joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000783d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x10041c30
call fcn.10009a30
mov dword [ebp - 0x30], edx
mov ebx, ecx
xor esi, esi
test ebx, ebx
jne 0x1000785d
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10007874
push 0xc1
jmp 0x10007985
mov edi, dword [ebx + 0x3c]
cmp dword [edi + ebx], 0x4550
je 0x1000788a
push 0xbf
jmp 0x10007985
cmp word [edi + ebx + 0x14], si
je 0x10007980
mov edi, dword [edi + ebx + 0x78]
lea eax, [edi + ebx]
neg edi
sbb edi, edi
and edi, eax
mov dword [ebp - 0x28], edi
je 0x10007980
mov ecx, dword [edi + 0x1c]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [edi + 0x20]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x1c], esi
cmp eax, dword [edi + 0x14]
jae 0x10007957
test ecx, ecx
je 0x100078f4
mov edx, dword [ecx + eax*4]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
jmp 0x100078f6
mov edx, esi
mov ecx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
cmp eax, dword [edi + 0x18]
jae 0x10007927
mov edi, dword [ebp - 0x24]
movzx eax, word [edi + eax*2]
cmp eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
jne 0x1000794e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000794a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x10]
add eax, dword [ebp - 0x1c]
push edx
push ecx
push eax
push dword [ebp - 0x30]
mov eax, 0x10006382
call eax
test eax, eax
je 0x10007957
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
jmp 0x100078dd
mov ecx, esi
jmp 0x10007927
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x100078fd
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10007994
push 0xc0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10027d86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10027d95
pop dword [ebp - 0x3c]
mov eax, 0x10027d95
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x4552d
push 0
mov eax, 0x402812b8
sub eax, 0x3024e264
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x56ff734e
add ecx, 0xa900da1a
mov edi, eax
mov edx, 0x1004b600
add edx, dword [ebp - 0x3c]
mov esi, 0x8d7b3c3d
xor dword [ebp - 0x34], ecx
mov ebx, dword [edx]
sub ebx, esi
mov dword [edi], ebx
add dword [ebp - 0x30], edx
add edi, 4
add edx, 4
loop 0x10027de3
add eax, 0x12873
mov ebx, eax
add eax, 5
mov ecx, 0xbf3609c7
sub ecx, 0xaf3609c7
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x3c8e2129
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x7403338b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x401890
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa1960b21
mov ecx, 0x18b71962
rorx edx, eax, 0xb
sarx ecx, ecx, ecx
mulx eax, edx, ecx
xor eax, edx
mov ecx, 0xf5f7ffbe
pext eax, eax, ecx
cmp eax, 0x22f270c
sete al
ret

Function at 0x4155f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4155f8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41560b
test al, 0x10
je 0x41560b
mov al, 1
ret
xor al, al
ret
Function at 0x416970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c90a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [edx + 4]
mov ebx, dword [edx]
sub edi, ebx
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
lea edx, [ecx + 2]
mov word [ebp - 0x34], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4169c0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34]
call fcn.00415170
lea edx, [ebp - 0x34]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00465cc0
xor edx, edx
mov byte [ebp - 4], 1
mov ecx, eax
call fcn.00465ef0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x416a36
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416a2c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416af7
push edx
push ecx
call fcn.00479e95
add esp, 8
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 0
cmovae eax, dword [ebp - 0x34]
push 0x80
push 2
push 0
push 5
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 2
cmp esi, 0xffffffff
je 0x416afc
push 0
push 0
push 0
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416b29
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x416adb
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416ad1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416b4b
push edx
push ecx
call fcn.00479e95
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
call fcn.0049b19a
lea ecx, [ebp - 0x34]
call fcn.00414fe0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push str.set_file_content__ls
push eax
lea ecx, [ebp - 0x48]
call fcn.0042a730
push 0x50271c
lea eax, [ebp - 0x48]
push eax
call fcn.00491d27
push str.set_file_content
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x48]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x48]
push eax
call fcn.00491d27
call fcn.0049b19a
int3
Function at 0x41b690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
lea ebx, [ecx + 0x18]
mov dword [ebp - 0x78], eax
mov eax, dword [ebx]
mov ecx, ebx
push edi
push 2
push 0xffffc000
call dword [eax + 0x14]
test eax, eax
jle 0x41b7b0
mov eax, dword [ebx]
mov ecx, ebx
push 0x4000
call dword [eax + 0xc]
mov edi, eax
test edi, edi
je 0x41b7b0
cmp dword [edi + 0x3ff8], 0x53575341
jne 0x41b6f4
cmp dword [edi + 0x3ffc], 0x646e6769
je 0x41b78e
push 0x3ff0
mov edx, edi
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0046d300
add esp, 4
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x74]
call fcn.0046d3e0
lea edx, [edi + 0x3ff0]
mov esi, 0xc
lea ecx, [ebp - 0x18]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x41b78e
add ecx, 4
add edx, 4
sub esi, 4
jae 0x41b750
push dword [ebp - 0x78]
push 0x3ff0
push edi
call fcn.0041bb30
mov esi, eax
mov ecx, ebx
mov eax, dword [ebx]
push edi
call dword [eax + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx]
mov ecx, ebx
push edi
mov esi, 0xd
call dword [eax + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov eax, 0x52
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00479e61
mov esp, ebp
pop ebp
ret 4
Function at 0x41df80
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9830
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
call fcn.004158a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41dfe3
push str.Reboot:_Restarting_windows...
push 0x4e6454
push 0x50b654
push 2
push eax
call fcn.00417530
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x41e013
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x41e013
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x41e013
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push 0
push 0x28
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x41e050
lea eax, [ebp - 0x3c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41e0e3
lea eax, [ebp - 0x28]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41e0b0
mov eax, dword [ebp - 0x28]
push 0
push 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
push 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x41e0b0
call esi
cmp eax, 0x514
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x41e0e3
push 0x80040002
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
test eax, eax
jne 0x41e140
call esi
push eax
call fcn.0041cb60
add esp, 4
jmp 0x41e140
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movlpd qword [ebp - 0x20], xmm0
call fcn.004158a0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41e11b
push str.Reboot:_AdjustPrivilege_for_SE_SHUTDOWN_NAME_has_failed.
push 0x4e6454
push 0x50b654
push 7
push eax
call fcn.00417530
add esp, 0x14
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x41e140
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x41e140
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x41e140
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
Function at 0x41f440
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push 0x18
mov esi, ecx
mov dword [esp + 0x24], 0
xor eax, eax
mov dword [esp + 0x28], 7
push str.www.google_analytics.com
lea ecx, [esp + 0x18]
mov word [esp + 0x18], ax
call fcn.00415170
push 0
push 0
push 0
push 0
push str.Avast_SFX_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ebx, eax
test ebx, ebx
je 0x41f505
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x10]
push 0
cmovae ecx, dword [esp + 0x14]
push 0
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esp + 0xc], eax
test eax, eax
je 0x41f502
cmp dword [esi + 0x14], 8
jb 0x41f4be
mov esi, dword [esi]
push 0
push 0
push 0
push 0
push esi
push 0x4e7168
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
je 0x41f4fc
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x41f4f9
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
push esi
call edi
push dword [esp + 0xc]
call edi
push ebx
call edi
mov edx, dword [esp + 0x24]
cmp edx, 8
jb 0x41f53d
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41f533
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f544
push edx
push ecx
call fcn.00479e95
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0049b19a
int3
Function at 0x4220f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0
cmp dword [esi + 0x40], 0
jne 0x42214e
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x421ee0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x40], eax
test eax, eax
je 0x42214e
mov eax, dword [esi + 4]
test eax, eax
je 0x42213d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00479e61
mov esp, ebp
pop ebp
ret
Function at 0x422ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x422ee8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422efb
test al, 0x10
jne 0x422efb
mov al, 1
ret
xor al, al
ret

Function at 0x422f00
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x422f0f
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x422f17
mov edi, dword [edi]
mov bh, 1
mov bl, bh
nop dword [eax + eax]
test bl, bl
je 0x422f4c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov bl, 1
cmp eax, 0xffffffff
je 0x422f4c
and eax, 0x3126
mov ecx, 0x80
cmove eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
sete bl
push 0xb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x422f84
add bh, 0xff
je 0x422f7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov ecx, 0xc8
mov eax, 0x14
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x422f20
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422fa5
and eax, 0x3126
mov ecx, 0x80
cmove eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x42a9e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca869
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x40], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x58], esi
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push ecx
push eax
mov dword [ebp - 0x3c], 1
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x42ab82
cmp dword [ebp - 0x1c], 0
jne 0x42ab76
mov edi, dword [ebp - 0x20]
cmp edi, 0x7fffffff
ja 0x42ab76
mov eax, dword [esi + 4]
mov ecx, eax
mov edx, dword [esi]
sub ecx, edx
mov dword [ebp - 0x38], eax
cmp edi, ecx
jae 0x42aaa8
lea eax, [edx + edi]
jmp 0x42aad9
jbe 0x42aadc
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x42aac1
push ecx
push edi
mov ecx, esi
call fcn.0042abd0
mov edi, dword [ebp - 0x20]
jmp 0x42aadc
sub edi, ecx
push edi
push 0
push dword [ebp - 0x38]
call fcn.004928b0
mov eax, dword [ebp - 0x38]
add esp, 0xc
add eax, edi
mov edi, dword [ebp - 0x20]
mov dword [esi + 4], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0
push eax
push edi
push dword [esi]
xorps xmm0, xmm0
push dword [ebp - 0x40]
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42aba4
mov eax, dword [esi + 4]
mov ecx, eax
mov edx, dword [esi]
sub ecx, edx
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
cmp edi, ecx
jae 0x42ab28
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x42ab56
jbe 0x42ab56
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x42ab3e
push ecx
push edi
mov ecx, esi
call fcn.0042abd0
jmp 0x42ab56
sub edi, ecx
push edi
push 0
push dword [ebp - 0x38]
call fcn.004928b0
mov ecx, dword [ebp - 0x38]
add esp, 0xc
add ecx, edi
mov dword [esi + 4], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.get_file_content
push 0xdf
jmp 0x42ab8e
push str.get_file_content:_GetFileSizeEx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x54]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x54]
push eax
call fcn.00491d27
push str.get_file_content:_ReadFile
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x54]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x54]
push eax
call fcn.00491d27
int3
Function at 0x42ce30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cabd9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x505034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], 0
sub esi, edi
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
lea ecx, [esi + 2]
mov dword [ebp - 4], 0
mov eax, 0x55555556
mov dword [ebp - 0x18], 1
imul ecx
xor ecx, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 4
mul edx
push 0
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, ebx
call fcn.00417f70
mov eax, ebx
xor ecx, ecx
cmp dword [eax + 0x14], 0x10
jb 0x42cec1
mov ebx, dword [eax]
cmp esi, 3
jl 0x42cf5a
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
mov dword [ebp - 0x14], edx
lea eax, [edx*4]
sub eax, edx
neg eax
add esi, eax
mov dword [ebp + 8], esi
nop word [eax + eax]
movzx esi, byte [edi]
movzx edx, byte [edi + 1]
movzx eax, byte [edi + 2]
add edi, 3
shl esi, 8
or esi, edx
shl esi, 8
or esi, eax
mov eax, esi
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx], al
mov eax, esi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx + 2], al
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx + 3], al
add ecx, 4
sub dword [ebp - 0x14], 1
jne 0x42cef0
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp esi, 2
jne 0x42cfa8
movzx edx, byte [edi]
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
mov eax, edx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
shr edx, 6
and edx, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx + 1], al
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx + 2], al
mov byte [ebx + ecx + 3], 0x3d
jmp 0x42cfda
cmp esi, 1
jne 0x42cfdd
movzx edx, byte [edi]
shl edx, 0x10
mov eax, edx
shr edx, 0xc
shr eax, 0x12
and edx, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx], al
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + ecx + 1], al
mov word [ebx + ecx + 2], 0x3d3d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e0a0
Capabilities:
Terminate process

Disassembly:
push 0xa
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x42e0c5
push 0x10
push 0x4e8a48
push str.We_are_sorry_but_the_installer_cannot_run_on_your_computer_because_your_processor_does_not_support_SSE2_instruction_set.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0xc000001d
ret
push str.LdrEnumerateLoadedModules
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42e0eb
push 0
push 0x41d430
push 0
call eax
push 0x4e5e14
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.SetDefaultDllDirectories
push 0x4e64d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42e118
push 0x1000
call eax
call fcn.0047ada7
jmp fcn.0046bd70