp + 0x10]
je 0x4562a2
cmp eax, 0xffffffff
je 0x4562a2
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.Codepage
push esi
mov dword [esp + 0x28], eax
call edi
mov ebx, dword [ebp + 0xc]
cmp dword [ebx - 0xc], 0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x4562ca
test ebx, ebx
je 0x4562ca
push ebx
call ebp
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.DisplayName
push esi
call edi
mov ecx, dword [esp + 0x1c]
mov ebx, dword [ecx + 0x10]
cmp dword [ebx - 0xc], 0
je 0x4562f0
test ebx, ebx
je 0x4562f0
push ebx
call ebp
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push str.FaviconPath
push esi
call edi
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x14]
cmp dword [ebx - 0xc], 0
je 0x456316
test ebx, ebx
je 0x456316
push ebx
call ebp
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.FaviconURL
push esi
call edi
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x18]
cmp dword [ebx - 0xc], 0
je 0x45633c
test ebx, ebx
je 0x45633c
push ebx
call ebp
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.OSDFileURL
push esi
call edi
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp dword [ecx + 0x1c], eax
setne al
cmp eax, 0xffffffff
je 0x456364
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.ShowSearchSuggestions
push esi
mov dword [esp + 0x28], eax
call edi
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x20]
cmp dword [ebx - 0xc], 0
je 0x45638a
test ebx, ebx
je 0x45638a
push ebx
call ebp
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.SuggestionsURL_JSON
push esi
call edi
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x24]
cmp dword [ebx - 0xc], 0
je 0x4563b0
test ebx, ebx
je 0x4563b0
push ebx
call ebp
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x4abde4
push esi
call edi
test esi, esi
je 0x4563bb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4

Function at 0x4563d0
Capabilities:
Delete registry key

Disassembly:
push ecx
mov edx, dword [esi]
push eax
push str.DefaultScope
xor eax, eax
mov ecx, str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
call fcn.00455860
add esp, 8
test al, al
jne 0x4563f0
xor al, al
pop ecx
ret
mov ecx, dword [esi]
push str.SOFTWAREMicrosoftInternet_ExplorerUser_Preferences
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x456407
cmp eax, 2
jne 0x4563ec
mov al, 1
pop ecx
ret
Function at 0x4566d0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, dword [ebp + 4]
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push eax
mov eax, 0x100
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.00455540
test al, al
jne 0x456719
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x45670f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
mov esi, dword [esp + 0x10]
je 0x456746
cmp eax, 0xffffffff
je 0x456746
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.Codepage
push esi
mov dword [esp + 0x28], eax
call edi
mov ebx, dword [ebp + 0xc]
cmp dword [ebx - 0xc], 0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x45676e
test ebx, ebx
je 0x45676e
push ebx
call ebp
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push str.DisplayName
push esi
call edi
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x10]
cmp dword [ebx - 0xc], 0
je 0x456794
test ebx, ebx
je 0x456794
push ebx
call ebp
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.FaviconPath
push esi
call edi
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x14]
cmp dword [ebx - 0xc], 0
je 0x4567ba
test ebx, ebx
je 0x4567ba
push ebx
call ebp
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.FaviconURL
push esi
call edi
mov ecx, dword [esp + 0x1c]
mov ebx, dword [ecx + 0x18]
cmp dword [ebx - 0xc], 0
je 0x4567e0
test ebx, ebx
je 0x4567e0
push ebx
call ebp
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push str.OSDFileURL
push esi
call edi
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp dword [ecx + 0x1c], eax
setne al
cmp eax, 0xffffffff
je 0x456808
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.ShowSearchSuggestions
push esi
mov dword [esp + 0x28], eax
call edi
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x20]
cmp dword [ebx - 0xc], 0
je 0x45682e
test ebx, ebx
je 0x45682e
push ebx
call ebp
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.SuggestionsURL_JSON
push esi
call edi
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x24]
cmp dword [ebx - 0xc], 0
je 0x456854
test ebx, ebx
je 0x456854
push ebx
call ebp
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x4abde4
push esi
call edi
test esi, esi
je 0x45685f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret

