joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524930
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push ebp
xor edi, edi
call fcn.004e1f00
push ebp
call fcn.004e1e20
mov esi, eax
add esp, 8
test esi, esi
je 0x524b39
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 4]
add eax, eax
cmp eax, dword [esi + 8]
jg 0x524965
mov eax, esi
jmp 0x52496f
push eax
push esi
call fcn.004d5a60
add esp, 8
test eax, eax
je 0x524b38
mov ebp, dword [ebx + 4]
dec ebp
js 0x524ae8
mov eax, dword [ebx]
mov edx, dword [eax + ebp*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, 0x80000001
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + ebp*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + ebp*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + ebp*8], edx
dec ebp
jns 0x524981
mov eax, dword [ebx + 4]
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x524b11
mov ecx, dword [esi]
lea edx, [eax - 1]
lea edx, [ecx + edx*4]
lea esp, [esp]
mov ecx, dword [edx]
lea edx, [edx - 4]
test ecx, ecx
jne 0x524b0e
dec eax
test eax, eax
jg 0x524b00
mov dword [esi + 4], eax
cmp dword [esi + 4], edi
jne 0x524b19
mov dword [esi + 0xc], edi
push dword [esp + 0x1c]
push esi
push dword [esp + 0x1c]
call fcn.00523a40
mov ebp, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
mov ecx, 1
cmovne edi, ecx
pop ebx
push ebp
call fcn.004e1db0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x528440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.0054da90
mov eax, dword [0x602280]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x528605
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x528595
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.0041aec0
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x528530
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x5285ec
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0054bf74
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054bf74
add esp, 0x28
ret
Function at 0x529b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.0054da90
mov eax, dword [0x602280]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x529d25
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x529cb5
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.0041b940
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x529c50
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x529d0c
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0054bf74
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054bf74
add esp, 0x28
ret
Function at 0x52bec0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0054da90
mov eax, dword [0x602280]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xb4]
test edi, edi
je 0x52c063
push ebp
dec edi
lea ebp, [ebx + 0xc]
add ebx, 0x14
shr edi, 3
push esi
mov esi, dword [esp + 0xb8]
inc edi
mov dword [esp + 0x18], ebx
jmp 0x52bf10
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebp]
and al, 0xdf
mov dword [esp + 0x14], ecx
or al, 0x40
mov dword [esp + 0x28], ecx
mov byte [ebp], al
movzx eax, byte [ebx]
and al, 0xbf
mov dword [esp + 0x20], ecx
or al, 0x20
push ebp
mov byte [ebx], al
call fcn.004e6980
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.004e6740
push 1
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00402280
push ebx
call fcn.004e6980
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.004e6740
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00402280
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
xor edx, ecx
xor ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor ebx, eax
mov dword [esp + 0x14], ecx
xor eax, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, ecx
shr eax, 8
mov byte [ecx + 4], dl
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
dec edi
jne 0x52bf10
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop edi
pop ebx
xor ecx, esp
call fcn.0054bf74
add esp, 0xa0
ret
Function at 0x5362b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x58d018
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x602280]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x4c]
mov dword [esi + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x40], 0
push eax
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.005371f6
add esp, 4
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 8], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x3c
ret 8

Function at 0x55d13f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x57b18d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005588e5
mov dword [ebp - 0x14], eax
cmp dword [0x60d678], esi
jne 0x57b280
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x57b20d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x57b360
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x57b360
push 0x5e37e8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x57b360
push eax
call ebx
push 0x5e37f4
push edi
mov dword [0x60d678], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x60d67c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5e3818
push edi
mov dword [0x60d680], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x60d688], eax
test eax, eax
je 0x57b27d
push 0x5e3834
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x60d684], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x57b2a5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x57b298
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x57b2ba
push 4
pop eax
jmp 0x57b362
cmp dword [ebp - 0x14], esi
je 0x57b2ba
push dword [0x60d678]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x57b29f
mov eax, dword [0x60d684]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x57b318
cmp dword [0x60d688], edi
je 0x57b318
push eax
call ebx
push dword [0x60d688]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x57b318
test eax, eax
je 0x57b318
call ecx
test eax, eax
je 0x57b30d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x57b30d
test byte [ebp - 8], 1
jne 0x57b318
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x57b348
mov eax, dword [0x60d67c]
cmp eax, edi
je 0x57b345
push eax
call ebx
test eax, eax
je 0x57b345
call eax
mov esi, eax
test esi, esi
je 0x57b345
mov eax, dword [0x60d680]
cmp eax, edi
je 0x57b345
push eax
call ebx
test eax, eax
je 0x57b345
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x60d678]
call ebx
test eax, eax
je 0x57b360
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x57b362
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054bf74
mov esp, ebp
pop ebp
ret
Function at 0x4038d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x403908
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x4038eb
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
jne 0x40390c
xor al, al
jmp 0x40394c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40394a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x44
je 0x403940
cmp dword [ebp - 0xc], 0x20
je 0x403940
cmp dword [ebp - 0xc], 0x45
je 0x403940
cmp dword [ebp - 0xc], 0x24
jne 0x403946
mov al, 1
jmp 0x40394c
xor al, al
jmp 0x40394c
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x403cc0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x45e008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x108]
push eax
push 0
push 0
mov eax, dword [0x45e8d0]
cdq
mov esi, eax
mov edi, edx
add esi, 8
adc edi, 0
mov eax, dword [0x45e8d4]
cdq
add eax, 0x2598
adc edx, 0
push 0
push 0x2598
push edx
push eax
call fcn.0044ed00
mov ecx, eax
mov ebx, edx
add ecx, 5
adc ebx, 0
mov eax, dword [0x45e8d4]
cdq
add eax, 8
adc edx, 0
push edx
push eax
push ebx
push ecx
call fcn.0044ed00
add esi, eax
adc edi, edx
add esi, 0x2598
adc edi, 0
push edi
push esi
call fcn.00402730
add esp, 8
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x114], eax
xor edx, edx
mov dword [ebp - 0x11c], 0x2580
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
xor eax, 0x18
xor ecx, 0
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], ecx
xor edx, edx
mov dword [ebp - 0x124], 0x18
mov dword [ebp - 0x120], edx
mov eax, dword [0x45e8c0]
xor eax, 0x2598
mov ecx, dword [0x45e8c4]
xor ecx, 0
push 0
push 0
push ecx
push eax
call fcn.0044ed00
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], edx
xor edx, edx
mov dword [ebp - 0x13c], 0x2598
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x128]
add eax, dword [ebp - 0x12c]
adc ecx, edx
add eax, 1
adc ecx, 0
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x138]
sub eax, dword [ebp - 0x13c]
sbb ecx, edx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], ecx
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x148]
push esi
push edx
push ecx
push eax
call fcn.0044ed60
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
mov eax, dword [ebp - 0x114]
cdq
mov ecx, dword [ebp - 0x154]
mov esi, dword [ebp - 0x150]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], esi
mov edx, dword [ebp - 0x15c]
cmp edx, dword [ebp - 0x164]
jne 0x403ecf
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x160]
jne 0x403ecf
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0x110]
call fcn.00401810
mov edx, dword [ebp - 0x10c]
or edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x110]
jmp 0x403ef4
push 0x458bb9
mov ecx, dword [ebp - 0x110]
call fcn.00401810
mov eax, dword [ebp - 0x10c]
or eax, 1
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x110]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437b28
mov esp, ebp
pop ebp
ret
Function at 0x40dbf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x45e008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004393f0
add esp, 0xc
mov dword [ebp - 0x48], 0x44
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40dc28
mov dword [ebp - 0x5c], 1
jmp 0x40dc2f
mov dword [ebp - 0x5c], 0
mov dx, word [ebp - 0x5c]
mov word [ebp - 0x18], dx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40dc56
mov dword [ebp - 0x60], 0
jmp 0x40dc5d
mov dword [ebp - 0x60], 0x8000000
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40dc85
jmp 0x40dc91
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437b28
mov esp, ebp
pop ebp
ret
Function at 0x433aa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x9c], 0
mov esp, ebp
pop ebp
ret
Function at 0x441490
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4414cf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4414cf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4414cf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4414cf
cmp dword [ecx + 0x74], 0xe
jbe 0x4414cf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x443bd3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455d30
push 0x455d28
push str.FlsAlloc
push 0x1f
call fcn.00443aef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443c07
push dword [ebp + 8]
mov ecx, esi
call dword [0x4531c0]
call esi
jmp 0x443c0d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x443c51
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455d40
push 0x455d38
push str.FlsGetValue
push 0x21
call fcn.00443aef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443c88
push dword [ebp + 8]
mov ecx, esi
call dword [0x4531c0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x443c90
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455d48
push 0x455d40
push str.FlsSetValue
push 0x22
call fcn.00443aef
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443cca
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4531c0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x447295
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x447332
push ebx
push esi
call fcn.0044725e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004471f2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4472df
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x447331
push edi
push eax
call fcn.004438c6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4472ff
call fcn.00443371
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x447330
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004471f2
add esp, 0x20
test eax, eax
jne 0x44731e
push edi
call fcn.00443371
jmp 0x447326
push ebx
call fcn.00443371
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret