joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461d40
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x461f14
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040502c
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x461ef1
xor eax, eax
push ebp
push 0x461eea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.0040309c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x461ecc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x461eb6
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jns 0x461dec
call fcn.00403edc
test edi, edi
jl 0x461eb6
inc edi
xor ebx, ebx
cmp ebx, 0x400
jbe 0x461e04
call fcn.00403edc
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x400
jbe 0x461e27
call fcn.00403edc
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405794
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405794
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.00461cfc
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.00461c30
pop ecx
push dword [ebp - 0x28]
push 0x461f2c
mov eax, esi
mov edx, 4
call fcn.004053cc
inc ebx
dec edi
jne 0x461df7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461ed3
mov eax, dword [ebp - 0x14]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461f1b
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 8]
call fcn.0040502c
ret
Function at 0x46265c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
call fcn.00463854
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00462ec4
test al, al
jne 0x462712
xor eax, eax
mov dword [ebp - 4], eax
push 0x462744
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x462712
xor eax, eax
push ebp
push 0x46270b
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4626f4
xor eax, eax
push ebp
push 0x4626ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4626f4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462712
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp dword [ebp - 4], 0
je 0x46273b
push 0x462768
push 0x462784
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov ebx, esi
test esi, esi
je 0x46273b
mov eax, dword [ebp - 4]
push eax
call ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x462790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x184]
mov ecx, 0x5e
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x46288e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046265c
mov ebx, eax
push 0x4628a8
push esi
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x188]
call fcn.004286e8
push dword [ebp - 0x188]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004053cc
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x46286b
xor eax, eax
push ebp
push 0x462860
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x178
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462867
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462895
lea eax, [ebp - 0x188]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x4628b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x840], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x83c]
mov ecx, 0x20c
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x4629bb
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046265c
mov ebx, eax
push 0x4629d4
push esi
push 0x4629ec
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x840]
call fcn.004286e8
push dword [ebp - 0x840]
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x462998
xor eax, eax
push ebp
push 0x46298d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x830
lea eax, [ebp - 0x83c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462994
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4629c2
lea eax, [ebp - 0x840]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x462ec4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x462ee9
mov dword [ebp - 5], eax
mov byte [ebp - 1], 0
lea eax, [ebp - 5]
push eax
push 0x462e2c
call sub.user32.dll_EnumWindows
movzx edx, byte [ebp - 1]
mov eax, edx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4637d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], eax
push 0x80000001
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00439eec
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
test eax, eax
jns 0x463811
call fcn.00403edc
push eax
push 0x463750
call sub.user32.dll_EnumWindows
test eax, eax
je 0x463829
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x46383f
push 0
push ebx
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00439eec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4662ec
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x466318
call fcn.004662d4
test al, al
je 0x466309
mov dword [ebx], 1
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x46632c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax], 0
je 0x466342
xor edx, edx
mov dword [eax], edx
mov eax, 0x46634c
call fcn.004662e0
pop ebp
ret
Function at 0x467558
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46767a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.004050c4
cmp dword [ebp - 4], 0
je 0x4675bf
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4675a0
cmp eax, dword [edx - 4]
jb 0x4675a5
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x4675bf
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x46765f
xor eax, eax
push ebp
push 0x467658
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405308
test eax, eax
jns 0x46760e
call fcn.00403edc
push eax
mov eax, ebx
call fcn.0040550c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x467641
call fcn.0042df68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467664
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
call fcn.0042df68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467681
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x467710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46786a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x46774c
mov ecx, 0x40b
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
test edi, edi
jne 0x467764
mov ecx, 0x40c
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
mov edx, ebx
mov eax, 0x4678c8
call fcn.00405650
test eax, eax
je 0x467788
mov ecx, 0x40d
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
mov edx, ebx
mov eax, 0x4678d4
call fcn.00405650
test eax, eax
je 0x4677ac
mov ecx, 0x40e
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
cmp byte [0x66b53c], 0
je 0x4677e4
mov eax, dword [ebp - 4]
push eax
push esi
push dword [0x66b540]
push 0x4678c8
push ebx
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov edx, dword [ebp - 8]
mov ecx, edi
mov eax, 0x80000001
call fcn.00467158
jmp 0x46784f
mov eax, esi
mov edx, 0x2800
call fcn.00405794
mov eax, dword [0x66b540]
call fcn.0040550c
push eax
mov eax, dword [esi]
call fcn.00405308
test eax, eax
jns 0x46780b
call fcn.00403edc
push eax
mov eax, dword [esi]
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, edi
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, eax
mov eax, esi
call fcn.00405794
lea edx, [ebp - 0xc]
mov eax, dword [esi]
call fcn.00466f0c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467871
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret
Function at 0x469828
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x469a1f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x469887