Function at 0x456870
Capabilities:
Delete registry key

Disassembly:
push ecx
push eax
push str.DefaultScope
mov eax, 0x100
mov ecx, str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00455860
add esp, 8
test al, al
jne 0x456896
xor al, al
pop ecx
ret
push str.SOFTWAREMicrosoftInternet_ExplorerUser_Preferences
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x4568af
cmp eax, 2
jne 0x456892
mov al, 1
pop ecx
ret
Function at 0x456a50
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 8], 0
push edi
jne 0x456aa2
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jne 0x456aa2
cmp dword [esi], 0
je 0x456aa2
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x456aa2
test eax, eax
je 0x456aa2
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x456aa2
test eax, eax
je 0x456aa2
push edi
push 0
push esi
push 0x456af0
push 0
push 0
call fcn.00477643
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x456aa2
cmp dword [edi], 0
je 0x456aa2
mov al, 1
pop edi
ret
xor al, al
pop edi
ret

Function at 0x457000
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4d24
call fcn.0048ef80
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x4d1c], eax
push esi
push edi
jmp 0x457030
lea esi, [esp + 0x18]
call fcn.0045a930
call fcn.0045a9d0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x4712]
push ecx
mov word [esp + 0x4714], ax
call fcn.0047c020
add esp, 0xc
push str.7CF4158BB8E292F27389C3E4FC1B7B06488DC207FAE47A9A391003EC39EC492EF4C66E05EC5DBAEBE9489A5F80A37BBD9D16C4BDA491EB79
mov edx, esi
push edx
lea ecx, [esp + 0x4710]
call fcn.0045b7a0
mov ecx, 0x10
mov esi, str.C435D7366E0385E2CD67BFE1B01C21C0
lea edi, [esp + 0x4b18]
rep movsd dword es:[edi], dword [esi]
push 0x1c6
lea eax, [esp + 0x4b5e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0047c020
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x491a]
push edx
mov word [esp + 0x491c], cx
call fcn.0047c020
add esp, 0xc
lea eax, [esp + 0x4b18]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x4918]
call fcn.0045b7a0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x491c]
push edx
lea eax, [esp + 0x4718]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x45712d
mov ecx, dword [esp + 0x4d24]
mov eax, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d24
ret
Function at 0x457270
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x4d14
call fcn.0048ef80
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x4d0c], eax
push esi
push edi
jmp 0x4572a0
lea esi, [esp + 8]
call fcn.0045a930
call fcn.0045a9d0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x490a]
push ecx
mov word [esp + 0x490c], ax
call fcn.0047c020
add esp, 0xc
push str.02D0D3B17D64A874
mov edx, esi
push edx
lea ecx, [esp + 0x4908]
call fcn.0045b7a0
mov ecx, 0x20
mov esi, str.EE9E757CEA16CAF1CFDB93D3E775370BC1D4E864E95820BF726088A95E9AE71F
lea edi, [esp + 0x4b08]
rep movsd dword es:[edi], dword [esi]
push 0x186
lea eax, [esp + 0x4b8e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0047c020
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4702]
push edx
mov word [esp + 0x4704], cx
call fcn.0047c020
add esp, 0xc
lea eax, [esp + 0x4b08]
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x4700]
call fcn.0045b7a0
jmp 0x45735b
lea edx, [esp + 0x4900]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test eax, eax
jne 0x457386
pop edi
pop esi
mov ecx, dword [esp + 0x4d0c]
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d14
ret
push eax
lea eax, [esp + 0x46fc]
push 0x2a
push eax
call fcn.00457150
mov ecx, dword [esp + 0x4d20]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d14
ret

