joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ac11
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
or esi, 0xffffffff
xor edi, edi
mov dword [ebp - 4], esi
mov ebx, edx
test ecx, ecx
jne 0x46ac30
mov edi, 0x80070057
jmp 0x46ac87
push edi
push 0x80
push 2
push edi
push 2
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.004692b0
mov esi, dword [ebp - 4]
cmp esi, 0xffffffff
jne 0x46ac69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov edi, eax
jmp 0x46ac87
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46ac58
cmp dword [ebp - 8], ebx
je 0x46ac8e
mov edi, 0x8000ffff
mov ecx, edi
call fcn.0046b33e
mov ecx, edi
call fcn.0046b356
test esi, esi
je 0x46aca5
cmp esi, 0xffffffff
je 0x46aca5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46b5a3
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 0x800c
push dword [ecx]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x46b5e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov esi, eax
mov ecx, esi
call fcn.0046b33e
jmp 0x46b654
push 4
pop edi
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x46b5c9
cmp dword [ebp - 0xc], edi
je 0x46b60a
mov esi, 0x8000ffff
jmp 0x46b5d8
mov edi, dword [ebp + 0x14]
cmp dword [ebp + 0x10], esi
je 0x46b64f
mov eax, dword [ebp - 8]
cmp eax, dword [edi]
jbe 0x46b620
mov esi, 0x8007007a
jmp 0x46b5d8
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x46b5c9
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x46b5c9
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov ecx, esi
call fcn.0046b356
cmp dword [ebp - 4], 0
je 0x46b66a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46b792
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0xc], eax
push esi
push edi
test ebx, ebx
jne 0x46b7b9
mov ecx, 0x80070057
mov esi, ecx
call fcn.0046b33e
jmp 0x46b947
cmp dword [ebp + 0x10], 0
je 0x46b7a8
lea ecx, [ebp - 0x14]
push ecx
push 2
pop edx
mov ecx, eax
call fcn.0046c902
mov esi, eax
test esi, esi
jns 0x46b7d7
mov ecx, esi
jmp 0x46b7af
mov edi, dword [ebp - 0x14]
xor edx, edx
push 3
pop ecx
mov eax, edi
mov dword [ebp - 8], edi
div ecx
xor ecx, ecx
mov esi, ecx
test eax, eax
je 0x46b80f
mov edx, eax
shl edx, 2
mov ecx, edx
shr ecx, 2
cmp ecx, eax
je 0x46b80a
mov esi, 0x80070216
mov ecx, esi
call fcn.0046b33e
jmp 0x46b812
mov dword [ebp - 8], edx
jmp 0x46b812
mov dword [ebp - 8], ecx
mov ecx, esi
call fcn.0046b356
test esi, esi
js 0x46b7d3
mov edi, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp - 8]
inc edx
test edi, edi
jne 0x46b83f
push dword [ebp + 0x10]
call fcn.0046c902
mov esi, eax
test esi, esi
js 0x46b7d3
xor esi, esi
jmp 0x46b947
lea eax, [ebp - 0x10]
push eax
call fcn.0046c902
mov esi, eax
test esi, esi
js 0x46b7d3
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
jae 0x46b862
mov esi, 0x8007007a
jmp 0x46b7d3
lea edx, [edi + ecx*2]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
test edx, edx
jle 0x46b93b
lea ecx, [edi + 6]
mov dword [ebp - 0xc], ecx
xor eax, eax
mov word [ebp - 8], ax
mov ah, byte [ebx]
inc ebx
mov byte [ebp - 1], al
cmp edx, 1
jbe 0x46b89d
mov al, byte [ebx]
inc ebx
mov byte [ebp - 2], al
cmp edx, 2
jbe 0x46b8a3
mov al, byte [ebx]
inc ebx
mov byte [ebp - 1], al
jmp 0x46b8a3
mov al, byte [ebp - 7]
mov byte [ebp - 2], al
cmp ecx, dword [ebp - 0x14]
jae 0x46b959
movzx ecx, ah
mov eax, ecx
shl ecx, 4
shr eax, 2
movzx eax, byte [eax + 0x40a240]
mov word [edi], ax
movzx eax, byte [ebp - 2]
mov dword [ebp - 0x18], eax
shr eax, 4
or eax, ecx
and eax, 0x3f
