joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476f2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
jo 0x47714f
mov dword [esp + 0x1c], esp
jmp 0x477153
mov dword [esp + 0x1c], esp
call fcn.00476f82
mov ah, bl
jmp 0x4771f1

Function at 0x476f62
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x477085
lea esp, [esp + 0x14]
pushfd
jmp 0x476f72
push 0xf046844c
jmp 0x476fef
mov dl, dh
jmp 0x47700d
mov dl, dh
cmc
sub esp, 0xc
jmp 0x477011
bts cx, di
jl 0x476fd0
jge 0x476fd8
rdtsc
bsf edi, ebx
jge 0x47705a
mov si, word [esp]
jmp 0x47705e
cmc
sub esp, 0xc
mov ebp, dword [esp + 0x38]
jmp 0x476ff7
lea esi, [esp + 0xc]
bsf cx, bx
jns 0x477060
bts ax, ax
jmp 0x47706f
mov si, word [esp]
jmp 0x477044
bts ax, ax
mov cx, 0xd791
jmp 0x4770d9
mov cx, 0xd791
jmp 0x4770d9
mov eax, edx
sub esp, 0xb4
mov edi, esp
mov bl, bh
setp ah
jmp 0x4770ae

Function at 0x477255
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], ebx
call fcn.00476f2c
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
jmp 0x476f67
pop word [esp]
lea esp, [esp + 2]
jmp 0x476f43

Function at 0x478a2b
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov cl, 0x77
mov word [esp], cx
jmp 0x478c26
bswap ecx
pushal
bsr ax, cx
jmp 0x478bc2
jle 0x478bb6
bswap ecx
rcl dl, 5
jmp 0x478b0f
bswap ecx
lea esp, [esp + 4]
inc ebp
setg al
xchg dl, cl
cmc
jmp 0x478b7f

Function at 0x4792d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
invalid
xchg dx, ax
call fcn.00479338
out dx, eax
outsd dx, dword [esi]
call [edx - 0x7ff84c97]
push ss
jno 0x479253
aas
mov ebp, 0x72f51f8c
cmc
jb 0x4792a2
jae 0x4792a2
lea esp, [esp + 2]
lea esp, [esp + 0xc]
neg cl
xchg dl, dh
jmp 0x4793c0
lea eax, [ecx + edx]
cmp eax, 0x8d07e639
sub esp, 0xb
jmp 0x47942b
mov eax, dword [esp]
push edi
jmp 0x479393
btc edx, esi
ja 0x4793a9
mov eax, dword [esp]
push edi
lea eax, [ecx + edx]
cmp eax, 0x8d07e639
sub esp, 0xb
jmp 0x47942b
dec dx
lea edx, [ebp*4]
bswap edx
xor eax, edi
pushfd
call fcn.00479482
cdq
clc
invalid
not ax
dec dx
jnp 0x4793d6
dec dx
jmp 0x479411
pushfd
jmp 0x4794cc
lea edx, [ebp*4]
bswap edx
xor eax, edi
jmp 0x4793f7
mov dl, dh
mov ax, 0x659e
lea esp, [esp + 3]
lea esp, [esp + 0xc]
add cl, 0xd3
jmp 0x4793ec
mov ax, dx
lea esp, [esp + 4]
not cl
mov ax, 0x941f
call fcn.004794b5
adc al, 0x87

Function at 0x479302
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4791d4
mov al, 0xd4
mov dx, cx
call fcn.00479361
fst qword [esi - 0x3c]
mov dword [reloc.KERNEL32.dll_GetProcAddress], eax
stc
fdivr dword [ebx]
adc cl, byte [ebp - 0x78fddb9c]
je 0x479348
xor al, 0x8d
xchg ebx, eax
mov word [0x1ba10c0], cs
jmp 0x479383
and al, 0xeb
ror byte [edi], cl
retf 0x828d
add byte [eax], al
add byte [edx + 0x23b82434], cl
shl byte [esi - 0x12], 1
Function at 0x4794e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 1], ax
mov dx, cx
lea edx, [ecx + 0xd9]
setg al
xchg dword [esp + 4], eax
jmp 0x4795f3
lea edx, [ecx - 0xe8]
call 0x479591
mov dword [esi], eax
bsr edx, esi
js 0x479618
bswap edx
neg cx
jmp 0x47965c
neg cl
jmp 0x4795fe
bswap edx
jmp 0x479620
neg cx
call fcn.0047a55a
or al, 0x8e
sbb al, 0x7b
xchg esi, eax
push edi
sahf
and esi, dword [ebx - reloc.KERNEL32.dll_GetProcAddress]
adc dword [eax + reloc.KERNEL32.dll_GetProcAddress], edx
pushfd
dec cx
js 0x479614
neg cl
jmp 0x4795fe

Function at 0x4796dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, al
setns al
lea edi, [edi + 0xbb]
mov dh, byte [esp]
mov eax, 0xee66d023
call fcn.00479186
lea eax, [edi - 0x9d]
xchg dword [esp + 4], edi
inc dx
jmp 0x47937b

Function at 0x47a225
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ecx
sub esp, 0x1f
add esp, 8
mov ah, 0x43
mov eax, dword [esp + 7]
jmp 0x47a25f
mov dx, 0x5aeb
setne dl
bsr edx, esi
rdtsc
stc
jmp 0x47a20f
sub esp, 0x11
mov dh, byte [esp + 0xc]
lea esp, [esp + 1]
xchg dword [esp + 0x28], ecx
jmp 0x47a7e5
mov byte [esp + 0x13], bl
lea esp, [esp + 3]
lea ecx, [ecx + 1]
rdtsc
mov dh, byte [esp]
push esi
jmp 0x47a249
sub esp, 6
xchg dx, ax
mov eax, dword [esp + 5]
mov al, 0x7f
lea esp, [esp + 2]
push dword [esp + 0x2c]
ret 0x30

Function at 0x47b09c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x47b0d8
push word [esp + 1]
jle 0x47b0c2
mov word [esp + 2], ax
mov word [esp + 2], bx
jmp 0x47b0fa
mov word [esp + 3], ax
lea esp, [esp + 2]
mov dword [esp], edi
jmp 0x47b11c

Function at 0x49d2af
Capabilities:
Encrypt data using speck

Disassembly:
call 0x49d35f
mov dword [reloc.KERNEL32.dll_GetProcAddress], eax
pushal
inc edi
mov dword [esp + 0x18], eax
popal
call fcn.0049d2cc
add eax, 0x90610690
push edx
xchg ebp, eax
or eax, 0xa417e49d
sbb al, 0x6f
jbe 0x49d30e
mov al, byte [0x24648de3]
add al, 0x57
lea esp, [esp + 4]
push edi
jmp 0x49d291
lea esp, [esp + 0x44]
cmp dword [ebp + 0xc], 2
jmp 0x49d32b
and ecx, edx
and esi, edx
pushal
jmp 0x49d2f8
jb 0x469398
mov di, 0xc28b
call fcn.0049d315
mov edi, eax
shr edi, 6
pushal
jmp 0x49d375
and edi, edx
lea esp, [esp + 0x24]
jmp 0x469382

Function at 0x49d2cc
Capabilities:
Encrypt data using speck

Disassembly:
xchg dword [esp], edx
jmp 0x49d2d7
bts dx, bx
mov esi, 0xe5a53e89
jmp 0x49d2b6
lea esp, [esp + 4]
push 0x3f
mov dx, si
bswap edx
push esi
jmp 0x49d794
stc
shr esi, 0xc
pushal
cmc
push dword [esp + 0x17]
jmp 0x49d30e
shr ecx, 0x12
mov dx, 0x1e38
lea esp, [esp + 4]
pop edx
jmp 0x49d353
mov esi, eax
bswap edx
or edx, edx
mov dl, 0x58
setno dh
jmp 0x49d39e

Function at 0x49d380
Capabilities:
Encrypt data using speck

Disassembly:
push eax
jmp 0x49d387
mov eax, ebp
jmp 0x49d5ef
lea eax, [eax + 0xc]
mov edi, dword [eax]
pop eax
lea esp, [esp + 8]
jmp 0x469382
Function at 0x49e427
Capabilities:
Encode data using base64

Disassembly:
call 0x49e65d
call 0x249d0945
add ah, bl
inc esi
invalid
cmp ecx, 0x34
jmp 0x49e587
jmp 0x49e571
xor ebx, ebx
jmp 0x49e5bd
call 0x2fec3f6
adc byte [esi], 0x71
add byte [ecx - 0x44], 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
invalid
movzx edx, bl
call fcn.0049d941
nop
sbb ecx, dword [ebx - 0x953e212]
jl 0x49d936
jne 0x49d8aa
inc ecx
leave
push 0xe82ffb80
test byte [edx], 0
add byte [edx + 0x9fa9f0f], al
mov eax, dword [reloc.KERNEL32.dll_GetProcAddress]
jmp 0x49d913
lea esp, [esp + 4]
jne 0x49d93f
call fcn.0049e2d0
lea esp, [esp + 0x20]
push 0x3f
mov dx, word [esp]
xchg bx, dx
jmp 0x49e45c
pop ebx
jmp 0x49e4a2
mov edx, eax
lea esi, [esi*4]
bts esi, edi
pushal
call fcn.0049e487
push word [esp + 6]
lea esp, [esp + 3]
jmp 0x49e503
shr edx, 0xc
stc
jmp 0x49e538
shr ecx, 0x12
jmp 0x49e4ed
shr esi, 6
and ecx, ebx
and edx, ebx
call fcn.0049e522
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
and esi, ebx
stc
jmp 0x49e8c4
cmp ecx, 0x3e
jmp 0x49e5de
jae 0x4696aa
mov ebx, 0x8d8a5a5a
lea ebx, [ecx + 0x47]
jmp 0x46967e
lea ebx, [ecx + 0x41]
jmp 0x46967e
lea ebx, [ecx - 4]
jmp 0x46967e
cmp ecx, 0x3e
setne bl
call fcn.0049e605
lea esp, [esp + 8]
jmp 0x49e5ef
jae 0x469703
push di
xchg byte [esp], bh
lea esp, [esp + 2]
jmp 0x49e5b5
lea ebx, [ebx*4 + 0x2b]
jmp 0x46967e
cmp ecx, 0x1a
jae 0x469694
lea ebx, reloc.KERNEL32.dll_GetProcAddress
mov bx, ax
jmp 0x49e5ad
cmc
cmc
and eax, ebx
lea esp, [esp + 8]
jmp 0x49e6e4

Function at 0x5179e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
pushal
lea esi, [ecx + edi]
mov ebx, eax
mov edi, 0x18b85fd4
jmp 0x5179f1
push sp
lea esp, [esp + 2]
mov dword [esp], eax
jmp 0x5179d0
mov dl, 0xf2
lea eax, reloc.KERNEL32.dll_GetProcAddress
bts ebx, ebp
mov edx, dword [esp]
btc di, bp
mov bh, byte [esp]
jmp 0x517aba
neg si
stc
lea eax, [ecx + esi]
lea edx, [edx + esi]
sub esp, 2
rcl edx, cl
jmp 0x517a86
xchg edi, ebx
mov ebx, 0x618a6fa4
bswap esi
dec edx
mov cx, dx
mov eax, dword [esp]
jmp 0x517a21
lea eax, [edi*4]
bswap edi
mov edi, dword [esp]
btc bx, bx
mov ebp, 0xde68ff3d
mov bh, bl
jmp 0x517a37
dec cl
xchg byte [esp], dl
lea esp, [esp + 1]
neg ax
rdtsc
jmp 0x517a9a
sub cl, ch
not di
mov ecx, 0x9c9ac206
xchg al, ah
bsf si, cx
bswap ebx
jmp 0x517a70
lea edx, [esi*4]
xchg bx, bp
lea ebx, [ecx + ebp]
std
mov byte [esp], dl
lea eax, [ebp + ebp]
jmp 0x517aee
xchg ch, al
xchg cx, si
lea ebp, [edi - 0x87]
mov dl, byte [esp]
rdtsc
setnp dl
jmp 0x517a57
lea esi, [ebp*4]
xchg edi, ebx
or ax, cx
mov bx, di
call fcn.00517b95
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.KERNEL32.dll_GetProcAddress]
add byte [ebx - 0x76], 0x1c
and al, 0xc0
rol byte [esi], cl
mov bl, byte [esp]
rcl dl, 6
push di
lea ebx, [eax + edi]
lea ecx, [eax + eax]
cmp ah, bl
jmp 0x517acf
Function at 0x517b95
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, ax
mov ebx, 0x7ed89154
mov ch, byte [esp]
setno dh
std
jmp 0x517b61
btc dx, bp
rcl ax, 0
mov eax, dword [esp]
btc edx, esp
bswap ebx
std
jmp 0x517b00
cpuid
mov byte [esp], ch
mov byte [esp], al
rcr cl, cl
mov ebp, 0x7830647d
mov edx, dword [esp]
jmp 0x517b16
mov ax, sp
push word [esp + 3]
bswap esi
mov dx, ax
jmp 0x517b7c
mov esi, 0x6f7eeb1f
lea eax, reloc.KERNEL32.dll_GetProcAddress
mov al, byte [esp]
mov cx, word [esp]
sub esp, 0xd
lea esp, [esp + 8]
jmp 0x517b4b
lea esi, [ecx*4]
mov bh, 0x7f
mov bh, dl
mov edx, dword [esp + 4]
clc
mov ebx, edx
jmp 0x517bb2
add esp, 4
pop cx
jmp 0x517b37
xchg esi, eax
sete ah
xchg ch, dh
clc
lea esp, [esp + 6]
neg esi
jmp 0x517bdd
neg ah
mov dword [esp], edx
mov word [esp + 5], ax
mov ebx, 0x43bb11ea
rdtsc
xchg al, ch
jmp 0x517b9c
bswap eax
std
push cx
add esp, 1
mov eax, dword [esp]
mov edx, dword [esp]
jmp 0x517fb1
stc
pop bx
mov cx, word [esp]
xchg ebx, ecx
not cx
lea esi, [ebx*4]
jmp 0x517bc7
cmp di, dx
setge ah
mov dh, byte [esp]
sub esp, 0x14
lea ebp, [ecx + ebp]
jmp 0x517c45
mov edx, 0x6780be63
mov di, bx
btc ax, ax
lea eax, reloc.KERNEL32.dll_GetProcAddress
cpuid
mov bh, ch
jmp 0x517c17
mov ch, dh
neg al
bswap eax
sub esp, 0x1a
mov di, word [esp + 0x12]
pop word [esp + 0xc]
jmp 0x517ca4
pushfd
adc eax, eax
lea esp, [esp + 0x13]
setl bl
mov bp, word [esp + 0xf]
jmp 0x517c8c
rdtsc
lea edx, reloc.KERNEL32.dll_GetProcAddress
rdtsc
lea ebp, [ecx*4]
mov esi, 0xc3d7b502
mov esi, ebx
jmp 0x517c2d
push dword [esp + 0x14]
pop di
call fcn.00517cd5
dec ebp
fisttp qword [ebp + 0x14]
out 7, eax
mov ebp, 0x36dbbc2e
fistp qword [edi + 0x66d88b59]
pop dword [esp + 0xf]
pop ecx
mov ebx, eax
pop word [esp + 0xf]
bswap ebp
neg bl
mov byte [esp + 0x1d], bh
jmp 0x517c5a
cld
cld
neg bp
add esp, 0
rcl di, 5
xchg ebx, edx
jmp 0x517c71
cmp bx, 0xc0e3
mov ah, byte [esp]
rdtsc
mov eax, 0x5d861363
cpuid
rdtsc
jmp 0x517d06
sbb esi, 0x741bcaf6
mov ebp, dword [esp]
not esi
add esp, 0
mov si, 0x42d1
rcl bl, cl
jmp 0x517e89
Function at 0x51825e
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, ecx
push dword [esp + 2]
not bh
lea esp, [esp + 3]
mov word [esp + 0xc], dx
jmp 0x518410
mov ecx, esp
neg bl
shr edx, 0
and cx, 0x738a
pop word [esp + 5]
mov edi, dword [esp + 0xe]
rdtsc
lea ebx, reloc.KERNEL32.dll_GetProcAddress
mov ebx, edx
push dword [esp + 0x1a]
sub esp, 0xf
xchg word [esp + 0x13], si
jmp 0x518331

Function at 0x51864b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 2]
cld
push dx
pushal
std
xchg dword [esp + 2], esi
jmp 0x51861a
mov bx, word [esp + 3]
mov dword [esp], esi
lea ebp, [ecx*4]
lea esp, [esp + 9]
bts ax, ax
lea esp, [esp + 1]
jmp 0x5185b0
rdtsc
mov dword [esp + 1], eax
not cx
mov dl, bl
pop di
mov byte [esp + 0x10], bl
jmp 0x5185c6
bswap ebp
mov bx, bp
sub bl, dl
xchg byte [esp + 7], dl
inc esi
jmp 0x518627
mov ah, 0xdf
pop esi
push esp
popal
mov bl, byte [esp + 1]
mov eax, esp
jmp 0x518604
lea esi, [ecx*4]
mov dword [esp + 8], eax
lea esi, [ebx*4]
mov cl, byte [esp + 9]
lea ebx, [eax + eax]
lea esp, [esp + 3]
jmp 0x51866a
xchg dword [esp + 0xc], edx
bsr ebx, edi
jmp 0x5185f1
xchg byte [esp + 1], bh
mov edi, dword [esp]
setnp ah
mov cx, dx
jmp 0x519388
pop dword [esp]
mov bx, ax
pop esi
setp bl
mov al, dl
xchg ebx, edi
jmp 0x518654
stc
call fcn.005186a0
bts di, ax
mov dx, 0x103f
mov dh, 0x2e
mov ebp, 0x6bf83a6f
jmp 0x518720
mov bx, dx
ror dh, cl
mov ah, byte [esp + 1]
call fcn.0051870a
xchg si, ax
lea esp, [esp + 0x23]
mov si, di
mov bl, 4
xchg dword [esp + 3], ebp
jmp 0x51875e
mov cx, dx
mov al, ah
ror edi, cl
mov dx, word [esp + 3]
mov dl, 2
pushal
jmp 0x5187bc
inc edx
lea esi, [ecx + ebp]
add esp, 2
mov di, si
clc
xchg edi, ecx
jmp 0x51879e
mov word [esp], sp
cpuid
setbe dh
rdtsc
pushal
pop dword [esp + 0xd]
jmp 0x5187cf
add esp, 0x22
not si
xchg dword [esp], eax
cmp dl, bh
mov edx, dword [esp + 1]
pop si
jmp 0x51876f
stc
lea eax, [edi*4]
xchg si, ax
push ax
pop dword [esp + 2]
mov edi, esi
jmp 0x51882c
bsf bx, bx
inc bh
mov cx, word [esp + 2]
xchg byte [esp + 0x11], cl
jmp 0x518868
mov dword [esp], eax
sub esp, 0xc
mov byte [esp + 0xc], dl
bswap esi
sete bl
mov ebp, dword [esp + 0xf]
jmp 0x5187fc
mov ch, byte [esp + 0xb]
mov ax, si
mov al, dl
lea ebp, [eax*4]
lea esp, [esp + 0x16]
bswap eax
jmp 0x518812
pop dx
pop dword [esp + 4]
