joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef6dc
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
xor edi, edi
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.004ef630
test al, al
jne 0x4ef701
xor eax, eax
jmp 0x4ef78f
push 0x20
call fcn.004e0050
pop ecx
mov ebx, eax
push 0x202
call fcn.004e0050
pop ecx
mov esi, eax
test ebx, ebx
je 0x4ef777
test esi, esi
je 0x4ef777
mov dword [esp + 4], 0x10
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
mov dword [esp + 4], 0x100
lea edx, [esp + 4]
push edx
push esi
call sub.ADVAPI32.DLL_GetUserNameW
push esp
push 1
push esi
push ebx
call dword [0x51a644]
cmp dword [esp], 0
je 0x4ef777
mov ecx, dword [esp]
cmp dword [ecx + 0xc], 2
jne 0x4ef767
mov edi, 1
cmp dword [esp], 0
je 0x4ef777
mov eax, dword [esp]
push eax
call dword [0x51a638]
test ebx, ebx
je 0x4ef782
push ebx
call fcn.004e0060
pop ecx
test esi, esi
je 0x4ef78d
push esi
call fcn.004e0060
pop ecx
mov eax, edi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ef798
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x51a69c
push esi
push edi
cmp dword [ebx], 0
mov edi, str.userenv.dll
je 0x4ef7b4
mov eax, 1
jmp 0x4ef8d7
push edi
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [ebx], esi
test esi, esi
jne 0x4ef7c9
xor eax, eax
jmp 0x4ef8d7
lea edx, [edi + 0xc]
push edx
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6a4], eax
lea ecx, [edi + 0x1d]
push ecx
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6a0], eax
cmp dword [0x51a6a4], 0
je 0x4ef7fb
cmp dword [0x51a6a0], 0
jne 0x4ef802
xor eax, eax
jmp 0x4ef8d7
lea edx, [edi + 0x2e]
push edx
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
mov dword [0x51a6c0], esi
test esi, esi
jne 0x4ef821
xor eax, eax
jmp 0x4ef8d7
lea edx, [edi + 0x40]
push edx
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6ac], eax
lea eax, [edi + 0x59]
push eax
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6a8], eax
cmp dword [0x51a6ac], 0
je 0x4ef855
cmp dword [0x51a6a8], 0
jne 0x4ef859
xor eax, eax
jmp 0x4ef8d7
lea edx, [edi + 0x72]
push edx
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6b4], eax
lea eax, [edi + 0x88]
push eax
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6b0], eax
cmp dword [0x51a6b4], 0
je 0x4ef890
cmp dword [0x51a6b0], 0
jne 0x4ef894
xor eax, eax
jmp 0x4ef8d7
lea edx, [edi + 0x9e]
push edx
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6bc], eax
lea eax, [edi + 0xbb]
push eax
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x51a6b8], eax
cmp dword [0x51a6bc], 0
je 0x4ef8ce
cmp dword [0x51a6b8], 0
jne 0x4ef8d2
xor eax, eax
jmp 0x4ef8d7
mov eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x4efa18
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10e], eax
push 0x104
push ebx
push eax
call fcn.004f054c
add esp, 0xc
push 0x104
push ebx
push ebx
call sub.KERNEL32.DLL_GetLongPathNameA
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
lea eax, [ebx + 0x108]
push eax
call fcn.004f0a60
pop ecx
mov esi, eax
mov dword [ebx + 0x104], esi
cmp esi, 2
jne 0x4efa77
call fcn.004ef6dc
test eax, eax
setne al
and eax, 1
mov byte [ebx + 0x10d], al
mov eax, ebx
mov eax, dword [eax + 0x10e]
call fcn.0045a200
mov esi, eax
mov dword [ebx + 0x112], esi
cmp esi, dword [ebx + 0x10e]
jne 0x4efacc
mov eax, 0x409
call sym.PhantosysServerService.exe__Reinit_LoadNewResourceModule_qqrui
test eax, eax
je 0x4efac3
call sym.PhantosysServerService.exe__Reinit_ReinitializeForms_qqrv
mov eax, ebx
mov eax, dword [eax + 0x10e]
call fcn.0045a200
mov dword [ebx + 0x112], eax
mov byte [ebx + 0x10c], 1
jmp 0x4efad3
mov byte [ebx + 0x10c], 0
jmp 0x4efad3
mov byte [ebx + 0x10c], 1
call sub.KERNEL32.DLL_GetSystemDefaultLangID
mov word [ebx + 0x116], ax
mov al, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4f0588
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, esi
push 2
push 0x51a81c
lea eax, [ebx + 1]
push eax
call fcn.004e10b0
add esp, 0xc
test eax, eax
jne 0x4f05ac
add ebx, 3
cmp byte [ebx], 0
jne 0x4f05bb
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
jmp 0x4f05d4
movsx edx, byte [ebx]
cmp edx, 0x5c
jne 0x4f05d1
mov byte [ebx], 0
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
mov byte [ebx], 0x5c
inc ebx
jmp 0x4f05ac
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4f08b8
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
test ebx, ebx
jne 0x4f08dc
xor eax, eax
jmp 0x4f08f2
lea edx, [ebp - 0x1c]
push edx
push 1
push ebx
call sub.ADVAPI32.DLL_ControlService
mov esi, eax
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f3314
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
xor ebx, ebx
mov al, byte [ebp + 8]
mov byte [ebp - 8], al
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push 0x80
lea edx, [ebp - 0x88]
push edx
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x4f33a7
push str.NTFS
lea eax, [ebp - 0x88]
push eax
call fcn.004e116c
add esp, 8
test eax, eax
jne 0x4f3371
mov bl, 7
jmp 0x4f33a7
push 0x51aa91
lea eax, [ebp - 0x88]
push eax
call fcn.004e116c
add esp, 8
test eax, eax
jne 0x4f338d
mov bl, 4
jmp 0x4f33a7
push str.FAT32
lea eax, [ebp - 0x88]
push eax
call fcn.004e116c
add esp, 8
test eax, eax
jne 0x4f33a7
mov bl, 0xb
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3aec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x634
push 1
call fcn.004dffb4
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4f3b14
xor eax, eax
jmp 0x4f3cb2
push esi
call fcn.004e0ef8
pop ecx
add eax, 0x21
push eax
push 1
call fcn.004dffb4
add esp, 8
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4f3b3f
push ebx
call fcn.004e0060
pop ecx
xor eax, eax
jmp 0x4f3cb2
mov dl, byte [esi]
push edx
call fcn.004f3314
pop ecx
mov byte [ebx + 0x62f], al
mov eax, dword [ebx]
mov edi, esi
add eax, 0x20
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [ebp - 4]
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov edi, ebx
xor eax, eax
mov edi, dword [edi]
mov byte [edi + 0x18], 0
mov dword [edi], eax
add edi, 0x20
push edi
call fcn.004e0ef8
mov edx, dword [ebx]
pop ecx
lea edi, [ebx + 0xc]
mov word [edx + 0x1e], ax
mov ecx, dword [ebx]
mov byte [ecx + 0x1d], 0xff
mov dword [ebx + 0x630], 1
mov dword [ebx + 0x61f], 0x64
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov edx, dword [ebx]
mov cx, word [edx + 0x1e]
xor edx, edx
mov word [ebx + 0x20c], cx
mov eax, dword [ebx]
mov dword [ebx + 0x20e], eax
mov dword [ebx + 0x613], edx
push esi
push edi
mov eax, edi
mov edi, esi
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebx]
mov dword [ebx + 8], eax
push 0x105
push 0x559060
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x559060
call fcn.004e0ef8
pop ecx
mov dword [0x559474], eax
push 0x105
push 0x559165
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x559165
call fcn.004e0ef8
pop ecx
mov dword [0x559478], eax
call fcn.004ef798
dec eax
jne 0x4f3cb0
mov dword [0x559480], 0x105
push 0x559480
push 0x55936f
call dword [0x51a6b0]
lea edx, [ebp - 8]
push edx
push 0xf01ff
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x4f3cb0
mov dword [ebp - 0xc], 0x105
lea ecx, [ebp - 0xc]
push ecx
push 0x55926a
mov eax, dword [ebp - 8]
push eax
call dword [0x51a6a8]
push 0x55926a
call fcn.004e0ef8
pop ecx
mov dword [0x55947c], eax
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3f94
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xfffffdec
mov ebx, eax
push 0x20a
lea eax, [esp + 0xe]
push eax
mov eax, dword [0x51fb94]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
push 0xa
lea eax, [esp + 4]
push eax
push 3
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [esp + 0xa]
push eax
call sub.KERNEL32.DLL_lstrlenW
mov ebx, eax
add ebx, ebx
lea eax, [esp + 0xa]
add ebx, eax
jmp 0x4f3fdb
sub ebx, 2
cmp word [ebx], 0x2e
je 0x4f3fe9
lea eax, [esp + 0xa]
cmp ebx, eax
jne 0x4f3fd8
xor eax, eax
xor esi, esi
lea edx, [esp + 0xa]
cmp ebx, edx
je 0x4f4034
add ebx, 2
cmp word [esp], 0
je 0x4f4034
push esp
push ebx
call sub.KERNEL32.DLL_lstrcpyW
push 2
push 0
lea eax, [esp + 0x12]
push eax
call sub.KERNEL32.DLL_LoadLibraryExW
test eax, eax
jne 0x4f4034
mov word [esp + 4], 0
push esp
push ebx
call sub.KERNEL32.DLL_lstrcpyW
push 2
push 0
lea eax, [esp + 0x12]
push eax
call sub.KERNEL32.DLL_LoadLibraryExW
test eax, eax
je 0x4f403f
call fcn.004f3f50
mov esi, eax
mov eax, esi
add esp, 0x214
pop esi
pop ebx
ret

Function at 0x4f5bac
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ecx, ecx
mov ebx, 0x559c9c
mov eax, ecx
xor edx, edx
test al, 1
je 0x4f5bc5
shr eax, 1
xor eax, 0xedb88320
jmp 0x4f5bc7
shr eax, 1
inc edx
cmp edx, 8
jl 0x4f5bb8
mov dword [ebx], eax
inc ecx
add ebx, 4
cmp ecx, 0x100
jb 0x4f5bb4
pop ebx
ret
Function at 0x50a40c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret 4
Function at 0x50c1c0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], 0x9e3779b9
mov ebx, dword [eax]
mov dword [ebp - 8], ebx
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 8]
mov dword [ebp - 0x10], ebx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x20
xor eax, eax
xor ebx, ebx
mov bl, byte [edx + 1]
mov al, byte [edx]
shl ebx, 0x10
shl eax, 0x18
or eax, ebx
xor ebx, ebx
mov bl, byte [edx + 2]
shl ebx, 8
or eax, ebx
xor ebx, ebx
mov bl, byte [edx + 3]
or eax, ebx
xor ebx, ebx
mov bl, byte [edx + 4]
shl ebx, 0x18
movzx edi, byte [edx + 5]
shl edi, 0x10
or ebx, edi
movzx edi, byte [edx + 6]
shl edi, 8
or ebx, edi
movzx edx, byte [edx + 7]
or ebx, edx
mov edx, ebx
jmp 0x50c274
add ecx, dword [ebp - 4]
mov ebx, edx
shl ebx, 4
add ebx, dword [ebp - 8]
lea edi, [ecx + edx]
xor ebx, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0xc]
xor ebx, edi
add eax, ebx
mov ebx, eax
shl ebx, 4
add ebx, dword [ebp - 0x10]
lea edi, [ecx + eax]
xor ebx, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x14]
xor ebx, edi
add edx, ebx
mov ebx, dword [ebp - 0x18]
add dword [ebp - 0x18], 0xffffffff
test ebx, ebx
ja 0x50c23f
mov ecx, eax
shr ecx, 0x18
mov byte [esi], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 1], cl
mov ecx, eax
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 3], al
mov eax, edx
mov ecx, edx
shr eax, 0x18
mov byte [esi + 4], al
mov eax, edx
shr eax, 0x10
shr ecx, 8
mov byte [esi + 5], al
mov byte [esi + 6], cl
mov byte [esi + 7], dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50c2c0
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, 0xc6ef3720
mov dword [ebp - 4], 0x9e3779b9
mov ebx, dword [edx]
mov dword [ebp - 8], ebx
mov ebx, dword [edx + 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [edx + 8]
mov dword [ebp - 0x10], ebx
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0x20
xor edx, edx
xor ebx, ebx
mov bl, byte [eax + 1]
mov dl, byte [eax]
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
xor ebx, ebx
mov bl, byte [eax + 2]
shl ebx, 8
or edx, ebx
xor ebx, ebx
mov bl, byte [eax + 3]
or edx, ebx
xor ebx, ebx
mov bl, byte [eax + 4]
shl ebx, 0x18
movzx edi, byte [eax + 5]
shl edi, 0x10
or ebx, edi
movzx edi, byte [eax + 6]
shl edi, 8
or ebx, edi
movzx eax, byte [eax + 7]
or ebx, eax
mov eax, ebx
jmp 0x50c377
mov ebx, edx
shl ebx, 4
add ebx, dword [ebp - 0x10]
lea edi, [ecx + edx]
xor ebx, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0x14]
xor ebx, edi
sub eax, ebx
mov ebx, eax
shl ebx, 4
add ebx, dword [ebp - 8]
lea edi, [ecx + eax]
xor ebx, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0xc]
xor ebx, edi
sub edx, ebx
sub ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
add dword [ebp - 0x18], 0xffffffff
test ebx, ebx
ja 0x50c342
mov ecx, edx
shr ecx, 0x18
mov byte [esi], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov edx, eax
mov ecx, eax
shr edx, 0x18
mov byte [esi + 4], dl
mov edx, eax
shr edx, 0x10
shr ecx, 8
mov byte [esi + 5], dl
mov byte [esi + 6], cl
mov byte [esi + 7], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x50c554
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0
push 1
push 0x51f2d4
push 0
push esi
call sub.ADVAPI32.DLL_CryptAcquireContextA
test eax, eax
jne 0x50c59e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x80090016
jne 0x50c59e
push 8
push 1
push str.Microsoft_Strong_Cryptographic_Provider
push 0
push esi
call sub.ADVAPI32.DLL_CryptAcquireContextA
test eax, eax
jne 0x50c59e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x50c674
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edx, dword [eax + 0xc]
shr edx, 3
mov dword [esi], edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8004
mov eax, dword [eax]
push eax
call sub.ADVAPI32.DLL_CryptCreateHash
test eax, eax
je 0x50c6ce
push 0
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_CryptHashData
test eax, eax
je 0x50c6ce
push esi
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push 2
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_CryptSignHashA
test eax, eax
jne 0x50c6d9
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_CryptDestroyHash
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x50c6ec
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, dword [ebp + 8]
push eax
push 0
push 0
push 0x8004
xor ebx, ebx
mov edx, dword [esi]
push edx
call sub.ADVAPI32.DLL_CryptCreateHash
test eax, eax
je 0x50c740
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_CryptHashData
test eax, eax
je 0x50c740
push 0
push 0
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_CryptVerifySignatureA
test eax, eax
jne 0x50c74b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_CryptDestroyHash
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x50c75c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, ebx
mov eax, dword [eax + 0x10]
shr eax, 3
mov edx, eax
sub edx, 0xb
cmp edx, dword [ebp + 0x10]
jae 0x50c781
or eax, 0xffffffff
jmp 0x50c7be
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004e0b90
mov edx, dword [ebp + 0x18]
add esp, 0xc
lea eax, [ebp + 0x10]
mov ecx, dword [edx]
push ecx
push eax
push edi
push 0
push 1
push 0
mov edx, dword [ebx + 4]
push edx
call sub.ADVAPI32.DLL_CryptEncrypt
test eax, eax
jne 0x50c7bc
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x50c7c4
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor esi, esi
mov edx, eax
mov edx, dword [edx + 0x10]
shr edx, 3
cmp edx, dword [ebp + 0x10]
je 0x50c7e4
or eax, 0xffffffff
jmp 0x50c833
lea ecx, [ebp + 0x10]
push ecx
push edi
push 0
push 1
push 0
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_CryptDecrypt
mov ebx, eax
test ebx, ebx
je 0x50c826
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
cmp edx, dword [ebp + 0x10]
jae 0x50c80d
or eax, 0xffffffff
jmp 0x50c833
mov edx, dword [ebp + 0x10]
push edx
push edi
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004e0b90
add esp, 0xc
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov dword [eax], edx
test ebx, ebx
jne 0x50c831
call sub.KERNEL32.DLL_GetLastError
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b646
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
sub esp, 4
mov dword [esp], 0xf408cf14
pop edx
and esi, edx
add edx, 1
call fcn.0043b682
mov edx, esi
xor dword [eax], edi
add edx, 1
or edx, edx
inc eax
add edx, edx
cmp eax, ebx
jne fcn.0043b646
add edx, 0x3efd9712
and edx, esi
dec esi
ret
Function at 0x427510
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
mov edx, 0x59ac28
lea eax, [ebp - 0x18]
call fcn.0040e7c0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004274f0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, str.KABx64
call fcn.00408bb0
push 0
lea eax, [ebp - 0x1c]
call fcn.00427460
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, str.KABx64Direct1Direct1_adobeapp.exe
call fcn.00408cb0
lea eax, [ebp - 0x10]
mov edx, str.Adobe_Cabinet
call fcn.00408bb0
push 0
lea eax, [ebp - 0x1c]
call fcn.00427460
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, str.AdobeCDirect1Direct1_adobeapp.exe
call fcn.00408cb0
mov byte [ebp - 8], 0
add byte [ebp - 8], 1
mov edx, 1
mov eax, 0x5e89e8
call fcn.0056e8d0
mov dword [ebp - 4], eax
xor eax, eax
push fcn.004274e0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x80000001
call fcn.0056e890
mov al, byte [ebp - 8]
cmp al, 1
jl 0x4275fc
sub al, 1
je 0x4275d8
sub al, 1
je 0x4275ec
jmp 0x4275fc
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.0056eb00
jmp 0x4275fc
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.0056eb00
nop
movzx eax, byte [ebp - 8]
mov edx, dword [ebp + eax*8 - 0x20]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.0056ece0
mov eax, dword [ebp - 0x1c]
movzx edx, byte [ebp - 8]
mov edx, dword [ebp + edx*8 - 0x1c]
call fcn.00409770
test eax, eax
je 0x42763c
movzx eax, byte [ebp - 8]
mov ecx, dword [ebp + eax*8 - 0x1c]
movzx eax, byte [ebp - 8]
mov edx, dword [ebp + eax*8 - 0x20]
mov eax, dword [ebp - 4]
call fcn.0056eea0
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004274e0
cmp byte [ebp - 8], 2
jl 0x427590
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004274f0
mov esp, ebp
pop ebp
ret
Function at 0x4bd550
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4bd584
mov eax, esi
call fcn.004c1ad0
cmp byte [esi + 0x40], 0
je 0x4bd57c
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4bd635
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4bd614
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4bd60c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4bd5b8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4bd5d0
xor bl, bl
jmp 0x4bd635
cmp edi, 2
je 0x4bd60a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4bd5a8
cmp edi, 3
je 0x4bd5e8
cmp edi, 1
jne 0x4bd5a8
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4bd5a8
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4bd5a8
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4bd62c
cmp dword [esi + 0x14], 0xcc
je 0x4bd62c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004bd970
lea esi, [esi]
mov eax, esi
call fcn.004bd640
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x50d460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x50d47b
jmp 0x50d488
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x50d490
jmp 0x50d498
jmp 0x50d54a
xor eax, eax
push 0x50d527
push ebp
push 0x414680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040d0b0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x50d509
jmp 0x50d51c
cmp dword [ebp - 8], 0
jne 0x50d511
jmp 0x50d51c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x50d54a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret