joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c47bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.004d7c10
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4c4826
lea eax, [ebp - 0x20c]
push 0x6194dc
push eax
call fcn.004ddf30
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004c3b56
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484636
mov esp, ebp
pop ebp
ret 4

Function at 0x4c8bcf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x4c8bd7
mov dword [edx*4 + 0x63b720], ecx
inc edx
cmp edx, 0x100
jb 0x4c8bd2
mov esi, 0x800
jmp 0x4c8c20
mov ecx, dword [edx*4 + 0x63b320]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x63b720]
mov dword [edx*4 + 0x63b720], ecx
inc edx
cmp edx, esi
jb 0x4c8c04
mov dword [0x63d720], 0x4c4bf0
call fcn.004c8fe2
mov ecx, dword [0x63d720]
test eax, eax
mov edx, 0x4c4c89
cmove ecx, edx
mov dword [0x63d720], ecx
pop esi
ret

Function at 0x4c9099
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x4c90ab
xor eax, eax
jmp 0x4c90d2
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
push 1
push dword [ebp + 0xc]
call fcn.004df278
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
jne 0x4c90c9
xor eax, eax
jmp 0x4c90d1
push dword [ebx]
call fcn.004ee0c2
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4c9125
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
jne 0x4c9137
xor eax, eax
jmp 0x4c915e
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
push 1
push dword [ebp + 0xc]
call fcn.004de4db
add esp, 0x10
mov dword [edi], eax
cmp eax, esi
jne 0x4c9155
xor eax, eax
jmp 0x4c915d
push dword [ebx]
call fcn.004ee0c2
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4c9cec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x4c9d0d
xor eax, eax
jmp 0x4c9e62
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
mov edx, dword [ebp + 8]
push ebx
or ebx, 0xffffffff
add ecx, edx
mov dword [ebp - 8], ecx
add edx, edi
mov dword [ebp - 4], edx
cmp edx, ecx
jae 0x4c9d39
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x4c9d36
inc edx
cmp edx, ecx
jb 0x4c9d29
mov dword [ebp - 4], edx
mov edi, edx
sub edi, dword [ebp + 8]
cmp edx, ecx
jae 0x4c9e46
mov ecx, edi
sub ecx, ebx
cmp ecx, 3
jbe 0x4c9d71
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test al, al
je 0x4c9dae
cmp al, 0xff
je 0x4c9dae
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x4c9e3f
dec ecx
shl esi, cl
and esi, 7
je 0x4c9d51
movzx eax, byte [esi + 0x5bd160]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x5bd158], 0
mov al, byte [ecx + 4]
je 0x4c9d98
test al, al
je 0x4c9d98
cmp al, 0xff
jne 0x4c9d51
and esi, 3
mov ebx, edi
add esi, esi
or esi, 1
inc edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
jmp 0x4c9d20
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 0x10]
shl ebx, 8
or ebx, eax
cmp dword [ebp + 0x18], 0
je 0x4c9ddb
add ebx, edi
add ebx, edx
jmp 0x4c9ddf
sub ebx, edi
sub ebx, edx
mov dword [ebp + 0xc], ebx
test esi, esi
je 0x4c9e15
movzx eax, byte [esi + 0x5bd160]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x4c9e04
cmp al, 0xff
jne 0x4c9e15
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0xc]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp + 0xc]
jmp 0x4c9dcf
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x10]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
add edi, eax
jmp 0x4c9da3
mov edx, edi
xor eax, eax
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp edx, 3
cmova esi, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ca253
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4cac44
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xfa4]
push edi
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x5bd660
call fcn.004d915b
pop ecx
lea ecx, [ebp - 0xfa4]
lea eax, [ecx + eax*2]
push eax
call fcn.004d95d7
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.004ddf30
push 0x3c
xor edi, edi
lea eax, [ebp - 0xfe0]
push edi
push eax
call fcn.004d7c10
add esp, 0x1c
mov dword [ebp - 0xfdc], 0x200
xor eax, eax
mov dword [ebp - 0xfcc], esi
inc eax
mov ecx, str.open
mov dword [ebp - 0xfd4], ecx
push eax
push edi
push edi
push esi
push ecx
push edi
mov dword [ebp - 0xfc4], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4cacf5
push edi
push edi
lea eax, [ebp - 0xfa4]
push edi
push eax
call fcn.004b4b35
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00484636
mov esp, ebp
pop ebp
ret 4

Function at 0x4caddd
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4cae25
xor eax, eax
jmp 0x4caf0f
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004d7c10
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x6172ac
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4caef1
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004d7c10
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push str.Internet_Exploreriexplore.exe
push eax
call fcn.004ddf30
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cae1e
lea ecx, [ebp - 0x20c]
push ecx
push esi
call fcn.004d95d7
pop ecx
pop ecx
jmp 0x4caf0c
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004d95d7
pop ecx
pop ecx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00484636
mov esp, ebp
pop ebp
ret 4
Function at 0x4caf3e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor ebx, ebx
push 0x208
push ebx
push eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x21c], ebx
call fcn.004d7c10
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push 0x20019
push ebx
push str.http
push SysReAllocStringLen
call esi
test eax, eax
je 0x4cafb0
xor eax, eax
jmp 0x4cb059
lea eax, [ebp - 0x210]
push eax
push 0x20019
push ebx
push str.shell
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x4cafa9
lea eax, [ebp - 0x214]
push eax
push 0x20019
push ebx
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x4cafa9
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push 0x6172ac
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004e7bc2
push edi
push eax
call fcn.004d7710
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484636
mov esp, ebp
pop ebp
ret 4
Function at 0x4cc206
Capabilities:
Get disk information

Disassembly:
push 0x4e0
mov eax, 0x5a66dd
call fcn.00485177
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x4e0]
mov ebx, dword [ebp + 0xc]
xor edi, edi
push edi
xor eax, eax
mov dword [ebp - 0x4ec], edi
push 0x6172ac
mov dword [ebp - 0x4cc], 7
mov dword [ebp - 0x4d0], edi
mov word [ebp - 0x4e0], ax
call fcn.00427e30
mov dword [ebp - 4], edi
test ebx, ebx
je 0x4cc33c
lea eax, [ebp - 0x4c8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4cc33c
mov dword [ebp - 0x4e4], edi
cmp word [ebp - 0x4c8], di
je 0x4cc33c
and dword [ebp - 0x4e8], 0
lea edi, [ebp - 0x4c8]
push 0x5bd37c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4cc310
push 0x5bd384
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4cc310
mov ax, word [edi]
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x4e8]
push 0x64
mov ax, word [ebp + eax - 0x4c6]
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4cc3ba
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0xe0]
push edi
push eax
push ebx
call fcn.004ee0ed
add esp, 0xc
test eax, eax
je 0x4cc362
mov eax, dword [ebp - 0x4e4]
lea edi, [ebp - 0x4c8]
add eax, 4
mov dword [ebp - 0x4e4], eax
add eax, eax
add edi, eax
mov dword [ebp - 0x4e8], eax
xor eax, eax
cmp word [edi], ax
jne 0x4cc292
xor edi, edi
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
call fcn.0042ef80
push edi
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00427d40
mov eax, esi
call fcn.00485121
ret 8
cmp word [ebp - 0x18], 0
jne 0x4cc36d
xor eax, eax
jmp 0x4cc377
lea eax, [ebp - 0x18]
push eax
call fcn.004d915b
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.00428a20
lea edi, [ebx + edi*2]
xor ebx, ebx
cmp word [edi], bx
jne 0x4cc395
mov eax, ebx
jmp 0x4cc39c
push edi
call fcn.004d915b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x4e0]
call fcn.00428a20
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
call fcn.0042ef80
push ebx
jmp 0x4cc34b
xor ecx, ecx
mov dword [esi + 0x14], 7
xor eax, eax
mov dword [esi + 0x10], ecx
mov word [esi], ax
push ecx
jmp 0x4cc34b
Function at 0x4cca50
Capabilities:
Encode data using xor

Disassembly:
push 0x78
mov eax, 0x5a6840
call fcn.00485177
mov esi, ecx
mov dword [ebp - 0x50], esi
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x4cca8e
xor ebx, ebx
push ebx
call fcn.004de7f4
mov dword [esi], eax
imul eax, dword [esi + 8], 0x3c
pop ecx
mov dword [esi + 4], edx
test eax, eax
jle 0x4cca9c
push eax
push ebx
call fcn.004b63b2
cdq
add dword [esi], eax
pop ecx
adc dword [esi + 4], edx
jmp 0x4cca9b
xor ebx, ebx
push ebx
call fcn.004de7f4
mov dword [esi], eax
mov dword [esi + 4], edx
pop ecx
push 0x1869f
push 0x2710
call fcn.004b63b2
pop ecx
pop ecx
lea ecx, [esi + 0xa8]
mov edi, eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00427990
xor eax, eax
mov dword [ebp - 4], ebx
inc eax
cmp dword [ebp - 0x18], 0
je 0x4ccbe9
push str._rand
call fcn.004d90d0
pop ecx
push eax
push str._rand
lea ecx, [ebp - 0x28]
call fcn.0042f7d0
mov eax, edi
cdq
push edx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004b7285
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0042f890
xor eax, eax
mov byte [ebp - 4], bl
push ebx
inc eax
lea ecx, [ebp - 0x40]
push eax
call fcn.00427fb0
lea ecx, [ebp - 0x84]
call fcn.00588d40
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00588a00
lea ecx, [ebp - 0x84]
call fcn.00588950
push 1
mov dword [ebp - 0x44], eax
mov edi, dword [eax + 4]
sub edi, dword [eax]
pop eax
cmove edi, eax
inc edi
push edi
call fcn.004846b0
mov dword [ebp - 0x48], eax
pop ecx
test eax, eax
je 0x4ccbdb
push edi
push ebx
push eax
call fcn.004d7c10
push 0x5bd140
mov edi, ebx
call fcn.004d90d0
mov dword [ebp - 0x4c], eax
add esp, 0x10
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
je 0x4ccbb8
mov edx, dword [ebp - 0x48]
mov esi, ebx
mov ecx, dword [eax]
mov al, byte [ecx + esi]
xor al, byte [edi + 0x5bd140]
inc edi
mov ecx, dword [ebp - 0x44]
mov byte [esi + edx], al
xor eax, eax
cmp edi, dword [ebp - 0x4c]
cmovge edi, eax
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
inc esi
cmp esi, eax
mov eax, ecx
jb 0x4ccb8f
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x48]
mov ecx, esi
push edi
call fcn.004cc819
push edi
test al, al
jne 0x4ccbcf
call fcn.00484647
jmp 0x4ccbda
call fcn.00484647
xor eax, eax
inc eax
mov byte [esi + 0xc], al
pop ecx
lea ecx, [ebp - 0x84]
call fcn.00588cd0
xor eax, eax
inc eax
push ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.00427fb0
call fcn.00485121
ret

Function at 0x4ccc06
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
mov eax, esi
setne dl
mov dword [esi + 4], edx
pop esi
pop ebp
ret 4
Function at 0x4cdfe6
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x5b3f38
mov esi, ecx
call ebx
mov dword [esi], eax
test eax, eax
je 0x4ce066
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5bda70
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GetSystemWow64DirectoryW
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x4ce065
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push eax
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret

Function at 0x4ce136
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x4ce203
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5aac00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5aac00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5aac00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5aac00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.004d9040
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x4ce1df
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.004d9040
pop ecx
pop ecx
test eax, eax
je 0x4ce220
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x4ce169
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.004d90d0
pop ecx
test eax, eax
je 0x4ce220
push ebx
mov ecx, edi
call fcn.004ceb62
mov al, 1
jmp 0x4ce222
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ceaa5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 0x114
push edi
push ebx
xor edi, edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.004d7c10
add esp, 0xc
mov dword [ebp - 0x118], ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x4ceb06
mov ecx, esi
call fcn.004ce4fc
jmp 0x4ceb1b
mov ebx, edi
test edi, edi
jne 0x4ceb1b
mov ecx, esi
call fcn.004ce3d7
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x4ceb08
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484636
mov esp, ebp
pop ebp
ret

Function at 0x4d220f
Capabilities:
Check if file exists
Delete file
Download url
Receive data

Disassembly:
push 0x20c
mov eax, 0x5a7003
call fcn.00485177
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d224e
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004d7c10
push 0x98967f
push 0xf4240
call fcn.004b63b2
add esp, 0x14
cmp dword [esi + 0x14], 8
jb 0x4d227a
mov esi, dword [esi]
push eax
push esi
lea eax, [ebp - 0x218]
push str._s__d
push eax
call fcn.00430670
add esp, 0x10
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
cmovae eax, dword [ebp + 0xc]
push ebx
push ebx
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x4d22c7
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d22c7
mov bl, 1
push 0
push 1
lea ecx, [ebp + 0xc]
call fcn.00427d40
mov al, bl
call fcn.00485121
ret 0x1c
Function at 0x4d2483
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x840
mov eax, 0x5a708b
call fcn.00485177
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x830]
mov esi, dword [ebp + 0xc]
mov ebx, 0x208
and dword [ebp - 0x84c], 0
push ebx
push 0
push eax
call fcn.004d7c10
lea eax, [ebp - 0x848]
push esi
push eax
call fcn.004b7ffd
xor esi, esi
lea ecx, [ebp - 0x830]
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
push ecx
cmovae eax, dword [ebp - 0x848]
push eax
mov dword [ebp - 4], esi
call fcn.004b5976
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004d7c10
push ebx
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.004d7c10
push ebx
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.004d7c10
add esp, 0x40
lea eax, [ebp - 0x420]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004d95d7
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004ddf30
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d2582
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.004276b0
push 0
push 1
lea ecx, [ebp - 0x848]
call fcn.00427d40
mov eax, edi
call fcn.00485121
ret 8
Function at 0x4d460f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x62b370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x4d46a4
lea ecx, [eax + 0x80]
add eax, 0x100
dec edi
mov dword [ebp - 0x14], ecx
shr edi, 3
inc edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
mov edx, ebx
mov ecx, esi
push 8
sub edx, esi
pop edi
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x4d4654
push 8
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004d4c70
push esi
push esi
push dword [ebp - 0x14]
call fcn.004d38f5
mov edx, dword [ebp - 0x18]
add esp, 0x18
xor ecx, ecx
mov al, byte [edx + ecx]
xor byte [esi + ecx], al
inc ecx
cmp ecx, 8
jl 0x4d467d
push 8
lea eax, [ebp - 0xc]
push eax
push edx
call fcn.004d4c70
add esp, 0xc
add ebx, 8
add esi, 8
sub dword [ebp - 0x10], 1
jne 0x4d464b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484636
mov esp, ebp
pop ebp
ret

Function at 0x4f3361
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f31e0

Function at 0x4f5b9e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f585e