joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049cd6
Capabilities:
Encode data using xor

Disassembly:
pop es
add dword [eax], eax
mov word [esp], cx
call fcn.1007552e
xchg edi, eax
pushal
loop 0x10049d52
cmp al, 0x7c
mov esi, 0x9faa34c2
loop 0x10049cf7
push ds
invalid
mov dword [0xf34c0a76], eax
daa
daa
xor eax, 0x141cfe25
mov ah, 0xe6
pop ecx
and eax, 0xb4141cfe
out 0x59, al
enter 0xffffffffffffbf23, 0xffffffffffffffd8
jl 0x10049cfb
fsubr qword [ecx]
jge 0x10049d25
inc esp
mov ch, 0xcd
mov cl, 0xd5
xor eax, 0x59dd1e8f
cmp ch, byte [ebp + ebx*4 - 0x17]
xchg esp, eax
cmp bh, byte [esi + 0x7b]
dec edx
scasd eax, dword es:[edi]
aam 0xc4
out dx, al
pop ds
imul ebx, dword [ebp - 0x427ea806], 0x5a
sar dword [0x89064969], 0xe3
je 0x10049cd3
jg 0x10049d27
out 0x63, eax
sbb byte ss:[esi + 0x59eb20e7], bh
clc
inc ebx
imul esp, edx, 0xffffffed
jl 0x10049cfe
sbb ch, dh
sub al, 0x39
cld
jne 0x10049dc5
push es
scasd eax, dword es:[edi]
mov edx, 0x660c2e73
lodsb al, byte [esi]
xchg ecx, eax
mov ecx, 0xfbc7d1b3
pop ecx
test byte [ecx - 0x73], 0x64
inc ecx
lea esp, [esp + 8]
stc
mov bh, 0x70
jno 0x10049dde
jl 0x10049db0
dec esp
mov ebp, 0x223b6d5b
int3
xchg dword [ecx + esi*8], ebx
push cs
stc
xchg byte [ebp + 0x3298fded], al
pcmpeqb mm4, qword [edx - 0x22]
test edx, edi
push ebx
sbb cl, ch
test eax, 0xe3c8401e
invalid
push ds
inc eax
enter 0xffffffffffffdee3, 0xffffffffffffffd6
imul edi, dword [ecx + edi - 0x65], 0xfffffffb
int1
xor dword [eax - 0x1284bae4], ebp
mov ecx, 0x3ae8ddc
xchg esi, eax
xor al, 0xac
lodsb al, byte [esi]
jb 0x10049d9d
rcr byte [edi], cl
jb 0x10049d9d
fcmovb st(0), st(0)
salc
sub esi, esi
arpl word [ecx - 0x15], ax
sahf
sbb eax, 0xfb62752d
or ebp, dword [eax - 0x1d]
push 0xc0b989e3
lea esp, [esp + 0x30]
invalid
and byte [ecx], 0xf9
invalid

Function at 0x1005e5f9
Capabilities:
Encode data using xor

Disassembly:
sete dl
push edx
setge dl
pushf
pop word [esp + 2]
not dl
dec dl
mov dl, byte [esi]
push 0x4a22cb6f
call fcn.10077337
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, dl
sub ebp, ecx
lea edi, [0xa9f7877c]
push edi
pop esp
pop edx
sbb dl, cl
or ebp, dword [esi - 0xd]
std
rcl bl, 1
jge 0x1005ba75
add dh, dh
sar dh, cl
retf 0x168a
wait
mov ebp, 0x2284b7ff
sbb al, 0xef
ret 0x4d8d
pushfd
lea esp, [esp + 0xc]
jne 0x1005a411
mov dl, 0x14
push 0x5365d665
lea esp, [esp + 4]
jge 0x1005ba68
pushf
dec dl
mov dl, byte [esi]
pushfd
push ebx
inc dl
cmc
clc
cmc
neg dl
pushfd
stc
stc
rol dl, 2
pushal
jmp 0x1004c80d
Function at 0x42b1b7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x42b1db
cmp dword [esi + 8], edi
jge 0x42b1d3
push esi
call fcn.004281d8
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x42b204
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x42b1e7
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x42b21e
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x42b20f
xor dl, dl
jmp 0x42b214
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x42b206
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x42b252
mov dword [0x877248], str.zlib_corrupt
xor eax, eax
jmp 0x42b294
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x42b267
mov dword [0x877248], str.read_past_buffer
jmp 0x42b24e
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x42b27e
push edi
push esi
call fcn.0042d6da
pop ecx
pop ecx
test eax, eax
je 0x42b24e
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005c1780
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x42f592
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x742b87
call fcn.005f004f
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
mov dword [ebp - 0x838], esi
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
call fcn.005c1f30
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x42f5ef
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00409440
and dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x42f635
mov eax, dword [esi]
push ebx
push eax
call fcn.005c5a49
pop ecx
pop ecx
test eax, eax
jne 0x42f67d
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x42f665
call fcn.0042f4c3
jmp 0x42f66a
call fcn.0042f56f
push eax
mov ecx, esi
call fcn.0040d5d0
lea ecx, [ebp - 0x828]
call fcn.0040a140
mov eax, esi
call fcn.005f000a
ret 0x10
Function at 0x4300d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
mov esi, ecx
call fcn.005c1f30
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x430109
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x75b560
push eax
call fcn.0040d2b0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x430141
lea eax, [ebp - 0x20c]
push eax
call fcn.0043c30e
pop ecx
push ebx
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.005c1f30
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x75b524
push eax
call fcn.0040d2b0
lea eax, [ebp - 0x61c]
push eax
call fcn.005c5a2e
add esp, 0x20
lea ecx, [esi + 0x8c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0040a2c0
push ebx
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.005c1f30
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x75b524
push eax
call fcn.0040d2b0
lea eax, [ebp - 0x824]
push eax
call fcn.005c5a2e
add esp, 0x20
lea ecx, [esi + 0xa4]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0040a2c0
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005c1f30
lea eax, [ebp - 0xa44]
push str.ZSPath
push eax
call fcn.0043c618
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x430208
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x75b420
push eax
call fcn.0040d2b0
add esp, 0xc
lea ecx, [ebp - 0xa44]
call fcn.0040a140
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x430246
lea eax, [ebp - 0x414]
push eax
call fcn.0043c30e
pop ecx
push ebx
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.005c1f30
push str.UseCache.ini
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push 0x75b524
push eax
call fcn.0040d2b0
lea eax, [ebp - 0xa2c]
push eax
call fcn.005c5a2e
add esp, 0x20
lea ecx, [esi + 0xbc]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.0040a2c0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00419933
leave
ret
Function at 0x4306d7
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x742c24
call fcn.005f004f
mov ebx, ecx
call fcn.0042f455
mov esi, eax
push esi
call fcn.005c5a2e
pop ecx
push eax
lea edi, [ebx + 0xd4]
push esi
mov ecx, edi
call fcn.0040a2c0
mov esi, str.BeiKePDFConverter.ini
push esi
call fcn.005c5a2e
pop ecx
push eax
push esi
mov ecx, edi
call fcn.0040d810
push str.beikeconv
push 0x75b61c
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0042f54c
and dword [ebp - 4], 0
lea eax, [ebp - 0x248]
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.004092d0
push str.beikeconv
mov ecx, esi
call fcn.00418390
test al, al
je 0x4307be
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c1f30
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x43077d
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.beikeconv
push eax
push edi
push 0x75b61c
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.005c5a2e
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0040a2c0
jmp 0x4307c3
mov edi, str.beikeconv
push edi
mov ecx, esi
call fcn.00418390
test al, al
je 0x430883
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c1f30
and dword [ebp - 0x220], 0
lea eax, [ebx + 0x5c]
and dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x230]
add esp, 0xc
push eax
call fcn.0040a3d0
push str.BeiKePDFConverter.ini
mov byte [ebp - 4], 1
call fcn.005c5a2e
pop ecx
push eax
push str.BeiKePDFConverter.ini
lea ecx, [ebp - 0x230]
call fcn.0040d810
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x75b61c
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call fcn.005c5a2e
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0040a2c0
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.0040a140
push edi
mov ecx, esi
call fcn.00418390
test al, al
je 0x4308bb
push edi
push 0x75b61c
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0042f592
push eax
mov ecx, esi
call fcn.0040d5d0
lea ecx, [ebp - 0x230]
call fcn.0040a140
lea ecx, [ebp - 0x248]
call fcn.0040a140
call fcn.005f000a
ret

Function at 0x430b88
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005c1f30
push 0x75b474
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.0040d2b0
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00419933
leave
ret
Function at 0x430be6
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.005f0180
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.005c1f30
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.005d6e42
push 0x800
lea eax, [ebp - 0x1024]
push esi
push eax
call fcn.005c1f30
push 0x75b474
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.00430a86
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.005c1f30
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.005c1f30
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.005c5a2e
pop ecx
test eax, eax
je 0x430e45
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.005c3030
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x430e45
lea eax, [ebp - 0x20c]
push eax
call fcn.005c5a2e
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.005d6e42
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.00430a86
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1024]
push 0x3ff
push 0x400
push eax
call fcn.00413d70
push esi
call fcn.005d6e00
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x2034]
push eax
mov dword [ebp - 0x2030], edx
call fcn.005d73c0
add esp, 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test edi, edi
je 0x430e45
lea ecx, [ebp - 0x1024]
push ecx
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2024]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00430aa4
xor eax, eax
add esp, 0x28
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x414]
push eax
call ebx
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x75b6cc
push eax
cmovne esi, ebx
call fcn.005d5978
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x430e45
test esi, esi
jne 0x430deb
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xfeff
push ebx
push eax
call fcn.005d70de
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
call fcn.005c5a2e
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.005d70de
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xd
push ebx
push eax
call fcn.005d70de
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xa
push ebx
push eax
call fcn.005d70de
push edi
call fcn.005d5a63
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419933
leave
ret
Function at 0x430e54
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.005f0180
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
call fcn.005d6e00
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.005d73c0
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00430aa4
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
xor ecx, ecx
pop edi
inc ecx
test eax, eax
push 0x75b6cc
push ebx
cmovne edi, ecx
call fcn.005d5978
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x430f70
test edi, edi
jne 0x430f13
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.005d70de
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
call fcn.005c5a2e
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.005d70de
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.005d70de
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.005d70de
push esi
call fcn.005d5a63
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419933
leave
ret
Function at 0x4314db
Capabilities:
Get mac address on windows

Disassembly:
push 0x58
mov eax, 0x742d0e
call fcn.005f004f
mov esi, dword [ebp + 8]
mov dword [ebp - 0x58], esi
push 0x288
mov dword [ebp - 0x54], 4
call fcn.005cd8ee
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x431516
push 0x829420
mov ecx, esi
call fcn.00409910
jmp 0x43166b
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x43153b
push ebx
call fcn.005cd8e9
push dword [ebp - 0x54]
call fcn.005cd8ee
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x431505
xor eax, eax
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x431643
lea edi, [ebp - 0x20]
xor ecx, ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x64], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
and dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 1
mov edi, ebx
test ebx, ebx
je 0x431626
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
lea eax, [ebp - 0x20]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.00408960
lea eax, [edi + 0x10c]
push eax
call fcn.00731da0
push 0x75b844
push eax
call fcn.005c37b0
add esp, 0x2c
test eax, eax
jne 0x431675
cmp dword [edi + 0x1a0], 0x47
je 0x431675
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x50]
call fcn.00409910
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.004312d4
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0040a5d0
mov edi, dword [edi]
test edi, edi
jne 0x431581
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
test eax, eax
je 0x43163b
push ecx
lea ecx, [ebp - 0x38]
call fcn.00409700
lea ecx, [ebp - 0x64]
call fcn.00431b29
push ebx
call fcn.005cd8e9
xor eax, eax
pop ecx
mov byte [ebp - 0x58], al
mov ecx, esi
push dword [ebp - 0x58]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040abe0
lea ecx, [ebp - 0x38]
call fcn.0040a5d0
mov eax, esi
call fcn.005f000a
ret 4
lea eax, [ebp - 0x20]
push eax
call fcn.005c5710
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040a850
jmp 0x43163b
Function at 0x4316a4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a0
mov eax, dword [0x85e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov dword [ebp - 0x69c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push ebx
push eax
call fcn.005c1f30
add esp, 0xc
lea eax, [ebp - 0x284]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x75b854
call fcn.005c5a2e
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005d73fd
push edi
lea eax, [ebp - 0x694]
push ebx
push eax
call fcn.005c1f30
push edi
lea eax, [ebp - 0x48c]
push ebx
push eax
call fcn.005c1f30
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], ebx
push ebx
push eax
mov dword [ebp - 0x69c], ebx
mov dword [ebp - 0x6a0], ebx
call fcn.005c1f30
add esp, 0x34
lea eax, [ebp - 0x48c]
mov ecx, 0x104
push ecx
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x698]
push eax
push ecx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43179e
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.00408960
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00409910
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419933
leave
ret 4
Function at 0x431bf3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor eax, eax
xor ecx, ecx
xor esi, esi
push edi
cmp dword [ebp + 0xc], eax
jle 0x431ce5
mov edi, dword [ebp + 8]
mov dl, byte [esi + edi]
movzx ebx, dl
cmp dl, 0x3d
jne 0x431c20
inc ecx
cmp ecx, 2
jg 0x431cec
cmp dl, 0x7f
ja 0x431cec
mov dl, byte [ebx + 0x75b8b0]
cmp dl, 0x7f
je 0x431cec
cmp dl, 0x40
jae 0x431c45
test ecx, ecx
jne 0x431cec
inc eax
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x431c0b
test eax, eax
je 0x431ce5
mov edi, dword [ebp + 0x14]
imul eax, eax, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x431c6d
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x431cee
mov edx, dword [ebp + 0x10]
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x431ce0
mov eax, dword [ebp + 8]
push 3
pop edi
movzx eax, byte [eax]
mov cl, byte [eax + 0x75b8b0]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x431cd1
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x431cbc
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x431cc9
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x431cd1
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x431c81
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0xffffffffffffffee
pop eax
jmp 0x431ce7
Function at 0x431cf1
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x431d05
xor eax, eax
jmp 0x431e3b
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x431d2e
dec edx
sub edx, 1
jne 0x431d30
add eax, 2
jmp 0x431d30
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x431d43
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x431e3a
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x431dd3
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
push 3
mov al, byte [eax + 0x75b870]
mov byte [edi], al
pop eax
and ecx, eax
mov eax, edx
shr eax, 4
add ecx, ecx
and edx, 0xf
mov al, byte [eax + ecx*8 + 0x75b870]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
mov al, byte [eax + edx*4 + 0x75b870]
mov byte [edi + 2], al
mov al, byte [esi + 0x75b870]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x431d6a
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x431dd6
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x431e2d
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x431deb
movzx ecx, byte [eax + 1]
jmp 0x431ded
xor ecx, ecx
mov eax, edx
shr eax, 2
push 3
mov al, byte [eax + 0x75b870]
mov byte [edi], al
pop eax
and edx, eax
mov eax, ecx
add edx, edx
shr eax, 4
mov al, byte [eax + edx*8 + 0x75b870]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x431e21
and ecx, 0xf
mov al, byte [ecx*4 + 0x75b870]
jmp 0x431e23
mov al, 0x3d
mov byte [edi + 2], al
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438453
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x7437f9
call fcn.005f001b
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0043e864
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0043e898
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x438493
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4384f3
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4384ce
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4384f3
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0043e877
call fcn.005efff5
ret 0xc