joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460580
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00460590

Function at 0x462a30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
cmp eax, ebx
jb 0x462a43
mov eax, ebx
mov edi, dword [esp + 0x18]
add eax, eax
push eax
push dword [esp + 0x14]
push edi
call fcn.0043e210
mov al, byte [esi + 0x101]
add esp, 0xc
mov ecx, dword [0x4c71dc]
add ebx, ebx
mov byte [esp + 0x14], al
test ecx, ecx
jne 0x462ad0
cmp byte [0x4c71d8], cl
jne 0x462ad0
push str.Crypt32.dll
call fcn.0046c570
mov dword [0x4c71d4], eax
test eax, eax
je 0x462abc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0x4c71d4]
mov dword [0x4c71dc], eax
call esi
mov ecx, dword [0x4c71dc]
mov dword [0x4c71e0], eax
mov byte [0x4c71d8], 1
jmp 0x462ad5
mov eax, dword [0x4c71e0]
mov ecx, dword [0x4c71dc]
mov byte [0x4c71d8], 1
jmp 0x462ad5
mov eax, dword [0x4c71e0]
mov edx, ebx
and edx, 0xfffffff0
mov dword [esp + 0x1c], edx
xor edx, edx
cmp byte [esp + 0x14], dl
setne dl
cmp byte [esp + 0x20], 0
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1c]
je 0x462b34
test ecx, ecx
je 0x462b4b
push dword [esp + 0x14]
push edx
push edi
call ecx
test eax, eax
jne 0x462b73
push str.CryptProtectMemory_failed
push 0x4c71e4
call fcn.00462310
add esp, 8
mov ecx, 0x4c71e4
call fcn.00407ff0
push 2
mov ecx, 0x4c71e4
call fcn.004622c0
pop edi
pop esi
pop ebx
ret 0x14
test eax, eax
je 0x462b4b
push dword [esp + 0x14]
push edx
push edi
call eax
test eax, eax
jne 0x462b73
push str.CryptUnprotectMemory_failed
jmp 0x462b0b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor eax, eax
mov dword [esp + 0x20], ecx
test ebx, ebx
je 0x462b73
lea ecx, [ecx]
add cl, 0x4b
lea edx, [eax + edi]
add cl, al
inc eax
xor byte [edx], cl
mov ecx, dword [esp + 0x20]
cmp eax, ebx
jb 0x462b60
pop edi
pop esi
pop ebx
ret 0x14
Function at 0x462b80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x4c71dc]
push esi
push edi
test ecx, ecx
jne 0x462bef
cmp byte [0x4c71d8], cl
jne 0x462bef
push str.Crypt32.dll
call fcn.0046c570
mov dword [0x4c71d4], eax
test eax, eax
je 0x462bdb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0x4c71d4]
mov dword [0x4c71dc], eax
call esi
mov ecx, dword [0x4c71dc]
mov dword [0x4c71e0], eax
mov byte [0x4c71d8], 1
jmp 0x462bf4
mov eax, dword [0x4c71e0]
mov ecx, dword [0x4c71dc]
mov byte [0x4c71d8], 1
jmp 0x462bf4
mov eax, dword [0x4c71e0]
mov esi, dword [esp + 0x10]
mov edx, esi
movzx edi, byte [esp + 0x18]
and edx, 0xfffffff0
cmp byte [esp + 0x14], 0
je 0x462c44
test ecx, ecx
je 0x462c5b
push edi
push edx
push dword [esp + 0x14]
call ecx
test eax, eax
jne 0x462c80
push str.CryptProtectMemory_failed
push 0x4c71e4
call fcn.00462310
add esp, 8
mov ecx, 0x4c71e4
call fcn.00407ff0
push 2
mov ecx, 0x4c71e4
call fcn.004622c0
pop edi
pop esi
ret
test eax, eax
je 0x462c5b
push edi
push edx
push dword [esp + 0x14]
call eax
test eax, eax
jne 0x462c80
push str.CryptUnprotectMemory_failed
jmp 0x462c1e
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ebx, eax
test esi, esi
je 0x462c7f
mov edi, dword [esp + 0x10]
mov edi, edi
lea eax, [ebx + 0x4b]
add al, dl
lea ecx, [edx + edi]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x462c70
pop ebx
pop edi
pop esi
ret
Function at 0x463d90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x1010]
push ebp
push esi
mov esi, dword [esp + 0x1014]
push edi
movzx eax, word [esi]
test ax, ax
je 0x463fc3
push eax
call fcn.00464b40
mov edi, esi
add esp, 4
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x463dd4
sub edi, ecx
lea ebp, [esi + 2]
movzx ecx, word [esi]
sar edi, 1
mov eax, ecx
cmp ecx, 0x5c
jne 0x463df6
cmp word [ebp], cx
je 0x463e2f
push ecx
call fcn.00464b40
movzx eax, ax
add esp, 4
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x463ecc
cmp word [ebp], 0x3a
jne 0x463ecc
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x463e2c
cmp eax, 0x2f
jne 0x463ecc
movzx eax, word [esi]
push eax
call fcn.00464b40
movzx eax, ax
add esp, 4
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x463e7b
cmp word [ebp], 0x3a
jne 0x463e7b
lea eax, [edi + 4]
mov edi, dword [esp + 0x1020]
cmp edi, eax
jbe 0x463fc3
push edi
push 0x4aff5c
push ebx
call fcn.00464c00
push edi
push esi
push ebx
call fcn.00464ba0
add esp, 0x18
mov al, 1
jmp 0x463fc5
cmp word [esi], 0x5c
jne 0x463fc3
cmp word [ebp], 0x5c
jne 0x463fc3
mov esi, dword [esp + 0x1020]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x463fc3
push esi
push 0x4aff5c
push ebx
call fcn.00464c00
push esi
push 0x4aff68
push ebx
call fcn.00464ba0
push esi
push ebp
push ebx
call fcn.00464ba0
add esp, 0x24
mov al, 1
jmp 0x463fc5
lea eax, [esp + 0x10]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x463fc3
cmp eax, 0x7ff
ja 0x463fc3
movzx eax, word [esi]
cmp eax, 0x5c
je 0x463f87
cmp eax, 0x2f
je 0x463f87
lea eax, [esp + 0x10]
push 0x800
push eax
call fcn.004638d0
lea ecx, [esp + 0x18]
add esp, 8
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463f20
sub ecx, edx
lea eax, [edi + 4]
mov edi, dword [esp + 0x1020]
sar ecx, 1
add eax, ecx
cmp edi, eax
jbe 0x463fc3
push edi
push 0x4aff5c
push ebx
call fcn.00464c00
push edi
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00464ba0
add esp, 0x18
cmp word [esi], 0x2e
jne 0x463f78
movzx eax, word [esi + 2]
push eax
call fcn.00464120
add esp, 4
test al, al
je 0x463f78
add esi, 4
push edi
push esi
push ebx
call fcn.00464ba0
add esp, 0xc
mov al, 1
jmp 0x463fc5
lea eax, [edi + 6]
mov edi, dword [esp + 0x1020]
cmp edi, eax
jbe 0x463fc3
push edi
push 0x4aff5c
push ebx
call fcn.00464c00
xor eax, eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x1c]
push edi
push eax
push ebx
call fcn.00464ba0
push edi
push esi
push ebx
call fcn.00464ba0
add esp, 0x24
mov al, 1
jmp 0x463fc5
xor al, al
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
Function at 0x46c4e0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x30]
mov word [esp + 0x34], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp], eax
test eax, eax
je 0x46c550
lea eax, [esp]
push eax
push dword [esp + 8]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 4]
neg eax
sbb eax, eax
and dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp]
test eax, eax
mov ecx, dword [esp + 0x10]
setne al
xor ecx, esp
call fcn.0043cc06
add esp, 0x14
ret

Function at 0x46c570
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
lea eax, [esp + 4]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x46c5bc
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret 4
push 0x800
lea eax, [esp + 8]
push eax
push esi
push eax
call fcn.00464180
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret 4

Function at 0x46c6a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x114], eax
cmp byte [0x4c7214], 0
jne 0x46c730
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 0xa
ja 0x46c70f
jne 0x46c6ec
cmp dword [esp + 0xc], 0x55f0
jb 0x46c6ec
call fcn.0046c750
test al, al
je 0x46c70f
xor al, al
mov byte [0x4c7214], 1
mov byte [0x4c7215], al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043cc06
add esp, 0x118
ret
mov al, 1
mov byte [0x4c7215], al
mov byte [0x4c7214], al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043cc06
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
mov al, byte [0x4c7215]
xor ecx, esp
call fcn.0043cc06
add esp, 0x118
ret
Function at 0x46cbe0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x104], 0
jne 0x46cc6d
push ebx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x46cc6c
push ebp
push edi
lea edi, [esi + 4]
lea ecx, [ecx]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x46cd10
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
jne 0x46cc48
push str.CreateThread_failed
push 0x4c71e4
call fcn.00462310
add esp, 8
mov ecx, 0x4c71e4
call fcn.00407ff0
push 2
mov ecx, 0x4c71e4
call fcn.004622c0
mov dword [edi], ebp
inc dword [esi + 0x104]
mov eax, dword [0x4c7218]
test eax, eax
je 0x46cc62
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x46cc00
pop edi
pop ebp
pop ebx
cmp dword [esi + 0x108], 0x40
jb 0x46cc7d
mov ecx, esi
call fcn.0046cde0
mov ecx, dword [esi + 0x30c]
mov eax, dword [esp + 0xc]
mov dword [esi + ecx*8 + 0x10c], eax
mov ecx, dword [esi + 0x30c]
mov eax, dword [esp + 0x10]
mov dword [esi + ecx*8 + 0x110], eax
mov eax, dword [esi + 0x30c]
inc eax
and eax, 0x3f
inc dword [esi + 0x108]
mov dword [esi + 0x30c], eax
pop esi
pop ecx
ret 8