lea edx, [ebp - 0x28]
mov eax, dword [0x565d20]
call fcn.0040765c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0041f64c
mov eax, dword [ebp - 0x24]
mov ecx, 0x9e8
mov edx, 0x469a38
call fcn.00404f58
mov byte [ebp - 0x11], 1
mov dl, 1
mov eax, dword [0x4392e0]
call fcn.00403fdc
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4699b5
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00469278
push dword [ebp - 4]
push 0x469a60
push 0x469a6c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004053cc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x3f
call fcn.00469424
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x46999f
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push 0x469a60
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x46994a
test al, 0x10
je 0x46994a
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00469828
mov ebx, eax
jmp 0x469985
cmp dword [ebp - 0x10], 0
je 0x46995a
mov edx, eax
mov eax, dword [ebp - 8]
call dword [ebp - 0x10]
mov ebx, eax
test bl, bl
je 0x469985
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x469985
mov eax, dword [ebp - 8]
call fcn.00428db8
mov ebx, eax
test bl, bl
jne 0x469993
mov byte [ebp - 0x11], 0
cmp byte [ebp - 9], 0
jne 0x46999f
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x4698f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4699bc
lea eax, [ebp - 0x18]
call fcn.0042e4f8
ret
Function at 0x469b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x469b88
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x469ce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.00469b08
cmp dword [ebp - 4], 0
jne 0x469bcd
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004035a4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00428eec
test esi, esi
jne 0x469c74
lea eax, [ebp - 0x18]
push eax
call fcn.00427b24
lea edx, [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0045c054
movzx eax, byte [0x469cf0]
push eax
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x469cfc
mov eax, dword [ebp - 8]
call fcn.00446564
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469d00]
push eax
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 0x469d0c
mov eax, dword [ebp - 8]
call fcn.00446564
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469d00]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x469d18
mov eax, dword [ebp - 8]
call fcn.00446564
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004050c4
push dword [ebp - 4]
push dword [ebp - 8]
push 0x469d24
mov eax, ebx
mov edx, 3
call fcn.004053cc
jmp 0x469cb8
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x469cb8
lea eax, [ebp - 8]
call fcn.004680dc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469ce7
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x46ad34
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test edi, edi
jbe 0x46aeac
mov ebx, eax
mov eax, edi
mov esi, 3
xor edx, edx
div esi
mov esi, eax
test esi, esi
jns 0x46ad59
call fcn.00403edc
test esi, esi
jle 0x46aded
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ad88
call fcn.00403edc
movzx edx, byte [edx + 0x56034c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ada3
call fcn.00403edc
movzx edx, byte [edx + 0x56034c]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46adbf
call fcn.00403edc
movzx edx, byte [edx + 0x56034c]
mov byte [ecx + 2], dl
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46add6
call fcn.00403edc
movzx eax, byte [eax + 0x56034c]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x46ad61
mov eax, edi
mov esi, 3
xor edx, edx
div esi
dec edx
je 0x46ae03
dec edx
je 0x46ae48
jmp 0x46aeac
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae1b
call fcn.00403edc
movzx edx, byte [edx + 0x56034c]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46ae34
call fcn.00403edc
movzx eax, byte [eax + 0x56034c]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x46aeac
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae69
call fcn.00403edc
movzx edx, byte [edx + 0x56034c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae84
call fcn.00403edc
movzx edx, byte [edx + 0x56034c]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46ae9e
call fcn.00403edc
movzx eax, byte [eax + 0x56034c]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebx
ret
Function at 0x46fd90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46fd99
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ffc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040502c
mov eax, edi
call fcn.0040502c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.0044611c
test al, al
je 0x46ffa1
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x46ffa1
mov eax, esi
call fcn.0040309c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x46ff9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
push esi
push 0
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46ff84
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x46ffd4
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46fece
push 0x46fff8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00428710
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00428710
push dword [ebp - 0x24]
push 0x470014
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46fece
cmp dword [ebp - 0x10], 1
jbe 0x46fece
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00429298
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0040511c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x470028
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46ff84
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.00408754
mov ebx, eax
mov eax, dword [ebp - 0x1c]
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.00408754
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.004285fc
push dword [ebp - 0x28]
push 0x470034
lea edx, [ebp - 0x2c]
movzx eax, si
call fcn.004285fc
push dword [ebp - 0x2c]
push 0x470034
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x12]
call fcn.004285fc
push dword [ebp - 0x30]
push 0x470034
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x14]
call fcn.004285fc
push dword [ebp - 0x34]
mov eax, edi
mov edx, 7
call fcn.004053cc
mov eax, dword [edi]
mov edx, 0x470040
call fcn.00405458
jne 0x46ff84
mov eax, edi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ffa1
mov eax, dword [ebp - 0x18]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ffcb
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x470220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, ebx
call fcn.0046fce8
test al, al
je 0x470275
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x470275
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov dword [edi], eax
push esi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x470275
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x492264
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x49226a
ret
Function at 0x4a12b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x561ea4
test edx, edx
jne 0x4a12cf
xor eax, eax
jmp 0x4a13ed
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4a12ec
push esi
push edx
push eax
call fcn.004a13f4
add esp, 0xc
jmp 0x4a13ed
push esi
push edx
push eax
call fcn.004a16b4
add esp, 0xc
jmp 0x4a13ed
pop esi
pop ebx
pop ecx
pop ebp
ret