joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cb20
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4950d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.Software_
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 1
call fcn.00401bc0
push 9
push str.yxdownbox
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 2
call fcn.00405740
mov eax, dword [esp + 0x38]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x41cba1
push 1
push 0x4a04bc
lea ecx, [esp + 0x1c]
call fcn.00405740
mov eax, dword [esp + 0x38]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00405740
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebx
push edx
push SysReAllocStringLen
xor esi, esi
mov dword [esp + 0x2c], ebx
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x41cbd4
mov esi, dword [esp + 0x18]
jmp 0x41cc3c
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edx
push SysReAllocStringLen
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41cc0c
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x41cc0c
push esi
call ebp
xor esi, esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 0xf003f
push ebx
push ecx
push SysReAllocStringLen
mov dword [esp + 0x34], ebx
call edi
cmp eax, ebx
jne 0x41cc5a
xor eax, eax
cmp esi, ebx
je 0x41cc34
push esi
call ebp
mov esi, dword [esp + 0x20]
cmp eax, ebx
jne 0x41cc5a
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
push 4
lea eax, [esp + 0x44]
push eax
push 4
push ebx
push ecx
push esi
mov dword [esp + 0x58], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
je 0x41cc61
push esi
call ebp
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41cc86
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ccaa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ccd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x422250
Capabilities:
Create pipe
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x494e08
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebp
push esi
push edi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
call fcn.004448fb
xor ecx, ecx
xor esi, esi
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x422298
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x20], ebp
push esi
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0xa4], esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xc
mov dword [esp + 0x40], 1
mov dword [esp + 0x3c], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, esi
je 0x4223bb
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x14]
xor edx, edx
lea ecx, [esp + 0x34]
push ecx
mov word [esp + 0x78], dx
lea edx, [esp + 0x48]
push edx
push esi
push esi
push 0x20
push 1
push esi
push esi
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov dword [esp + 0x98], 0x101
mov dword [esp + 0xa4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x4223bb
cmp dword [esp + 0xa4], esi
jne 0x4223bb
push ebx
lea ecx, [esp + 0x20]
call fcn.00401bc0
mov eax, dword [esp + 0x34]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x422382
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42239b
mov ecx, dword [esp + 0x34]
push ecx
call edi
mov edx, dword [esp + 0x38]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4223bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x4223ca
push eax
call edi
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4223d9
push eax
call edi
mov dword [esp + 0x14], esi
lea eax, [ebp - 0x10]
mov dword [esp + 0x9c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422400
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x90
ret
Function at 0x422e60
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x422f3b
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x422e94
cmp dword [esi + 0x40], edi
jae 0x422e94
push eax
call fcn.00442e6d
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x422eab
lea eax, [edi + edi]
push eax
call fcn.00442e78
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0046b0a0
add esp, 0xc
cmp edi, ebp
jbe 0x422f37
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4a4d68]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4a4d68]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x422ec0
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x422f74
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x422f5c
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0046b0a0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x422f95
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x426260
Capabilities:
Parse url

Disassembly:
mov eax, 0x2f28
call fcn.00466340
mov eax, dword [0x4b8a40]
xor eax, esp
mov dword [esp + 0x2f24], eax
cmp dword [ecx + 0x18], 8
mov eax, dword [esp + 0x2f34]
mov dword [esp + 4], eax
lea eax, [esp + 0xfe4]
mov dword [esp], edx
mov dword [esp + 0xc], eax
lea edx, [esp + 0x44]
lea eax, [esp + 0x1f84]
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], eax
lea edx, [esp + 0x814]
lea eax, [esp + 0x17b4]
push ebp
mov ebp, dword [esp + 0x2f34]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], eax
mov eax, 0x3e8
lea edx, [esp + 0x2758]
push esi
mov esi, dword [esp + 0x2f34]
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x44], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
jb 0x426305
mov ecx, dword [ecx + 4]
jmp 0x426308
add ecx, 4
push ebx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov edx, dword [esp + 0x24]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426322
sub eax, ebx
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.004055f0
mov edx, dword [esp + 0x40]
mov cx, word [esp + 0x2c]
mov eax, edx
mov word [edi], cx
lea esi, [eax + 2]
pop ebx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426350
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.004055f0
mov edx, dword [esp + 0x44]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426371
mov ecx, dword [esp + 0xc]
sub eax, esi
sar eax, 1
push eax
push edx
call fcn.004055f0
mov ecx, dword [esp + 0x2f2c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
pop esi
pop ebp
xor ecx, esp
mov dword [eax], edx
call fcn.00461a99
add esp, 0x2f28
ret 0xc
Function at 0x42d4a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x494af8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x42d50a
cmp dword [edi + 0x18], eax
je 0x42d50a
push ebx
push eax
call fcn.00402650
test al, al
je 0x42d50a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x42d503
mov eax, dword [edi + 4]
jmp 0x42d506
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x42d6eb
jmp 0x42d526
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x42d6eb
cmp al, 0x5c
jne 0x42d627
cmp esi, ecx
je 0x42d643
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x42d567.35
movzx eax, byte [eax + 0x42d72c]
jmp dword [eax*4 + 0x42d704]
push 0x22
jmp 0x42d62c
push 0x2f
jmp 0x42d62c
push 0x5c
jmp 0x42d62c
push 8
jmp 0x42d62c
push 0xc
jmp 0x42d62c
push 0xa
jmp 0x42d62c
push 0xd
jmp 0x42d62c
push 9
jmp 0x42d62c
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.0042d780
test al, al
je 0x42d68f
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x5c]
call fcn.0042bae0
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov dword [esp + 0x8c], ebx
call fcn.004027e0
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x74], 0x10
jb 0x42d609
mov ecx, dword [esp + 0x60]
push ecx
call fcn.00442e6d
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
jmp 0x42d634
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, edi
call fcn.0042dcb0
cmp esi, dword [esp + 0x18]
jne 0x42d522
jmp 0x42d6eb
push 0x1f
xor edi, edi
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
call fcn.004024e0
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], edi
call fcn.0042da30
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x42d6eb
mov eax, dword [esp + 0x28]
push eax
jmp 0x42d6e3
xor al, al
jmp 0x42d6ed
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.004024e0
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x88], 2
call fcn.0042da30
cmp dword [esp + 0x58], 0x10
mov bl, al
jb 0x42d6eb
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00442e6d
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x430b20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4957d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, edx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call fcn.00405810
mov eax, esi
mov dword [esp + 0x34], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x430b76
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.00430a10
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.00405810
cmp dword [esp + 0x28], 8
jb 0x430bbf
mov eax, dword [esp + 0x14]
push eax
call fcn.00442e6d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x430dc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x495f88
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4b8a40]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea esi, [esp + 0x10]
mov dword [esp + 0x54], ebx
call fcn.004251e0
mov byte [esp + 0x54], 1
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x430e27
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x24]
push eax
lea esi, [esp + 0x30]
call fcn.00425270
add esp, 4
mov byte [esp + 0x54], bl
cmp dword [esp + 0x28], 8
jb 0x430e50
mov eax, dword [esp + 0x14]
push eax
call fcn.00442e6d
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
lea esi, [esp + 0x14]
call fcn.00430c50
add esp, 4
mov esi, 0x10
mov byte [esp + 0x54], 3
cmp dword [eax + 0x18], esi
jb 0x430e75
mov eax, dword [eax + 4]
jmp 0x430e78
add eax, 4
mov ecx, edi
call fcn.00425210
cmp dword [esp + 0x28], esi
jb 0x430e92
mov edx, dword [esp + 0x14]
push edx
call fcn.00442e6d
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], esi
jb 0x430eb5