Function at 0x4573b0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x4d14
call fcn.0048ef80
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x4d0c], eax
push esi
push edi
jmp 0x4573e0
lea esi, [esp + 8]
call fcn.0045a930
call fcn.0045a9d0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x490a]
push ecx
mov word [esp + 0x490c], ax
call fcn.0047c020
add esp, 0xc
push str.02D0D3B17D64A874
mov edx, esi
push edx
lea ecx, [esp + 0x4908]
call fcn.0045b7a0
mov ecx, 0x20
mov esi, str.EE9E757CEA16CAF1CFDB93D3E775370BC1D4E864E95820BF56E31B3E50449DC6
lea edi, [esp + 0x4b08]
rep movsd dword es:[edi], dword [esi]
push 0x186
lea eax, [esp + 0x4b8e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0047c020
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4702]
push edx
mov word [esp + 0x4704], cx
call fcn.0047c020
add esp, 0xc
lea eax, [esp + 0x4b08]
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x4700]
call fcn.0045b7a0
jmp 0x45749b
lea edx, [esp + 0x4900]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test eax, eax
jne 0x4574c6
pop edi
pop esi
mov ecx, dword [esp + 0x4d0c]
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d14
ret
push eax
lea eax, [esp + 0x46fc]
push 0xd
push eax
call fcn.00457150
mov ecx, dword [esp + 0x4d20]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d14
ret
Function at 0x4574f0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x4d14
call fcn.0048ef80
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x4d0c], eax
push esi
push edi
jmp 0x457520
lea esi, [esp + 8]
call fcn.0045a930
call fcn.0045a9d0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x490a]
push ecx
mov word [esp + 0x490c], ax
call fcn.0047c020
add esp, 0xc
push str.02D0D3B17D64A874
mov edx, esi
push edx
lea ecx, [esp + 0x4908]
call fcn.0045b7a0
mov ecx, 0x20
mov esi, str.EE9E757CEA16CAF1CFDB93D3E775370BC1D4E864E95820BF56E31B3E50449DC6
lea edi, [esp + 0x4b08]
rep movsd dword es:[edi], dword [esi]
push 0x186
lea eax, [esp + 0x4b8e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0047c020
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x4702]
push edx
mov word [esp + 0x4704], cx
call fcn.0047c020
add esp, 0xc
lea eax, [esp + 0x4b08]
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x4700]
call fcn.0045b7a0
jmp 0x4575db
lea edx, [esp + 0x4900]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
test eax, eax
jne 0x457606
pop edi
pop esi
mov ecx, dword [esp + 0x4d0c]
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d14
ret
push eax
lea eax, [esp + 0x46fc]
push 1
push eax
call fcn.00457150
mov ecx, dword [esp + 0x4d20]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.00476dfd
add esp, 0x4d14
ret

Function at 0x457860
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x14
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
mov ebp, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3f], 0
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 5
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4578ce
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00476dfd
add esp, 0x14
ret
mov eax, dword [esp + 8]
push ebx
push edi
mov dword [esp + 0x14], eax
cmp dword [ebp], esi
jbe 0x457901
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [ebp + 4]
mov edx, dword [edi]
mov eax, dword [esp + 0x10]
push edx
push eax
call ebx
test eax, eax
jne 0x457921
inc esi
add edi, 8
cmp esi, dword [ebp]
jb 0x4578e6
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45790c
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
pop ebx
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00476dfd
add esp, 0x14
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x457930
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x20]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00476dfd
add esp, 0x14
ret
Function at 0x458010
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push edi
push 1
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
jne 0x45802f
pop edi
xor al, al
pop ebx
add esp, 0x1c
ret
push esi
push 4
push str.wscsvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
jne 0x458054
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
xor al, al
pop ebx
add esp, 0x1c
ret
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x10], 4
jne 0x458087
mov bl, 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop edi
mov al, bl
pop ebx
add esp, 0x1c
ret
Function at 0x4589d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [0x4c6300]
test eax, eax
jl 0x458a0b
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00476dfd
add esp, 0x144
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [esp + 0x30]
push edx
mov dword [0x4c6300], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.0047c020
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x458a7b
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x114
call esi
test eax, eax
je 0x458acd
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x458acd
lea edx, [esp + 4]
push edx
call eax
mov eax, dword [esp + 4]
cmp ax, 9
je 0x458aad
cmp ax, 6
jne 0x458acd
mov eax, 1
mov dword [0x4c6300], eax
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00476dfd
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
xor al, al
call fcn.00476dfd
add esp, 0x144
ret

