joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483900
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor bl, bl
mov dword [ebp - 0x43c], ecx
push edi
mov byte [ebp - 0x431], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x438], eax
cmp eax, 0xffffffff
jne 0x483951
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x483a19
push 0xffffffffffffffff
mov edx, 0xfde9
lea ecx, [ebp - 0x410]
call fcn.00419bb0
mov edi, eax
add esp, 4
cmp edi, str.winex11.drv
je 0x4839ab
test edi, edi
je 0x4839b2
push str.winex11.drv
push edi
call fcn.004c97f3
add esp, 8
test eax, eax
sete al
test al, al
je 0x4839b2
mov byte [ebp - 0x431], 1
push 0xffffffffffffffff
mov edx, 0xfde9
lea ecx, [ebp - 0x210]
call fcn.00419bb0
mov esi, eax
push esi
push edi
push dword [ebp - 0x418]
push dword [ebp - 0x41c]
push str.Module:__p__06X___16s__s_r_n
push dword [ebp - 0x43c]
call fcn.0040bee0
add esp, 0x1c
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_Module32NextW]
push esi
mov ebx, eax
call fcn.004bf8aa
push edi
call fcn.004bf8aa
add esp, 8
test ebx, ebx
jne 0x483971
mov bl, byte [ebp - 0x431]
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x483d50
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x483d9f
push str.DetectExeType__:_failed_to_detect_type
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x483e6f
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
jmp 0x483dd0
lea eax, [ebp - 0x410]
push 0x4f9044
push eax
call fcn.004c8f6f
add esp, 8
test eax, eax
sete al
test al, al
jne 0x483e6a
push 0xb
lea eax, [ebp - 0x410]
push 0x4f902c
push eax
call fcn.004c98d5
add esp, 0xc
test eax, eax
sete al
test al, al
je 0x483e52
lea eax, [ebp - 0x410]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x483e15
sub eax, edx
sar eax, 1
cmp eax, 0xb
jb 0x483e52
lea eax, [ebp + eax*2 - 0x426]
cmp eax, str.install.exe
je 0x483e66
test eax, eax
je 0x483e52
push str.install.exe
push eax
call fcn.004c8f6f
add esp, 8
test eax, eax
sete al
test al, al
jne 0x483e66
lea eax, [ebp - 0x430]
push eax
push esi
call edi
test eax, eax
jne 0x483dd0
jmp 0x483e6f
xor ebx, ebx
jmp 0x483e6f
mov ebx, 2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret

Function at 0x483ec0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x483fad
mov ecx, edx
call fcn.00483bf0
test al, al
je 0x483fad
call fcn.00483c60
test al, al
je 0x483fad
call fcn.00483a40
test al, al
jne 0x483fad
call fcn.00483b10
call fcn.00483d50
push 8
mov dword [0x569128], eax
call fcn.004bcd25
add esp, 4
mov esi, eax
push 0
push 0x20000
push 0
mov dword [esi], 0x4f9078
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x4ef194
push str.https:__kjkpub.s3.amazonaws.com_sumatrapdf_rel_SumatraPDF_3.1.2
push str._s_s.pdb.lzsa
mov dword [esi + 4], eax
mov dword [0x56bf38], esi
call fcn.00419f30
add esp, 0xc
mov dword [0x56bf24], eax
push edi
call fcn.004c91a0
add esp, 4
mov dword [0x56bf18], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x56bf28], eax
test eax, eax
je 0x483fad
push 0
push 0
push 0
push 0x4831c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x56bf14], eax
test eax, eax
je 0x483fad
push 0x483210
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x483e90
push 0x16
mov dword [0x56bf3c], eax
call fcn.004cc5c9
add esp, 8
pop edi
pop esi
pop ecx
ret
Function at 0x486020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 0x14]
mov dword [ebp - 4], ecx
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x34]
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x20]
mov esi, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
add eax, ecx
sub ebx, eax
lea eax, [edx + esi]
sub edi, eax
test ebx, ebx
jle 0x48605b
test edi, edi
jg 0x48605f
xor edi, edi
xor ebx, ebx
test ebx, ebx
je 0x486141
test edi, edi
je 0x486141
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 8], ecx
je 0x486141
cmp dword [eax + 0x40], ebx
jne 0x486090
cmp dword [eax + 0x44], edi
je 0x486141
mov ecx, eax
mov dword [eax + 0x40], ebx
mov dword [eax + 0x44], edi
call fcn.00485d20
push 0x54
call fcn.004bcd25
mov esi, eax
add esp, 4
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0x400
mov dword [esi + 0xc], ecx
mov ecx, esi
mov dword [esi + 0x50], 0
call fcn.0040be50
mov ecx, dword [ebp - 4]
lea eax, [ecx + 0x1c]
mov dword [ecx + 0x34], esi
push eax
sub esp, 0x10
mov ecx, esp
push dword [ebp - 8]
call fcn.00488530
mov edx, edi
mov ecx, ebx
call fcn.00485350
add esp, 0x14
mov esi, eax
push 0x43c
call fcn.004bcd25
mov ebx, dword [ebp - 4]
add esp, 4
mov edi, eax
push dword [ebx + 4]
lea eax, [ebx + 0xc]
push dword [ebx + 0x3c]
push ebx
push esi
sub esp, 0x10
mov ecx, esp
push eax
call fcn.00488530
mov ecx, edi
call fcn.00485560
push 0
push 0
mov esi, eax
push esi
push 0x420da0
push 0
mov dword [ebx + 0x48], esi
mov ecx, dword [esi + 4]
push 0
mov dword [ebx + 0x4c], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, ebx
mov dword [esi + 8], eax
call fcn.00486410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4883e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x58], 0
je 0x4884a9
mov ecx, dword [ebx]
call fcn.00487cb0
mov esi, eax
test esi, esi
je 0x4884a0
mov ecx, esi
call fcn.0041cd60
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x488438
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test al, al
je 0x488497
mov edx, 0x4f1664
mov ecx, esi
call fcn.004198b0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
mov eax, dword [ebx + 0x58]
push 0
push dword [eax]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
call fcn.00428de0
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax + 0xc]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
push ebx
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
push edi
call fcn.004bf8aa
add esp, 4
push esi
call fcn.004bf8aa
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret

Function at 0x4884c0
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.004882b0
test al, al
je 0x48851f
mov ecx, dword [edi]
call fcn.00487cb0
mov esi, eax
test esi, esi
je 0x4884ec
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4884ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [edi + 0x58]
test ebx, ebx
je 0x48850f
push dword [ebx]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push ebx
call fcn.004bcfc5
add esp, 8
push esi
mov dword [edi + 0x58], 0
call fcn.004bf8aa
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x48c7f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x56cc50]
push ebx
push esi
push edi
test eax, eax
je 0x48c827
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
cmp word [0x56cc54], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jne 0x48c872
push 0x48c5f0
mov edx, str.SUMATRA_PDF_ABOUT
lea ecx, [ebp - 0x98]
call fcn.00416a60
add esp, 4
push 1
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov word [0x56cc54], ax
push 0
push 0
call esi
push eax
push 0
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0xc80000
mov ecx, str.About_SumatraPDF
call fcn.00489000
push eax
push str.SUMATRA_PDF_ABOUT
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [0x56cc50], esi
test esi, esi
je 0x48c9c3
mov ecx, dword [0x56c02c]
cmp ecx, 2
je 0x48c8dc
cmp ecx, 0x17
je 0x48c8dc
cmp ecx, 0x1f
je 0x48c8dc
cmp ecx, 0x27
je 0x48c8dc
xor ebx, ebx
jmp 0x48c8e1
mov ebx, 1
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
test bl, bl
je 0x48c8f8
or ecx, 0x500000
jmp 0x48c8fe
and ecx, 0xffafffff
cmp ecx, eax
je 0x48c90c
push ecx
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x58], 0
push eax
push dword [0x56cc50]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
push 0
push esi
call dword [sym.imp.GDI32.dll_SetLayout]
mov ecx, dword [0x56cc50]
lea eax, [ebp - 0x58]
push eax
mov edx, esi
call fcn.0048bd80
add esp, 4
lea eax, [ebp - 0x48]
push eax
push dword [0x56cc50]
call dword [sym.imp.USER32.dll_EndPaint]
mov esi, dword [ebp - 0x50]
lea ecx, [ebp - 0x58]
mov edi, dword [ebp - 0x4c]
add esi, 0x10
push dword [0x56cc50]
add edi, 0x10
call fcn.00401190
push dword [0x56cc50]
lea ecx, [ebp - 0x68]
call fcn.00401120
sub edi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x4c]
sub esi, dword [ebp - 0x60]
add eax, edi