Function at 0x46cf80
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x46cfef
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46cfef
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop esi
setne al
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
mov ecx, dword [esp + 0x1008]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret

Function at 0x46d010
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x46d07f
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d07f
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
mov ecx, dword [esp + 0x1008]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
Function at 0x46d0a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46d0f6
push 0x800
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d0f3
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1008]
setne al
pop esi
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret

Function at 0x46d110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46d17a
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d178
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret

Function at 0x46d1d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push esi
call fcn.004647d0
add esp, 4
movzx eax, word [eax]
cmp eax, 0x2e
je 0x46d213
cmp eax, 0x20
je 0x46d213
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46d272
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d2a4
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d24a
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d2a4
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d2a4
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46d2a4
cmp byte [esp + 0x1010], 0
je 0x46d28c
push dword [esp + 0x1014]
push esi
call fcn.0046d4d0
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x46d2b9
cmp eax, 3
mov eax, 1
jne 0x46d2be
mov eax, 2
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
Function at 0x46d2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1028
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1024], eax
mov ecx, dword [esp + 0x1038]
push ebx
push ebp
mov ebp, dword [esp + 0x103c]
push esi
mov esi, dword [esp + 0x1038]
push edi
mov edi, dword [esp + 0x1040]
mov dword [esp + 0x18], ecx
test edi, edi
je 0x46d33c
mov eax, dword [edi]
or eax, dword [edi + 4]
mov byte [esp + 0x10], 1
jne 0x46d341
mov byte [esp + 0x10], 0
test ebp, ebp
je 0x46d352
mov eax, dword [ebp]
or eax, dword [ebp + 4]
mov byte [esp + 0x12], 1
jne 0x46d357
mov byte [esp + 0x12], 0
test ecx, ecx
je 0x46d367
mov eax, dword [ecx]
or eax, dword [ecx + 4]
mov byte [esp + 0x11], 1
jne 0x46d36c
mov byte [esp + 0x11], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46d3a3
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d3ba
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46d3ba
test bl, 1
je 0x46d3ba
push 0
push esi
mov byte [esp + 0x1b], 1
call fcn.0046d4d0
add esp, 8
jmp 0x46d3bf
mov byte [esp + 0x13], 0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x46d426
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d4b4
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x46d4b4
cmp byte [esp + 0x10], 0
je 0x46d439
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.004631c0
cmp byte [esp + 0x12], 0
je 0x46d44c
lea eax, [esp + 0x2c]
mov ecx, ebp
push eax
call fcn.004631c0
cmp byte [esp + 0x11], 0
je 0x46d461
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
call fcn.004631c0
movzx eax, byte [esp + 0x10]
lea ecx, [esp + 0x1c]
neg eax
mov edi, dword [esp + 0x14]
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x15]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x30]
push eax
movzx eax, byte [esp + 0x1a]
neg eax
sbb eax, eax
and eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
je 0x46d4b4
push ebx
push esi
call fcn.0046d4d0
add esp, 8
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1028
ret
Function at 0x46d4d0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
push dword [esp + 0x1014]
mov esi, dword [esp + 0x1014]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x46d54d
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d54d
push dword [esp + 0x1014]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
pop esi
setne al
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret
mov ecx, dword [esp + 0x1008]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1004
ret

