joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdad0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5009ef
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x536008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a2e0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a2e0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a2e0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a2e0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a2e0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040a2e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4bdb60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5009ef
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x536008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a2e0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a2e0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a2e0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a2e0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a2e0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040a2e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c0fd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500ebf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x536008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0040abc0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0040abc0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.0040abc0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.0040abc0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.0040abc0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.0040abc0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3e90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x536008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4c3f12
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4c3f12
test ecx, ecx
je 0x4c3f0e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4c3ed0
xor eax, eax
jmp 0x4c3f17
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4c3f21
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e62ab
add esp, 0xc
ret 0xc
Function at 0x4c8e20
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x536008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4c8eb7
cmp dword [esp + 8], 6
jb 0x4c8eb7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004e62ab
add esp, 0x118
ret

Function at 0x4c8ee0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501e20
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x536008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.wintrust.dll
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040a350
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004b99f0
mov ecx, eax
call fcn.004b9ab0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
push 0xb
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x40]
push str.crypt32.dll
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.0040a350
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004b99f0
mov ecx, eax
call fcn.004b9ab0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a2e0
test ebx, ebx
je 0x4c903d
test esi, esi
je 0x4c903d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c98a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501e48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x536008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4c98df
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x4c98f1
mov al, 1
jmp 0x4c994e
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004ca400
test al, al
je 0x4c993b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x4c993b
mov bl, 1
jmp 0x4c993d
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e62ab
mov esp, ebp
pop ebp
ret

Function at 0x4c9970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501e48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x536008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c99a6
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4c9a0a
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004ca400
test al, al
je 0x4c99fb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e62ab
mov esp, ebp
pop ebp
ret
Function at 0x4c9a30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501e80
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x536008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x4c9a68
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c9a72
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4c9b2c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x41], al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.004ca400
movzx ecx, byte [ebp - 0x41]
test al, al
mov edx, 1
mov dword [ebp - 0x18], 0
cmovne ecx, edx
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], dl
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004ca400
test al, al
jne 0x4c9aef
cmp byte [ebp - 0x48], al
je 0x4c9b30
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4c9b30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a2e0
mov al, 1
jmp 0x4c9b4d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a2e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e62ab
mov esp, ebp
pop ebp
ret
Function at 0x4c9b70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x536008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4c9ba9
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4c9bb3
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0xb
push ecx
push eax
call ebx
test eax, eax
je 0x4c9bca
mov al, 1
jmp 0x4c9cf0
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x59], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.004ca400
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
mov dword [ebp - 0x18], 0
cmovne ecx, edx
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], dl
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004ca400
test al, al
jne 0x4c9c46
cmp byte [ebp - 0x60], al
je 0x4c9c66
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0xb
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
jne 0x4c9cba
mov ecx, esi
call fcn.004c9970
cmp eax, 0xffffffff
je 0x4c9cd1
push esi
lea ecx, [ebp - 0x58]
call fcn.0040abc0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.004ca1c0
test al, al
je 0x4c9cc5
lea edx, [ebp - 0x58]
mov ecx, esi
call fcn.004c9a30
test al, al
je 0x4c9cc5
mov edx, esi
mov ecx, edi
call fcn.004c9a30
lea ecx, [ebp - 0x58]
test al, al
je 0x4c9cbe
call fcn.004c9d10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0040a2e0
mov bl, 1
jmp 0x4c9cd3
mov edx, esi
call fcn.004c9a30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0040a2e0
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a2e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e62ab
mov esp, ebp
pop ebp
ret
Function at 0x4c9d10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501f10
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x536008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c9d47
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4c9d5b
mov al, 1
jmp 0x4c9ee2
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x4c9d65
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c9d90
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040a350
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004c9970
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
cmp ebx, 0xffffffff
jne 0x4c9dd8
xor al, al
jmp 0x4c9ee2
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x4c9de2
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c9e10
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040a350
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004c98a0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
test bl, bl
je 0x4c9dd1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c9e59
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x4c9d54
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004ca400
test al, al
je 0x4c9ea3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x4c9ea3
mov bl, 1
jmp 0x4c9ed1
cmp dword [esi + 0x14], 8
jb 0x4c9eab
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x44]
call fcn.0040a100
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004c98a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.0040a2e0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a2e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e62ab
mov esp, ebp
pop ebp
ret
Function at 0x4c9f20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x536008]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4c9f5e
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x4c9f66
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4c9fc6
xor eax, eax
lea edx, [esp + 0xc]
mov word [esp + 0x216], ax
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4c9f90
sub edx, esi
lea eax, [esp + 0xc]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.0040a350
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e62ab
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e62ab
add esp, 0x210
ret
Function at 0x4cc4d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x536008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4cc535
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cc510
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4cc535
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004e62ab
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004e62ab
add esp, 8
ret 4
Function at 0x4e2110
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4e211b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004e2130
Function at 0x4576f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx + edx*2 + 8]
test ecx, ecx
leave
mov dl, 3
xor esi, dword [ecx - 0x6627743d]
mov fs, edx
pop ds
fld st(2)
mov edx, dword [esp + 4]
sar eax, 5
cmp dword [edx + 4], eax
jle 0x4576f8
and ecx, 0xd6009e1f
mov edx, dword [edx]
jns 0x45771e
dec ecx
test ecx, ecx
loopne 0x45779d
mov eax, dword [edx + eax*4]
shr eax, cl
and eax, 1
ret
mov ebx, es
int3

Function at 0x4eb7b0
Capabilities:
Encode data using xor

Disassembly:
int3
push ebp
jno 0x4eb82c
invalid
sub eax, 0x8b397e8b
inc edi
pushal
mov ecx, dword [eax]
xor edx, dword [edi + 0x32]
mov dword [edi + 0x60], ecx
mov dword [eax], edx
xor cl, byte [ecx + 0x1089604f]
mov dword [edi + 0x3c], eax
and byte [eax + 5], 0xef
cmp byte [edi + 0x35], bh
add dword [edx - 0xeabfab8], ecx
xchg ecx, eax
push edi
xor al, 0x80
loop 0x4eb7e1
enter 0xffffffffffffb863, 0xa
ror dword [eax + 0x45890550], 1
invalid
jo 0x4eb7af
cli
jbe 0x4eb7d6
neg ecx

Function at 0x4edda0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
mov esp, ecx
mov eax, dword [ebp - 0x25]
or esi, 8
or cx, word [edi]
mov dl, 0xf
push 0xccaa0ec
mov cl, byte [ecx + 0x46c3240b]
sub dword [0xc9754e08], 0xffffff8b
pop ebp
or al, 0xf6
inc ebx
add eax, 0x8b117404
push ebp
aaa
push eax
arpl word [edx - 0x18], dx
xchg ebp, eax
fdiv st(7), st(0)
jmp [edx - 0x3b7cc2bb]
mov dword [ebx + 0x20], eax
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp - 0x40]
mov ebx, dword [edi + 0x10]
jg 0x4eddcc
xor al, 0x8b
jo 0x4eddaf
and eax, 0x7785d366
and eax, 0x3f
lea edx, [eax - 6]
mov dword [eax - 4], eax
je 0x4edd93
sbb al, 0xf
xchg dword [0xf000001], esi
mov dh, 0x92
xchg edx, eax
and bh, bl
jp 0x4edd57
les esp, [edx*4 + 0x4edf22]
mov eax, dword [edi + 0x12]
xor al, ch
or byte [esi + 0x1006086c], bh
shr esi, 6
adc edx, 0x8d00ff
mov dword [edx], edx
dec ebx
inc eax
add al, 0x5f
mov dword [eax], esi
int1
add al, 0xff
pop ebx
mov esp, ebp
retf 0x8bc3

Function at 0x50c4ae
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test edx, edx
jne 0x50c4c8
call dword [0x828618]
inc esi
add dh, byte [ebx]
push ds
xor ebx, dword [esi]
test eax, eax
je 0x50c4da
push eax
call fcn.005022a5
pop ecx
or eax, 0xffffffff
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x50d4c1
Capabilities:
Encode data using xor

Disassembly:
sar dword [0x84f30400], cl
sbb eax, 0xb7b2ed13
invalid
Function at 0x50ec60
Capabilities:
Create process on windows

Disassembly:
and al, 0x56
call fcn.00511180
aam 0x7c
cmp byte [ecx], al
push 1
push edi
call fcn.005137f0
add esp, 0x14
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x50ee5f
add al, byte cs:[eax]
add byte [edi], ah
daa
jne 0x50ec10
push edi
push eax
call fcn.0050377c
add esp, 0x5a
cmp eax, ebx
jne 0xffbbeb8b
push esi
push edi
push dword [ebp - 0x1c]
call fcn.00503ddf
add esp, 0xc
sub ebx, eax
bswap eax
xor ah, ah
invalid
jne 0x50ec87
call fcn.00503ddf
jl 0x50ec2d
or al, 0x3b
ret
fsub st(0), st(0)
inc esp
mov edi, edi
pop ebx
pop ecx
pop ecx
test eax, eax
mov eax, dword [0x90458d26]
push eax
aaa
test dword [edi + edi*8 - 1], ecx
call dword [eax + 0x5f]
dec esp
push ebx
push 1
push ebx
popfd
push dword [ebp - 0x1c]
xchg edi, eax
loope 0x50ec7f
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x44], eax
jmp 0xe9f8ee77
inc dword [edx]
aam 0xe8
ljmp 0xef8b
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x12470389
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3a682e1b
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219