joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49aed0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x512008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x49af52
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x49af52
test ecx, ecx
je 0x49af4e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x49af10
xor eax, eax
jmp 0x49af57
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x49af61
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b6413
add esp, 0xc
ret 0xc
Function at 0x49f8c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x49f8f8
mov edx, dword [esp + 4]
test edx, edx
je 0x49f8f8
cmp dword [eax], 0xffffffff
je 0x49f8f8
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49f8f8
mov al, 1
ret 0xc
xor al, al
ret 0xc

Function at 0x49f900
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x49f93a
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x49f93a
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x49f93a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49f93a
cmp edi, dword [esi]
jne 0x49f93a
pop edi
mov al, 1
pop esi
ret 0xc
pop edi
xor al, al
pop esi
ret 0xc

Function at 0x49f980
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x512008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x49f9e3
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x49f9e3
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49f9be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49f9e3
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004b6413
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004b6413
add esp, 8
ret 4

Function at 0x49fac0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x49fb6e
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x28], xmm0
call fcn.0049fa00
test al, al
je 0x49fb6e
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push edi
push dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.0049fa00
test al, al
je 0x49fb6e
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [esp + 0x10], eax
jne 0x49fb44
cmp dword [esp + 0x14], edi
jne 0x49fb44
mov eax, dword [esi]
test eax, eax
jne 0x49fb31
xor bl, bl
jmp 0x49fb44
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x49fb2d
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x24]
mov ecx, esi
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x24]
call fcn.0049fa00
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a0400
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cde38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x512008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x4a0438
xor al, al
jmp 0x4a04a7
and esi, 0xffffb1af
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x4a045c
mov al, 1
jmp 0x4a04a7
lea ecx, [ebp - 0x28]
call fcn.00412f80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004a0ab0
test al, al
je 0x4a0494
lea ecx, [ebp - 0x28]
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push esi
push eax
call ebx
test eax, eax
je 0x4a0494
mov bl, 1
jmp 0x4a0496
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412e40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6413
mov esp, ebp
pop ebp
ret

Function at 0x4a04d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cde38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x512008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a055c
lea ecx, [ebp - 0x28]
call fcn.00412f80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004a0ab0
test al, al
je 0x4a054b
lea ecx, [ebp - 0x28]
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6413
mov esp, ebp
pop ebp
ret
Function at 0x4a0580
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3570
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x512008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4a05cd
mov al, 1
jmp 0x4a06e5
mov ecx, esi
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
lea ecx, [ebp - 0x28]
call fcn.00412eb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004a04d0
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412e40
cmp ebx, 0xffffffff
jne 0x4a0613
xor al, al
jmp 0x4a06e5
mov ecx, esi
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
lea ecx, [ebp - 0x28]
call fcn.00412eb0
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004a0400
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412e40
test bl, bl
je 0x4a060c
mov ecx, esi
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
call edi
test eax, eax
jne 0x4a05c6
lea ecx, [ebp - 0x28]
call fcn.00412f80
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004a0ab0
test al, al
je 0x4a06a0
lea ecx, [ebp - 0x28]
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
call edi
test eax, eax
je 0x4a06a0
mov bl, 1
jmp 0x4a06d4
mov ecx, esi
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push eax
lea ecx, [ebp - 0x44]
call fcn.00412eb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004a0400
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00412e40
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412e40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6413
mov esp, ebp
pop ebp
ret
Function at 0x4a0710
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x4d35a8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x512008]
xor eax, ebp
mov dword [ebp + 0x620], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
lea ecx, [ebp - 0x10]
call fcn.004126c0
mov eax, dword [0x51f1d0]
mov dword [ebp - 0x10], 0x51f1d0
test eax, eax
je 0x4a0768
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov ecx, 0x51f1e0
call fcn.00412dc0
test al, al
jne 0x4a07db
cmp esi, 0x51f1e0
je 0x4a07b2
mov ecx, 0x51f1e0
call fcn.004131e0
mov ecx, esi
call fcn.004131e0
mov ecx, 0x51f1e0
call fcn.004131e0
mov ecx, eax
push dword [eax + 0x10]
call fcn.004131a0
push eax
mov ecx, esi
call fcn.00413310
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a07d4
mov eax, dword [eax]
test eax, eax
je 0x4a07cd
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x4a08c4
push 0x20c
lea eax, [ebp + 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x414]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4a08a0
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x61e], ax
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push 0x208
push eax
lea eax, [ebp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4a0864
test eax, eax
je 0x4a0864
add eax, eax
cmp eax, 0x412
jae 0x4a08e5
xor ecx, ecx
mov word [ebp + eax], cx
lea eax, [ebp]
jmp 0x4a086a
lea eax, [ebp + 0x414]
push eax
mov ecx, esi
call fcn.00412df0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a07d4
mov eax, dword [eax]
test eax, eax
je 0x4a07cd
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x4a08c4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a08c2
mov eax, dword [eax]
test eax, eax
je 0x4a08bb
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.004b6413
lea esp, [ebp + 0x624]
pop ebp
ret
call fcn.004b6b8d
int3
Function at 0x4a3740
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d22bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x512008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.00411e40
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, edi
mov dword [ebp - 0x10], edi
push esi
call fcn.00413010
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00413010
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00413010
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00413010
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00413010
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00413010
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a5470
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x512008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4a54d5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a54b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4a54d5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004b6413
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004b6413
add esp, 8
ret 4
Function at 0x4a5650
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4198
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x512008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x4a5699
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x4a57eb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x4a57b6
test eax, eax
je 0x4a57b6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x4a57b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x4a573b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a572f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4a573b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x4a5749
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00413010
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x4a57b6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x4a56f4
jmp 0x4a57b9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x4a57e2
test edx, edx
je 0x4a57de
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x4a56b0
mov al, 1
jmp 0x4a57ed
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4a57eb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b6413
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4aa040
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x512008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4aa0d7
cmp dword [esp + 8], 6
jb 0x4aa0d7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004b6413
add esp, 0x118
ret

