joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xac
mov eax, dword [0x42d370]
test eax, eax
je 0x42bd1d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x48], 0x61616161
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], 0x61616161
mov dword [ebp - 0x40], 0x61616161
mov dword [ebp - 0x3c], 0x61616161
mov dword [ebp - 0x38], 0x61616161
mov dword [ebp - 0x34], 0x61616161
mov dword [ebp - 0x30], 0x61616161
mov dword [ebp - 0x2c], 0x61616161
mov byte [ebp - 0x28], 0
mov dword [esp], eax
call sub.KERNEL32.DLL_FindAtomA
movzx eax, ax
sub esp, 4
test ax, ax
jne 0x42be7b
mov dword [esp], 0x14
xor esi, esi
lea ebx, [ebp - 0x78]
call sym._malloc
lea ecx, [ebp - 0xa8]
test eax, eax
mov edx, eax
mov dword [0x42d370], eax
mov edi, ecx
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 4], sym._abort
mov dword [eax + 8], sym._abort
jne 0x42be68
mov byte [ebp - 0xa8], 0x30
lea ecx, [ebp - 0xa7]
cmp ecx, edi
jbe 0x42bddc
mov esi, esi
dec ecx
inc esi
movzx eax, byte [ecx]
mov byte [ebx], al
inc ebx
cmp ecx, edi
ja 0x42bdd0
mov byte [ebx], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov eax, 0x20
sub eax, esi
mov dword [esp + 4], 0x61
mov dword [esp + 8], eax
call sym._memset
xor edx, edx
cmp edx, esi
jae 0x42be26
lea esi, [esi]
lea edi, [edi]
mov eax, edx
sub eax, esi
cmp byte [edx + ebp - 0x78], 0x30
je 0x42be64
mov cl, 0x41
mov byte [eax + ebp - 0x28], cl
inc edx
cmp edx, esi
jb 0x42be10
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sub.KERNEL32.DLL_AddAtomA
sub esp, 4
mov edx, dword [0x42d370]
lea eax, [edx + 4]
mov dword [0x42d374], eax
lea eax, [edx + 8]
mov dword [0x42d378], eax
lea eax, [edx + 0xc]
add edx, 0x10
mov dword [0x42d37c], eax
mov dword [0x42d380], edx
jmp 0x42bd15
mov cl, 0x61
jmp 0x42be1d
mov eax, edx
and eax, 1
add al, 0x30
mov byte [ecx], al
inc ecx
shr edx, 1
jne 0x42be68
jmp 0x42bdca
mov dword [esp], eax
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x21
call sub.KERNEL32.DLL_GetAtomNameA
xor edx, edx
sub esp, 0xc
mov esi, esi
lea edi, [edi]
cmp byte [edx + ebp - 0x48], 0x61
setne al
add al, 0x30
mov byte [edx + ebp - 0x48], al
inc edx
cmp edx, 0x1f
jbe 0x42bea0
mov dword [esp + 4], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 8], 2
call sym._strtoul
mov dword [0x42d370], eax
jmp 0x42be38
Function at 0x405b0f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push dword [ebp + 0x10]
push 0x50
call fcn.00404a5a
test eax, eax
mov dword [ebp - 4], eax
jne 0x405b2a
leave
ret
push ebx
push esi
push edi
cld
mov edi, dword [ebp - 4]
mov eax, 0
mov ecx, 0x50
or ecx, ecx
je 0x405b41
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
push 0x14
xor esi, esi
pop ebx
mov eax, esi
shr eax, 2
mov edx, eax
mov eax, dword [ebp - 4]
shl edx, 2
add eax, edx
mov ecx, esi
sub ecx, edx
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
shl ecx, 3
shl edx, cl
or dword [eax], edx
inc esi
cmp esi, ebx
jb 0x405b49
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], 0x123174bb
mov dword [ebp - 0x48], 0x86521ff8
mov dword [ebp - 0x44], 0x98d2438b
mov dword [ebp - 0x40], 0x7966ce12
mov dword [ebp - 0x3c], 0xc5d92014
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, 0x5e96ac
mov ecx, dword [ebp - 8]
mov eax, edi
cld
or ecx, ecx
je 0x405bbc
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor edx, edx
push 5
mov eax, ecx
pop esi
div esi
mov eax, dword [ebp + edx*4 - 0x4c]
xor dword [ebp + ecx*4 - 0x24], eax
inc ecx
cmp ecx, esi
jb 0x405bbe
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cld
or ecx, ecx
je 0x405bf5
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push dword [ebp + 0xc]
push 0
push 0x5ea13c
push dword [0x5e96c0]
push eax
push ebx
push dword [ebp - 4]
call fcn.0040d63c
lea eax, [ebp - 0x38]
mov byte [eax], 0
inc eax
dec ebx
jne 0x405c18
mov eax, dword [ebp - 4]
push 0x50
pop ecx
pop edi
pop esi
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x405c28
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00404a75
xor eax, eax
inc eax
leave
ret
Function at 0x408600
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x40873b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x408710
test eax, eax
jne 0x408710
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x408650
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x40873b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x408710
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc
Function at 0x40969d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
je 0x4096ea
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
sub ecx, edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov esi, dword [edi + edx]
mov ecx, dword [edx]
lea ebx, [ecx + esi]
add eax, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + edx], eax
mov ebx, ecx
xor ebx, esi
and ebx, eax
or ecx, esi
xor ebx, ecx
shr ebx, 0x1f
add edx, 4
dec dword [ebp + 0x14]
mov eax, ebx
jne 0x4096c1
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x4098c9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x409916
