joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce80
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov edx, dword [ebp + 0x58]
cmp edx, 5
push esi
push edi
jne 0x46ce9d
cmp dword [ebp + 0x60], 0x4b
jge 0x46d047
fld dword [ebp + 0x30]
fcomp qword [0x679738]
fnstsw ax
test ah, 0x41
je 0x46d047
fild dword [ebp + 0x10]
fadd dword [ebp + 0x30]
fcomp qword [0x679298]
fnstsw ax
jmp 0x794151
mov eax, ebp
call fcn.0046eb20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4

Function at 0x46d390
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x5c]
mov edx, dword [edi + 4]
lea ebx, [eax + eax*2]
xor ebp, ebp
lea esi, [esp + 0x10]
lea ebx, [ebx*4 + 0x69f1c0]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call fcn.0041c8f0
test al, al
je 0x46d3eb
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x1c], eax
je 0x46d3d7
push edi
call fcn.0046d2b0
test al, al
je 0x46d3d7
add ebp, 1
mov edx, dword [edi + 4]
lea esi, [esp + 0x10]
call fcn.0041c8f0
test al, al
jne 0x46d3c0
mov dword [esp + 0x14], ebp
jmp 0x7a21c1

Function at 0x46e460
Capabilities:
Check http status code

Disassembly:
push ecx
push esi
mov esi, eax
jmp loc.007a23b1
Function at 0x46e540
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64ea28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
fld1
push ebx
push esi
fst dword [esp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x5c]
cmp eax, 0xb
lea ecx, [eax + eax*2]
lea edx, [ecx*4 + 0x69f1c0]
push edi
mov dword [esp + 0x14], edx
jne 0x46e59b
mov eax, dword [0x6a7664]
fld dword [0x679668]
fstp dword [esp + 0x10]
mov dword [esp + 0xc], eax
jmp 0x46e6c3
test eax, eax
je 0x46e6b9
cmp eax, 0xd
je 0x46e6b9
cmp eax, 1
jne 0x46e5c0
mov ecx, dword [0x6a7408]
mov dword [esp + 0xc], ecx
jmp 0x46e6c3
cmp eax, 6
jne 0x46e5d2
mov dword [esp + 0xc], 0
jmp 0x46e6c3
cmp eax, 8
jne 0x46e5e2
mov edx, dword [0x6a76c8]
jmp 0x46e6bf
cmp eax, 7
jne 0x46e5f5
mov eax, dword [0x6a74f8]
mov dword [esp + 0xc], eax
jmp 0x46e6c3
cmp eax, 4
jne 0x46e633
mov ecx, dword [0x6a7830]
mov eax, dword [esi + 0x60]
push 1
sub esp, 8
fstp dword [esp + 4]
mov dword [esp + 0x18], ecx
fld dword [0x6795cc]
mov ecx, 0x1e
xor edx, edx
fstp dword [esp]
call fcn.00511bf0
fstp dword [esp + 0x1c]
fld1
add esp, 0xc
jmp 0x46e6c3
cmp eax, 9
jne 0x46e64a
fld dword [0x679fcc]
mov edx, dword [0x6a72f8]
fstp dword [esp + 0x10]
jmp 0x46e6bf
cmp eax, 2
jne 0x46e65e
mov eax, dword [0x6a7928]
fst dword [esp + 0x10]
mov dword [esp + 0xc], eax
jmp 0x46e6c3
cmp eax, 0xa
jne 0x46e679
mov ecx, dword [0x6a7700]
fld dword [0x679fc8]
fstp dword [esp + 0x10]
mov dword [esp + 0xc], ecx
jmp 0x46e6c3
cmp eax, 0xc
jne 0x46e690
fld dword [0x679664]
mov edx, dword [0x6a7284]
fstp dword [esp + 0x10]
jmp 0x46e6bf
cmp eax, 3
jne 0x46e6a4
mov eax, dword [0x6a78e8]
fst dword [esp + 0x10]
mov dword [esp + 0xc], eax
jmp 0x46e6c3
cmp eax, 5
jne 0x46e6c3
mov ecx, dword [0x6a7308]
fst dword [esp + 0x10]
mov dword [esp + 0xc], ecx
jmp 0x46e6c3
mov edx, dword [0x6a76a8]
mov dword [esp + 0xc], edx
jmp 0x7a22c5
Function at 0x486d20
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
xor eax, eax
cmp dword [edx + 0x24], eax
mov dword [esp], eax
jle 0x486e39
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esp + 0xc]
push eax
mov esi, ebx
call fcn.00485e20
mov edx, dword [ebx + 0xd14]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea ebp, [ebx + ecx*4]
mov ecx, dword [edx + 0x144]
mov edx, dword [esp + 0x10]
lea esi, [ecx + edx + 0x28]
mov edx, dword [ebp + 0xd8]
mov edi, eax
call fcn.00489b50
cmp byte [ebp + 0xd0], 0
je 0x486e11
mov eax, dword [ebp + 0xd4]
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x34]
cmp eax, 0x3c
je 0x486de2
cmp eax, 0x3d
je 0x486de2
cmp eax, 0x3e
je 0x486de2
cmp eax, 0x3f
je 0x486de2
cmp eax, 0x40
je 0x486de2
cmp eax, 0x41
je 0x486de2
cmp eax, 0x42
je 0x486de2
cmp eax, 0x43
je 0x486de2
cmp eax, 0x44
je 0x486de2
cmp eax, 0x45
je 0x486de2
cmp eax, 0x46
je 0x486de2
cmp eax, 0x47
je 0x486de2
cmp eax, 0x48
je 0x486de2
cmp eax, 0x49
je 0x486de2
cmp eax, 0x4a
jne 0x486de6
xor eax, eax
jmp 0x486e06
cmp eax, 0x30
jne 0x486dfc
cmp ecx, 0xffffffff
je 0x486dfc
lea ecx, [ecx + ecx*8]
mov eax, dword [ecx*4 + 0x796014]
jmp 0x486e06
lea edx, [eax + eax*8]
mov eax, dword [edx*4 + 0x796014]
mov dword [esi + 0x28], eax
mov byte [esi + 0x49], 1
mov byte [esi + 0x48], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
add dword [esp + 0x10], 0x50
add eax, 1
cmp eax, dword [edx + 0x24]
mov dword [esp + 0xc], eax
jl 0x486d44
pop edi
pop esi
pop ebp
mov eax, dword [ebx + 0xd14]
mov eax, dword [eax + 0x15c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x774]
mov byte [edx + 0x55], 0
mov ecx, dword [eax + 0x20]
mov edx, dword [0x6aa230]
lea ecx, [ecx + edx + 0xa]
mov edx, dword [eax]
mov byte [eax + 0x2c], 0
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x320]
mov edx, dword [ecx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x20]
push eax
call edx
add esp, 8
ret
Function at 0x487250
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push edi
mov edi, eax
mov eax, dword [edi]
cmp dword [eax + 0x7fc], 3
jne 0x487375
cmp dword [edi + 0x34], 0xffffffff
je 0x487375
mov ecx, dword [edi + 4]
cmp dword [ecx + 0x5568], 0
jne 0x487280
call fcn.00487190
cmp byte [edi + 0x48], 0
jne 0x4872ac
cmp byte [edi + 0x49], 0
je 0x4872ac
jmp 0x7bc31c
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x487375
lea ecx, [eax - 1]
lea edx, [ecx - 0x190]
mov dword [esp + 8], edx
fild dword [esp + 8]
mov dword [edi + 0x3c], ecx
fdiv qword [0x679730]
fstp dword [esp + 8]
fldz
fld dword [esp + 8]
fcom st(1)
fnstsw ax
fld1
test ah, 0x41
jp 0x4872f0
fstp st(1)
fld dword [0x679320]
jmp 0x487311
fcom st(1)
fnstsw ax
test ah, 0x41
jp 0x487303
fstp st(1)
fld dword [0x6793e0]
jmp 0x487311
fxch st(1)
fmul qword [0x679a40]
fadd qword [0x6793b8]
fstp dword [esp + 8]
fld dword [esp + 8]
fmul qword [0x679530]
fadd dword [edi + 0x44]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x44]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 1
jne 0x487366
test ecx, ecx
mov eax, dword [edi + 0x40]
mov dword [edi + 0x34], eax
jne 0x487350
fstp st(0)
mov byte [edi + 0x48], 1
fstp dword [edi + 0x44]
pop edi
add esp, 8
ret
fstp st(1)
push edi
fsub qword [0x65b8f8]
fstp dword [edi + 0x44]
call fcn.00487070
pop edi
add esp, 8
ret
test ecx, ecx
fstp st(0)
fstp st(0)
jne 0x487375
mov dword [edi + 0x3c], 1
pop edi
add esp, 8
ret
Function at 0x522580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
add eax, 0x312
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
push esi
mov eax, edi
fstp dword [edi + 0x2c]
call fcn.00531880
mov ecx, dword [ebp + 0xc]
fstp dword [edi + 0x30]
fldz
mov dl, byte [ebp + 0x10]
xor ebx, ebx
fst dword [edi + 0x34]
mov eax, 0x78
fst dword [edi + 0x120]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x65]
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x24], ecx
mov byte [edi + 0x50], dl
mov byte [edi + 0x51], bl
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb0], ebx
mov byte [edi + 0xb8], bl
mov byte [edi + 0xb9], bl
mov byte [edi + 0xba], 1
mov byte [edi + 0xbb], 1
mov byte [edi + 0xbc], bl
mov byte [edi + 0xbd], bl
mov byte [edi + 0xbe], bl
mov dword [edi + 0xc4], ebx
mov dword [edi + 0xd8], ebx
mov byte [edi + 0xbf], bl
mov dword [edi + 0xc0], ebx
mov dword [edi + 0x38], ebx
call fcn.005af400
add eax, 0x190
mov dword [edi + 0x3c], eax
mov eax, 0xc
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, 0x24
mov dword [edi + 0x8c], eax
mov eax, 0x2a
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], eax
mov eax, 0x32
mov dword [edi + 0x9c], eax
or esi, 0xffffffff
lea ecx, [ebx + 0x73]
mov dword [edi + 0xa0], ebx
mov eax, 0x14
mov dword [edi + 0xa4], eax
mov dword [edi + 0x60], ebx
mov dword [edi + 0x80], esi
mov dword [edi + 0x28], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov byte [edi + 0x88], bl
mov byte [edi + 0x70], bl
mov dword [edi + 0xf0], ebx
mov dword [edi + 0x98], ecx
mov dword [edi + 0xa8], ecx
mov byte [edi + 0x104], bl
mov dword [edi + 0x74], esi
fld1
mov byte [edi + 0x78], bl
fstp dword [edi + 0x11c]
mov dword [edi + 0x7c], esi
mov dword [edi + 0xdc], ebx
mov dword [edi + 0xd0], ebx
fst dword [edi + 0x84]
mov dword [edi + 0xe4], ebx
fstp dword [edi + 0x124]
mov dword [edi + 0x110], ebx
mov dword [edi + 0x114], ebx
mov dword [edi + 0x138], esi
mov dword [edi + 0x134], esi
mov dword [edi + 0x13c], esi
mov dword [edi + 0x118], ebx
mov dword [edi + 0x128], ebx
mov dword [edi + 0x12c], ebx
mov dword [edi + 0x140], ebx
mov dword [edi + 0x144], ebx
mov dword [edi + 0x130], esi
mov dword [edi + 0x148], esi
mov byte [edi + 0x14c], bl
mov dword [edi + 0x150], ebx
mov dword [edi + 0x154], esi
mov dword [edi + 0xf4], ebx
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], ebx
jmp loc.007a041a
Function at 0x52ae60
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
jmp loc.007a608e

Function at 0x52b340
Capabilities:
Check http status code

Disassembly:
mov eax, dword [edi + 4]
sub esp, 8
add dword [edi + 0x3c], 0xffffffff
mov eax, dword [eax + 0xa0]
push esi
jne 0x52b415
call fcn.005af400
test eax, eax
jne 0x52b415
cmp byte [edi + 0xba], al
je 0x52b415
cmp dword [edi + 0x24], 0x19
je 0x52b415
mov eax, dword [edi + 4]
call fcn.00413a40
test al, al
jne 0x52b415
fldz
mov ecx, dword [edi]
fstp dword [esp + 8]
call fcn.004538c0
test al, al
je 0x52b3bd
fld dword [0x679800]
sub esp, 8
fstp dword [esp + 4]
fld dword [0x67959c]
fstp dword [esp]
call fcn.00511cb0
fstp dword [esp + 0x10]
add esp, 8
cmp dword [edi + 0x24], 0x17
jne 0x52b3d1
mov eax, dword [edi]
mov esi, 0x46
call fcn.00453630
jmp 0x52b403
cmp byte [edi + 0x50], 0
je 0x52b3e1
push ecx
mov ecx, dword [edi]
mov eax, 0xc
jmp 0x52b3f7
mov ecx, dword [edi]
cmp byte [ecx + 0x8be], 0
push ecx
mov eax, 0xd
jne 0x52b3f7
mov eax, 0xb
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.00453650
mov eax, 0x3e8
call fcn.005af400
add eax, 0x1f4
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 0xb4]
test eax, eax
jle 0x52b43e
add eax, 0xffffffff
mov dword [edi + 0xb4], eax
jne 0x52b43e
mov eax, edi
call fcn.00532350
push 0x3a
push 0x6a
push 0x4b
mov eax, edi
call fcn.005321f0
jmp 0x7b8ddf
Function at 0x7a0c74
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x200
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov esi, dword [esp + 0x230]
mov dword [esp + 0x158], esi
mov esi, dword [esp + 0x158]
mov dword [esp + 0x230], esi
mov esi, dword [esp + 0x158]
cmp byte [esi], 0
jne 0x7a0cc6
mov dword [esp + 0x150], 1
jmp 0x7a0ce2
cmp byte [esi], 0x40
jne 0x7a0cd8
mov byte [esi], 0
add dword [esp + 0x158], 1
jmp 0x7a0ce2
add dword [esp + 0x158], 1
jmp 0x7a0cad
push dword [esp + 0x230]
push dword [esp + 0x234]
lea esi, [esp + 0x108]
call fcn.005b0ca0
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [0x7a0db1]
call fcn.00403e20
mov ecx, dword [esp + 0x244]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
lea eax, [0x7a0db1]
push eax
call edx
mov ecx, dword [esp + 0x244]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x224]
mov dword [ecx + 0x40], eax
lea eax, [esp + 0x234]
call fcn.00586cc0
lea eax, [esp + 0x100]
mov edi, dword [esp + 0x154]
mov ecx, dword [esp + 0x248]
imul edi, ecx
add edi, dword [esp + 0x22c]
push edi
push dword [esp + 0x22c]
push eax
mov eax, dword [esp + 0x230]
call fcn.00587120
lea ecx, [esp + 0x100]
call fcn.00404420
add dword [esp + 0x154], 1
cmp dword [esp + 0x150], 1
jne 0x7a0c9f
add esp, 0x200
popal
ret 0x24

Function at 0x7a58bd
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esi
mov ebp, esi
call fcn.007a5959
cmp eax, ebp
jne 0x7a5924
nop dword [eax]
cmp dword [ebp + 0x28e], 1
jge 0x7a5924
nop dword [eax]
add dword [ebp + 0x28e], 1
pushal
mov esi, dword [0x6a9ec0]
mov esi, dword [esi + 0x820]
mov esi, dword [esi]
push 0x47
push 0x61a80
push dword [ebp + 0xc]
add dword [esp], 0x28
fild dword [esp]
fstp dword [esp]
push dword [ebp + 8]
add dword [esp], 0x32
fild dword [esp]
fstp dword [esp]
call fcn.00518a70
mov edx, eax
push 0x3f99999a
call fcn.00518630
popal
push 0x7a59e8
call fcn.007a0a4a
test al, al
jne 0x7a5956
call fcn.007a5959
cmp eax, ebp
je 0x7a5956
fld dword [eax + 0x2c]
fld dword [ebp + 0x2c]
fstp dword [eax + 0x2c]
fstp dword [ebp + 0x2c]
mov dword [ebp + 0x292], 0x190
call fcn.0052f050
pop esi
pop ebp
ret
Function at 0x7bb1be
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x200
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov esi, dword [esp + 0x230]
mov dword [esp + 0x158], esi
mov esi, dword [esp + 0x158]
mov dword [esp + 0x230], esi
mov esi, dword [esp + 0x158]
cmp byte [esi], 0
jne 0x7bb210
mov dword [esp + 0x150], 1
jmp 0x7bb22c
cmp byte [esi], 0x40
jne 0x7bb222
mov byte [esi], 0
add dword [esp + 0x158], 1
jmp 0x7bb22c
add dword [esp + 0x158], 1
jmp 0x7bb1f7
push dword [esp + 0x230]
push dword [esp + 0x234]
lea esi, [esp + 0x108]
call fcn.005b0ca0
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [0x7bb2fb]
call fcn.00403e20
mov ecx, dword [esp + 0x244]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
lea eax, [0x7bb2fb]
push eax
call edx
mov ecx, dword [esp + 0x244]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x224]
mov dword [ecx + 0x40], eax
lea eax, [esp + 0x234]
call fcn.00586cc0
lea eax, [esp + 0x100]
mov edi, dword [esp + 0x154]
mov ecx, dword [esp + 0x248]
imul edi, ecx
add edi, dword [esp + 0x22c]
push edi
push dword [esp + 0x22c]
push eax
mov eax, dword [esp + 0x230]
call fcn.00587120
lea ecx, [esp + 0x100]
call fcn.00404420
add dword [esp + 0x154], 1
cmp dword [esp + 0x150], 1
jne 0x7bb1e9
add esp, 0x200
popal
ret 0x24

Function at 0x7bd26a
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [esi + 0x581e], 0x64
jne 0x7bd2af
nop dword [eax]
cmp dword [esi + 0x5852], 0
jne 0x7bd2af
nop dword [eax]
mov dword [esi + 0x585e], 1
pushal
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
push 2
push 8
push 0x14c
push 0x26b
call fcn.0040cb10
popal
ret
Function at 0x401130
Capabilities:
Check if file exists
Check mutex on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.MSVCR120.dll_memset
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0x18
mov dword [ebp - 0x420], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
push 0x105
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 0x41446c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4011ee
push 0x104
push esi
push dword [ebp - 0x420]
call fcn.00401380
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x401227
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x401249
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.thsnYaVieBoda
push 0x104
push esi
call fcn.00401540
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40123a
push eax
push 0x104
push esi
call fcn.00401540
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00410c15
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x401217
cmp dword [ebp + 0x10], 0
jne 0x401217
push str.TsnIorcAeBoda
jmp 0x40121c

Function at 0x401270
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call edi
test eax, eax
je 0x401296
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4012c5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
jne 0x4012c5
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call edi
test eax, eax
je 0x4012be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4012c5
call esi
cmp eax, 2
je 0x401302
push 0x419517
push 0x208
call fcn.00410c0c
mov esi, eax
add esp, 8
test esi, esi
je 0x401302
push 0x208
push 0
push esi
call sub.MSVCR120.dll_memset
push 0
push esi
call fcn.00401070
add esp, 0x14
test eax, eax
je 0x401308
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
pop edi
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3e8
jae 0x40131a
add eax, 0x3e8
push 1
push eax
push esi
call fcn.004013e0
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
je 0x401362
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 2
je 0x401361
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 1
jne 0x40134e
push 0
push 0xce
jmp 0x401358
test ebx, ebx
jne 0x401361
push ebx
push 0xcc
push esi
call fcn.004013e0
add esp, 0xc
pop ebx
push esi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4013e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor esi, esi
push esi
push 0x190000
push 3
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40141f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0xd
pop edi
cmove eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x401453
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 4
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401474
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xd
test esi, esi
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], esi
je 0x4014c1
xor eax, eax
mov byte [ebp - 4], 0
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 4]
push eax
push edi
call fcn.004014d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4014c1
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
inc ecx
cmp eax, ecx
mov dword [ebp - 0x10], eax
push edx
lea eax, [ebp - 8]
mov esi, 0xd
push eax
push 4
lea eax, [ebp - 0x10]
cmove esi, edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4014d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
lea ebx, [edi + 0xd]
lea esp, [esp]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40152b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
cmove esi, ebx
cmp esi, 0xe8
jne 0x401522
push 0xa
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xa
jl 0x4014e0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [ebp - 4], 4
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402935
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402974
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402970
lea ebx, [ebx]
cmp esi, edx
jae 0x402974
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402960
cmp esi, edx
jb 0x402979
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x403bb0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0
mov eax, dword [esi + 0x10]
lea ebx, [eax + eax]
mov eax, 0xaaaaaaab
lea ecx, [ebx + 2]
mul ecx
mov edi, edx
shr edi, 1
shl edi, 2
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x34], edi
jb 0x403c0d
mov esi, dword [esi]
lea eax, [esi + ebx]
mov dword [ebp - 0x14], 0xf
xor bl, bl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], bl
mov dword [ebp - 4], 0
cmp edi, 0xf
je 0x403c58
push 1
push edi
lea ecx, [ebp - 0x28]
call fcn.00403540
test al, al
je 0x403c55
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
cmovae eax, dword [ebp - 0x28]
mov byte [eax], bl
mov eax, dword [ebp - 0x2c]
xor edi, edi
cmp dword [ebp - 0x34], edi
jbe 0x403d09
cmp esi, eax
jae 0x403cbd
mov eax, edi
and eax, 3
cmp eax, 3
ja case.default.0x403c71
jmp dword [eax*4 + 0x403d6c]
mov bl, byte [esi]
shr bl, 2
jmp case.default.0x403c71
mov bl, byte [esi]
inc esi
and bl, 3
shl bl, 4
mov al, byte [esi]
shr al, 4
or bl, al
jmp case.default.0x403c71
mov bl, byte [esi]
inc esi
and bl, 0xf
shl bl, 2
mov al, byte [esi]
shr al, 6
or bl, al
jmp case.default.0x403c71
mov bl, byte [esi]
and bl, 0x3f
inc esi
cmp bl, 0x40
jae 0x403cd4
mov eax, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ecx, bl
movzx eax, byte [ecx + eax]
push eax
jmp 0x403cbf
push 0x3d
push 1
lea ecx, [ebp - 0x28]
call fcn.00403670
inc edi
cmp edi, dword [ebp - 0x34]
jae 0x403d09
mov eax, dword [ebp - 0x2c]
jmp 0x403c63
mov ebx, dword [ebp - 0x30]
mov ecx, ebx
push 0
push 0x4147d1
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
call fcn.00403840
cmp dword [ebp - 0x14], 0x10
jb 0x403d4d
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x403d4d
mov ebx, dword [ebp - 0x30]
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jae 0x403d3f
mov eax, dword [ebp - 0x18]
inc eax
je 0x403d44
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.MSVCR120.dll_memmove]
mov ecx, dword [ebp - 0x14]
add esp, 0xc
jmp 0x403d44
mov eax, dword [ebp - 0x28]
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410c15
mov esp, ebp
pop ebp
ret