mov ecx, dword [ebp - 0x50]
push 0
push eax
add ecx, esi
push ecx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [0x56cc50]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [0x56cc50]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x498d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx], 0
jne 0x498d4d
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.0041d720
add esp, 4
pop ebp
ret 0xc
push ebx
push esi
sub esp, 8
push dword [ebp + 8]
call fcn.00498cb0
mov esi, eax
cmp esi, 0xffffffff
jne 0x498d72
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 8]
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x498da2
cmp edi, dword [ebp + 8]
jne 0x498da2
pop edi
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret 0xc
pop edi
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret 0xc

Function at 0x49b030
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x56c2bc], 0
push ebx
mov ebx, ecx
push edi
mov dword [ebp - 0x2c], ebx
jne 0x49b108
push esi
mov ecx, str.unrar.dll
call fcn.0041d3c0
mov esi, eax
test esi, esi
je 0x49b0fe
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x49b0fe
test byte [ebp - 0x28], 0x10
jne 0x49b0fe
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x49b0fe
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RAROpenArchiveEx
push edi
call ebx
mov dword [0x56c2c8], eax
test eax, eax
jne 0x49b0b3
push esi
call fcn.004bf8aa
mov ebx, dword [ebp - 0x2c]
jmp 0x49b104
push str.RARReadHeaderEx
push edi
call ebx
mov dword [0x56c2c4], eax
test eax, eax
je 0x49b0a8
push str.RARProcessFile
push edi
call ebx
mov dword [0x56c2f4], eax
test eax, eax
je 0x49b0a8
push str.RARCloseArchive
push edi
call ebx
mov dword [0x56c2c0], eax
test eax, eax
je 0x49b0a8
push str.RARGetDllVersion
push edi
call ebx
push esi
mov dword [0x56c2bc], eax
call fcn.004bf8aa
mov ebx, dword [ebp - 0x2c]
jmp 0x49b104
push esi
call fcn.004bf8aa
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x4a40a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4a40c0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4a40e9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4a40e6
inc esi
cmp esi, edx
jb 0x4a40d7
mov ecx, dword [ebp - 4]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4a41f9
cmp ecx, 3
jbe 0x4a4128
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x4a4166
cmp cl, 0xff
je 0x4a4166
mov edx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 4]
jmp 0x4a40d0
dec ecx
shl eax, cl
and eax, 7
je 0x4a4100
movzx ecx, byte [eax + 0x4ed9ec]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x4ed9e4], 0
mov cl, byte [edx + 4]
je 0x4a4150
test cl, cl
je 0x4a4150
cmp cl, 0xff
jne 0x4a4100
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4a40d0
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x4a41c2
movzx edx, byte [eax + 0x4ed9ec]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4a41ae
cmp dl, 0xff
jne 0x4a41c2
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x4a4184
mov edx, dword [ebp - 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 4]
jmp 0x4a40d0
pop esi
pop ebx
cmp ecx, 3
jbe 0x4a420e
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4ba180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov ecx, dword [esi]
cmp ecx, 0xffffffff
jne 0x4ba19f
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call ebx
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [esi]
call ebx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x4ba1f0
mov edi, dword [ebp - 4]
jmp 0x4ba1f2
xor edi, edi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [esi]
call ebx
mov eax, edi
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d649c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d615c

Function at 0x4dbf76
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dbdf5
Function at 0x401100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov edi, 0x1c
test eax, eax
je 0x401205
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x401205
cmp eax, edx
jae 0x401205
mov ecx, 0x743f
mov eax, 0xb11fd3b9
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401130