Function at 0x4aa0f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d49b0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x512008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00412eb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00495180
mov ecx, eax
call fcn.00495240
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412e40
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00412eb0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00495180
mov ecx, eax
call fcn.00495240
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00412e40
test ebx, ebx
je 0x4aa205
test esi, esi
je 0x4aa205
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4290
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4b429b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004b42b0
Function at 0x902a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x394000]
push edi
jmp 0x902a3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x902a41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x902a30
mov eax, 1
add ebx, ebx
jne 0x902a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x902a64
jne 0x902a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x902a83
dec eax
add ebx, ebx
jne 0x902a70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x902a48
add ebx, ebx
jne 0x902a7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x902ad5
xor ecx, ecx
sub eax, 3
jb 0x902a9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x902b0a
sar eax, 1
mov ebp, eax
jmp 0x902aa6
add ebx, ebx
jne 0x902aa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x902a74
inc ecx
add ebx, ebx
jne 0x902ab4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x902a74
add ebx, ebx
jne 0x902ac1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x902ab6
jne 0x902ad2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x902ab6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x902af4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x902ae6
jmp 0x902a36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x902af4
add edi, ecx
jmp 0x902a36
pop esi
mov edi, esi
mov ecx, 0x292d3f
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x902b2f
cmp byte [edi], 0x2b
jne 0x902b14
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x902b12
lea edi, [esi + 0x4fe000]
mov eax, dword [edi]
or eax, eax
je 0x902b80
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5044c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x504658]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x902b35
mov ecx, edi
jns 0x902b64
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x504660]
or eax, eax
je 0x902b7a
mov dword [ebx], eax
add ebx, 4
jmp 0x902b52
call dword [esi + 0x50465c]
mov ebp, dword [esi + 0x504664]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x902bb4
sub esp, 0xffffff80
jmp 0x693ab8
Function at 0x401a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40539c]
test esi, esi
jle 0x401b90
mov eax, dword [0x4053a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401ac0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401b3f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401ab0
mov dword [esp], ebx
call fcn.00402400
mov edi, eax
test eax, eax
je 0x401bb7
mov eax, dword [0x4053a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402510
mov edx, dword [0x4053a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b97
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401b38
sub eax, 4
and eax, 0xfffffffb
jne 0x401b46
add dword [0x40539c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4053a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401b38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401a30
xor esi, esi
jmp 0x401aca
mov eax, dword [0x4053a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401a30
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401a30
lea esi, [esi]
nop

Function at 0x402070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
test ebx, ebx
je 0x4020c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020be
test esi, esi
je 0x4020be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020a0
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
adc edi, esi
cmp dword [ebp + 0x3a059e41], 0xab0c7f44
invalid