mov eax, dword [esp + 0x30]
push eax
call fcn.00442e6d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00461a99
add esp, 0x4c
ret
Function at 0x430f00
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, edx
push edi
mov edi, eax
test esi, esi
je 0x43100b
test edi, edi
jle 0x43100b
cmp edi, 3
jl 0x430fa5
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
jmp 0x430f40
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x430f40
pop ebx
test edi, edi
jle 0x431003
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x430fcd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x430fee
mov al, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
mov al, 1
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x4311a0
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
jne 0x4311ad
xor al, al
pop edi
ret
cmp dword [eax + 4], 0
je 0x4311a9
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x4310a0
push 0
push 0
call fcn.00463b6d
mov edx, dword [edi]
mov dword [edx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], 0
jne 0x431202
or esi, 0xffffffff
mov dword [eax + 0x10], esi
mov edi, dword [edi]
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x4311f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
pop esi
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
xor al, al
pop edi
ret
mov byte [eax + 8], 1
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x431224
mov esi, dword [edi]
call fcn.00431130
mov edx, dword [edi]
mov byte [edx + 8], 0
pop esi
mov al, 1
pop edi
ret
Function at 0x431c80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x493d69
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4b8a40]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], edi
call fcn.004448fb
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x431ccd
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x24], edi
push edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x431d6b
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x104
or eax, ecx
jge 0x431d25
push 0x104
mov ecx, esi
call fcn.00402310
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
cmp eax, edi
jne 0x431d40
xor eax, eax
jmp 0x431d4e
push ecx
push eax
call fcn.00461dfb
add esp, 8
cmp eax, edi
jl 0x431d7f
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x431d7f
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
push 0x80070057
call fcn.004010b0
int3
Function at 0x434740
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x434751
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x43476f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4347a6
test ecx, ecx
je 0x43479f
test esi, esi
ja 0x434760
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x437290
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4bf420], ecx
inc edx
cmp edx, 0x100
jb 0x437293
cmp edx, 0x800
jae 0x437369
lea ecx, [ecx]
mov eax, dword [edx*4 + 0x4bf020]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4bf420]
inc edx
mov dword [edx*4 + 0x4bf41c], eax
cmp edx, 0x800
jb 0x437340
mov dword [0x4bdcb0], 0x438680
call fcn.00438850
test eax, eax
jne 0x437386
mov dword [0x4bdcb0], 0x438730
pop ecx
ret
Function at 0x437c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x4b8a40]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 0x14]
push edi
mov ebx, edx
mov edx, dword [eax + 0x10]
push ecx
lea edi, [esp + 0x2c]
mov dword [esp + 0x28], ebx
call fcn.0043ae80
xor edi, edi
add esp, 4
cmp eax, edi
jne 0x437dcb
mov edx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xa8]
mov eax, 1
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x78], eax
nop
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 0x40000
cmp dword [esp + 0xac], edi
ja 0x437d03
jb 0x437cff
cmp ebx, 0x40000
jae 0x437d03
mov dword [esp + 0x14], ebx
mov edx, dword [ebp]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebp
call edx
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x437db7
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0xb8]
push 1
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
push eax
push ecx
lea eax, [esp + 0x3c]
call fcn.0043aaf0
mov esi, eax
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x28], eax
add esp, 0x14
sub ebx, eax
sbb dword [esp + 0xac], 0
test esi, esi
jne 0x437db7
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x4c], ecx
je 0x437d94
test eax, eax
jne 0x437d7d
cmp edi, dword [esp + 0x4c]
je 0x437d94
mov edx, dword [ebp + 4]
push eax
push ebp
call edx
mov esi, eax
add esp, 8
test esi, esi
jne 0x437db7
xor edi, edi
jmp 0x437ce0
cmp ecx, dword [esp + 0xb4]
jne 0x437db2
cmp dword [esp + 0x14], 0
jne 0x437db2
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x437db7
cmp eax, 4
je 0x437db7
mov esi, 1
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
push eax
call ecx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00461a99
add esp, 0x90
ret