lea ebx, reloc.KERNEL32.dll_GetProcAddress
xchg dword [esp + 5], ebp
lea esi, [esp + eax]
xchg byte [esp + 5], ch
jmp 0x5188db
lea ebx, [edx + ebx]
push dword [esp + 8]
sub esp, 2
xchg word [esp + 2], bp
call fcn.005188ae
bswap esi
cmc
popal
lea edx, [ebx + edi]
xchg edi, ebx
xchg dx, si
jmp 0x518b16
sub esp, 4
bswap edi
rdtsc
pop esi
cpuid
mov word [esp + 0x1c], bx
jmp 0x5186bf
setns al
cpuid
mov ebp, 0x7fc76808
setl bl
xchg edx, ebx
mov si, 0x52f6
mov ebp, ecx
pushal
jmp 0x518925
Function at 0x51a090
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
push word [esp + 2]
jmp 0x51a0d3
mov dx, 0x487d
pop eax
mov al, byte [esp + 1]
push dword [esp + 6]
jmp 0x51a106
push dword [esp + 2]
mov si, 0xbaf9
push word [esp + 9]
lea esi, reloc.KERNEL32.dll_GetProcAddress
mov word [esp + 1], dx
xchg si, ax
jmp 0x51a0bd
setae al
lea esp, [esp]
pop edx
lea eax, [esp + edi]
std
sub esp, 0xc
jmp 0x51a163
push dword [esp + 5]
add esp, 0xe
push si
mov dl, byte [esp + 3]
neg ax
push word [esp]
jmp 0x51a0f0
push dword [esp + 5]
sub esp, 0xa
bsr esi, esp
pop dword [esp + 7]
pop word [esp + 0xb]
xchg dx, si
jmp 0x51a191
pop word [esp + 7]
xchg byte [esp + 8], dl
mov word [esp + 4], bx
mov al, dh
mov dh, ch
mov dl, byte [esp + 5]
jmp 0x51a145
lea edx, [edi + 0x10]
std
lea edx, [edi*4]
mov word [esp], si
jmp 0x51a1c5
lea esi, [edx*4]
xchg dword [esp + 3], eax
pop word [esp + 3]
pop word [esp + 0xc]
mov dh, 0x42
mov dx, word [esp + 0xe]
jmp 0x51a17b
lea esp, [esp + 0xf]
mov ah, dl
mov esi, edx
mov byte [esp + 1], bh
bswap esi
jmp 0x51a59c
rdtsc
mov dh, 0xb1
pushfd
add esp, 1
mov eax, 0x6f58716a
mov word [esp + 1], sp
jmp 0x51a1af
lea esp, [esp + 2]
lea eax, [esp + edi]
not esi
rdtsc
btr si, bx
xchg dl, dh
jmp 0x51a1f8
rdtsc
mov al, dh
mov dh, bl
mov esi, ebp
std
mov eax, dword [esp]
jmp 0x51a20e
mov byte [esp + 2], dl
rdtsc
push dword [esp + 1]
mov byte [esp + 3], bl
mov eax, ebx
xchg esi, edx
jmp 0x51a27e