mov ecx, 0xf4
mov ebx, 0x62fd
nop
mov eax, 0x151d07eb
imul ebx
sar edx, 3
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401150
mov ebx, 0x5eba
mov esi, 0x6eab
lea ecx, [ecx]
mov eax, 0x2c0b02c1
imul esi
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401170
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov edx, 0x21
mov dword [ebp + 0xc], eax
mov eax, 0x3ac9
cmp edi, edx
cmovg edi, edx
dec eax
jne 0x401196
mov edi, edi
mov eax, 0x2fa0be83
imul ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4011a0
mov eax, 0x7945
mov edx, 0xd3
lea ecx, [ecx]
cmp ecx, edx
cmovl ecx, edx
dec eax
jne 0x4011c0
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
test ebx, ebx
je 0x4011e2
mov edx, dword [ebp + 8]
mov al, byte [ecx + edx + 1]
add al, 0x17
xor byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x4011d4
inc esi
mov eax, 0x66666667
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x4011fd
inc esi
cmp esi, 0x68fb
jl 0x4011e2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, 0x89
push edi
mov esi, 0x3504
mov ecx, 0x8c7
lea edi, [ebx + 0x3d]
lea esp, [esp]
mov eax, 0x5397829d
imul esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x403040
mov edx, dword [ebp + 8]
add edx, 0xd
mov dword [ebp - 4], edx
mov eax, 0x6983
mov esi, 0x8c
cmp ebx, esi
cmovg ebx, esi
dec eax
jne 0x403066
mov ebx, dword [ebp + 8]
inc byte [ebx + 0x123]
movzx esi, byte [ebx + 0x123]
movzx eax, byte [ebx + 8]
add esi, edx
movzx edx, byte [esi]
add eax, edx
movzx edx, al
add edx, ebx
mov byte [ebx + 8], al
movzx eax, byte [edx + 0xd]
mov bl, byte [esi]
mov byte [esi], al
mov byte [edx + 0xd], bl
mov bh, byte [esi]
add bh, bl
mov edx, 0x4630
mov esi, 0xac
mov eax, 0x91
nop
cmp eax, 0xac
cmovg eax, esi
dec edx
jne 0x4030b0
mov edx, dword [ebp - 4]
movzx eax, bh
mov bl, byte [eax + edx]
mov eax, 0x99d722db
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4030c4
mov eax, 0x7a16
mov ecx, 0xf6
cmp edi, ecx
cmovl edi, ecx
dec eax
jne 0x4030e3
movzx ecx, byte [ebp + 0xc]
movzx eax, bl
pop edi
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001aa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0x10009164
xor edx, edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 8]
shr ecx, 4
je 0x10001b86
mov ebx, dword [edi]
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
shr ebx, 0x10
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
mov ebx, dword [edi + 4]
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
shr ebx, 0x10
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
mov ebx, dword [edi + 8]
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
shr ebx, 0x10
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
mov ebx, dword [edi + 0xc]
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
shr ebx, 0x10
mov dl, al
shr eax, 8
xor dl, bl
xor eax, dword [esi + edx*4]
mov dl, al
shr eax, 8
xor dl, bh
xor eax, dword [esi + edx*4]
add edi, 0x10
dec ecx
jne 0x10001ac5
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
and ecx, 0xf
je 0x10001ba0
mov dl, al
mov bl, byte [edi]
shr eax, 8
xor edx, ebx
inc edi
xor eax, dword [esi + edx*4]
dec ecx
jne 0x10001b90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001cb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov ecx, 0xc
lea eax, [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x3c]
push esi
push edi
mov esi, ebx
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
mov edx, ecx
mov esi, dword [eax - 4]
mov edi, dword [eax]
xor edi, esi
dec ecx
mov dword [eax], edi
sub eax, 4
dec edx
jne 0x10001cd2
mov edi, dword [esp + ecx*4 + 0xc]
lea eax, [esp + ecx*4 + 0xc]
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0xc]
xor edi, ecx
push edx
mov dword [eax], edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.10001000
mov esi, eax
add esp, 4
test esi, esi
je 0x10001d21
mov eax, dword [esi]
push edi
add ebx, 0x30
push 0
push ebx
push 0
mov ecx, esi
call dword [eax + 4]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x10001d32
push eax
call fcn.100010f0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret