joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402900
Capabilities:
Delete file
Delete service
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
jne 0x402934
mov eax, 1
jmp 0x402ae7
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x404]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc08], eax
cmp dword [ebp - 0xc08], 0
jne 0x402970
mov edx, dword [ebp - 0x404]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x402ae7
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4029a5
mov ecx, dword [ebp - 0x404]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0xc08]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x402ae7
mov eax, dword [ebp - 0x404]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea edx, [ebp - 0xc04]
push edx
call fcn.004025b0
add esp, 8
test eax, eax
je 0x4029e1
mov eax, 1
jmp 0x402ae7
mov edi, str._SYSTEMROOT__system32_
lea edx, [ebp - 0x400]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc04]
lea edx, [ebp - 0x400]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
lea edx, [ebp - 0x400]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x400
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x402a96
mov eax, 1
jmp 0x402ae7
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402aae
mov eax, 1
jmp 0x402ae7
push 0x40eb60
push 0x40eb60
push 0x40eb60
push 0x40eb60
call fcn.00401070
add esp, 0x10
test eax, eax
je 0x402ad5
mov eax, 1
jmp 0x402ae7
call fcn.00401210
test eax, eax
je 0x402ae5
mov eax, 1
jmp 0x402ae7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4094ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4094cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406efa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4094ec
test byte [esp + 8], 2
je 0x4094ec
mov dword [0x40eb64], 0xd
mov dword [0x40eb68], 5
jmp 0x4094c7
xor eax, eax
ret
Function at 0xef2848
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef2852
pushal
call 0xef2858
pop ebp
sub ebp, 0x10
sub ebp, 0xaf2848
jmp 0xef286e
mov eax, 0xaf2848
add eax, ebp
add eax, 0x4c
mov ecx, 0x5af
mov edx, 0x3441ee84
xor byte [eax], dl
inc eax
dec ecx
jne 0xef2885
jmp 0xef2898
cmovns ecx, dword [edi]
or eax, 0x848484b8
add eax, 0x84847c45
test byte [edi - 0x7b7dc3b7], al
test byte [esi + edi - 0x7b7b7b54], al
jae 0xef291a
xchg dword [edi + ecx + 5], ecx
mov byte [esp + eax*4 - 0x2bbe787c], al
or eax, esp
mov al, byte [0xa0800d78]
in al, dx
or byte [ebx - 0x5b], cl
test ah, ch
fmul qword ds:[ecx]
test byte [ebp - 0x32135f58], al
invalid
or byte [ebx - 0x5b], cl
test ah, ch
fmul qword ds:[ecx]
test byte [ebp + 0x6cd5a0a8], al
add dword [esp + eax*4 - 0x7942927c], 0xd0d18484
fnstcw word [ebx - 0xf]
xchg byte [esp + eax*4 + 0x7bd9d0d1], al
int1
mov byte [ebx - 0xf], bh
mov word [eax + ebp*8 - 0x7c], gs
test byte [edi + ecx - 0x7b7b73c7], al
test byte [edi + 0x756b74d], dh
insb byte es:[edi], dx
or esp, 0x84ca008b
test byte [ebx + ecx*4 - 0x7b7b33f4], al
test dl, ah
sets byte [ebp - 0x749380fc]
add byte [esi + 0x4848484], bl
jg 0xef29d6
mov eax, dword [eax]
xchg ebp, eax
test byte [esp + eax*4 + 0x7b7f05e2], al
mov eax, dword [0x8491008b]
test byte [ebp + eax*8 + 0x7b7b486d], al
jnp 0xef292e
enter 0xffffffffffff85bd, 7
inc ebp
add dword [edi], 0x396d806c
jnp 0xef2a09
jnp 0xef293d
sar byte [ebp - 0x7dbaf87a], 1
pop es
outsb dx, byte [esi]
add byte [edi], 0x6c
sub dword [ebp + 0x2f], 0xf7b7b7b
test al, 0xa0
or eax, esp
mov al, byte [0x84884680]
ror dword [edi], 1
push 0xfd1d3d2
int1
mov byte [edi], cl
stc
invalid
test byte [esi], cl
xchg edx, eax
ret 0x5696
test byte [esi - 0x7efe74aa], al
test byte [esp + eax*4 - 0x693d6df2], al
push esi
xchg edi, eax
inc esp
xchg byte [esi - 0x75], dl
add dword [ecx + 0xe848484], eax
xchg edx, eax
ret 0x5696
Function at 0x40b044
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407b04
xor eax, eax
push ebp
push 0x40b104
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040858c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040873c
mov eax, dword [ebx]
call fcn.0040aef4
test al, al
jne 0x40b0e1
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040858c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040873c
mov eax, dword [ebx]
call fcn.0040aef4
test al, al
jne 0x40b0e1
mov eax, ebx
call fcn.00407a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b10b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407a80
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x40caa4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40e538
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040e524
add esp, 0x208
pop ebx
ret

