joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470d80
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8b6e
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.00499e80
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401e00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00401e00
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2b4]
push eax
lea edx, [ebp - 0x29c]
lea ecx, [ebp - 0x27c]
call fcn.004185e0
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.00401df0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b4]
call fcn.00401df0
lea ecx, [ebp - 0x27c]
call fcn.00419ab0
test al, al
je 0x470f82
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x280], 0
call fcn.00496cae
add esp, 4
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 5
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 4
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x27c]
push 0x80
push 4
push 1
push 0x80000000
push eax
lea ecx, [ebp - 0x280]
call fcn.0041ce80
test al, al
jne 0x470f86
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x470f82
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x470f6d
test eax, eax
je 0x470f6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.00497076
add esp, 8
mov dword [ebp - 0x280], 0
xor bl, bl
jmp 0x470fcf
push esi
lea ecx, [ebp - 0x280]
call fcn.0041d060
mov bl, al
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x470fcf
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x470fba
test eax, eax
je 0x470fba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.00497076
add esp, 8
mov dword [ebp - 0x280], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.00401df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret 4
Function at 0x477720
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c949c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4fb068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.00401df0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.00401df0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.00401df0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401df0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00401df0
push 0x88
push ebx
call fcn.00497076
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x484df0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x484dfb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00484e10
Function at 0x486a50
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x4ca752
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x486a94
call fcn.00486be0
cmp byte [0x4fe089], 0
jne 0x486aa7
mov eax, 0x80000001
jmp 0x486bbc
mov eax, dword [esi]
test eax, eax
jne 0x486b12
push 8
call fcn.00496cae
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
push 1
call fcn.00496cae
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call fcn.00499e80
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x486b01
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x486bab
call fcn.0041f620
test al, al
jne 0x486b4c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.0041f780
test al, al
je 0x486bab
mov ecx, dword [esi]
add ecx, 4
call fcn.0041f180
call fcn.0041f620
test al, al
je 0x486bab
push str.Advapi32.dll
lea ecx, [ebp - 0x28]
call fcn.00401e00
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
call fcn.00426140
mov ecx, eax
call fcn.00426200
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401df0
test edi, edi
je 0x486bab
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x486bab
push dword [esi]
push dword [ebp + 0x128]
call eax
test eax, eax
je 0x486bab
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x486bba
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.00496c8f
lea esp, [ebp + 0x120]
pop ebp
ret 4

Function at 0x4881f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca9df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4fb068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.004888d0
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00401df0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00401df0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00401df0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00401df0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00401df0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401df0
mov eax, dword [ebp + 8]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x488ea0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cabcf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4fb068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00401df0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00401df0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00401df0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00401df0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00401df0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401df0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48a180
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cad6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4fb068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.004077b0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.004077b0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.004077b0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.004077b0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.004077b0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.004077b0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48b2b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x14], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x14], edi
mov esi, edi
cmp edi, ebp
jge 0x48b321
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
lea edx, [ecx - 0x18]
call fcn.00411e05
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
push eax
call fcn.004022c0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.00407770
mov edi, esi
cmp esi, ebp
jl 0x48b2e0
mov eax, dword [esp + 0x10]
cmp esi, ebp
jne 0x48b34b
test al, 1
jne 0x48b34b
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [ebx + eax*8]
push eax
call fcn.004022c0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.00407770
mov edi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.004022c0
add esp, 4
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x14], edi
jge 0x48b3a0
lea esi, [edi - 1]
mov edx, ecx
sar esi, 1
lea eax, [esi + esi*2]
lea ebp, [ebx + eax*8]
mov ecx, ebp
call fcn.00411e05
test al, al
je 0x48b39c
push ebp
call fcn.004022c0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.00407770
mov edi, esi
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], esi
jl 0x48b363
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004022c0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.00407770
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48cb90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4fb068]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x48cc12
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x48cc12
test ecx, ecx
je 0x48cc0e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x48cbd0
xor eax, eax
jmp 0x48cc17
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x48cc21
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00496c8f
add esp, 0xc
ret 0xc

Function at 0x491370
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca9df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4fb068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.00401b80
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.00407810
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00407810
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00407810
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00407810
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00407810
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00407810
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x492f10
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4fb068]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x492f75
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x492f50
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x492f75
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00496c8f
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00496c8f
add esp, 8
ret 4
Function at 0x493110
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc298
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x493159
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x4932ab
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x493276
test eax, eax
je 0x493276
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x493279
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x4931fb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4931ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4931fb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x493209
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00407810
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x493276
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x4931b4
jmp 0x493279
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x4932a2
test edx, edx
je 0x49329e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x493170
mov al, 1
jmp 0x4932ad
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4932ab
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496c8f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4951f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4fb068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x495219
xor eax, eax
jmp 0x495275
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x495246
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x495246
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x4952fa
cmp dword [edi + 0x4c], 0
je 0x49526f
mov ecx, edi
call fcn.00494e47
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x495285
push dword [edi + 0x4c]
push ebx
call fcn.00494829
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x495274
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00496c8f
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4cd424]
mov ecx, dword [ebp - 0x2c]
call esi
test eax, eax
js 0x49526f
cmp eax, 1
jle 0x4952cd
cmp eax, 3
jne 0x49526f
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x495261
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x4952ea
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.004a583d
add esp, 0x10
cmp esi, eax
jne 0x49526f
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x49526f
mov ax, bx
jmp 0x495274

Function at 0x4acb12
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ac7d5

Function at 0x4acb1d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ac956

Function at 0x4b1353
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b1013
Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18

Function at 0x84755c
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x8472a2
add ecx, 0x6ff0449e
call fcn.00847598
add edx, ecx
or ecx, edx
dec edx
xor dword [esi], ebx
add edx, 1
push 0x4cf2a5ba
pop edx
mov ecx, ecx
inc esi
sub ecx, 0x1f2249a1
cmp esi, edi
jne fcn.0084755c
and ecx, edx
push edx
mov edx, dword [esp]
add esp, 4
ret
Function at 0x408682
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x2c
mov eax, 0x439d3b
call fcn.00421760
lea esi, [ecx + 0x124]
mov edi, 0x104
push edi
mov ecx, esi
call fcn.004017e6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4087a1
push 0xffffffffffffffff
mov ecx, esi
call fcn.00401872
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.004013b4
add eax, 0x10
pop ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov ecx, esi
push edi
mov dword [ebp - 4], ebx
call fcn.004017e6
push eax
push ebx
push 0x44009c
lea ecx, [ebp - 0x10]
call fcn.00408dfb
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401856
push 0xffffffffffffffff
mov ecx, esi
call fcn.00401872
lea ecx, [ebp - 0x38]
call fcn.00414292
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.004072b0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
push 0x1001
push dword [esi]
lea ecx, [ebp - 0x38]
call fcn.0041471a
test eax, eax
jne 0x408746
mov ecx, esi
call fcn.00401451
jmp 0x408783
push 0x4400a4
push 0x87
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x38]
call fcn.00414a81
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], vtable.CFileException.0
lea ecx, [ecx - 0x10]
call fcn.00401856
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004142b9
call fcn.0042172e
ret

Function at 0x4087be
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x439d6e
call fcn.00421760
mov edi, dword [ebp + 8]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.004013b4
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov ebx, 0x104
push ebx
mov ecx, edi
call fcn.004017e6
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401856
push 0xffffffffffffffff
mov ecx, edi
call fcn.00401872
lea ecx, [ebp - 0x2c]
call fcn.00415495
mov eax, dword [edi]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 0xc], 0
je 0x40886b
push 0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00415732
test eax, eax
je 0x40886b
lea ecx, [ebp - 0x2c]
call fcn.004158da
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004159f3
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0040132a
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00401856
lea ecx, [ebp - 0x2c]
call fcn.004156e6
jmp 0x40886d
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00415646
mov eax, ebx
call fcn.0042172e
ret 4