Function at 0x46d6c0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.00497b90
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1260]
push edi
mov edi, dword [esp + 0x126c]
push eax
cmp esi, 0xffffffff
jne 0x46d76f
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46d794
push 0x800
lea eax, [esp + 0x260]
push eax
push ebx
call fcn.00463d90
add esp, 0xc
test al, al
je 0x46d740
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46d794
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x46d762
cmp eax, 3
je 0x46d762
cmp eax, 0x12
je 0x46d762
mov al, 1
mov byte [edi + 0x1044], al
jmp 0x46d842
xor al, al
mov byte [edi + 0x1044], al
jmp 0x46d842
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46d794
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne cl
or eax, 0xffffffff
mov byte [edi + 0x1044], cl
jmp 0x46d844
push 0x800
push ebx
push edi
call fcn.00464c00
push 0x800
lea eax, [esp + 0x48]
push eax
push edi
call fcn.00464900
mov ecx, dword [esp + 0x40]
xor eax, eax
add esp, 0x18
add eax, dword [esp + 0x2c]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0xc]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 0x1004], ecx
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x102c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1034], ecx
mov ecx, dword [esp + 0x24]
mov dword [edi + 0x1038], eax
lea eax, [esp + 0x20]
mov dword [edi + 0x103c], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.004634d0
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x1018]
call fcn.004634d0
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x1020]
call fcn.004634d0
mov eax, esi
mov ecx, dword [esp + 0x125c]
mov dword [edi + 0x1040], 0
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043cc06
add esp, 0x1254
ret
Function at 0x46e080
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x164
mov eax, dword [0x4c400c]
xor eax, esp
mov dword [esp + 0x160], eax
push ebp
mov ebp, dword [esp + 0x16c]
push esi
push edi
mov edi, dword [esp + 0x178]
mov eax, dword [ebp]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edi
cmp eax, 2
jne 0x46e17b
mov eax, dword [ebp + 4]
push ebx
push 0
push 0
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x140]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push edi
call fcn.0046f330
lea ecx, [esp + 0x155]
mov eax, 2
sub eax, ecx
lea edx, [esp + 0x155]
xor ebp, ebp
mov dword [esp + 0x38], eax
mov ecx, 3
add esp, 0x24
xor ebx, ebx
sub ecx, edx
mov dword [esp + 0x10], ecx
lea edi, [ebp + 1]
mov edi, edi
lea esi, [esp + 0x131]
add esi, ebp
movzx edx, byte [esi + 1]
lea ecx, [eax + esi]
movzx eax, byte [esi - 1]
and ecx, 3
shl ecx, 3
shl edx, cl
mov ecx, ebp
and ecx, 3
add ebp, 4
shl ecx, 3
shl eax, cl
mov ecx, edi
xor edx, eax
and ecx, 3
movzx eax, byte [esi]
add edi, 4
shl ecx, 3
shl eax, cl
mov ecx, dword [esp + 0x10]
xor edx, eax
movzx eax, byte [esi + 2]
add ecx, esi
and ecx, 3
xor ebx, edx
shl ecx, 3
shl eax, cl
xor ebx, eax
mov eax, dword [esp + 0x14]
cmp edi, 0x21
jb 0x46e110
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov eax, dword [ebp]
mov dword [ebp + 4], ebx
pop ebx
cmp eax, 3
jne 0x46e314
lea eax, [esp + 0xec]
xor edx, edx
sub edi, eax
nop
lea ecx, [esp + 0xec]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, 0x20
jb 0x46e190
lea eax, [esp + 0x1c]
mov dword [esp + 0x10c], 0x36363636
push eax
mov dword [esp + 0x114], 0x36363636
mov dword [esp + 0x118], 0x36363636
mov dword [esp + 0x11c], 0x36363636
mov dword [esp + 0x120], 0x36363636
mov dword [esp + 0x124], 0x36363636
mov dword [esp + 0x128], 0x36363636
mov dword [esp + 0x12c], 0x36363636
call fcn.0047c150
push 0x40
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0047c1a0
push 0x20
add ebp, 4
lea eax, [esp + 0x30]
push ebp
push eax
call fcn.0047c1a0
lea eax, [esp + 0x148]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0047c040
add esp, 0x24
xor edx, edx
lea ecx, [esp + 0xec]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor al, 0x5c
mov byte [ecx], al
cmp edx, 0x20
jb 0x46e243
lea eax, [esp + 0x84]
mov dword [esp + 0x10c], 0x5c5c5c5c
push eax
mov dword [esp + 0x114], 0x5c5c5c5c
mov dword [esp + 0x118], 0x5c5c5c5c
mov dword [esp + 0x11c], 0x5c5c5c5c
mov dword [esp + 0x120], 0x5c5c5c5c
mov dword [esp + 0x124], 0x5c5c5c5c
mov dword [esp + 0x128], 0x5c5c5c5c
mov dword [esp + 0x12c], 0x5c5c5c5c
call fcn.0047c150
push 0x40
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0047c1a0
push 0x20
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.0047c1a0
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.0047c040
mov ecx, 8
lea esi, [esp + 0x170]
mov edi, ebp
add esp, 0x24
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0043cc06
add esp, 0x164
ret