joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4484f0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481cd2
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x4a5018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x4b4]
mov eax, dword [esi]
mov dword [ebp - 0x4b8], eax
lea eax, [esi + 4]
push eax
call fcn.0043e6e0
lea eax, [esi + 0x1c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x49c]
call fcn.0043e6e0
lea eax, [esi + 0x34]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x484]
call fcn.0043e6e0
lea eax, [esi + 0x4c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x46c]
call fcn.0043e6e0
lea eax, [esi + 0x64]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x454]
call fcn.0043e6e0
lea edi, [esi + 0x7c]
mov byte [ebp - 4], 4
push edi
lea ecx, [ebp - 0x43c]
call fcn.0043e6e0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 5
push 0
push eax
call fcn.004573c0
cmp dword [ebp - 0x470], 8
lea eax, [ebp - 0x484]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
cmovae eax, dword [ebp - 0x484]
push eax
lea eax, [ebp - 0x218]
push 0x492ce0
push eax
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004573c0
cmp dword [ebp - 0x4a0], 8
lea eax, [ebp - 0x4b4]
cmovae eax, dword [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x420]
push str._s.lnk
push eax
call esi
add esp, 0x30
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x448632
sub eax, edx
lea ecx, [ebp - 0x43c]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00405dc0
lea eax, [ebp - 0x4b8]
push eax
call fcn.004483e0
test eax, eax
js 0x448714
cmp dword [edi + 0x14], 8
jb 0x448670
mov edi, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
call fcn.00402880
mov ecx, eax
test ecx, ecx
je 0x44873e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push str.barP
lea eax, [ebp - 0x424]
mov byte [ebp - 4], 6
push str.Task_sin
push eax
call fcn.00407700
add esp, 0xc
lea eax, [ebp - 0x43c]
cmp dword [ebp - 0x428], 8
cmovae eax, dword [ebp - 0x43c]
push 0
push 0
push 0
push eax
push 0x492e10
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x428], 8
lea eax, [ebp - 0x43c]
cmovae eax, dword [ebp - 0x43c]
push eax
call esi
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x424]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x448714
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x4b8]
call fcn.0043e8e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454d47
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402980
int3
Function at 0x448f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481e10
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4a5018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x10], 0
jne 0x44900b
push 0x10
lea eax, [ebp - 0x234]
push eax
call fcn.00449190
push eax
mov ecx, edi
call fcn.004235c0
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x44900b
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449001
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44916e
push edx
push ecx
call fcn.00455202
add esp, 8
cmp dword [edi + 0x28], 0
jne 0x449068
push 2
lea eax, [ebp - 0x234]
push eax
call fcn.00449190
push eax
lea ecx, [edi + 0x18]
call fcn.004235c0
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x449068
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44905e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449173
push edx
push ecx
call fcn.00455202
add esp, 8
cmp dword [edi + 0x40], 0
jne 0x44913e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004573c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00402880
mov ecx, eax
test ecx, ecx
je 0x449178
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push str.kBar
push str.k_LaunchUser_P
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push str.MicrosoftInternet_ExplorerQuic_sinnedTas_s
push eax
call fcn.00407700
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
add esp, 0x10
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x449100
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [edi + 0x30]
call fcn.00405dc0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44913e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x28], 0
je 0x44914e
cmp dword [edi + 0x10], 0
je 0x44914e
xor eax, eax
jmp 0x449153
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454d47
mov esp, ebp
pop ebp
ret
call fcn.00459a0a
call fcn.00459a0a
push 0x80004005
call fcn.00402980
int3
Function at 0x449190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a5018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x44928b
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x449275
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004573c0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x449259
xor eax, eax
mov dword [esi], 0
lea ecx, [ebp - 0x210]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x449240
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
jmp 0x4492aa
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x214], 0
xor eax, eax
mov dword [esi], 0
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x492e10
mov ecx, esi
call fcn.00405dc0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00454d47
mov esp, ebp
pop ebp
ret 8
Function at 0x4492d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a5018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x20a
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004573c0
add esp, 0xc
cmp dword [ebx + 0x10], 0
je 0x449368
cmp dword [ebx + 0x14], 8
jb 0x449322
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x44932a
mov edi, dword [edi]
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [ebp + 0x18], 0
je 0x449360
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x449360
push eax
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 0x10], 0
je 0x4493ae
jmp 0x44938b
cmp dword [esi + 0x10], 0
je 0x4493ae
cmp dword [edi + 0x14], 8
jb 0x449376
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0045db9d
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp dword [esi + 0x14], 8
jb 0x4493a0
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..lnk
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00466696
mov ebx, dword [ebp - 0x214]
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4493f0
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00405dc0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454d47
mov esp, ebp
pop ebp
ret 0x14
Function at 0x449640
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481edb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4a5018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004573c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x22c], eax
call fcn.00402880
mov ecx, eax
test ecx, ecx
je 0x449888
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x21c]
call fcn.004067d0
test al, al
jne 0x449712
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4496f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.004069d0
mov dword [ebp - 4], 1
mov edx, 1
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x44974a
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.00406b80
mov eax, dword [ebp - 0x21c]
push str._system32Shell32.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x21c]
push dword [eax - 8]
push eax
call fcn.0045d623
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x44987e
mov eax, dword [ebp - 0x21c]
cmp ecx, dword [eax - 8]
jg 0x44987e
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], edx
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x220]
mov eax, dword [ebp - 0x21c]
push ecx
push eax
mov dword [ebp - 0x228], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x44983b
push esi
call fcn.0045d3aa
mov edi, eax
add esp, 4
test edi, edi
je 0x44983b
push edi
push esi
push 0
push dword [ebp - 0x228]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x449832
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x494444
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x449832
mov eax, dword [ebp - 0x228]
push edi
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x22c], eax
call fcn.00459833
add esp, 4
cmp esi, 0x60002
jb 0x44983b
cmp dword [ebp - 0x22c], 0x295a01c8
mov eax, 1
cmovae ebx, eax
jmp 0x44983b
push edi
call fcn.00459833
add esp, 4
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x21c]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x449860
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454d47
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402980
push 0x80004005
call fcn.00402980
int3
Function at 0x44b500
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4090], ebx
je 0x44b5aa
cmp dword [esi + 0x6c], ebx
jbe 0x44b5aa
mov eax, 0xffffff78
lea ebx, [esi + 0x88]
sub eax, esi
mov dword [ebp - 4], eax
push edi
movzx eax, byte [ebx]
mov ecx, dword [esi + 0x4094]
xor eax, ecx
mov edx, dword [esi + 0x40a0]
movzx eax, al
mov edi, dword [esi + 0x409c]
shr ecx, 8
and edi, 0xfffd
or edi, 2
xor ecx, dword [edx + eax*4]
movzx eax, cl
add eax, dword [esi + 0x4098]
imul eax, eax, 0x8088405
mov dword [esi + 0x4094], ecx
mov ecx, dword [esi + 0x409c]
inc eax
mov dword [esi + 0x4098], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edx + eax*4]
mov eax, edi
xor eax, 1
mov dword [esi + 0x409c], ecx
imul eax, edi
shr eax, 8
xor byte [ebx], al
inc ebx
mov eax, dword [ebp - 4]
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x44b530
xor ebx, ebx
pop edi
push dword [esi + 0x6c]
mov ecx, dword [esi + 8]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call ecx
add esp, 0x10
or ecx, 0xffffffff
cmp eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], 0
cmovne ebx, ecx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44cc60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x44cc9c
cmp byte [esi + 0x2c], bl
jne 0x44cd86
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44cc90
jmp 0x44cd6c
mov edi, dword [esi + 0x18]
test edi, edi
je 0x44ccb2
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x44cca3
push 2
push 0
push ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.0047b046
push ebx
call fcn.0047ad7f
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.0047b046
add esp, 0x1c
test edi, edi
jg 0x44cd1d
cmp byte [esi + 0x2c], 0
jne 0x44cd86
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44cd14
jmp 0x44cd6c
lea eax, [edi + 1]
push eax
call fcn.0045540a
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.0045df28
add esp, 0x14
cmp eax, 1
je 0x44cd8f
push edi
call fcn.00455405
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x44cd86
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44cd65
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.0044bd20
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
mov dl, byte [edi]
mov ecx, edi
test dl, dl
je 0x44cdbe
nop dword [eax]
inc eax
lea ebx, [ecx + 1]
cmp dl, 0xd
jne 0x44cdb4
mov byte [ecx], 0xa
cmp byte [eax], 0xa
jne 0x44cdb6
inc eax
jmp 0x44cdb6
mov byte [ecx], dl
mov dl, byte [eax]
mov ecx, ebx
test dl, dl
jne 0x44cda0
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push edi
call dword [eax + 8]
push edi
call fcn.00455405
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44ce90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4820d7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a5018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x48
call fcn.004551d2
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x4aaa10
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x4aaa10
mov byte [ebp - 4], 2
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x49447b
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0044bd20
push esi
mov ecx, edi
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0044cdf0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4511d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov esi, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, edx
cmp dword [edi + 0x6c], eax
jb 0x45127a
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00456e40
mov eax, dword [edi + 0x4c]
add esp, 0xc
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x451224
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x40]
mov edi, esi
lea edx, [eax + esi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x451252
mov edi, dword [ebp - 8]
add ebx, esi
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x451342
mov ecx, dword [edi + 0x6c]
mov edx, dword [edi + 0x74]
add ecx, edx
add ecx, dword [edi + 0x38]
cmp eax, ebx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
cmovbe ebx, eax
test ebx, ebx
jne 0x4512a8
xor ebx, ebx
jmp 0x451301
sub eax, ebx
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4512c5
mov edx, dword [ecx]
mov ecx, dword [ecx + 0x30]
push ebx
call fcn.00453990
jmp 0x4512df
cmp eax, 2
jne 0x4512e8
mov edx, dword [ecx]
mov eax, dword [ecx + 0x30]
test edx, edx
jne 0x4512d7
xor eax, eax
jmp 0x4512e5
push ebx
mov ecx, eax
call fcn.00451f10
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ecx + 0x30], eax
push ebx
push dword [ecx]
push dword [ebp - 0xc]
call fcn.00456e40
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], ebx
add dword [eax + 8], ebx
mov edx, dword [edi + 0x74]
add edx, ebx
mov dword [ebp - 0xc], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x45132e
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 0xc]
cmp edx, 0x106
jae 0x451342
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4511e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d3fa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046d270

Function at 0x47234d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00471fca

Function at 0x100014c3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1000301c]
xor eax, ebp
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.10001493
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR71.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10001527
cmp dword [ebp - 0x1c], 5
jb 0x1000153f
jmp 0x1000153b
cmp dword [ebp - 0x10], 1
jne 0x1000153f
cmp dword [ebp - 0x1c], 4
ja 0x1000153b
jne 0x1000153f
cmp dword [ebp - 0x18], 0
jbe 0x1000153f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x1000215c
call fcn.100010a6
test eax, eax
jge 0x10001560
mov byte [0x10003038], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10001127
add ebp, 0x78
leave
ret
Function at 0x10001100
Capabilities:
Hash data using crc32b

Disassembly:
push 0x400
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001120
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000112c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001136
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001140
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000114a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001154
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000115e
or eax, 2
test cl, 2
je 0x10001166
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001220
test al, 1
je 0x1000122d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001220
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001114
pop edi
pop ebx
ret

Function at 0x10001250
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x1000501c]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x40c]
push ebx
push esi
push 0x100041a8
push eax
or esi, 0xffffffff
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebx, eax
add esp, 8
mov dword [esp + 8], ebx
test ebx, ebx
jne 0x1000128e
or eax, 0xffffffff
jmp 0x100012e3
push ebp
nop
push ebx
push 0x400
lea eax, [esp + 0x18]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
mov ecx, eax
lea edx, [esp + 0x10]
test eax, eax
je 0x100012cd
movzx ebp, byte [edx]
mov ebx, esi
and ebx, 0xff
xor ebx, ebp
shr esi, 8
xor esi, dword [edi + ebx*4]
dec ecx
inc edx
test ecx, ecx
jne 0x100012b0
mov ebx, dword [esp + 0xc]
cmp eax, 0x400
je 0x10001290
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov eax, esi
not eax
pop ebp
mov ecx, dword [esp + 0x40c]
pop esi
pop ebx
xor ecx, esp
call fcn.10002663
add esp, 0x408
ret 4