joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov ebx, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor eax, eax
push fcn.00425870
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4f0]
call fcn.0050c830
mov edx, dword [eax]
call dword [edx + 0x88]
mov esi, eax
lea ecx, [ebp - 8]
mov edx, 1
mov eax, esi
mov esi, dword [esi]
call dword [esi + 0x7c]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
mov eax, ebx
call fcn.00424ac0
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.004426c0
test al, al
je 0x425938
push 5
lea eax, [ebp - 8]
call fcn.00403a60
push 0
mov ecx, dword [ebp - 4]
mov edx, str.explorer.exe
lea eax, [ebp - 8]
call fcn.00408a60
mov eax, dword [ebp - 8]
test eax, eax
jne 0x42592a
mov eax, 0x5db2f0
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x42594f
lea esi, [esi]
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00422da0
mov eax, dword [ebp - 0xc]
mov edx, 0x30
call fcn.004229d0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00425870
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425fe0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x218]
push ebx
push esi
push edi
mov dword [ebp - 0x20c], 0
xor eax, eax
push fcn.00425fd0
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x5dc710], 0
push 0x208
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov dword [ebp - 0x210], eax
mov word [ebp + eax*2 - 0x208], 0
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov eax, ebp
call fcn.004262a0
mov ecx, dword [ebp - 0x210]
shl ecx, 1
mov eax, dword [0x5dc700]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
call fcn.00403590
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
call fcn.00404700
mov dword [ebp - 0x214], eax
mov edx, eax
lea eax, [ebp - 0x20c]
call fcn.0040a6e0
mov ecx, dword [ebp - 0x214]
shl ecx, 1
mov eax, ebx
mov edx, dword [ebp - 0x20c]
call fcn.00403590
mov ebx, 1
jmp 0x42625f
add ebx, 1
cmp dword [ebp - 0x214], ebx
jl 0x4260c2
mov eax, dword [ebp - 0x20c]
cmp word [eax + ebx*2 - 2], 0x20
jbe 0x4260a8
cmp dword [ebp - 0x214], ebx
jl 0x42626b
mov esi, esi
mov byte [ebp - 0x218], 0
mov edi, ebx
mov dword [ebp - 0x210], 0
jmp 0x42615b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x426150
sub ax, 0x20
jbe 0x42610c
sub ax, 2
je 0x426120
jmp 0x426150
mov al, byte [ebp - 0x218]
test al, al
je 0x426163
add dword [ebp - 0x210], 1
jmp 0x426158
cmp dword [ebp - 0x214], ebx
jle 0x42614b
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 1]
cmp word [edx + eax*2 - 2], 0x22
je 0x42614b
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x426158
add ebx, 1
jmp 0x426158
add dword [ebp - 0x210], 1
nop
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x4260e8
cmp dword [0x5dc710], 0
jle 0x426258
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x5dc710]
mov eax, ebp
call fcn.004262a0
mov byte [ebp - 0x218], 0
mov ebx, edi
mov esi, 1
jmp 0x42624b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x426224
sub ax, 0x20
jbe 0x4261c0
sub ax, 2
je 0x4261f4
jmp 0x426224
mov al, byte [ebp - 0x218]
test al, al
je 0x426257
mov edx, dword [0x5dc700]
mov eax, dword [0x5dc710]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
jmp 0x426248
cmp dword [ebp - 0x214], ebx
jle 0x42621f
mov eax, dword [ebp - 0x20c]
lea edx, [ebx + 1]
cmp word [eax + edx*2 - 2], 0x22
je 0x42621f
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x426248
add ebx, 1
jmp 0x426248
mov eax, dword [0x5dc700]
mov edx, dword [0x5dc710]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
lea esi, [esi]
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x426198
nop
add dword [0x5dc710], 1
cmp dword [ebp - 0x214], ebx
jge 0x4260ab
sub dword [0x5dc710], 1
cmp word [0x5da030], 0xfde9
jne 0x426284
call fcn.00425ee0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00425fd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4266b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov bl, cl
push 4
lea ecx, [ebp - 8]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 2
jle 0x42673a
lea edx, [eax - 2]
test edx, edx
jl 0x42674f
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov si, word [ebp + ecx*2 - 8]
mov di, word [ebp + ecx*2 - 8]
cmp di, 0x20
jb 0x42674f
sub di, 0x20
je 0x426734
sub di, 0x80
je 0x426734
sub di, 0x1f62
jb 0x42674f
sub di, 1
jbe 0x426734
sub di, 6
je 0x426734
sub di, 0x26
jne 0x42674f
mov esi, esi
jmp 0x426734
cmp edx, ecx
jg 0x4266e8
jmp 0x42674f
cmp eax, 2
jne 0x426745
mov si, word [ebp - 8]
jmp 0x42674f
mov al, bl
call fcn.0040b1b0
mov si, ax
mov ax, si
sub ax, 0x7f
jbe 0x4267c8
sub ax, 0x21
je 0x4267d8
sub ax, 0x17
je 0x4267dc
sub ax, 0x222
je 0x4267e0
sub ax, 0x392
je 0x4267e4
sub ax, 1
je 0x4267e8
sub ax, 0x1996
je 0x4267ec
sub ax, 1
je 0x4267f0
sub ax, 6
je 0x4267f4
sub ax, 0xb
je 0x4267fc
sub ax, 0x1b
je 0x4267f8
sub ax, 0x367
je 0x426800
jmp 0x426804
mov ax, si
call fcn.0040b250
jmp 0x426808
mov al, 0x20
jmp 0x426808
mov al, 0x2e
jmp 0x426808
mov al, 0x27
jmp 0x426808
mov al, 0x2c
jmp 0x426808
mov al, 0x27
jmp 0x426808
mov al, 0x20
jmp 0x426808
mov al, 0x20
jmp 0x426808
mov al, 0x20
jmp 0x426808
mov al, 0x20
jmp 0x426808
mov al, 0x2d
jmp 0x426808
mov al, 0x27
jmp 0x426808
mov al, bl
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00431b50
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x431c78
mov al, byte [ebp - 0x110]
test al, al
