joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432fb0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x493a28
push 0x44cf60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x498098]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402630
call fcn.004330c0
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x433032
test bl, bl
jne 0x433090
mov ecx, esi
call fcn.00402630
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.0044dc70
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push 0x48952c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.00402a20
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004028c0
mov ecx, esi
call fcn.00402620
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0044b565
lea esp, [ebp + 0x414]
pop ebp
ret
mov edx, dword [esp + 4]
jmp 0x432fb0

Function at 0x433240
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x493a28
push 0x44cf60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x498098]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402630
call fcn.004330c0
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x433032
test bl, bl
jne 0x433090
mov ecx, esi
call fcn.00402630
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.0044dc70
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push 0x48952c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.00402a20
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004028c0
mov ecx, esi
call fcn.00402620
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0044b565
lea esp, [ebp + 0x414]
pop ebp
ret
mov edx, dword [esp + 4]
jmp 0x432fb0
Function at 0x433e00
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x628]
sub esp, 0x628
push 0xffffffffffffffff
push 0x474fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x498098]
xor eax, ebp
mov dword [ebp + 0x624], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x630]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp + 0x634]
call fcn.00402710
mov dword [ebp - 4], 0
mov eax, dword [0x49a49c]
mov dword [ebp], 0
mov dword [ebp], 0x49a49c
test eax, eax
je 0x433e74
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x49a484
call fcn.00402620
test al, al
jne 0x433eb8
mov ecx, 0x49a484
call fcn.00402810
lea ecx, [ebp - 0x24]
cmp ecx, eax
je 0x433f6d
mov ecx, 0x49a484
call fcn.00402810
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x433eaf
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x433f65
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.0044dc70
add esp, 0xc
lea eax, [ebp + 0x418]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x434009
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 4]
push eax
call fcn.0044dc70
add esp, 0xc
lea eax, [ebp + 4]
push 0x208
push eax
lea eax, [ebp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x433f4e
test eax, eax
je 0x433f4e
add eax, eax
cmp eax, 0x412
jae 0x43405c
xor ecx, ecx
mov word [ebp + eax + 4], cx
lea eax, [ebp + 4]
push eax
call fcn.00402a20
add esp, 4
push eax
lea eax, [ebp + 4]
jmp 0x433f64
lea eax, [ebp + 0x418]
push eax
call fcn.00402a20
add esp, 4
push eax
lea eax, [ebp + 0x418]
push eax
lea ecx, [ebp - 0x24]
call fcn.004028c0
mov byte [ebp - 4], 0
mov eax, dword [0x49a49c]
test eax, eax
je 0x433f81
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x24]
mov dword [ebp], 0
push eax
mov ecx, esi
call fcn.00433d80
test al, al
je 0x433fa0
mov bl, 1
jmp 0x434026
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.0044dc70
add esp, 0xc
lea eax, [ebp + 0x418]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x434024
xor eax, eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 0x418]
push eax
call fcn.00402a20
add esp, 4
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp + 0x418]
push eax
call fcn.004028c0
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00433d80
mov bl, al
jmp 0x434026
mov byte [ebp - 4], 0
mov eax, dword [0x49a49c]
test eax, eax
je 0x43401d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004026b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x624]
xor ecx, ebp
call fcn.0044b565
lea esp, [ebp + 0x628]
pop ebp
ret 8
call fcn.0044b925
int3
Function at 0x438620
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x498098]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.0044dc70
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4386b7
cmp dword [esp + 8], 6
jb 0x4386b7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.0044b565
add esp, 0x118
ret

Function at 0x4386d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4757c0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x498098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00403280
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004084c0
mov ecx, eax
call fcn.00408580
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004026b0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00403280
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004084c0
mov ecx, eax
call fcn.00408580
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004026b0
test ebx, ebx
je 0x4387e5
test esi, esi
je 0x4387e5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4439b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
nop dword [eax]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x49a7b0], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x49a4b0], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x49a6b0], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x49a5b0], al
inc esi
cmp esi, 0x100
jl 0x443ac0
pop esi
add esp, 0x80
ret
Function at 0x4488e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4488eb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00448900
Function at 0x448bd0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x124
push 0xffffffffffffffff
push 0x47733a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x498098]
xor eax, ebp
mov dword [ebp + 0x120], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x448c15
call fcn.00448e20
cmp byte [0x49a474], 0
jne 0x448c28
mov eax, 0x80000001
jmp 0x448df1
mov eax, dword [esi]
test eax, eax
jne 0x448c93
push 8
call fcn.0044b576
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push 1
call fcn.0044b576
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 8]
push eax
call fcn.0044dc70
add esp, 0x14
mov dword [ebp + 4], 0x11c
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x448c82
cmp dword [ebp + 8], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x448de0
call fcn.00405c90
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test al, al
jne 0x448d86
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x30]
mov eax, dword [esi]
add eax, 4
mov byte [ebp - 0xd], 0
push str.Advapi32.dll
mov dword [ebp - 0x14], eax
call fcn.00403280
mov dword [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
call fcn.004084c0
mov ecx, eax
call fcn.00408580
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004026b0
test edi, edi
je 0x448de0
push str.OpenProcessToken
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x448de0
push dword [ebp - 0x18]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x448de0
lea eax, [ebp]
mov dword [ebp], 0
push eax
push 0x20008
push edi
call ebx
test eax, eax
je 0x448d53
push dword [ebp]
mov ecx, dword [ebp - 0x14]
call fcn.00405e20
mov bl, al
jmp 0x448d56
mov bl, byte [ebp - 0xd]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ecx, dword [ebp]
test ecx, ecx
je 0x448d69
push ecx
call edi
test bl, bl
je 0x448de0
mov ecx, dword [esi]
add ecx, 4
call fcn.004057b0
call fcn.00405c90
test al, al
je 0x448de0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Advapi32.dll
lea ecx, [ebp - 0x30]
call fcn.00403280
mov dword [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.004084c0
mov ecx, eax
call fcn.00408580
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004026b0
test edi, edi
je 0x448de0
push str.RegOpenCurrentUser
push edi
call ebx
test eax, eax
je 0x448de0
push dword [esi]
push 0x20019
call eax
test eax, eax
je 0x448de0
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x448def
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0044b565
lea esp, [ebp + 0x124]
pop ebp
ret 4
Function at 0x462de1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00462c60

Function at 0x46746e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046712e
Function at 0x29801a89
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x298601b4]
jne 0x29801a93
repz ret
jmp fcn.2983e792

Function at 0x298050c5
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x2983eb59
call fcn.29801f91
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x298050e5
xor eax, eax
call fcn.298029c6
ret 4
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x29805113
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
mov edi, dword [eax]
add edi, dword [ecx]
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, edi
jae 0x29805113
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298050dd
xor edi, edi
cmp dword [esi + 0x54], edi
jne 0x2980511f
or eax, 0xffffffff
jmp 0x298050dd
mov ecx, esi
call fcn.29803ec2
cmp dword [esi + 0x44], edi
jne 0x2980513c
push dword [esi + 0x54]
push ebx
call fcn.2981326a
pop ecx
pop ecx
test al, al
je 0x2980511a
jmp 0x2980510f
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.2981326a
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051f1
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2f]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x2980520f
cmp eax, 1
jg 0x298051f9
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051a4
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x298051cb
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051b7
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x2980520f
lea eax, [ebp - 0x30]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x29805229
test edi, edi
jne 0x2980515b
cmp dword [ebp - 0x1c], 0x20
jae 0x2980520f
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2981326a
jmp 0x2980515b
mov ecx, dword [ebp - 0x2c]
jmp 0x2980516d
cmp eax, 3
jne 0x2980520f
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.2981326a
pop ecx
pop ecx
test al, al
jne 0x29805229
or esi, 0xffffffff
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2981326a
mov eax, esi
jmp 0x298050dd
mov esi, ebx
jmp 0x29805212
Function at 0x2980522d
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x2983fd5f
call fcn.29801f91
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x29805323
cmp byte [esi + 0x49], 0
je 0x29805323
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x29805263
xor al, al
jmp 0x29805325
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.2981326a
mov dword [ebp - 4], edi
lea ebx, [esi + 0x4c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052c5
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x298052ca
dec eax
je 0x298052ce
dec eax
dec eax
je 0x2980531f
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2981326a
mov al, bl
jmp 0x29805325
mov ecx, dword [ebp - 0x2c]
jmp 0x29805290
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052da
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x29805301
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052ed
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x298052af
cmp byte [esi + 0x49], 0
je 0x2980531f
test edi, edi
jne 0x29805282
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2981326a
jmp 0x29805282
mov bl, 1
jmp 0x298052b1
mov al, 1
call fcn.298029c6
ret
Function at 0x2981326a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x29813279
pop dword [ebp - 0x28]
mov eax, 0x29813279
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe10a8057
sub dword [ebp - 0x38], 0x92b83b0c
mov dword [ebp - 0x34], 0x45f292a5
sub dword [ebp - 0x34], 0x13bf4660
mov dword [ebp - 0x30], 0x4307472e
add dword [ebp - 0x30], 0x944fd00
mov dword [ebp - 0x2c], 0x2247b3c1
add dword [ebp - 0x2c], 0xddb84c3f
lea eax, [ebp - 0x38]
push eax
mov eax, 0x5b289428
sub eax, 0x31a45330
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xdb7a668d
add dword [ebp - 0x38], 0x98f802c9
mov dword [ebp - 0x34], 0xc7f85b40
add dword [ebp - 0x34], 0x79740635
mov dword [ebp - 0x30], 0xe1f2fc26
sub dword [ebp - 0x30], 0x7e838fba
mov dword [ebp - 0x2c], 0xb41aeb94
add dword [ebp - 0x2c], 0x4be5146c
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x45c97
push 0
call eax
mov ecx, 0xb69207be
add ecx, 0x496e4604
mov edx, eax
mov edi, 0xb5ec2012
add edi, 0x739b9fee
add edi, dword [ebp - 0x28]
mov esi, 0xca562c85
add dword [ebp - 0x1c], edx
mov ebx, dword [edi]
add dword [ebp - 0xc], 0x822bbf2d
xor ebx, esi
xor dword [ebp - 0x20], esi
mov dword [edx], ebx
sub dword [ebp - 8], 0x6608f493
add edx, 4
add edi, 0x4f3644b2
sub edi, 0x4f3644ae
loop 0x2981338b
add eax, 0x129db
mov ebx, eax
add eax, 0xc60134a5
sub eax, 0xc60134a0
mov ecx, 0x7199cb8e
sub ecx, 0x4819cb8e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x2982092f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x29840d8f
call fcn.2983e23c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x298209dd
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2981326a
add esp, 0xc
test eax, eax
js 0x298209dd
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x298209c3
push edi
call fcn.2981d496
pop ecx
test al, al
je 0x298209c3
mov eax, edi
call fcn.2983e480
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x298209cf
push edi
lea ecx, [ebp - 0x428]
call fcn.2981326a
push 3
push edi
push esi
push eax
call fcn.2981326a
cmp eax, ebx
jne 0x29820a1a
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x298209f6
lea ecx, [ebp - 0x418]
call fcn.2981cb8c
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2981cb0e
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.2983e275
ret 0x10
push 2
push ebx
push eax
call fcn.2981d73e
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x29820a3b
call fcn.2981c3ab
mov esi, eax
jmp 0x29820b05
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x29820a5e
call fcn.2981c3ab
jmp 0x29820af7
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x29820a54
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x29820a8e
mov esi, 0x8007000e
jmp 0x29820af9
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2981326a
mov dword [ebp - 4], 1
jmp 0x29820abc
cmp dword [ebp - 0x418], ebx
je 0x29820a87
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2981326a
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2981326a
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x298209fb
lea ecx, [ebp - 0x418]
call fcn.2981cb8c
jmp 0x298209fb
Function at 0x401110
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, str.SeDebugPrivilege
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.00401152
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401144
push ebx
call fcn.0042c760
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x40114c
mov esp, ebp
pop ebp
ret 8
Function at 0x40a05d
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40a07b
mov eax, 0x4cb5ab
push eax
push 1
mov ebx, 0x42ccb0
call fcn.0042c772
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a0a5
mov eax, 0
jmp 0x40a119
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40a106
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40a0ef
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40a0de
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40a0cf
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4