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
sub ecx, esi
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], edx
mov edi, dword [ebx + esi]
mov edx, dword [esi]
mov ecx, edi
sub ecx, edx
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + esi], ecx
xor ecx, edi
xor edx, edi
or ecx, edx
xor ecx, edi
shr ecx, 0x1f
add esi, 4
dec dword [ebp + 0x14]
mov eax, ecx
jne 0x4098ed
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x40e9cf
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
call fcn.0040e958
test eax, eax
je 0x40ea10
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
push 0
push str.Seed
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 8
Function at 0x414730
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0048af60
mov eax, dword [0x51e710]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x414795
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x414795
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00492538
add eax, 0x40
push eax
call fcn.004ce0ed
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00487e85
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004cfdb7
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x414824
call fcn.004145f0
test eax, eax
jle 0x414824
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00487e85
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00487e85
add esp, 0x108
ret
Function at 0x455d50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x455d69
mov esi, edi
mov edi, eax
jmp 0x455d6b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x455d7b
mov eax, ebx
jmp 0x455d85
push eax
push ebx
call fcn.00411150
add esp, 8
test eax, eax
jne 0x455d8d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x455dab
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x455d94
cmp eax, dword [esi + 4]
jge 0x455dc2
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x455db0
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x455de5
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x455de2
sub eax, 1
test eax, eax
jg 0x455dd2
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x45ce20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
mov ebx, edi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
and eax, 0xff
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
dec dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x45ce43
mov ecx, dword [edi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45ceb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
lea ebx, [edi + 0x44]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx - 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
and eax, 0xff
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
dec dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x45ced4
mov ecx, dword [edi]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 4]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45cf40
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0x12
push esi
push edi
mov ecx, 0x400
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 0x48]
mov esi, 0x50fc10
rep movsd dword es:[edi], dword [esi]
mov eax, 0x510c10
xor esi, esi
sub eax, ebx
mov edi, ebx
mov ebx, eax
movzx eax, byte [esi + edx]
lea edi, [edi + 4]
inc esi
xor ecx, ecx
cmp esi, dword [ebp + 8]
cmovge esi, ecx
shl eax, 8
movzx ecx, byte [esi + edx]
inc esi
or ecx, eax
xor eax, eax
cmp esi, dword [ebp + 8]
cmovge esi, eax
shl ecx, 8
movzx eax, byte [esi + edx]
inc esi
or eax, ecx
xor ecx, ecx
cmp esi, dword [ebp + 8]
cmovge esi, ecx
shl eax, 8
movzx ecx, byte [esi + edx]
inc esi
or ecx, eax
xor eax, eax
cmp esi, dword [ebp + 8]
cmovge esi, eax
mov eax, dword [ebx + edi - 4]
xor eax, ecx
dec dword [ebp - 8]
mov dword [edi - 4], eax
jne 0x45cf71
mov ebx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.0045ce20
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x45cfd8
lea esi, [ebx + 0x4c]
mov dword [ebp - 0xc], 4
jmp 0x45d010
mov edi, 0x80
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.0045ce20
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
dec edi
jne 0x45d015
dec dword [ebp - 0xc]
jne 0x45d010
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45e9d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x45e9e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x45ea24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x45ea20
lea ebx, [ebx]
cmp esi, edx
jae 0x45ea24
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x45ea10
cmp esi, edx
jb 0x45ea29
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4617b0
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0be6
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x51e710]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x418], 0
call fcn.004613d0
push eax
lea ecx, [ebp - 0x418]
call fcn.0045ec20
mov dword [ebp - 4], 0
push dword [ebp - 0x418]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x46182e
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4619e2
cmp dword [edi + 0x10], 0