Function at 0x45a9d0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x7c
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0x78], eax
push 0x3f
lea eax, [esp + 0x3d]
push 0
push eax
mov byte [esp + 0x44], 0
call fcn.0047c020
add esp, 0xc
xor eax, eax
jmp 0x45aa00
mov ecx, eax
shr ecx, 3
movsx edx, byte [ecx + str.1F7BB2575E4D2D1B4F8FE32D1E6F53B87C981C61D3BFFA01]
mov ecx, eax
and ecx, 7
shl edx, cl
inc eax
sar edx, 7
and dl, 1
mov byte [esp + eax + 0x37], dl
cmp eax, 0x40
jb 0x45aa00
push 0x37
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.0047c020
add esp, 0xc
xor eax, eax
jmp 0x45aa40
movsx ecx, byte [eax + str.91__]
movzx edx, byte [esp + ecx + 0x37]
movsx ecx, byte [eax + 0x4a555d]
mov byte [esp + eax], dl
movzx edx, byte [esp + ecx + 0x37]
movsx ecx, byte [eax + 0x4a555e]
mov byte [esp + eax + 1], dl
movzx edx, byte [esp + ecx + 0x37]
movsx ecx, byte [eax + 0x4a555f]
mov byte [esp + eax + 2], dl
movzx edx, byte [esp + ecx + 0x37]
mov byte [esp + eax + 3], dl
add eax, 4
cmp eax, 0x38
jl 0x45aa40
push esi
lea edx, [esp + 4]
call fcn.0045aaa0
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00476dfd
add esp, 0x7c
ret
Function at 0x45aaa0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xac
mov eax, dword [0x4c13e0]
xor eax, esp
mov dword [esp + 0xa8], eax
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0xb8]
push esi
push edi
mov ecx, 7
mov esi, edx
lea edi, [esp + 0x80]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0x1c]
mov ecx, 7
lea edi, [esp + 0x9c]
xor ebx, ebx
mov byte [esp + 0x2c], 0
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov word [esp + 0x45], ax
mov byte [esp + 0x47], al
mov byte [esp + 0x10], al
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov word [esp + 0x29], ax
mov byte [esp + 0x2b], al
rep movsd dword es:[edi], dword [esi]
inc ebp
movsx esi, byte [ebx + 0x4a55c4]
mov eax, 0x1c
sub eax, esi
push eax
lea ecx, [esp + esi + 0x84]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.0047cd80
push esi
lea eax, [esp + 0x90]
lea ecx, [esp + 0x58]
push eax
sub ecx, esi
push ecx
call fcn.0047cd80
movsx esi, byte [ebx + 0x4a55c4]
mov edx, 0x1c
sub edx, esi
push edx
lea eax, [esp + esi + 0xb8]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0047cd80
push esi
lea edx, [esp + 0xc4]
lea eax, [esp + 0x54]
push edx
sub eax, esi
push eax
call fcn.0047cd80
push 0x37
lea ecx, [esp + 0x7d]
push 0
push ecx
call fcn.0047c020
mov ecx, 7
lea esi, [esp + 0x68]
lea edi, [esp + 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, 7
lea esi, [esp + 0x4c]
lea edi, [esp + 0xa0]
add esp, 0x3c
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x45abe0
movsx edx, byte [eax + 0x4a5594]
movzx ecx, byte [esp + edx + 0x47]
mov byte [eax + ebp - 1], cl
movsx edx, byte [eax + 0x4a5595]
movzx ecx, byte [esp + edx + 0x47]
mov byte [eax + ebp], cl
movsx edx, byte [eax + 0x4a5596]
movzx ecx, byte [esp + edx + 0x47]
mov byte [eax + ebp + 1], cl
movsx edx, byte [eax + 0x4a5597]
movzx ecx, byte [esp + edx + 0x47]
mov byte [eax + ebp + 2], cl
movsx edx, byte [eax + 0x4a5598]
movzx ecx, byte [esp + edx + 0x47]
mov byte [eax + ebp + 3], cl
movsx edx, byte [eax + 0x4a5599]
movzx ecx, byte [esp + edx + 0x47]
mov byte [eax + ebp + 4], cl
add eax, 6
cmp eax, 0x30
jl 0x45abe0
mov ecx, 7
lea esi, [esp + 0x2c]
lea edi, [esp + 0x80]
rep movsd dword es:[edi], dword [esi]
inc ebx
mov ecx, 7
lea esi, [esp + 0x10]
lea edi, [esp + 0x9c]
add ebp, 0x30
cmp ebx, 0x10
rep movsd dword es:[edi], dword [esi]
jl 0x45ab30
mov ecx, dword [esp + 0xb8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00476dfd
add esp, 0xac
ret 4