Function at 0x419680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4196d9
test eax, edx
je 0x4196dc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x419697
movzx eax, word [eax]
sub eax, ecx
jmp 0x4196be
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4196bf
add ecx, 4
js 0x4196af
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4196bc
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4196be
xor eax, eax
ret
test eax, eax
je 0x4196e8
test edx, edx
jne 0x419688
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41a1dc
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
sub ecx, 0x772c7d90
mov edx, 0x377ac334
and ecx, 0x3b836287
ror edx, 0xa
cmp edx, 0x4b97e531
in eax, 0x97
dec ebx
Function at 0x41a1f4
Capabilities:
Hash data using murmur3

Disassembly:
in eax, 0x97
dec ebx
jl 0x41a1fb
xor ecx, ebp
mov esi, ebx
call fcn.004504bf
and esi, edi
inc eax
xchg eax, esi
mov edx, esp
sub eax, 0xbe4f4ce2
cmp dword [0x4b9eff], ecx
invalid
je 0x41a21c
call fcn.0049aa6a
cmp dword [0x4b843f], eax
jo 0x41a226
xor esi, esp
cmp dword [0x4b95c5], esp
jo 0x41a230
or ebx, ecx
and ecx, 0x8f2e12d4
mov edi, edx
add edx, 0x764fe984
shl ecx, 0x1c
and ecx, 0xb063b349
or dword [0x4ba8be], esi
test esi, 0xa1ed6e46
jp 0x41a258
rol eax, 0xb
or edx, 0x35387795
mov ecx, 0x7a14091b
sub ebx, dword [0x4ba5da]
neg esi
mov edi, ecx
and esi, ebp
mov ebx, 0x9905252b
inc ebx
not ebx
shr edi, 0x12
xor dword [0x4ba81c], 0xd4dcdbfa
xchg edx, esi
rol eax, 0x14
not esi
and ebx, dword [0x4b9d05]
xchg edi, edx
or dword [0x4bab73], ecx
dec edx
mov edi, dword [0x4b8052]
inc eax
dec ecx
jne 0x41a263
test ebp, esp
jle 0x41a2ae
mov edx, 0xc7e11fa9
or edx, ebp
add ecx, 0xcf835efc
mov ecx, 0x71620b14
neg ebx
xor dword [0x4ba9a2], esi
sub edi, esi
call fcn.00466fb2
test dword [0x4b9e05], 0x79b77409
jne 0x41a2d9
shl esi, 0x1f
and edx, dword [0x4b9c12]
xor ebx, 0x74521a5e
or eax, dword [0x4b9d9f]
dec edi
xor dword [0x4baa8e], 0x81a1a30b
call fcn.00421e09
and edi, esi
cmp esp, 0xbe218d0f
ja 0x41a30b
xor edx, 0xa9cae26f
shl esi, 3
dec esi
dec ecx
jne 0x41a2bb
mov ecx, 0x47851008

Function at 0x41a214
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
in eax, 0x97
dec ebx
jl 0x41a1fb
xor ecx, ebp
mov esi, ebx
call fcn.004504bf
and esi, edi
inc eax
xchg eax, esi
mov edx, esp
sub eax, 0xbe4f4ce2
cmp dword [0x4b9eff], ecx
invalid
je 0x41a21c
call fcn.0049aa6a
cmp dword [0x4b843f], eax
jo 0x41a226
xor esi, esp
cmp dword [0x4b95c5], esp
jo 0x41a230
or ebx, ecx
and ecx, 0x8f2e12d4
mov edi, edx
add edx, 0x764fe984
shl ecx, 0x1c
and ecx, 0xb063b349
or dword [0x4ba8be], esi
test esi, 0xa1ed6e46
jp 0x41a258
rol eax, 0xb
or edx, 0x35387795
mov ecx, 0x7a14091b
sub ebx, dword [0x4ba5da]
neg esi
mov edi, ecx
and esi, ebp
mov ebx, 0x9905252b
inc ebx
not ebx
shr edi, 0x12
xor dword [0x4ba81c], 0xd4dcdbfa
xchg edx, esi
rol eax, 0x14
not esi
and ebx, dword [0x4b9d05]
xchg edi, edx
or dword [0x4bab73], ecx
dec edx
mov edi, dword [0x4b8052]
inc eax
dec ecx
jne 0x41a263
test ebp, esp
jle 0x41a2ae
mov edx, 0xc7e11fa9
or edx, ebp
add ecx, 0xcf835efc
mov ecx, 0x71620b14
neg ebx
xor dword [0x4ba9a2], esi
sub edi, esi
call fcn.00466fb2
test dword [0x4b9e05], 0x79b77409
jne 0x41a2d9
shl esi, 0x1f
and edx, dword [0x4b9c12]
xor ebx, 0x74521a5e
or eax, dword [0x4b9d9f]
dec edi
xor dword [0x4baa8e], 0x81a1a30b
call fcn.00421e09
and edi, esi
cmp esp, 0xbe218d0f
ja 0x41a30b
xor edx, 0xa9cae26f
shl esi, 3
dec esi
dec ecx
jne 0x41a2bb
mov ecx, 0x47851008
Function at 0x41a32c
Capabilities:
Hash data using murmur3