movzx eax, byte [eax + 0x40a240]
mov word [edi + 2], ax
cmp edx, 1
jbe 0x46b8fb
movzx ecx, byte [ebp - 1]
mov eax, dword [ebp - 0x18]
shl eax, 2
shr ecx, 6
or ecx, eax
and ecx, 0x3f
movzx eax, byte [ecx + 0x40a240]
jmp 0x46b8fe
push 0x3d
pop eax
mov word [edi + 4], ax
cmp edx, 2
jbe 0x46b917
movzx eax, byte [ebp - 1]
and eax, 0x3f
movzx eax, byte [eax + 0x40a240]
jmp 0x46b91a
push 0x3d
pop eax
mov ecx, dword [ebp - 0xc]
sub edx, 3
mov word [edi + 6], ax
add ecx, 8
add edi, 8
mov dword [ebp - 0xc], ecx
test edx, edx
jg 0x46b879
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
cmp edi, dword [ebp - 0x14]
jae 0x46b959
xor edx, edx
mov word [edi], dx
mov dword [eax], ecx
mov ecx, esi
call fcn.0046b356
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x8000ffff
jmp 0x46b7ad

Function at 0x46bb33
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bb4e
shr eax, 4
not eax
and eax, 1
jmp 0x46bb50
xor eax, eax
mov dword [esi], eax
xor ecx, ecx
call fcn.0046b356
xor ecx, ecx
call fcn.0046b356
xor eax, eax
pop esi
ret
Function at 0x46bc62
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, ebx
cmp dword [edi], ebx
je 0x46bc80
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [edi], ebx
cmp dword [edi + 8], ebx
je 0x46bcc9
push 0x30
push 0x18
push 0x4097d0
push dword [edi + 4]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x46bcb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov esi, eax
mov ecx, esi
call fcn.0046b33e
mov ecx, esi
call fcn.0046b356
test esi, esi
jns 0x46bcc9
mov ecx, esi
call fcn.0046b33e
jmp 0x46bcd8
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x46bcd8
call fcn.0046b1e2
mov dword [edi + 4], ebx
mov ecx, esi
call fcn.0046b356
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3cc7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov eax, edx
mov esi, ecx
push edi
movzx edi, al
test al, al
je 0x4a3d32
push ebx
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
add ecx, 4
xor ebx, eax
mov dword [ebp + 8], ecx
mov ecx, eax
movzx edx, bl
shl eax, 3
shr ecx, 3
xor ecx, eax
mov eax, ebx
shr eax, 8
add ecx, ebx
mov dword [ebp - 4], ecx
movzx ecx, al
mov eax, dword [esi + edx*8]
mov dword [esi + ecx*8], eax
mov eax, dword [esi + edx*8 + 4]
mov dword [esi + ecx*8 + 4], eax
mov eax, ebx
shr eax, 0x10
movzx ecx, al
shr ebx, 0x18
mov eax, dword [esi + ecx*8]
mov dword [esi + ebx*8], eax
mov eax, dword [esi + ecx*8 + 4]
mov dword [esi + ebx*8 + 4], eax
mov eax, dword [ebp - 4]
sub edi, 1
jne 0x4a3cdb
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a449c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4b21c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x34], eax
movzx eax, byte [0x468c50]
push esi
mov dword [ebp - 0x30], eax
movzx eax, word [0x468ca0]
push edi
xor edi, edi
mov dword [ebp - 0x40], edi
mov ebx, edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
test eax, eax
je 0x4a4676
test edi, edi
js 0x4a4676
mov esi, dword [ebx*8 + 0x468ca8]
mov ecx, dword [ebx*8 + 0x468ca4]
and esi, 0xfffffff
mov edx, dword [ebp - 0x40]
add esi, 0x400000
shr ecx, 1
and ecx, 0xfffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
lea eax, [ecx + esi]
mov dword [ebp - 0x44], eax
cmp esi, edx
jb 0x4a452c
mov eax, dword [ebp - 0x3c]
add eax, edx
lea edx, [ecx + esi]
cmp edx, eax
jb 0x4a4585
lea ecx, [ebp - 0x40]
call fcn.004a444c
mov eax, dword [ebp - 0x44]
mov edx, 0xfffff000
add eax, 0xfff
mov ecx, esi
and ecx, edx
and eax, edx
sub eax, ecx
mov dword [ebp - 0x40], ecx
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
call fcn.004a3e45
lea eax, [ebp - 0x28]
push eax
push 0x40
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2c], esi
call fcn.004a3ff8
test esi, esi
je 0x4a4661
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x4a4661
cmp dword [ebp + 8], 0
mov eax, dword [0x468c58]
je 0x4a4601
mov ecx, 0x800
test word [ebx*2 + 0x4b2274], cx
mov ecx, dword [ebp - 0x24]
jne 0x4a4666
push dword [0x468c5c]
push eax
lea eax, [ebp - 0x19]
push eax
mov eax, dword [ebx*8 + 0x468ca8]
and eax, 0xfffffff
push eax
push ecx
mov ecx, esi
call fcn.004a4b45
movzx ecx, byte [ebp - 0x19]
mov eax, 0x200
or cx, ax
mov edx, 0xfc03
mov ax, word [ebx*2 + 0x4b2274]
shl cx, 2
and ax, dx
or cx, ax
mov word [ebx*2 + 0x4b2274], cx
jmp 0x4a4666
movzx edx, word [ebx*2 + 0x4b2274]
test edx, 0x800
je 0x4a4666
push dword [0x468c5c]
push eax
mov eax, edx
shr edx, 2
shr eax, 0xa
not eax
and eax, 1
push eax
mov eax, dword [ebx*8 + 0x468ca8]
push edx
mov edx, dword [ebp - 0x20]
and eax, 0xfffffff
push eax
push ecx
mov ecx, esi
call fcn.004a4693
mov ax, word [ebx*2 + 0x4b2274]
mov ecx, 0xf7ff
and ax, cx
mov ecx, 0x400
or ax, cx
mov word [ebx*2 + 0x4b2274], ax
jmp 0x4a4666
mov edi, 0x8007000e
movzx ecx, word [0x468ca0]
inc ebx
cmp ebx, ecx
jb 0x4a44e3
lea ecx, [ebp - 0x40]
call fcn.004a444c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae550
mov esp, ebp
pop ebp
ret 4
Function at 0x4a8c1f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
lea edx, [ebp - 8]
and dword [ebp - 4], 0
push ebx
mov ebx, ecx
mov ecx, 0x40cf7c
push edi
call fcn.004a8d25
mov edi, eax
test edi, edi
jns 0x4a8c51
mov ecx, edi
call fcn.0046b33e
jmp 0x4a8cf5
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
lea ecx, [ebp - 4]
call fcn.004aae08
cmp dword [eax], 0
jne 0x4a8c7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov edi, eax
jmp 0x4a8c45
push 0x40cf90
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx], eax
test eax, eax
je 0x4a8c6c
push 0x40cfa0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 4], eax
test eax, eax
je 0x4a8c6c
push 0x40cfb0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 8], eax
test eax, eax
je 0x4a8c6c
push 0x40cfc8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x4a8c6c
push 0x40cfdc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4a8c6c
mov eax, dword [ebp - 4]
lea ecx, [ebx + 0x14]
and dword [ebp - 4], 0
push eax
call fcn.004aae08
mov ecx, edi
call fcn.0046b356
cmp dword [ebp - 4], 0
je 0x4a8d0f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x4a8d1d
mov ecx, dword [ebp - 8]
call fcn.0046b1e2
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8d25
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4b21c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40963c]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x214], eax
mov ebx, 0x104
mov dword [ebp - 0x230], edx
push ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x22c], ecx
mov esi, edi
mov dword [ebp - 0x220], edi
push eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x218], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4a8da6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov ebx, eax
mov ecx, ebx
call fcn.0046b33e
jmp 0x4a8e6f
lea eax, [ebp - 0x228]
mov edx, ebx
push eax
lea ecx, [ebp - 0x210]
call fcn.00469218
mov ebx, eax
test ebx, ebx
js 0x4a8d9a
mov edx, dword [ebp - 0x228]
push 0x5c
pop esi
movzx eax, word [ebp + edx*2 - 0x212]
cmp si, ax
je 0x4a8dde
push 0x2f
pop ecx
cmp cx, ax
jne 0x4a8ddf
