joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c5fa00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d18014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.01c5e7f0
mov eax, dword [esi]
test eax, eax
je 0x1c5fa53
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x1c5fa5a
lea ecx, [ebp - 0x14]
call fcn.01c5f260
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c9ca53
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x1c5fa35
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebx + 0x50], 0
je 0x1c5fa72
add ebx, 0x58
cmp ebx, edi
je 0x1c5fa35
jmp 0x1c5fa63
cmp byte [ebx + 0x1b], 0
jns 0x1c5fa7d
mov eax, dword [ebx + 0x10]
jmp 0x1c5fa80
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1c5fa69
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x1c5fab3
mov edx, ecx
mov ecx, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.01c60380
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1c5fa69
mov ecx, dword [ebp + 8]
push ebx
call fcn.01ce2730
jmp 0x1c5fa69

Function at 0x1c5fac0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d18014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.01c5e7f0
mov eax, dword [esi]
test eax, eax
je 0x1c5fb13
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x1c5fb1a
lea ecx, [ebp - 0x14]
call fcn.01c5f260
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c9ca53
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x1c5faf5
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebx + 0x50], 2
jne 0x1c5fb68
cmp byte [ebx + 0x1b], 0
jns 0x1c5fb34
mov eax, dword [ebx + 0x10]
jmp 0x1c5fb37
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1c5fb68
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x1c5fb71
mov edx, ecx
mov ecx, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.01c60380
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
add ebx, 0x58
cmp ebx, edi
je 0x1c5faf5
jmp 0x1c5fb23
mov ecx, dword [ebp + 8]
push ebx
call fcn.01ce2730
jmp 0x1c5fb68
Function at 0x1c721c0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor eax, eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x1c722af
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edx
mov edi, eax
cmp dword [ebp - 0x14], 7
mov ebx, 0
jb 0x1c72202
mov eax, 7
xor ecx, ecx
cpuid
and ebx, 0x20
mov dword [esi], edi
mov eax, edi
and eax, 0xf
mov dword [esi + 8], eax
shr edi, 0xc
and edi, 3
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0xc], al
mov eax, ecx
shr eax, 0x19
and al, 1
mov byte [esi + 0xd], al
shr ecx, 0x1a
and cl, 1
mov byte [esi + 0xe], cl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and al, 1
mov byte [esi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [esi + 0x19], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x1c722da
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [esi + 0x14], al
mov edx, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [esi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [esi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [esi + 0x16], cl
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000006
jle 0x1c722de
mov eax, 0x80000007
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x18], dh
test dh, dh
je 0x1c722e3
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1c72286
mov dh, byte [esi + 0x18]
jmp 0x1c722ce
cmp byte [esi + 0x19], 0
je 0x1c722d2
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x1c722d2
cmp ecx, 0x666f736f
jne 0x1c722d2
cmp edx, 0x76482074
jne 0x1c722d2
mov byte [esi + 0x18], 1
jmp 0x1c722d2

Function at 0x1c73028
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1c73063
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1c7304a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1c7305b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1c73065
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1c73040
xor eax, eax
pop edi
pop esi
ret
Function at 0x1c736c0
Capabilities:
Inspect section memory permissions

Disassembly:
xor ecx, dword [ebx - 0x1fcc382]
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1c737d7
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x1c7358d
cmp dword [eax + 0xc], ebx
je 0x1c73630
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.01c72fe8
push ebx
popal
sub al, 0x39
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.01c72fe8
int 0x83
pushfd
or dword [ebx + 0xa087], 0
cmp eax, ebx
je 0x1c7369c
add eax, esi
cmp dword [eax], ebx
je 0x1c7369c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1c73697