Disassembly:
rol esi, 0x1b
neg esi
dec edx
or edi, 0x20b0db37
test dword [0x4ba449], ecx
jns 0x41a32e
and edx, ebp
or eax, edx
rol ebx, 0x1f
sub eax, 0x4d06d9ea
inc eax
xchg eax, edx
xor esi, 0x56d02d8c
inc esi
dec ecx
jne 0x41a318
mov ecx, 0x8eb14465
mov dword [0x4bab3c], eax
xchg ecx, eax
or edi, 0x42d9dc5a
mov ebx, 0xb9f4d82b
dec eax
call fcn.00466fb2
neg eax
shr eax, 9
neg esi
shr edx, 0x15
rol ecx, 0x1e
mov ecx, 0x742d037d
xor edi, esi
dec edi
cmp dword [0x4ba119], esi
jl 0x41a384
xchg eax, edx
and eax, 0x7f818aa3
mov edi, 0x30f36d4c
ror esi, 0x19
add eax, 0xf30e4911
shr edx, 5
sub ebx, edi
inc edx
sub edi, esp
dec ecx
jne 0x41a377
mov ecx, 0xeec7530c
xor eax, 0xf9c4092b
dec edi
xor esi, 0xe348530f
call fcn.00426f81
or dword [0x4baac1], ebx
call fcn.00403b99
add eax, dword [0x4baf67]
add ebx, dword [0x4bafbc]
not eax
or ecx, dword [0x4bace7]
xor edx, 0x787fa8cc

Function at 0x41a3e0
Capabilities:
Hash data using murmur3

Disassembly:
sub eax, dword [0x4bac75]
add eax, edi
xor ecx, ebx
not ecx
xchg edi, edx
mov dword [0x4baac7], esi
not eax
rol edi, 0x14
sub esi, dword [0x4bac10]
sub edx, 0x446f141a
call fcn.00465370
add edx, 0x446f141a
ror edi, 0x14
not eax
or dword [0x4baa7c], ecx
xchg edi, edx
not ecx
xor ecx, ebx
sub eax, edi
xor edx, 0x787fa8cc
not eax
call fcn.0040df66
Function at 0x41a430
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00484683
xor esi, 0xe348530f
inc edi
xor eax, 0xf9c4092b
or ecx, 0xf144c027
xor ecx, edi
xor edx, ebp
not edx
xchg edx, eax
add esi, dword [0x4bad75]
call fcn.0041f230
add eax, edi
sub edi, dword [0x4bacfa]
not edi
call fcn.0049f179
ror edi, 4
xor eax, 0x5e003867
rol esi, 5
call fcn.00414638
ror esi, 5
xor eax, 0x5e003867
rol edi, 4
call fcn.00450ecf
not edi
sub eax, edi
call fcn.0045a292
xchg edx, eax
not edx
xor edx, ebp
xor ecx, edi
sub ecx, 0xffc7d32f
rol eax, 0x10
mov dword [0x4bab38], ebx
dec edx
or edx, dword [0x4bae61]
not ecx
sub ecx, dword [0x4bad9b]
add eax, dword [0x4bade8]
xor dword [0x4ba937], esi
not edx
add ecx, ebx
not eax
add dword [0x4ba981], edx
rol edx, 0x10
xchg eax, esi
add dword [0x4bab42], esi
or ebx, dword [0x4bae7b]
add esi, dword [0x4baeb2]
call fcn.0046be31
sub ecx, ebp
call fcn.00484683
add ecx, ebp
call fcn.00457971
add dword [0x4bab6b], edi
xchg eax, esi
ror edx, 0x10
not eax
sub ecx, ebx
not edx
sub dword [0x4ba9c0], edi
not ecx
inc edx
ror eax, 0x10
push ecx
rol esi, 8
call fcn.0047b843
neg ecx
inc edi
add dword [0x4babd4], eax
xor eax, dword [0x4baede]
call fcn.00456adf
xor ecx, 0xcc223a07
sub edi, dword [0x4bad5a]
inc esi
call fcn.0043d1c1
call fcn.00484683
call fcn.00463c4c
dec esi
xor ecx, 0xcc223a07
call fcn.00426f81
dec edi
neg ecx
call fcn.0049f2cd
ror esi, 8
mov ebx, 0x2aaf3b
xchg eax, esi
sub dword [0x4ba8e4], edx
dec eax
xor edx, eax
call fcn.0044c310
sub ebx, dword [0x4baf97]
sub eax, 0xe0434c54
sub esi, dword [0x4bad26]
xchg edi, edx
ror edi, 0x10
iretd
adc byte [ebx], ch
adc eax, 0x4bae67
or dword [0x4ba981], ebx
call fcn.00451ad7
add esi, 0xa6be7294
rol esi, 0xd
mov dword [0x4bab65], 0xd84055ee
xor edx, dword [0x4bac6e]
xor ebx, esp
call fcn.0045af29
xor ebx, esp
or dword [0x4baa1e], 0x40a78a79
ror esi, 0xd
sub esi, 0xa6be7294
call fcn.004733cc
or dword [0x4ba966], edi
rol edi, 0x10
xchg edi, edx
add eax, 0xe0434c54
xor edx, eax
inc eax
xchg eax, esi
push ebx
neg eax
ror ecx, 6
add esi, dword [0x4bad15]
call fcn.0047b843
xor dword [0x4baaf0], eax
dec ebx
add byte [ebx], dh
int1
dec ebx
xor edi, dword [0x4baeef]
add ebx, 0xa5464e2b
xchg edi, eax
xchg edi, eax
sub ebx, 0xa5464e2b
inc ebx
xor esi, ecx
add dword [0x4ba814], eax
rol ecx, 6
neg eax
mov edi, 0x8dc2e3f1
add esi, dword [0x4bac4d]
ror esi, 5
add ebx, 0x1e0bb2fd
sub edi, 0xaec6a57e
add ebx, dword [0x4badf1]
call fcn.00463c4c
rol edi, 0xf
call fcn.00463c4c
xor ecx, 0xd06fe24d
neg eax
call fcn.004733cc
xchg edi, eax
or edi, dword [0x4bad40]
sub dword [0x4ba8fd], 0xa06b389b
not esi
add ecx, esi
xor edx, 0x829f7761
mov dword [0x4babd1], edx
and dword [0x4bab26], ebx
stosd dword es:[edi], eax
dec ebx
add byte [ecx - 0x60889e0e], al
sub byte [ebx], 0xce
not esi
add dword [0x4baa9a], 0x26c31887
xchg edi, eax
neg eax
xor ecx, 0xd06fe24d
call fcn.0049c859
ror edi, 0xf
call fcn.0047b843
invalid
invalid
Function at 0x41e04c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x41e085
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00407ba8
jmp 0x41e08e
mov eax, ebx
mov edx, esi
call fcn.00407e00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ffac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4200ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407e48
lea eax, [ebp - 4]
call fcn.00407fb0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x420096
mov eax, ebx
call fcn.004053f0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x42008f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x420079
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4200c0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x420079
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420096
mov eax, dword [ebp - 0x10]
call fcn.0040540c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4200b3
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x422a44
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x422a8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004229d8
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422a91
lea eax, [ebp - 4]
call fcn.00407a20
ret
Function at 0x422ca0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x422d35
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x422ceb
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00407ba8
jmp 0x422d1f
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x422d02
lea eax, [ebp - 4]
call fcn.00407a20
jmp 0x422d15
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00422b60
mov ebx, eax
test esi, esi
je 0x422d15
dec esi
jmp 0x422cf2
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00407e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422d3c
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x422d44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041a77c
add esp, 0x208
pop ebx
ret

Function at 0x422da4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0041a77c
add esp, 0x208
pop ebx
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x26ba473f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4e046372
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b312
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5ab3e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call fcn.0048deb0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x4044d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4044df
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0048deb0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4044df
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00404570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b6e9
mov esp, ebp
pop ebp
ret
Function at 0x4102d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c4d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ab3e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
mov dword [ebp - 4], 0
and ecx, 0xfffffffc
xor al, al
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.0044de10
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
mov edx, dword [esi + 0x24]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 1
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.0044de10
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
je 0x41034c
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x41035d
push 0x40
push esi
call fcn.0048b6db
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4