dec edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00469327
mov ebx, eax
test ebx, ebx
jns 0x4a8e06
mov ecx, ebx
call fcn.0046b33e
mov esi, dword [ebp - 0x21c]
jmp 0x4a8e6f
mov eax, dword [ebp - 0x22c]
cmp si, word [eax]
jne 0x4a8e14
add eax, 2
lea edx, [ebp - 0x224]
mov ecx, eax
call fcn.0046b2da
mov ebx, eax
test ebx, ebx
js 0x4a8df7
push dword [ebp - 0x224]
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push eax
push esi
lea eax, [ebp - 0x220]
push 3
push eax
call fcn.004aadd7
mov ebx, eax
add esp, 0x14
test ebx, ebx
jns 0x4a8e61
mov ecx, ebx
call fcn.0046b33e
mov edi, dword [ebp - 0x220]
jmp 0x4a8e6f
mov ecx, dword [ebp - 0x230]
mov eax, dword [ebp - 0x220]
mov dword [ecx], eax
mov ecx, ebx
call fcn.0046b356
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x4a8e87
mov ecx, eax
call fcn.0046b1e2
test esi, esi
je 0x4a8e92
mov ecx, esi
call fcn.0046b1e2
test edi, edi
je 0x4a8e9d
mov ecx, edi
call fcn.0046b1e2
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae550
mov esp, ebp
pop ebp
ret
Function at 0x4ab990
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4b21c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x130], ecx
push 0x114
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], esi
push esi
xor edi, edi
push eax
mov dword [ebp - 0x128], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4aba08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov ebx, eax
mov ecx, ebx
call fcn.0046b33e
jmp 0x4aba2c
cmp dword [ebp - 0x110], 2
jne 0x4aba26
cmp dword [ebp - 0x11c], 6
jb 0x4aba26
mov dword [ebp - 0x12c], 1
jmp 0x4aba2c
and dword [ebp - 0x12c], ebx
mov ecx, ebx
call fcn.0046b356
test ebx, ebx
jns 0x4aba43
mov ecx, ebx
call fcn.0046b33e
jmp 0x4abae6
cmp dword [ebp - 0x12c], esi
je 0x4abac0
lea edx, [ebp - 0x128]
mov ecx, 0x40d01c
call fcn.004a8d25
mov ebx, eax
test ebx, ebx
jns 0x4aba70
mov ecx, ebx
call fcn.0046b33e
mov edi, dword [ebp - 0x128]
jmp 0x4abae6
mov edi, dword [ebp - 0x128]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
lea ecx, [ebp - 0x124]
call fcn.004aae08
mov esi, dword [ebp - 0x124]
test esi, esi
jne 0x4abaa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov ebx, eax
jmp 0x4aba37
push 0x40d038
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x4abac6
jmp 0x4aba97
and dword [ebp - 0x124], esi
mov ecx, dword [ebp - 0x130]
push esi
xor esi, esi
lea ecx, [ecx + 4]
call fcn.004aae08
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x124]
mov dword [ecx + 8], eax
mov ecx, ebx
call fcn.0046b356
test esi, esi
je 0x4abaf8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x4abb03
mov ecx, edi
call fcn.0046b1e2
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae550
mov esp, ebp
pop ebp
ret
Function at 0x4ac719
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4b21c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x94
lea eax, [ebp - 0xa0]
push ebx
xor esi, esi
mov edi, ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], ebx
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4ac77a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0046b326
mov esi, eax
mov ecx, esi
call fcn.0046b33e
jmp 0x4ac79f
cmp dword [ebp - 0x90], 2
jne 0x4ac79b
cmp dword [ebp - 0x9c], 5
ja 0x4ac796
jne 0x4ac79b
cmp dword [ebp - 0x98], esi
jbe 0x4ac79b
xor eax, eax
inc eax
jmp 0x4ac79d
mov eax, esi
mov dword [edi], eax
mov ecx, esi
call fcn.0046b356
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae550
mov esp, ebp
pop ebp
ret
Function at 0x4ad0a1
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov edi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x18], esi
jne 0x4ad0cb
mov ebx, 0x80070057
jmp 0x4ad1cf
lea eax, [ebp - 0x1c]
push eax
push 0x4689c8
call dword [sym.imp.SLC.dll_SLGetWindowsInformationDWORD]
mov ebx, eax
test ebx, ebx
js 0x4ad1cf
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov dword [ebp - 0x18], eax
test ax, ax
jne 0x4ad0ff
mov ebx, 0x80070490
jmp 0x4ad1cf
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call fcn.004abb16
test eax, eax
js 0x4ad149
cmp dword [ebp - 0x10], 0x4f8
jne 0x4ad149
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
lea ecx, [ecx + 0x378]
call fcn.004aca66
mov ebx, eax
test ebx, ebx
jns 0x4ad140
mov ecx, ebx
call fcn.0046b33e
mov edi, dword [ebp - 4]
jmp 0x4ad1d6
mov edi, dword [ebp - 4]
mov edx, edi
test edi, edi
jne 0x4ad14b
mov edx, esi
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.004acb27
mov ebx, eax
test ebx, ebx
js 0x4ad1cf
lea edx, [ebp - 4]
call fcn.004ace51
mov ebx, eax
test ebx, ebx
js 0x4ad1cf
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x18]
call fcn.004acf75
mov ebx, eax
test ebx, ebx
js 0x4ad1cf
mov edx, dword [ebp - 4]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x10]
push eax
call fcn.004acade
mov ebx, eax
test ebx, ebx
js 0x4ad1cf
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call fcn.004acc5d
mov ebx, eax
test ebx, ebx
jns 0x4ad1bc
mov ecx, ebx
call fcn.0046b33e
mov esi, dword [ebp - 8]
jmp 0x4ad1d6
mov esi, dword [ebp - 8]
mov ecx, esi
mov edx, dword [ebp + 0x18]
call fcn.004acfef
mov ebx, eax
test ebx, ebx
jns 0x4ad1d6
mov ecx, ebx
call fcn.0046b33e
mov ecx, ebx
call fcn.0046b356
test edi, edi
je 0x4ad1e8
mov ecx, edi
call fcn.0046b1e2
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4ad1f6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x4ad201
mov ecx, esi
call fcn.0046b1e2
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4ad20d
call fcn.0046b1e2
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4ad300
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
pop ebp
ret 4
Function at 0x4ae8b4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4b0e98
call fcn.004aebe8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ae914
cmp eax, 0xffffffff
je 0x4ae914
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4ae90d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4ae90d
cmp edx, 0x10000000
jae 0x4ae90d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4ae90a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004aec2d
ret 4

Function at 0x4ae960
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4ae99e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4ae996
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4ae9a0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4ae986
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4aea70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4aea86
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4aeaa1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x47e410
Capabilities:
Connect to http server
Create http request

Disassembly:
mov dword [edi], 0
mov dword [esi], 0
test eax, eax
je 0x47e426
cmp word [eax], 0
jne 0x47e42b
mov eax, 0x4ac82c
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi], eax
test eax, eax
je 0x47e476
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi], eax
test eax, eax
je 0x47e470
xor eax, eax
ret
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
jmp dword [sym.imp.KERNEL32.dll_GetLastError]