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1c73681
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1c73689
cmp edx, ebx
jne 0x1c737d7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1c73658
add eax, dword [eax + 4]
jmp 0x1c73645
mov dword [ebp + 0xc], ebx
jmp 0x1c736a7
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1c736bf
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1c736dd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1c7373b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1c73722
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1c7372b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1c73735
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1c73717
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1c736a1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1c73788
dec eax
je 0x1c7377f
sub eax, 3
je 0x1c73776
mov dword [ebp - 4], 0x40
jmp 0x1c737a5
mov dword [ebp - 4], 4
jmp 0x1c7378b
mov dword [ebp - 4], 0x20
jmp 0x1c7378b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1c737d7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1c73757
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.01c72fe8
dec esp
outsd dx, dword [esi]
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1c79300
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x1c79317
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c7931a
and edx, 0x7f
mov ecx, edx
cmp edx, 4
jb 0x1c79356
nop word cs:[eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c79330
cmp edx, 1
je 0x1c79377
cmp edx, 2
je 0x1c7936e
cmp edx, 3
jne 0x1c79382
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40596d
pop dword [ebp - 0x44]
mov eax, 0xa71e37b1
sub eax, 0xa6ddde44
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xc4092760
sub dword [ebp - 0x54], 0x75b6e215
mov dword [ebp - 0x50], 0x9ddb1094
add dword [ebp - 0x50], 0x94583bb1
mov dword [ebp - 0x4c], 0xc901cabc
add dword [ebp - 0x4c], 0x834a7972
mov dword [ebp - 0x48], 0xe7ce12f6
add dword [ebp - 0x48], 0x1831ed0a
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x13cfaad1
add dword [ebp - 0x54], 0x60a2be85
mov dword [ebp - 0x50], 0xc0bbf7a
add dword [ebp - 0x50], 0x3560a1fb
mov dword [ebp - 0x4c], 0x517512fa
add dword [ebp - 0x4c], 0x11fa5972
mov dword [ebp - 0x48], 0xf3cf27e3
add dword [ebp - 0x48], 0xc30d81d
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x329f1fd
add eax, 0xfd167f03
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36513
push 0
call eax
mov ecx, 0x129ded0e
add ecx, 0xed625959
xor edi, edi
add edi, eax
mov edx, 0xd5c38c25
add edx, 0x2a7d73db
add edx, dword [ebp - 0x44]
mov esi, 0xb76a1738
xor dword [ebp - 0x40], 0xba7c738c
mov ebx, dword [edx]
xor dword [ebp - 0x30], 0xf7e67790
add ebx, esi
sub dword [ebp - 0x34], 0x20d17a6f
mov dword [edi], ebx
mov dword [ebp - 0x18], 0x8ca9369
add edi, 0x512364d3
add edi, 0xaedc9b31
add edx, 4
loop 0x405a86
add eax, 0x10c6f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe4225031
add ecx, 0x1c1dafcf
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40150c
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x507948
jmp 0x401500
mov eax, 0x4c6f78
call fcn.00459198
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00401612
mov eax, dword [0x4ffb78]
lea ecx, [esi + 0xa0]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0xb0], eax
push 1
mov dword [esi], 0x4ce7d8
or dword [esi + 0x20], 0xffffffff
or dword [esi + 0x1c], 0xffffffff
pop edi
mov dword [esi + 0x28], ebx
push 0xa
mov dword [esi + 0x24], ebx
pop eax
mov byte [ebp - 4], 2
push 0x64
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
pop eax
push 0x507944
mov dword [esi + 0x2c], 2
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], ebx
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], 0x3e8
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], pe_nt_image_headers32
mov dword [esi + 0x84], 0x90
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x9c], ebx
call fcn.004b179d
push 0x507944
lea ecx, [esi + 0xb0]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
call fcn.004b179d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40b7cb
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4c7df4
call fcn.00459198
sub esp, 0x22c
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov esi, 0x507a00
push str.DataFile_Types
mov ecx, esi
call fcn.004c44cc
xor ebx, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x40b801
xor eax, eax
jmp 0x40b949
mov eax, dword [0x4ffb78]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x24], pe_nt_image_headers32
mov dword [ebp - 0x20], ebx
call edi
cmp eax, 0x103
je 0x40b919
lea eax, [ebp - 0x238]
push eax
push str.DataFile_Types
lea eax, [ebp - 0x10]
push 0x4ef0d8
push eax
call fcn.004aef37
add esp, 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
push ebx
push 0x4ef0a8
push dword [ebp - 0x10]
push eax
call fcn.004c457e
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004b174d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004b1606
push ebx
push 0x4ef0b4
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c457e
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004b174d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004b1606
push 0xffffffffffffffff
push 0x4ef45c
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004c4512
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 8], ebx
je 0x40b8f2
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 8], ebx
je 0x40b8f2
cmp eax, 0xffffffff
je 0x40b8f2
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0040ba36
lea eax, [ebp - 0x38]
inc dword [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x24], pe_nt_image_headers32
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
jmp 0x40b83d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b1606
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004b1606
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b1606
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40d3b9
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4d0c98
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.004591c0
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040d747
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40dfbd
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, 0x2b4
push edi
push esi
lea eax, [ebp - 0x2b4]
push 0
mov edi, ecx
push eax
call fcn.004591c0
mov eax, dword [ebp + 8]
add esp, 0xc
or ax, 0x4008
push eax
lea eax, [ebp - 0x2b4]
push esi
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b0]
pop edi
pop esi
leave
ret 4

Function at 0x40f703
Capabilities:
Check os version

Disassembly:
mov eax, 0x4c83ff
call fcn.00459198
sub esp, 0x118
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0x1c]
mov esi, ecx
mov dword [ebp - 0x10], esi
push ebx
call fcn.004b64ac
mov eax, dword [0x4ffb78]
mov dword [ebp - 4], ebx
mov dword [esi + 0x64], eax
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
mov dword [esi], 0x4d1268
jne 0x40f789
mov edi, 0x114
lea eax, [ebp - 0x124]
push edi
push ebx
push eax
call fcn.004591c0
add esp, 0xc
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 2
jne 0x40f782
cmp dword [ebp - 0x120], 5
mov dword [ebp + 0x20], 0x58
jae 0x40f789
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.0045997d
cmp eax, ebx
pop ecx
mov dword [esi + 0x5c], eax
jne 0x40f79e
call fcn.004af618
push dword [ebp + 0x20]
mov ecx, esi
push ebx
call fcn.0040f963
push eax
call fcn.004591c0
push 0x200002
call fcn.004b1bda
mov dword [esi + 0xe8], eax
mov word [eax], bx
mov eax, dword [ebp + 8]
add esp, 0x10
mov dword [esi + 0x60], eax
lea edi, [esi + 0x68]
neg eax
sbb eax, eax
mov ecx, esi
add eax, 0x7005
mov word [edi], bx
mov dword [esi + 0xec], ebx
mov dword [esi + 0x3c], eax
call fcn.0040f963
mov ecx, dword [ebp + 0x20]
mov dword [eax], ecx
mov ecx, esi
call fcn.0040f963
mov ecx, dword [esi + 0xe8]
mov dword [eax + 0x1c], ecx
mov ecx, esi
call fcn.0040f963
mov ecx, esi
mov dword [eax + 0x20], 0x100000
call fcn.0040f963
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x3c], ecx
mov ecx, esi
call fcn.0040f963
mov ecx, esi
mov dword [eax + 0x24], edi
call fcn.0040f963
mov ecx, esi
mov dword [eax + 0x28], 0x40
call fcn.0040f963
mov ecx, dword [ebp + 0x14]
add eax, 0x34
or ecx, 0x880020
or dword [eax], ecx
test byte [ebp + 0x14], 0x40
je 0x40f85b
mov ecx, esi
call fcn.0040f963
add eax, 0x34
and byte [eax + 2], 0x7f
call fcn.004c432d
mov edi, dword [eax + 0xc]
mov ecx, esi
call fcn.0040f963
mov ecx, esi
mov dword [eax + 8], edi
call fcn.0040f963
cmp dword [ebp + 0x10], ebx
mov dword [eax + 0x44], 0x40f58c
je 0x40f894
push 0x100000
push dword [ebp + 0x10]
push dword [esi + 0xe8]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x18], ebx
je 0x40f8d3
push dword [ebp + 0x18]
lea edi, [esi + 0x64]
mov ecx, edi
call fcn.004b179d
push ebx
mov ecx, edi
call fcn.004b1a4b
push 0x7c
push eax
call fcn.00459954
pop ecx
cmp eax, ebx
pop ecx
je 0x40f8c6
mov word [eax], bx
push 0x7c
add eax, 2
