joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e030
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, ecx
push ebx
push esi
push edi
mov esi, dword [edx + 0x4c]
mov ebx, 0x100
mov edi, dword [edx + 0x1b8]
cmp esi, 1
mov dword [ebp - 0xc], edx
sete al
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov byte [edi + 0x1c], al
mov eax, 0x2fe
push dword [edx + 0x64]
mov ecx, dword [edx + 4]
cmovne eax, ebx
push eax
push 1
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov dword [edi + 0x18], eax
add esp, 0x10
mov eax, dword [edi + 0x14]
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x64], ebx
jle 0x42e15a
nop dword [eax]
mov ecx, dword [edi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
cmp esi, 1
jne 0x42e0ac
mov eax, dword [edi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [edi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
xor esi, esi
mov edx, eax
nop dword [eax + eax]
cmp esi, edx
jle 0x42e0f4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x42e0e2
mov eax, dword [ebp - 0x10]
movzx eax, al
movzx ecx, bl
imul ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + eax], cl
inc esi
mov ecx, dword [ebp - 0x14]
cmp esi, 0xff
jle 0x42e0d0
mov esi, dword [ebp - 0x18]
cmp esi, 1
jne 0x42e141
mov ebx, eax
mov ecx, esi
lea edx, [ebx - 1]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x42e121
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
jl 0x42e090
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442ac0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push esi
mov esi, ecx
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [esp + 0x14], ecx
jg 0x442aee
jl 0x442b21
cmp dword [esp + 0x10], eax
jb 0x442b21
push 1
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esi + 4]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x442b1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x442b42
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x18]
push 0x4af008
push eax
call fcn.0044d560
add esp, 8
lea eax, [esp + 0x18]
push 0x4bbb64
push eax
call fcn.00466a95
push str.Cannot_set_file_pointer_to_specified_position
lea ecx, [esp + 0x1c]
call fcn.00462e80
push 0x4bbd64
lea eax, [esp + 0x1c]
push eax
call fcn.00466a95
int3
Function at 0x442ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x442bf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x442c20
jmp 0x442c0a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x442c5a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x24]
call fcn.00442dc0
push 0x4bbd9c
lea eax, [ebp - 0x24]
push eax
call fcn.00466a95
lea ecx, [ebp - 0x20]
call fcn.0044cc70
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
call fcn.004601b0
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00426960
push eax
lea ecx, [ebp - 0x38]
call fcn.004433a0
push 0x4bbc90
lea eax, [ebp - 0x38]
push eax
call fcn.00466a95
lea ecx, [ebp - 0x38]
call fcn.00442dc0
push 0x4bbd9c
lea eax, [ebp - 0x38]
push eax
call fcn.00466a95
int3

Function at 0x442ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f908
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x442d39
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x20]
call fcn.0044cc70
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
call fcn.004601b0
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00426960
push eax
lea ecx, [ebp - 0x34]
call fcn.004433a0
push 0x4bbc90
lea eax, [ebp - 0x34]
push eax
call fcn.00466a95
int3

Function at 0x448380
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x4bf454]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4c1a78], 0
jne 0x4483d5
movzx ecx, byte [ebp + 0xc]
lea eax, [ebp - 0x194]
push eax
movzx eax, byte [ebp + 8]
shl cx, 8
or cx, ax
movzx eax, cx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4483fa
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [0x4c1a78], 1
call fcn.00464d5e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a8]
push 0x4938f8
push eax
call fcn.0044d560
add esp, 8
lea eax, [ebp - 0x1a8]
push 0x4bbb64
push eax
call fcn.00466a95
lea eax, [ebp - 0x1a8]
push str.Failed_to_initialize_WindowsSocket.
push eax
call fcn.0044d560
add esp, 8
lea eax, [ebp - 0x1a8]
push 0x4bbb64
push eax
call fcn.00466a95
int3
Function at 0x448460
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ff46
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 2
push 1
lea ecx, [esi + 4]
mov dword [esi], vtable.SocketIPv4.0
call fcn.00462c10
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
call fcn.0044c930
push 6
push 1
push 2
mov byte [ebp - 4], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], 0
cmp eax, 0xffffffff
je 0x4484ec
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.004490e0
push 0x4b85ac
lea eax, [ebp - 0x28]
push eax
call fcn.00466a95
int3
Function at 0x448ab0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490057
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4bf454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.00448f30
mov ecx, esi
call fcn.00448f20
push eax
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x448b8c
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044c870
mov esi, dword [edi + 0x30]
mov dword [ebp - 4], 0
test esi, esi
je 0x448b34
mov ecx, esi
call fcn.00462c90
push 0xc
push esi
call fcn.00464d6f
add esp, 8
push 0xc
call fcn.0046523a
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x448b5e
movups xmm0, xmmword [ebp - 0x20]
sub esp, 0x10
mov ecx, esp
movups xmmword [ecx], xmm0
mov ecx, eax
call fcn.00448e80
jmp 0x448b60
xor eax, eax
lea ecx, [ebp - 0x2c]
mov dword [edi + 0x30], eax
mov byte [edi + 0x34], 0
call fcn.0044c890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464d5e
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x44]
call fcn.004490e0
push 0x4b85ac
lea eax, [ebp - 0x44]
push eax
call fcn.00466a95
int3

Function at 0x448bb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
xor eax, 1
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ecx + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x448bde
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x18]
call fcn.004490e0
push 0x4b85ac
lea eax, [ebp - 0x18]
push eax
call fcn.00466a95
int3

Function at 0x448c90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x24]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x448cb3
mov esp, ebp
pop ebp
ret 0xc
push 0x493a2c
lea ecx, [ebp - 0x14]
call fcn.004433a0
push 0x4bbc90
lea eax, [ebp - 0x14]
push eax
call fcn.00466a95
int3

Function at 0x448cd0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0xfffffffffffffffb
push 0xffff
push dword [ecx + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x448cfc
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.004490e0
push 0x4b85ac
lea eax, [ebp - 0x1c]
push eax
call fcn.00466a95
int3
Function at 0x448d60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4900b9
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 2
push 1
mov dword [ebp - 0x10], 0
call fcn.00462c10
push 2
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.00462c10
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x48]
mov word [ebp - 0x24], ax
mov dword [ebp - 0x10], 1
call fcn.0044cbc0
push 0x4c1a7c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0044c870
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x38]
call fcn.0044e110
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.00426960
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x448e5f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], eax
call fcn.0044e250
lea ecx, [ebp - 0x1c]
call fcn.0044c890
mov ax, word [ebp + 0xc]
lea ecx, [ebp - 0x48]
mov word [ebp - 0x24], ax
call fcn.0044cd00
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x24]
mov word [esi + 4], ax
call fcn.00462c90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x60]
call fcn.004490e0
push 0x4b85ac
lea eax, [ebp - 0x60]
push eax
call fcn.00466a95
int3

Function at 0x448f70
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490141
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
push 2
push 1
mov dword [ebp - 4], 0
call fcn.00462c10
xor eax, eax
mov dword [esi + 8], 0
mov word [esi + 4], ax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call fcn.0044cbc0
push 0x4c1a7c
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0044c870
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.0044e110
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00426960
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x449051
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [ebp - 0x28]
mov dword [esi + 8], eax
call fcn.0044e250
lea ecx, [ebp - 0x18]
call fcn.0044c890
mov cx, word [ebp + 0x10]
mov word [esi + 4], cx
lea ecx, [ebp - 0x38]
call fcn.0044cd00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x50]
call fcn.004490e0
push 0x4b85ac
lea eax, [ebp - 0x50]
push eax
call fcn.00466a95
int3
Function at 0x449c30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4bf454]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push str.Process_focus_restoration_in_the_RfbKeySym_class
mov dword [ebp - 0x20], esi
push dword [esi + 0x210]
call fcn.00443c30
lea eax, [esi + 8]
mov dword [ebp - 0x10], 0x12a2a311
add esp, 8
mov dword [ebp - 0xc], 0xa110a4a5
xor edi, edi
mov byte [ebp - 8], 0xa0
add esi, 0x108
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
nop
mov bl, byte [ebp + edi - 0x10]
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dx, ax
mov eax, dword [ebp - 0x18]
sar dx, 8
shr dl, 7
mov ch, dl
mov byte [ebp - 0x24], dl
shl ch, 7
mov byte [eax + esi], ch
cmp bl, 0x11
jne 0x449caf
mov al, 0xa2
jmp 0x449cc6
cmp bl, 0x12
jne 0x449cb8
mov al, 0xa4
jmp 0x449cc6
movzx eax, bl
cmp bl, 0x10
mov ebx, 0xa0
cmove eax, ebx
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 0x14], al
movzx eax, al
mov cl, byte [eax + ebx]
shr cl, 7
mov byte [eax + ebx], ch
cmp dl, cl
je 0x449cfe
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push eax
lea ecx, [ebx + 0x20a]
call fcn.0044f290
push dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp - 0x28]
call dword [eax + 4]
inc edi
cmp edi, 9
jl 0x449c80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464d5e
mov esp, ebp
pop ebp
ret
Function at 0x44ca10
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
mov dword [esi], vtable.Thread.0
push eax
push 4
push esi
push 0x44cac0
push 0
mov byte [esi + 0xc], 0
push 0
mov byte [esi + 0xd], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret

Function at 0x44ca80
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
mov byte [esi + 0xc], al
pop esi
ret

Function at 0x44e990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490850
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push 0x4947a4
mov eax, dword [ebx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44eac0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
and esi, 0xf
jbe 0x44ea12
movzx ecx, word [edi]
lea edi, [edi + ecx*2]
add edi, 2
sub esi, 1
jne 0x44ea04
movzx esi, word [edi]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041c970
add esi, esi
lea eax, [edi + 2]
push esi
push eax
push dword [ebp - 0x18]
call fcn.00466c70
mov eax, dword [ebp - 0x18]
add esp, 0xc
xor ecx, ecx
push dword [ebp + 0xc]
mov word [esi + eax], cx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x28]
call fcn.004501d0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044d3d0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004502c0
lea ecx, [ebp - 0x28]
call fcn.00450260
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x44eac0
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x44eab6
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ead6
push ecx
push edx
call fcn.00464d6f
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.004715c1
int3
Function at 0x451ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x451ffc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00452010

Function at 0x45c610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fd38
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.0044c870
mov ecx, dword [ebp + 8]
push dword [esi + 0x10]
mov dword [ebp - 4], 0
push dword [esi + 0xc]
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0x30]
lea ecx, [ebp - 0x14]
call fcn.0044c890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4603b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492140
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
call fcn.0044cc70
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x460535
lea eax, [ebp - 0xd]
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00423430
mov esi, dword [ebp - 0x2c]
push esi
push ebx
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x460535
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x4ab224
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x460535
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], 0x4ac318
movzx edx, word [eax + 0x16]
movzx ebx, word [eax + 0x12]
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x14]
cmp edx, 0x64
jbe 0x46048e
inc ecx
mov dword [ebp + 8], 0x49ba9c
add edx, 0xff9c
cmp cx, 0x64
jb 0x46048e
xor ecx, ecx
inc ebx
test dx, dx
jne 0x4604b0
test ax, ax
jne 0x4604d4
movzx eax, cx
push eax
movzx eax, bx
push eax
push str._d._d
push edi
call fcn.0044d0b0
add esp, 0x10
jmp 0x4604f2
test ax, ax
jne 0x4604d4
movzx eax, dx
push eax
push dword [ebp + 8]
movzx eax, cx
push eax
movzx eax, bx
push eax
push str._d._d_s_d
push edi
call fcn.0044d0b0
add esp, 0x18
jmp 0x4604f2
push eax
movzx eax, dx
push eax
push dword [ebp + 8]
movzx eax, cx
push eax
movzx eax, bx
push eax
push str._d._d_s_d._d
push edi
call fcn.0044d0b0
add esp, 0x1c
test esi, esi
je 0x46051f
mov ecx, dword [ebp - 0x24]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x460515
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46054b
push ecx
push esi
call fcn.00464d6f
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x54]
call fcn.00462ef0
push 0x4bbd64
lea eax, [ebp - 0x54]
push eax
call fcn.00466a95
call fcn.004715c1
int3
Function at 0x460570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x460597
mov esp, ebp
pop ebp
ret
push eax
lea ecx, [ebp - 0x28]
call fcn.00462e10
push 0x4bbd64
lea eax, [ebp - 0x28]
push eax
call fcn.00466a95
int3

Function at 0x460760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4921b0
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push esi
push edi
mov eax, dword [0x4bf454]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4607a3
push eax
call edi
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4607b4
push eax
call edi
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x38]
xorps xmm0, xmm0
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
test eax, eax
jne 0x460801
test edx, edx
jne 0x460801
test ecx, ecx
je 0x460808
or dword [ebp - 0x44], 0x100
lea ecx, [ebp - 0x1c]
call fcn.0044cc70
lea ecx, [esi + 0x14]
mov dword [ebp - 4], 0
call fcn.0044d220
test al, al
je 0x460828
lea eax, [esi + 4]
jmp 0x46084e
lea ecx, [esi + 0x14]
call fcn.00426960
push eax
lea ecx, [esi + 4]
call fcn.00426960
push eax
lea eax, [ebp - 0x1c]
push 0x49bb00
push eax
call fcn.0044d0b0
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044cb50
lea ecx, [ebp - 0x1c]
call fcn.0044cd00
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
movzx eax, byte [esi + 0x3c]
lea ecx, [ebp - 0x2c]
push 0
push 0
push 0
push eax
push 0
push 0
call fcn.00426960
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4608b7
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x80]
mov dword [esi + 0x24], eax
call fcn.0044cd00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xa8]
call fcn.00462ef0
push 0x4bbd64
lea eax, [ebp - 0xa8]
push eax
call fcn.00466a95
int3