joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0618
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b06f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3064]
cmp dword [eax], 5
jl 0x4b0670
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a24
push 0
push 0x26
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
call fcn.004056ac
mov edx, eax
mov eax, ebx
call fcn.004055cc
jmp 0x4b0682
lea eax, [ebp - 8]
call fcn.004b0554
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405630
mov eax, dword [ebx]
xor edx, edx
call fcn.004057d8
jbe 0x4b06aa
mov eax, dword [ebx]
call fcn.004056bc
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b06aa
mov eax, ebx
mov edx, 0x4b0708
call fcn.004056c8
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b0710
call fcn.00405728
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404fb4
mov eax, dword [ebp - 0xc]
call fcn.004b0280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b06fe
lea eax, [ebp - 0x10]
call fcn.00405474
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 4]
call fcn.00405474
ret

Function at 0x4b090c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b09eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3064]
cmp dword [eax], 5
jl 0x4b0964
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a24
push 0
push 0x1c
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
call fcn.004056ac
mov edx, eax
mov eax, ebx
call fcn.004055cc
jmp 0x4b0976
lea eax, [ebp - 8]
call fcn.004b0834
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405630
mov eax, dword [ebx]
xor edx, edx
call fcn.004057d8
jbe 0x4b099e
mov eax, dword [ebx]
call fcn.004056bc
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b099e
mov eax, ebx
mov edx, 0x4b09fc
call fcn.004056c8
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b0a04
call fcn.00405728
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404fb4
mov eax, dword [ebp - 0xc]
call fcn.004b0280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b09f2
lea eax, [ebp - 0x10]
call fcn.00405474
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 4]
call fcn.00405474
ret
Function at 0x4b0b0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b0beb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c3064]
cmp dword [eax], 5
jl 0x4b0b64
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a24
push 0
push 0x23
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
call fcn.004056ac
mov edx, eax
mov eax, ebx
call fcn.004055cc
jmp 0x4b0b76
lea eax, [ebp - 8]
call fcn.004b0a30
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405630
mov eax, dword [ebx]
xor edx, edx
call fcn.004057d8
jbe 0x4b0b9e
mov eax, dword [ebx]
call fcn.004056bc
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b0b9e
mov eax, ebx
mov edx, 0x4b0bfc
call fcn.004056c8
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b0c04
call fcn.00405728
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404fb4
mov eax, dword [ebp - 0xc]
call fcn.004b0280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0bf2
lea eax, [ebp - 0x10]
call fcn.00405474
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 4]
call fcn.00405474
ret

Function at 0x4b0d98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b0e6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c2f4c]
cmp byte [eax], 0
je 0x4b0def
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405a24
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
call fcn.004056ac
mov edx, eax
mov eax, ebx
call fcn.004055cc
jmp 0x4b0e01
lea eax, [ebp - 8]
call fcn.004b0d30
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405630
mov eax, dword [ebx]
call fcn.004056bc
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4b0e1e
mov eax, ebx
mov edx, 0x4b0e7c
call fcn.004056c8
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4b0e84
call fcn.00405728
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404fb4
mov eax, dword [ebp - 0xc]
call fcn.004b0280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0e72
lea eax, [ebp - 0x10]
call fcn.00405474
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 4]
call fcn.00405474
ret
Function at 0x4b109c
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4c349c]
cmp dword [eax], 2
je 0x4b10b9
mov byte [ebp - 1], 1
jmp 0x4b1287
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4c2dcc
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4b1287
xor eax, eax
push ebp
push 0x4b1280
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x4b111b
push 0x4b1290
push 0x4b12a8
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4b1142
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4b1269
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4b1269
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4b1193
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x4b1174
call fcn.0040473c
jmp 0x4b1287
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b1193
call fcn.0040473c
jmp 0x4b1287
xor eax, eax
push ebp
push 0x4b1262
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4b11d6
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x4b11d6
call fcn.0040473c
call fcn.0040473c
jmp 0x4b1287
mov eax, dword [ebp - 0x14]
call fcn.00402af0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4b1208
call fcn.0040473c
call fcn.0040473c
jmp 0x4b1287
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4b1243
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4b123f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4b123f
mov byte [ebp - 1], 1
jmp 0x4b1243
inc ebx
dec esi
jne 0x4b1215
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1269
mov eax, dword [ebp - 0x18]
call fcn.00402b20
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1287
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b17c4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4b194d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b1960
call fcn.004b0280
mov eax, dword [0x4c349c]
cmp dword [eax], 2
jne 0x4b18df
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b184c
mov eax, 0x4b1980
call fcn.004b0280
push 1
push 1
lea ecx, [ebp - 0x1c]
mov eax, dword [0x4c2fa4]
mov eax, dword [eax]
mov edx, 0x4b19a0
call fcn.0047f1a4
mov eax, dword [ebp - 0x1c]
mov ecx, 0x7d5
xor edx, edx
call fcn.004aa868
jmp 0x4b191d
lea eax, [ebp - 0x14]
push eax
push 0x4b19d0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b18df
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00409e78
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4b19ec
call fcn.00405038
mov eax, dword [ebp - 0x20]
call fcn.004b0280
push 1
push 1
lea ecx, [ebp - 0x28]
mov eax, dword [0x4c2fa4]
mov eax, dword [eax]
mov edx, 0x4b19a0
call fcn.0047f1a4
mov eax, dword [ebp - 0x28]
mov ecx, 0x7d5
xor edx, edx
call fcn.004aa868
jmp 0x4b191d
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x4b191d
mov eax, 0x4b1a20
call fcn.004b0280
push 1
push 1
lea ecx, [ebp - 0x2c]
mov eax, dword [0x4c2fa4]
mov eax, dword [eax]
mov edx, 0x4b19a0
call fcn.0047f1a4
mov eax, dword [ebp - 0x2c]
mov ecx, 0x7d5
xor edx, edx
call fcn.004aa868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1954
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040548c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 0x1c]
call fcn.00405474
ret
Function at 0x4b1d00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051dc
xor eax, eax
push ebp
push 0x4b1da5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004051ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, edi
call fcn.00404d1c
test ebx, ebx
je 0x4b1d8f
mov eax, ebx
call fcn.00402af0
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004051ec
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b1db4
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4b1d81
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00404f24
jmp 0x4b1d88
mov eax, edi
call fcn.00404d1c
mov eax, esi
call fcn.00402b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1dac
lea eax, [ebp - 4]
call fcn.00404d1c
ret

Function at 0x4b1ddc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405a6c
xor eax, eax
push ebp
push 0x4b1ea6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x4b1e3e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x78
jne 0x4b1e3e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404fb4
mov eax, dword [ebp - 0x14]
mov edx, edi
call fcn.004b1d00
jmp 0x4b1e88
mov eax, edi
call fcn.00404d1c
test ebx, ebx
je 0x4b1e88
mov eax, ebx
call fcn.00402af0
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b1eb4
push esi
call sub.version.dll_VerQueryValueW
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.00404f54
mov eax, esi
call fcn.00402b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1ead
lea eax, [ebp - 0x14]
call fcn.00404d1c
lea eax, [ebp - 4]
call fcn.00405474
ret
Function at 0x102108e
Capabilities:
Encode data using xor

Disassembly:
pop ds
or bl, byte [esi + 0x6ec5ea02]
out 5, al
add byte [esi + 7], 0x52
int1
lcall 0x4a83, 0xa05991fb
jb 0x102101e
fbld tbyte [edi - 0x27]
sub dh, dh
fldcw word [edx]
neg byte [edx + 0x19b9229f]
imul ebx, dword [0x7dd2201c], 0xffffff85
pop ebx
aaa
lcall 0x6bf2, 0x19b9229f
sbb eax, 0x7dd2201c
test dword [ebx + 0x37], ebx
jl 0x1021005
sti
mov bh, byte [edx + 0x2a]
invalid
xchg ebp, eax
in al, dx
jb 0x1021021
sub ebp, dword [edi]
mov ebp, 0xd5a2187d
ja 0x10210a6
and ch, byte [eax + 0x4c2dd8c4]
das
mov bl, 0x5f
invalid
invalid
Function at 0x5515b0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00475aaf
mov eax, dword [0x5dd040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x5df550]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x551788
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x5516d7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x5516d7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x5516b5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x551639
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x551741
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x5517a8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x551783
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5517a8
jmp 0x551612
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476928
mov esp, ebp
pop ebp
ret
Function at 0x551840
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00475aaf
mov eax, dword [0x5dd040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x5df550]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x551a2b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x551976
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x551976
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x551952
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x5518c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5519e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x551a4b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x551a26
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x551a4b
jmp 0x5518a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476928
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x4065c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4065e7
xor eax, eax
test eax, eax
je 0x4065f9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4065f9
xor ecx, ecx
jmp 0x4065fc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4066e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232e4], 0
push esi
jne 0x40671f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066f9
mov dword [ecx*4 + 0x4232e0], eax
inc ecx
cmp ecx, 0x100
jl 0x4066f4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406750
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232e0]
xor eax, esi
inc ecx
dec edx
jne 0x406732
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6ff5079
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7ab1291a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7447250c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5946970
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219