Function at 0x51a221
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, edi
neg eax
jmp 0x51a22b
lea edx, [edi*4]
lea eax, reloc.KERNEL32.dll_GetProcAddress
add esp, 0
push word [esp]
jmp 0x51a25b

Function at 0x51a7e4
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
pushal
pop dword [esp + 0xf]
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
jmp 0x51a806
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x51ae5c
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x51a06a
Function at 0x4012f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push edi
je 0x401397
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401397
push esi
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CryptCATAdminAcquireContext
push esi
call edi
push str.CryptCATAdminReleaseContext
push esi
mov dword [0x420b10], eax
call edi
push str.CryptCATAdminCalcHashFromFileHandle
push esi
mov dword [0x420b14], eax
call edi
push str.CryptCATAdminEnumCatalogFromHash
push esi
mov dword [0x420b18], eax
call edi
push str.CryptCATCatalogInfoFromContext
push esi
mov dword [0x420b24], eax
call edi
push str.CryptCATAdminReleaseCatalogContext
push esi
mov dword [0x420b1c], eax
call edi
push str.WinVerifyTrust
push esi
mov dword [0x420b20], eax
call edi
push ebx
mov dword [0x420b28], eax
call fcn.00401040
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop esi
pop edi
pop ebx
ret
pop edi
mov eax, 1
pop ebx
ret

Function at 0x4013a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4029f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x13c
lea eax, [esp]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xa]
mov eax, dword [esp + 8]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x24]
push str._d__d__d
push ecx
call fcn.00404297
add esp, 0x14
lea edx, [esp + 0x40]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x40]
push 0x5c
push eax
call fcn.00404270
add esp, 8
test eax, eax
jne 0x402a63
pop esi
pop ebx
add esp, 0x13c
ret
push edi
lea ecx, [esp + 0x44]
push 0x5c
push ecx
call fcn.00404270
mov byte [eax], 0
mov edi, str.date.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x44]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push 0x14
push ecx
push 0
push str.date
push str.check
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
pop edi
je 0x402b09
lea esi, [esp + 0x2c]
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402af7
test cl, cl
je 0x402af3
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402af7
add eax, 2
add esi, 2
test cl, cl
jne 0x402acf
xor eax, eax
jmp 0x402afc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402b09
pop esi
pop ebx
add esp, 0x13c
ret
lea eax, [esp + 0x40]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.date
push str.check
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop esi
mov eax, 1
pop ebx
add esp, 0x13c
ret
Function at 0x403200
Capabilities:
Access peb ldr_data
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4170df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x41d52c]
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], eax
push 0x420b2c
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call fcn.0040fb03
mov ebp, dword [esp + 0x34]
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jbe 0x40330e
lea ecx, [esi + 1]
push edi
push ecx
call fcn.0040f74b
add esp, 4
mov edi, eax
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403304
push 0x400
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], ebx
call fcn.0040f74b
add esp, 4
mov esi, eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4032fb
mov eax, dword [esp + 0x1c]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xCompanyName
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4032fb
cmp dword [esp + 0x38], ebx
jbe 0x4032fb
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push 0x41d4b8
push eax
call fcn.0040f1fa
add esp, 0xc
push esi
call fcn.0040f774
add esp, 4
push edi
call fcn.0040f774
add esp, 4
pop edi
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0040f77f
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0040fa0a
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x403350
Capabilities:
Access peb ldr_data
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x41710f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x41d52c]
push ebx
xor ebx, ebx
push ebp
push esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], eax
push 0x420b2c
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call fcn.0040fb03
mov ebp, dword [esp + 0x34]
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jbe 0x40345e
lea ecx, [esi + 1]
push edi
push ecx
call fcn.0040f74b
add esp, 4
mov edi, eax
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403454
push 0x400
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], ebx
call fcn.0040f74b
add esp, 4
mov esi, eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40344b
mov eax, dword [esp + 0x1c]
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileVersion
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40344b
cmp dword [esp + 0x38], ebx
jbe 0x40344b
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push 0x41d4b8
push eax
call fcn.0040f1fa
add esp, 0xc
push esi
call fcn.0040f774
add esp, 4
push edi
call fcn.0040f774
add esp, 4
pop edi
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0040f77f
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.0040fa0a
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x414d2a
Capabilities:
Create http request

Disassembly:
mov eax, 0x417228
call fcn.00404c74
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x414d62
call fcn.004166ce
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x414d87
push eax
push dword [esi + 4]
call fcn.00415c4a
jmp 0x414d93
push esi
push eax
mov ecx, 0x420d10
call fcn.00414da4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x4150bc
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x41729b
call fcn.00404c74
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00410c3c
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x41d52c]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0040fb03
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0040fb03
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18