lea esi, [edi + 0x10]
je 0x4619e2
mov dword [ebp - 0x41c], 0xf
mov dword [ebp - 0x420], 0
mov byte [ebp - 0x430], 0
push 0x2a
push str.key_is_32_bits_to_448_bits___variable_size
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 1
call fcn.0045e1a0
push 0x510f3c
push dword [ebp - 0x418]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0
push eax
call fcn.0048928b
mov eax, dword [ebp - 0x434]
add esp, 0xc
test eax, eax
je 0x4619b0
cmp dword [edi + 0x14], 0x10
jb 0x4618ac
mov edi, dword [edi]
mov dword [ebp - 0x438], edi
mov esi, dword [esi]
mov ebx, 1
test esi, esi
jle 0x461997
jmp 0x4618c0
cmp esi, 0x400
jle 0x4618cf
mov ebx, 0x400
jmp 0x461908
mov eax, esi
mov ebx, esi
and eax, 0x80000007
jns 0x4618df
dec eax
or eax, 0xfffffff8
inc eax
mov edi, 8
sub edi, eax
cmp edi, 8
jge 0x461902
push edi
lea eax, [ebp - 0x414]
add eax, esi
push 0
push eax
call fcn.0048a180
add esp, 0xc
lea ebx, [edi + esi]
mov edi, dword [ebp - 0x438]
push ebx
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0048fe00
add edi, ebx
lea edx, [ebp - 0x430]
add esp, 0xc
mov dword [ebp - 0x438], edi
sub esi, ebx
cmp dword [ebp - 0x41c], 0x10
cmovae edx, dword [ebp - 0x430]
mov eax, edx
lea ecx, [eax + 1]
mov dword [ebp - 0x43c], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461942
sub eax, dword [ebp - 0x43c]
lea ecx, [ebp - 0x414]
push eax
push edx
mov edx, ebx
call fcn.0045d050
add esp, 8
mov dword [ebp - 0x43c], eax
test eax, eax
je 0x46198b
push dword [ebp - 0x434]
lea eax, [ebp - 0x414]
push ebx
push 1
push eax
call fcn.004894f3
add esp, 0x10
test esi, esi
jg 0x4618c0
mov eax, dword [ebp - 0x434]
mov ebx, dword [ebp - 0x43c]
push eax
call fcn.004895e1
add esp, 4
test ebx, ebx
jne 0x4619b0
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x41c], 0x10
jb 0x4619c7
push dword [ebp - 0x430]
call fcn.00472297
add esp, 4
mov dword [ebp - 0x41c], 0xf
mov dword [ebp - 0x420], 0
mov byte [ebp - 0x430], 0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x418]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x461a09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00487e85
mov esp, ebp
pop ebp
ret 4
Function at 0x462550
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d0dab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x201c
call fcn.0048af60
mov eax, dword [0x51e710]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebx
push esi
push edi
mov eax, dword [0x51e710]
xor eax, esp
push eax
lea eax, [esp + 0x2030]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x20]
push eax
push 0x2000
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x4625ba
or eax, 0xffffffff
jmp 0x46269a
mov esi, dword [esp + 0x20]
xor ebx, ebx
shr esi, 2
xor edi, edi
mov dword [esp + 0x14], esi
test esi, esi
je 0x462698
mov eax, esi
mov esi, dword [esp + edi*4 + 0x24]
test esi, esi
je 0x46268f
call fcn.00473e96
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x4626c0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov edx, esi
mov dword [esp + 0x2038], 0
lea ecx, [esp + 0x1c]
call fcn.00466180
cmp eax, 1
jne 0x462662
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.004626d0
add esi, 0xfffffff0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2038], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x462654
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x1c], 1
mov eax, dword [esp + 0x14]
jne 0x46268f
inc ebx
jmp 0x46268f
mov dword [esp + 0x2038], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46268b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jb 0x4625d3
mov eax, ebx
mov ecx, dword [esp + 0x2030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.00487e85
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0045f320
int3

Function at 0x4629b0
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push ecx
push 0
mov edi, 1
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4629e5
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
mov eax, 2
pop esi
cmove edi, eax
mov eax, edi
pop edi
pop ebx
ret

Function at 0x462d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x462d39
cmp word [eax], 0
je 0x462d39
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0045f930
pop ebp
ret 4
Function at 0x465540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0869
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x51e710]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [esi], 0
call fcn.00473e96
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x46559b
push 0x80004005
call fcn.0045f320
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
mov dword [ebp - 0x10], 1
or ecx, eax
jge 0x4655d3
push 0x104
mov ecx, esi
call fcn.0045f070
push dword [esi]
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esi]
test eax, eax
jne 0x4655f0
xor ecx, ecx
jmp 0x465602
push dword [eax - 8]
push eax
call fcn.004886d5
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x465626
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x465626
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0045f320
int3