jmp 0x40f8b0
mov edi, dword [esi + 0x64]
mov ecx, esi
call fcn.0040f963
mov dword [eax + 0xc], edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x417825
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
xor esi, esi
mov byte [ebp - 4], al
mov byte [ebp - 3], al
mov byte [ebp - 2], al
mov byte [ebp - 8], al
mov byte [ebp - 7], al
mov byte [ebp - 6], al
mov byte [ebp - 5], al
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
dec eax
test ecx, ecx
je 0x4179a4
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
inc esi
inc dword [ebp + 8]
cmp esi, 3
mov al, byte [eax]
mov byte [ebp + esi - 5], al
mov dl, byte [ebp - 2]
mov al, byte [ebp - 3]
mov cl, byte [ebp - 4]
jne 0x4178ea
mov dl, cl
mov bl, al
shr dl, 2
mov byte [ebp - 8], dl
mov dl, cl
and dl, 3
shl dl, 4
shr bl, 4
add dl, bl
mov bl, byte [ebp - 2]
mov byte [ebp - 7], dl
mov dl, al
and dl, 0xf
shl dl, 2
shr bl, 6
add dl, bl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 2]
mov bl, dl
and bl, 0x3f
and dword [ebp + 0xc], 0
mov byte [ebp - 5], bl
mov ebx, dword [0x507c74]
test ebx, ebx
jne 0x4178c6
mov esi, 0x4d0c9c
jmp 0x4178d0
mov esi, dword [ebp + 0xc]
movzx esi, byte [ebp + esi - 8]
add esi, ebx
mov bl, byte [esi]
mov edi, dword [edi]
mov esi, dword [ebp + 0x10]
mov byte [edi + esi], bl
mov edi, dword [ebp + 0x14]
inc dword [edi]
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 4
jl 0x4178b5
xor esi, esi
dec dword [ebp - 0xc]
jne 0x41785e
test esi, esi
je 0x4179a4
cmp esi, 3
jge 0x417925
push 3
lea edi, [ebp + esi - 4]
pop ecx
xor eax, eax
sub ecx, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dl, byte [ebp - 2]
mov al, byte [ebp - 3]
mov cl, byte [ebp - 4]
mov edi, dword [ebp + 0x14]
mov bl, cl
and cl, 3
shr bl, 2
mov byte [ebp - 8], bl
mov bl, al
shl cl, 4
shr bl, 4
add cl, bl
and dword [ebp + 8], 0
mov byte [ebp - 7], cl
and al, 0xf
mov cl, dl
and dl, 0x3f
shl al, 2
shr cl, 6
add al, cl
lea ecx, [esi + 1]
test ecx, ecx
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
jle 0x41798c
mov edx, dword [0x507c74]
test edx, edx
jne 0x41796e
mov eax, 0x4d0c9c
jmp 0x417978
mov eax, dword [ebp + 8]
movzx eax, byte [ebp + eax - 8]
add eax, edx
mov edx, dword [edi]
mov ebx, dword [ebp + 0x10]
mov al, byte [eax]
mov byte [edx + ebx], al
inc dword [edi]
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x41795d
cmp esi, 3
jge 0x4179a4
push 4
pop eax
sub eax, ecx
mov ecx, dword [edi]
mov edx, dword [ebp + 0x10]
mov byte [ecx + edx], 0x3d
inc dword [edi]
dec eax
jne 0x417996
mov eax, dword [edi]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x418504
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4199ff
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4c8940
call fcn.00459198
push ecx
mov eax, dword [0x4ffb78]
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], eax
mov eax, dword [0x4ffb78]
and dword [ebp - 4], 0
mov dword [esi + 0x20], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0x24], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0x28], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0x2c], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0x30], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0x34], eax
mov eax, dword [0x4ffb78]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 7
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], 0x4d24c8
mov dword [esi + 0xc], eax
call fcn.0041cdf0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x41afe8
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 0x60]
lea ebx, [esi + 4]
mov dword [ebp - 4], eax
push ebx
mov dword [eax], edi
lea eax, [esi + 0x14]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
mov dword [esi + 0x5c], edi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41b020
or eax, 0xffffffff
jmp 0x41b095
cmp dword [ebp + 0xc], edi
mov dword [esi + 0x5c], 0xa
je 0x41b05c
mov dword [ebp + 8], edi
push 0x64
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41b066
mov eax, dword [ebp + 0xc]
cmp dword [eax], edi
je 0x41b02f
add dword [ebp + 8], 0x64
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x58]
jl 0x41b02f
push 1
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41b066
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x5c], 0x64
cmp eax, edi
je 0x41b07d
cmp dword [eax], edi
je 0x41b07d
push 1
pop eax
jmp 0x41b095
mov esi, dword [ebp - 4]
push esi
push dword [ebx]
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esi]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
leave
ret 8