joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6cd0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x83c160
push 1
push 0
push 0x83c150
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4a6cfe
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0x83c200
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x4a6d32
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8

Function at 0x4ade00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x537bb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.004ae1d0
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.004ae1d0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.004ae240
lea ecx, [esp + 0x10]
call fcn.0046bdd0
cmp eax, 1
jae 0x4adea8
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x4adf13
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4adf13
push esi
push edi
call ebx
push esi
lea ecx, [esp + 0x14]
call fcn.004ae240
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x10]
call fcn.0046bdd0
cmp eax, 1
jb 0x4adf13
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.004adca0
test eax, eax
je 0x4adf13
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.004adf80
mov edi, dword [esp + 0x44]
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.004ae2a0
push edi
lea ecx, [esp + 0x24]
call fcn.004ae2c0
push esi
lea ecx, [esp + 0x24]
call fcn.004ae360
push str..tmp
lea ecx, [esp + 0x24]
call fcn.004ae2c0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.004adc80
test eax, eax
je 0x4adf49
inc esi
cmp esi, 0x7a0a1f00
jb 0x4adeca
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004ae1f0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004ae1f0
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.004ae2a0
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004ae1f0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004ae1f0
mov eax, 1
jmp 0x4adf34
Function at 0x4ae6d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x537c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.004ae1d0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.004ae240
push 0
mov ecx, esi
call fcn.004ae650
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x4ae808
lea ecx, [esp + 0xc]
call fcn.0046bdd0
cmp eax, 1
jae 0x4ae757
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004ae1f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x34]
lea edi, [esi + 0xc]
test eax, eax
jne 0x4ae7a4
push 0
lea ecx, [esp + 0x10]
call fcn.0046d9e0
push eax
push edi
mov ecx, 0x889f24
call fcn.004ade00
test eax, eax
jne 0x4ae7ac
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004ae1f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push eax
mov ecx, edi
call fcn.004ae240
push edi
mov ecx, 0x889f24
call fcn.004add60
push 0
push 2
push 2
push 0
push 3
push 0xc0000000
mov ecx, edi
call fcn.0046d9d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4ae808
push 0
push ebx
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x4ae808
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x4ae838
push 1
mov ecx, esi
call fcn.004ae650
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004ae1f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.004ae1f0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x4af170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004ae240
pop edi
add esp, 0x104
ret 4
Function at 0x4af9d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4afa19
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4afe90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x537ec0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004afa40
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004afac0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004afac0
lea ecx, [esi + 0xc]
call fcn.00529158
lea ecx, [esi + 0x10]
call fcn.00529158
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004b1050
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004b1050
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004b1050
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005291cd
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005291cd
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b1240
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4b12a6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4b12a6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4b1287
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4b4150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x896190]
xor edx, edx
cmp eax, edx
jne 0x4b4176
xor eax, eax
mov byte [eax + 0x896090], al
inc eax
cmp eax, 0x100
jl 0x4b415e
mov dword [0x896190], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x896090
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4b4207
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4b41da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4b41a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4b4210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4b4263
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4b424a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4babe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5382be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004bb500
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x825efc
call fcn.00528f0e
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4bac73
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00528f0e
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4bac6c
push 0
mov ecx, eax
call fcn.004b1d80
mov dword [esi + 0xc], eax
jmp 0x4bac75
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4bac75
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4c83e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4c8413
push esi
call fcn.004cd280
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4c840c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4c8499
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4c8482
mov eax, dword [esi + 8]
test eax, eax
je 0x4c8437
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4c847e
cmp eax, 2
je 0x4c8482
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4c842a
cmp eax, 3
je 0x4c845d
cmp eax, 1
jne 0x4c842a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4c842a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4c842a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004c84d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4c84b9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004c84d0
add esp, 4
pop esi
ret
Function at 0x4f8e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4f8e6b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4f8f6e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x827668]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x827668]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x827668]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x827668]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x827668]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x827668]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x827668]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x827668]
xor eax, edx
inc ecx
dec edi
jne 0x4f8e86
pop edi
test esi, esi
je 0x4f8f90
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x827668]
xor eax, edx
inc ecx
dec esi
jne 0x4f8f72
pop esi
pop ebx
not eax
ret

Function at 0x52b59b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x52b5d3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00529628
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00529600
jmp 0x52b5df
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x52cc92
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x52ccd4
call fcn.00532800
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x52ccd4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x52cccb
xor eax, eax
jmp 0x52ccdc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0052cce2
pop edi
pop esi
pop ebx
ret 4
Function at 0x532d30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x532d5e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x532d7c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00532c96
jmp 0x532d7c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x532d7c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00532c96
test edi, edi
mov eax, edi
jne 0x532d66
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0xfd7d912d
sub eax, 0xfd3d74c7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x85026b8e
sub dword [ebp - 0x50], 0x36b02643
mov dword [ebp - 0x4c], 0x6138879e
sub dword [ebp - 0x4c], 0x2f053b59
mov dword [ebp - 0x48], 0x756e2ba1
add dword [ebp - 0x48], 0xd6de188d
mov dword [ebp - 0x44], 0x794b5226
sub dword [ebp - 0x44], 0x794b5226
lea eax, [ebp - 0x50]
push eax
mov eax, 0x27e4f64e
add eax, 0xd85b3a06
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x1be8388a
sub dword [ebp - 0x50], 0xa775cf34
mov dword [ebp - 0x4c], 0x7185178
sub dword [ebp - 0x4c], 0xc5abf003
mov dword [ebp - 0x48], 0x5c360539
sub dword [ebp - 0x48], 0xf8c698cd
mov dword [ebp - 0x44], 0xd1033573
add dword [ebp - 0x44], 0x2efcca8d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34a46
push 0
call eax
mov ecx, 0x40a5
xor ebx, ebx
add ebx, eax
mov edi, 0x56b1aab
add edi, 0xfad55555
add edi, dword [ebp - 0x40]
mov edx, 0x3234a5d3
xor dword [ebp - 0x38], edi
mov esi, dword [edi]
add dword [ebp - 0x18], esi
xor esi, edx
xor dword [ebp - 0x18], 0x9f4d5efe
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x6cc765a8
add ebx, 4
add edi, 0x63796690
sub edi, 0x6379668c
loop 0x401d79
add eax, 0x5324f362
add eax, 0xacdc0205
xor ebx, ebx
add ebx, eax
add eax, 0xce94baf4
sub eax, 0xce94baef
mov ecx, 0x1366a512
sub ecx, 0x1326a512
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10014980
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10014980
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10014980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001498f
pop dword [ebp - 0x40]
mov eax, 0x6f6e2299
sub eax, 0x5f6cd90a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xe6f9c791
add dword [ebp - 0x50], 0x67587dba
mov dword [ebp - 0x4c], 0x64f6f822
add dword [ebp - 0x4c], 0xcd3c5423
mov dword [ebp - 0x48], 0x449325aa
add dword [ebp - 0x48], 0x7b91e84
mov dword [ebp - 0x44], 0x7f9615eb
sub dword [ebp - 0x44], 0x7f9615eb
lea eax, [ebp - 0x50]
push eax
mov eax, 0x38753ced
add eax, 0xd78d349f
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc63c14da
sub dword [ebp - 0x50], 0x51c9ab84
mov dword [ebp - 0x4c], 0xb8c21b25
sub dword [ebp - 0x4c], 0x7755b9b0
mov dword [ebp - 0x48], 0x6825266d
add dword [ebp - 0x48], 0xfb4a45ff
mov dword [ebp - 0x44], 0x49acd360
add dword [ebp - 0x44], 0xb6532ca0
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x98d84567
add eax, 0x772a2c19
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3ca6f
push 0
call eax
mov ecx, 0x72501e1c
sub ecx, 0x724fe5a1
mov esi, eax
mov edx, 0xa7e70d3f
sub edx, 0x97e3753f
add edx, dword [ebp - 0x40]
mov edi, 0xf71f6a42
sub dword [ebp - 0x10], 0xd1b3b1c3
mov ebx, dword [edx]
xor dword [ebp - 0x30], eax
xor ebx, edi
mov dword [esi], ebx
sub dword [ebp - 0x24], 0x1ec00673
add esi, 4
add edx, 4
loop 0x10014aab
add eax, 0x4503aa91
sub eax, 0x4502d5d2
mov ebx, eax
add eax, 0xc14fe779
add eax, 0x3eb0188c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret