joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d43a0
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov bl, byte [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x258], eax
xor edi, edi
lea esi, [esp + 0x50]
push 0x208
push edi
push esi
call fcn.0048d770
add esp, 0xc
test bl, bl
mov eax, 0x26
mov ecx, 0x1c
cmovne ecx, eax
push esi
push edi
push edi
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4d4434
xor eax, eax
dec eax
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], eax
push edi
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4d445b
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov bl, 1
cmp dword [esp], eax
sbb ecx, 0
jb 0x4d4490
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 8]
mov ecx, esi
push 0xe0
push str.HasEnoughDiskSpace
push 0
call fcn.004b83c0
lea ecx, [esp + 0x44]
push 0x50b0f2
push str.SHGetFolderPath_failed
jmp 0x4d4480
lea esi, [esp + 8]
mov ecx, esi
push 0xe6
push str.HasEnoughDiskSpace
push 0
call fcn.004b83c0
lea ecx, [esp + 0x44]
push 0x50b10c
push str.GetDiskFreeSpaceEx_failed
call fcn.004b45d0
mov ecx, esi
call fcn.004374c0
mov bl, 1
jmp 0x4d441c
lea esi, [esp + 8]
mov ecx, esi
push 0xec
push str.HasEnoughDiskSpace
push 0
call fcn.004b83c0
lea ecx, [esp + 0x44]
push 0x50b13e
push str.There_is_not_enough_disk_space_to_install_browser
call fcn.004b45d0
mov ecx, esi
call fcn.004374c0
xor ebx, ebx
jmp 0x4d441c
Function at 0x4d68b0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
lea esi, [ecx + 4]
xor eax, eax
push esi
push eax
push eax
push 0x8004
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4d690d
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov bl, 1
test eax, eax
je 0x4d6948
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004b86f0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x35
push str.HashData
push 1
call fcn.004b84f0
lea ecx, [esp + 0x4c]
push 0x50d5d9
push str.Failed_to_initialize_hash_object__error:
jmp 0x4d6981
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004b86f0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x3a
push str.HashData
push 1
call fcn.004b84f0
lea ecx, [esp + 0x4c]
push 0x50d5f6
push str.Failed_to_hash_data__error:
call fcn.004b45d0
call edi
lea ecx, [esp + 0x18]
push eax
call fcn.004b44e0
mov ecx, esi
call fcn.004b8530
cmp byte [ebx + 0xb], 0
jns 0x4d69ab
push dword [esp + 4]
call fcn.00489982
add esp, 4
xor ebx, ebx
jmp 0x4d68f6

Function at 0x4d6e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4d6ea9
mov edi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4d6ea9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d6ea9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4d6ea9
mov edi, eax
mov ecx, esi
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00467e60
push ebx
push edi
push dword [esi]
call fcn.0048cc70
add esp, 0xc
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e3350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4562f0
push eax
push eax
call fcn.00498690
add esp, 0x18
mov ecx, esi
push eax
call fcn.0046d4a0
mov edi, dword [esi]
inc edi
cmp edi, 1
jbe 0x4e33a8
cmp edi, 1
seta bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004b86f0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x71
push str.InitializeThread
push 1
call fcn.004b84f0
lea ecx, [esp + 0x4c]
push 0x511afd
push str.Failed_to_create_thread_for_async_http_requests
call fcn.004b45d0
mov ecx, esi
call fcn.004b8530
cmp byte [ebx + 0xb], 0
jns 0x4e338d
push dword [esp + 4]
call fcn.00489982
add esp, 4
jmp 0x4e338d

Function at 0x4e3b20
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.0048a990
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0xff
push ebx
call fcn.0048d770
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], edi
push ecx
push ebx
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x4e3b99
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x4e3bbd
mov edi, 0x3f4
cmp eax, 1
jne 0x4e3b80
mov ecx, esi
push ebx
call fcn.00437400
xor edi, edi
jmp 0x4e3b80
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.0048d770
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
dec eax
mov edi, 0xea
cmp eax, 0x3ff
ja 0x4e3b80
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
jmp 0x4e3bb4

Function at 0x4e3c10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004a3276
add esp, 4
add eax, eax
add eax, 2
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4ec450
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edx, dword [ebp + 0xc]
movzx ebx, byte [edx + 0xb]
test bl, bl
jns 0x4ec469
mov ebx, dword [edx + 4]
mov edx, dword [edx]
mov eax, ebx
mov dword [ebp - 0x1c], edx
mov edi, ebx
mov dword [ebp - 0x10], ebx
cmp ebx, 4
jb 0x4ec4a6
mov eax, dword [ebp - 0x10]
mov edi, eax
mov edx, dword [ebp - 0x1c]
imul esi, dword [edx], 0x5bd1e995
mov ebx, esi
shr ebx, 0x18
xor ebx, esi
imul esi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add edx, 4
add edi, 0xfffffffc
cmp edi, 3
ja 0x4ec480
cmp edi, 1
je 0x4ec4c7
cmp edi, 2
je 0x4ec4be
cmp edi, 3
jne 0x4ec4d2
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, dword [ecx + 4]
mov dword [ebp - 0x18], edx
test edx, edx
je 0x4ec5df
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov ebx, dword [ebp - 0x18]
mov eax, ebx
shr eax, 1
and eax, 0x55555555
mov edx, ebx
sub edx, eax
mov eax, 0x33333333
mov esi, edx
and esi, eax
shr edx, 2
and edx, eax
add edx, esi
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x4ec5f2
lea edx, [ebx - 1]
and edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [eax + edx*4]
test eax, eax
mov esi, dword [ebp - 0x1c]
je 0x4ec5df
mov ebx, dword [eax]
test ebx, ebx
je 0x4ec5df
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x4ec59a
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x4ec572
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x4ec5aa
lea edx, [ebx + 8]
mov ecx, dword [edx]
test al, al
cmovs edx, ecx
js 0x4ec5c1
test al, al
je 0x4ec5d8
dec eax
xor edx, edx
cmp cl, byte [esi + edx]
jne 0x4ec5aa
cmp eax, edx
je 0x4ec5d8
mov cl, byte [ebx + edx + 9]
inc edx
jmp 0x4ec58a
cmp dword [ebp - 0x24], 1
ja 0x4ec5b2
and eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jne 0x4ec5df
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4ec55e
jmp 0x4ec5df
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x4ec5a3
xor edx, edx
div ecx
mov eax, edx
jmp 0x4ec5a3
cmp dword [ebp - 0x10], 0
je 0x4ec5d8
push dword [ebp - 0x10]
push esi
push edx
call fcn.0048bd5d
add esp, 0xc
test eax, eax
jne 0x4ec5aa
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x4ec5e8
mov eax, dword [ebp + 8]
mov dword [eax], 0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edx, edi
cmp edi, ebx
jb 0x4ec53a
mov eax, edi
xor edx, edx
div ebx
jmp 0x4ec53a
Function at 0x4edc90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0x48]
mov ecx, edi
mov edx, 3
call fcn.004f0ae0
lock inc dword [esi + 0x8c]
lea ecx, [esi + 8]
mov edx, dword [esi + 4]
call fcn.004edc30
mov ecx, edi
xor edx, edx
call fcn.004f0ae0
mov ecx, esi
call fcn.004ecc90
mov ecx, edi
xor edx, edx
call fcn.004f1620
xor ebx, ebx
inc ebx
mov ecx, edi
mov edx, ebx
call fcn.004f0ae0
mov ecx, esi
call fcn.004ece30
mov ecx, edi
mov edx, ebx
call fcn.004f1620
lea ebx, [esi + 0x84]
mov ecx, ebx
call fcn.0046b930
lock dec dword [esi + 0x8c]
mov ecx, ebx
call fcn.0046b950
lea ecx, [esi + 0x88]
call fcn.00438250
mov ecx, esi
call fcn.004ecf80
mov eax, dword [esi + 0x90]
mov byte [eax + 0x10], 3
mov ecx, edi
mov edx, 2
call fcn.004f0ae0
mov ecx, esi
call fcn.004ecff0
mov ecx, edi
mov edx, 2
call fcn.004f1620
mov ecx, edi
mov edx, 3
call fcn.004f1620
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004ed2c0
Function at 0x4f3640
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
movzx ebx, byte [edx + 0xb]
test bl, bl
jns 0x4f3659
mov ebx, dword [edx + 4]
mov edx, dword [edx]
mov eax, ebx
mov dword [ebp - 0x20], edx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 4
jb 0x4f3696
mov eax, dword [ebp - 0x1c]
mov esi, eax
mov edx, dword [ebp - 0x20]
imul ebx, dword [edx], 0x5bd1e995
mov edi, ebx
shr edi, 0x18
xor edi, ebx
imul edi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x4f3670
mov ebx, dword [ebp + 8]
cmp esi, 3
je 0x4f36aa
cmp esi, 1
je 0x4f36bc
cmp esi, 2
jne 0x4f36c7
jmp 0x4f36b3
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, dword [ecx + 4]
test esi, esi
jne 0x4f36e0
mov dword [ebx], 0
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edx, eax
shr edx, 0xf
xor edx, eax
mov dword [ebp - 0x18], edx
mov eax, esi
shr eax, 1
and eax, 0x55555555
mov edx, esi
sub edx, eax
mov eax, 0x33333333
mov edi, edx
and edi, eax
shr edx, 2
and edx, eax
add edx, edi
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x4f37fe
lea eax, [esi - 1]
and eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x4f36ce
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4f36ce
lea eax, [esi - 1]
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x18]
jne 0x4f37ac
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x13]
mov ecx, eax
test al, al
jns 0x4f377e
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0xc]
cmp ecx, dword [ebp - 0x1c]
jne 0x4f37be
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + 8]
mov ecx, dword [edx]
test al, al
cmovs edx, ecx
js 0x4f37db
test al, al
je 0x4f37f4
dec eax
xor edx, edx
cmp cl, byte [edi + edx]
jne 0x4f37be
cmp eax, edx
je 0x4f37f4
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + edx + 9]
inc edx
jmp 0x4f3799
cmp dword [ebp - 0x28], 1
ja 0x4f37cf
and eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jne 0x4f36ce
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4f3760
jmp 0x4f36ce
cmp eax, esi
jb 0x4f37b5
xor edx, edx
div esi
mov eax, edx
jmp 0x4f37b5
cmp dword [ebp - 0x1c], 0
je 0x4f37f4
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edx
call fcn.0048bd5d
add esp, 0xc
test eax, eax
jne 0x4f37be
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
jmp 0x4f36d4
mov eax, dword [ebp - 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
cmp eax, esi
jb 0x4f373e
mov eax, dword [ebp - 0x18]
xor edx, edx
div esi
mov dword [ebp - 0x14], edx
jmp 0x4f373e
Function at 0x4f5fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, ecx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4f60fa
movzx ecx, word [ebp + 8]
mov dword [edx], 0
xor eax, eax
test cl, 1
mov dword [ebp - 0x10], ecx
jne 0x4f5fe1
xor ecx, ecx
mov ebx, dword [ebp - 0x10]
movzx ebx, bx
shr ebx, 1
inc ecx
mov edi, ebx
mov dword [ebp - 0x10], ebx
test bl, 1
je 0x4f5fcc
jmp 0x4f5fe6
movzx edi, cx
xor ecx, ecx
test edi, edi
mov ebx, esi
je 0x4f5ff5
bsr eax, edi
xor eax, 0xffffffe0
add eax, 0x21
mov dword [ebp - 0x28], ecx
mov ecx, eax
imul ecx, ebx
cmp ecx, 0xde3
jg 0x4f6104
xor ecx, ecx
inc ecx
mov esi, ecx
add ecx, ecx
cmp esi, ebx
jle 0x4f600c
mov dword [ebp - 0x1c], edi
sar esi, 2
mov dword [ebp - 0x18], edx
je 0x4f606b
mov cl, 0x40
sub cl, al
xor edx, edx
dec edx
mov ebx, edx
shl ebx, cl
xor eax, eax
test cl, 0x20
cmovne edx, ebx
mov dword [ebp - 0x24], edx
movzx edi, word [ebp - 0x10]
mov dword [ebp - 0x14], 0
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
xor ebx, ebx
mov ecx, ebx
mov eax, edi
mul edi
imul ecx, edi
mov ebx, edx
add ebx, ecx
add ebx, ecx
mov edi, eax
test dword [ebp + 0xc], esi
jne 0x4f60ca
sar esi, 1
mov edx, dword [ebp - 0x18]
je 0x4f607a
test ebx, ebx
je 0x4f6048
jmp 0x4f607a
movzx edi, word [ebp - 0x10]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x14], 0
mov dword [edx], 0
mov eax, edi
or eax, ebx
je 0x4f60a5
xor eax, eax
mov ecx, ebx
shld ecx, edi, 4
and edi, 0xfffffff
mov dword [edx + eax*4 + 4], edi
shr ebx, 0x1c
inc eax
mov edi, ecx
or ecx, ebx
jne 0x4f6088
mov word [edx], ax
test byte [ebp - 0x14], 1
jne 0x4f6109
test esi, esi
mov edi, dword [ebp + 0xc]
jne 0x4f6118
mov eax, dword [ebp - 0x28]
imul eax, edi
mov ecx, edx
push eax
call fcn.0045e130
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, edi
and eax, dword [ebp - 0x20]
mov ecx, ebx
and ecx, dword [ebp - 0x24]
xor edx, edx
inc edx
or ecx, eax
movzx eax, word [ebp - 0x10]
cmovne eax, edx
mov ecx, dword [ebp - 0x14]
movzx ecx, cl
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
imul ebx, eax
mul edi
add ebx, edx
mov edi, eax
jmp 0x4f605e
xor eax, eax
inc eax
mov dword [edx + 4], eax
mov dword [edx], eax
jmp 0x4f60c0
call fcn.004b4af0
mov ecx, edx
push dword [ebp - 0x1c]
call fcn.0045e1d0
mov edx, dword [ebp - 0x18]
jmp 0x4f60ab
mov ecx, edx
call fcn.004f5de0
test esi, edi
je 0x4f612e
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0045e1d0
sar esi, 1
mov edx, dword [ebp - 0x18]
jmp 0x4f60ad
Function at 0x5ab7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x5ab805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x5ab878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x5ab83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x5ab86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x5ab86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x5ab831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x5ab7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402ee4
pop dword [ebp - 0x38]
mov eax, 0x76e2a6f7
sub eax, 0x76a27813
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xf5eb662b
sub dword [ebp - 0x48], 0xa79920e0
mov dword [ebp - 0x44], 0xb9bc8743
sub dword [ebp - 0x44], 0x87893afe
mov dword [ebp - 0x40], 0x356932a
add dword [ebp - 0x40], 0x48f5b104
mov dword [ebp - 0x3c], 0x922b3e16
add dword [ebp - 0x3c], 0x6dd4c1ea
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xe469166
sub dword [ebp - 0x48], 0x99d42810
mov dword [ebp - 0x44], 0x152ca948
sub dword [ebp - 0x44], 0xd3c047d3
mov dword [ebp - 0x40], 0x54b4f04b
sub dword [ebp - 0x40], 0xf14583df
mov dword [ebp - 0x3c], 0x7d5f4342
add dword [ebp - 0x3c], 0x82a0bcbe
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x80d886e0
add eax, 0x7f67fa20
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39267
push 0
call eax
mov ecx, 0x5075
xor esi, esi
add esi, eax
mov edi, 0x4eae0667
sub edi, 0x4e672267
add edi, dword [ebp - 0x38]
mov ebx, 0xc148f692
mov edx, dword [edi]
xor dword [ebp - 0x28], ebx
xor edx, ebx
sub dword [ebp - 0x20], 0xbe499d5a
mov dword [esi], edx
sub dword [ebp - 0x20], 0x32826b95
add esi, 4
add edi, 4
loop 0x402ff7
add eax, 0x134a7
mov ebx, eax
add eax, 0x1ba8574f
add eax, 0xe457a8b6
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x40160d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x82207c]
jne 0x401617
repz ret
jmp fcn.00401fa0

Function at 0x406bcc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x82207c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040454b
and dword [ebp - 0x14], 0
cmp dword [0x824a58], 0
mov dword [ebp - 0x18], eax
jne 0x406c7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406d27
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406d27
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x824a58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x824a5c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x824a60], eax
call edi
push eax
call esi
mov dword [0x824a68], eax
test eax, eax
je 0x406c7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x824a64], eax
mov eax, dword [0x824a64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406cd8
cmp dword [0x824a68], ecx
je 0x406cd8
push eax
call esi
push dword [0x824a68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406cd8
test ebx, ebx
je 0x406cd8
call edi
test eax, eax
je 0x406ccf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406ccf
test byte [ebp - 8], 1
jne 0x406cd8
or dword [ebp + 0x10], 0x200000
jmp 0x406d0b
mov eax, dword [0x824a5c]
cmp eax, dword [ebp - 0x18]
je 0x406d0b
push eax
call esi
test eax, eax
je 0x406d0b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406d0b
mov eax, dword [0x824a60]
cmp eax, dword [ebp - 0x18]
je 0x406d0b
push eax
call esi
test eax, eax
je 0x406d0b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x824a58]
call esi
test eax, eax
je 0x406d27
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406d29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040160d
leave
ret
Function at 0x408cb0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x40c
mov eax, dword [0x82207c]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [0x82ee94]
push ebx
mov ebx, dword [0x82ebbc]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x408cfc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov eax, dword [0x82ee94]
push esi
mov esi, dword [0x822e60]
cmp eax, 0x930
jne 0x408d17
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x82ee94]
mov dword [0x82ebb8], esi
pop esi
cmp eax, 0x114e
jne 0x408d3e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x82ee94]
cmp eax, 0x2f
jne 0x408d5d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push edi
push ebx
call fcn.00408b70
mov ecx, dword [esp + 0x418]
add esp, 8
pop edi
pop ebx
xor ecx, esp
call fcn.0040160d
add esp, 0x40c
ret