je 0x431c41
lea eax, [ebp - 0xc]
call fcn.00403a60
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404d30
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004091e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.00409fb0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57ddf0
call fcn.0044af70
mov edx, 0x431bca
mov ecx, ebp
call fcn.00413be0
jmp 0x431c78
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57ddf0
call fcn.0044af70
mov edx, 0x431c41
mov ecx, ebp
call fcn.00413be0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x431d44
mov al, byte [ebp - 0x110]
test al, al
je 0x431d0d
lea eax, [ebp - 0xc]
call fcn.00403a60
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404d30
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.004091e0
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.00409fb0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57ddf0
call fcn.0044af70
mov edx, 0x431c96
mov ecx, ebp
call fcn.00413be0
jmp 0x431d44
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x57ddf0
call fcn.0044af70
mov edx, 0x431d0d
mov ecx, ebp
call fcn.00413be0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00431510
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00431b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4351f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x57e9f8
call fcn.0040ce20
test al, al
je 0x4352d6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.004352f0
xor eax, eax
push fcn.004351e0
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408960
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.00434400
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.00433b30
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004351e0
jmp 0x4352e1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00437620
mov esp, ebp
pop ebp
ret
Function at 0x4415c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004415b0
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408960
lea eax, [ebp - 0xc10]
call fcn.00403aa0
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x441620
mov eax, 0x5db2f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4416ca
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040f8c0
xor eax, eax
push fcn.004415a0
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x44167c
mov eax, 0x5db2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4416b8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x58350c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4416b8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004415a0
jmp 0x441728
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4416ec
mov eax, 0x5db2f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x441728
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x58350c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x441728
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004415b0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x44c430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 4]
test eax, eax
jne 0x44c44e
mov eax, 0x5db2f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x44c486
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x44c46a
clc
jmp 0x44c471
bt dword [0x583a60], eax
jb 0x44c482
mov eax, ebp
call fcn.0044c570
test al, al
je 0x44c482
mov bl, 1
jmp 0x44c4b4
xor bl, bl
jmp 0x44c4b4
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x559f90]
sete bl
mov al, byte [ebp - 0xc]
and al, bl
je 0x44c4b4
and esi, 0x400
je 0x44c4b4
mov eax, ebp
call fcn.0044c4e0
mov bl, al
lea esi, [esi]
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c7e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x44c7ec
mov eax, 0x5db2f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esp, ebp
pop ebp
ret
Function at 0x44cce0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0044ccd0
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x5dcaec]
xor edx, edx
call fcn.00408960
mov dword [ebx*4 + 0x5dcb0c], 0xffffffff
cmp ebx, 7
jl 0x44cd08
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x44cd94
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00409350
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00443270
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x44cd94
push 4
push ebx
push esi
mov eax, 0x44cbb0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x44cc40
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044ccd0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d4e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push fcn.0044d4b0
push ebp
push 0x413d20
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
call fcn.004429f0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00408960
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.00409fb0
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00408960
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x1c], eax
mov ebx, eax
jmp 0x44d5ec
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.004092b0
mov eax, dword [ebp - 8]
test eax, eax
je 0x44d577
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.00409fb0
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.004098e0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00409780
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004429f0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00409520
test eax, eax
jne 0x44d5e4
push dword [ebp - 0x18]
mov eax, dword [ebp - 8]
test eax, eax
je 0x44d5d3
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.00409780
jmp 0x44d5f5
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x44d560
push dword [ebp - 0x1c]
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044d4b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d650
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.0044d620
push ebp
push 0x413d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0040aeb0
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00448ef0
jmp 0x44d728
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040ae60
mov edx, dword [ebp - 4]
mov ecx, 1
mov al, 0x3d
call fcn.0040b9d0
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx - 1]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b770
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00448ef0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b5b0
test eax, eax
jne 0x44d718
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
test eax, eax
je 0x44d706
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.0040b770
jmp 0x44d72f
mov eax, esi
call fcn.00404700
shl eax, 1
add eax, esi
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x44d6b0
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044d620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d760
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x5dcb50], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x5dc9b0], eax
mov eax, dword [ebp - 0x90]
mov dword [0x5dc9c0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x5dc9d0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x5dc9e0], eax
mov edx, 0x5dc9f1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00403590
lea eax, [ebp - 0x80]
call fcn.004046e0
mov byte [0x5dc9f0], al
mov eax, 0x583b30
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x5dcb60], eax
test eax, eax
je 0x44d800
mov eax, 0x583b3c
push eax
push dword [0x5dcb60]
call sub.kernel32.dll_GetProcAddress
mov dword [0x5dcb50], eax
nop
cmp dword [0x5dc9c0], 6
jae 0x44d814
mov dword [0x559850], 0
nop
cmp dword [0x5dc9c0], 6
jb 0x44d830
cmp dword [0x5dc9d0], 1
jb 0x44d830
mov dword [0x559860], 2
mov esp, ebp
pop ebp
ret

Function at 0x4675a0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], 0
xor edx, edx
push fcn.00467590
push ebp
push 0x413d20
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
call fcn.0040ad70
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4675d6
mov eax, 0x5db2f0
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
or eax, eax
setne al
mov bl, al
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00467590
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486190
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x4861c4
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x5dd160]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x4861a0
pop edi
pop esi
pop ebx
ret

Function at 0x4a0ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4a0ef1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4a0ee0
pop esi
pop ebx
ret

Function at 0x4a26d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4a26f4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4a27ba
mov esi, esi
xor eax, eax
push 0x4a279b
push ebp
push 0x4140a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040cfe0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x57e654
call fcn.00433290
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004a2950
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004a29c0
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004a2a30
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4a2790
cmp dword [ebp - 4], 0
je 0x4a2790
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4a27ba
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aabb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x4aabd8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x4aac86
mov esi, esi
xor eax, eax
push 0x4aac67
push ebp
push 0x4140a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
je 0x4aac3c
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00431510
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x4aac5c
cmp dword [ebp - 8], 0
je 0x4aac5c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4aac86
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ac580
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4ac5b4
mov eax, esi
call fcn.004b0b00
cmp byte [esi + 0x40], 0
je 0x4ac5ac
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4ac665
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4ac644
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4ac63c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4ac5e8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4ac600
xor bl, bl
jmp 0x4ac665
cmp edi, 2
je 0x4ac63a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4ac5d8
cmp edi, 3
je 0x4ac618
cmp edi, 1
jne 0x4ac5d8
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4ac5d8
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4ac5d8
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4ac65c
cmp dword [esi + 0x14], 0xcc
je 0x4ac65c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004ac9a0
lea esi, [esi]
mov eax, esi
call fcn.004ac670
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret