joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a735c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x503270]
push esi
mov esi, dword [ebp + 8]
test esi, esi
mov dword [ebp - 4], eax
je 0x4a73db
push esi
call fcn.00497149
test eax, eax
pop ecx
jne 0x4a73a3
call fcn.004980d2
mov dword [eax], 0xf
call fcn.004980c9
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.0049bcd6
leave
ret
and word [ebp - 6], 0
lea eax, [ebp - 0x218]
push eax
add esi, 0x40
lea eax, [ebp - 0x214]
push eax
mov word [ebp - 0xc], si
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x4a73ee
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4a7396
inc eax
cmp eax, esi
ja 0x4a7396
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4a7425
cmp eax, dword [ebp + 0x10]
jg 0x4a7406
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
call fcn.004978fc
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x4a743a
call fcn.004980c9
mov dword [eax], 0xc
jmp 0x4a7396
cmp eax, dword [ebp + 0x10]
jle 0x4a743a
call fcn.004980c9
mov dword [eax], 0x22
jmp 0x4a7396
lea eax, [ebp - 0x214]
push eax
push ecx
call fcn.004a7915
pop ecx
pop ecx
jmp 0x4a7398
Function at 0x4a827b
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x4f36d0
call fcn.0049b9e8
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x512210], edi
jne 0x4a82bf
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4a82aa
mov dword [0x512210], ebx
jmp 0x4a82bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4a82bf
mov dword [0x512210], 2
mov eax, dword [0x512210]
cmp eax, ebx
jne 0x4a82df
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x4a83a2
cmp eax, 2
je 0x4a82e8
cmp eax, edi
jne 0x4a8310
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x4a82fb
mov eax, dword [0x5121a0]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x4a8317
xor eax, eax
jmp 0x4a83a2
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00497b90
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x4a834a
cmp esi, edi
jne 0x4a8360
push dword [ebp - 0x20]
call fcn.004978fc
pop ecx
mov esi, eax
cmp esi, edi
je 0x4a8310
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4a8393
cmp dword [ebp + 0x14], edi
jne 0x4a837d
push edi
push edi
jmp 0x4a8383
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x4a839f
push esi
call fcn.00497557
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0049ba23
ret
Function at 0x4a83ab
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x4f36e0
call fcn.0049b9e8
xor esi, esi
cmp dword [0x512214], esi
jne 0x4a83ef
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4a83da
mov dword [0x512214], edi
jmp 0x4a83ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4a83ef
mov dword [0x512214], 2
mov eax, dword [0x512214]
cmp eax, 2
je 0x4a84d0
cmp eax, esi
je 0x4a84d0
cmp eax, 1
jne 0x4a8434
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x4a841d
mov eax, dword [0x5121a0]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4a843b
xor eax, eax
jmp 0x4a84e2
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00497b90
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4a8471
cmp edi, esi
jne 0x4a848c
lea eax, [ebx + ebx]
push eax
call fcn.004978fc
pop ecx
mov edi, eax
cmp edi, esi
je 0x4a8434
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4a84bf
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x4a84a9
push esi
push esi
jmp 0x4a84af
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x4a84cb
push edi
call fcn.00497557
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4a84e2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0049ba23
ret
Function at 0x4a89c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
push 0xc8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx ecx, byte [ebp - 0x104]
cmp ecx, 0x41
jne 0x4a8a23
mov edx, dword [str.c:_flexlm_]
mov al, byte [ebp - 0x104]
mov byte [edx], al
lea ecx, [ebp - 0x29c]
push ecx
push 0x101
call fcn.0043f57a
lea edx, [ebp - 0x10c]
push edx
push 0
call fcn.0043d1f2
add esp, 8
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x4a8a7a
push str.Initialization_error__exiting._n
push 0x502e38
call fcn.00498ac1
add esp, 8
push 0x502e38
call fcn.00498a68
add esp, 4
mov eax, 1
jmp 0x4a8ac0
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.004a8ad0
add esp, 8
call fcn.0043f58f
cmp dword [ebp - 0x108], 0
je 0x4a8abe
mov edx, dword [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call fcn.0043d5eb
add esp, 8
mov dword [ebp - 0x108], 0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4b8109
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 0xff
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sar ecx, 8
and ecx, 0xff
and ecx, 0xff
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0x80000000
jae 0x4b815e
mov edx, dword [ebp - 8]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
mov dword [ebp - 0x10], edx
jmp 0x4b8183
cmp dword [ebp - 0xc], 4
jae 0x4b817c
mov eax, dword [ebp - 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and ah, 0x7f
mov dword [ebp - 0x10], eax
jmp 0x4b8183
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 5
jne 0x4b8198
cmp dword [ebp - 4], 2
jne 0x4b8198
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 1
cmp dword [ebp - 0xc], 5
jne 0x4b81ad
cmp dword [ebp - 4], 1
jne 0x4b81ad
mov edx, dword [ebp + 0x10]
mov dword [edx], 1
cmp dword [ebp - 0xc], 5
jne 0x4b81c2
cmp dword [ebp - 4], 0
jne 0x4b81c2
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
cmp dword [ebp - 0xc], 4
jne 0x4b81d7
cmp dword [ebp - 4], 0
jne 0x4b81d7
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
cmp dword [ebp - 0xc], 3
jne 0x4b81ec
cmp dword [ebp - 4], 0
jne 0x4b81ec
mov edx, dword [ebp + 8]
mov dword [edx], 1
cmp dword [ebp - 0xc], 4
jne 0x4b8201
cmp dword [ebp - 4], 1
jne 0x4b8201
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4c7b5d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov dword [0x513578], 1
call fcn.004afd4f
cmp dword [ebp + 8], 0x18
je 0x4c7bb7
cmp dword [ebp + 8], 0x17
jge 0x4c7bb7
cmp dword [ebp + 8], 0
jle 0x4c7bb7
cmp dword [0x512218], 0
je 0x4c7b98
cmp dword [ebp + 8], 0xf
je 0x4c7bb7
push 0
push 1
call fcn.004c7e52
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str.EXITING_DUE_TO_SIGNAL__d_n
call fcn.004c7fe2
add esp, 8
jmp 0x4c7bd6
cmp dword [ebp + 8], 0x18
jne 0x4c7bd6
push 0
push 1
call fcn.004c7e52
add esp, 8
push str.daemon_shutdown_requested___shutting_down_n
call fcn.004c7fe2
add esp, 4
cmp dword [0x512218], 0
je 0x4c7be6
call fcn.004ac29e
jmp 0x4c7bf0
push 1
call fcn.004ce647
add esp, 4
push str.on_exit
push 0x50794c
call fcn.004ce8d0
add esp, 8
call fcn.004ce58a
cmp dword [ebp + 8], 0x20
je 0x4c7c17
push 1
call fcn.004b8e8f
add esp, 4
cmp dword [ebp + 8], 0x18
jne 0x4c7c24
push 0x25
call fcn.00498899
mov ecx, dword [ebp + 8]
push ecx
call fcn.00498899
mov esp, ebp
pop ebp
ret
Function at 0x4d0953
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0x104
mov dword [ebp - 0x108], 0
cmp dword [ebp + 8], 0
jne 0x4d09c2
jmp 0x4d0a4d
mov eax, dword [ebp + 8]
push eax
push str._s_EventLoggingMode
lea ecx, [ebp - 0x214]
push ecx
call fcn.004970c0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x20019
push 0
push str.SOFTWAREMacrovision_CorporationFLEXlm_License_Manager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d0a4d
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d0a4d
push str.ENABLE
lea edx, [ebp - 0x104]
push edx
call fcn.004a71f0
add esp, 8
test eax, eax
jne 0x4d0a4d
mov dword [ebp - 0x108], 1
cmp dword [ebp - 0x218], 0
je 0x4d0a6d
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x108]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4d0aa8
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
mov dword [ebp - 8], 0xffffff77
mov dword [ebp - 0x110], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x514f64], 0
je 0x4d0b08
mov eax, dword [ebp + 0x18]
and eax, 0xffff
test eax, eax
je 0x4d0b0d
cmp dword [ebp + 0x1c], 0
jne 0x4d0b0d
jmp 0x4d0c2b
mov cx, word [ebp + 0x18]
add cx, 1
mov word [ebp + 0x18], cx
mov edx, dword [ebp + 0x18]
and edx, 0xffff
shl edx, 2
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00428790
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x4d0c24
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x5091c4
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004970c0
add esp, 0xc
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x10c]
mov dword [edx], eax
mov dword [ebp - 0x110], 1
jmp 0x4d0b88
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp + 0x18]
and edx, 0xffff
cmp dword [ebp - 0x110], edx
jge 0x4d0be7
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx + ecx*4 - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043ca83
add esp, 0xc
mov edx, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + edx*4], eax
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x114]
cmp dword [eax + edx*4], 0
jne 0x4d0be5
mov cx, word [ebp - 0x110]
mov word [ebp + 0x18], cx
jmp 0x4d0c2b
jmp 0x4d0b79
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov dx, word [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov dx, word [ebp + 0xc]
push edx
mov eax, dword [0x514f64]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x4d0c22
mov dword [ebp - 8], 0
jmp 0x4d0c2b
mov dword [ebp - 8], 0xffffffd8
cmp dword [ebp - 0x114], 0
je 0x4d0cbc
mov dword [ebp - 0x110], 1
jmp 0x4d0c53
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp + 0x18]
and edx, 0xffff
cmp dword [ebp - 0x110], edx
jge 0x4d0ca3
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x114]
cmp dword [ecx + eax*4], 0
je 0x4d0ca1
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004289be
add esp, 4
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x114]
mov dword [eax + edx*4], 0
jmp 0x4d0c44
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.004289be
add esp, 4
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4d162a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x1c], 0
je 0x4d1670
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0xffff
mov eax, dword [ebp + 0xc]
push eax
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4d1670
call fcn.0047e95d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0
je 0x4d1697
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0047eb62
add esp, 8
cmp eax, 0xffffffff
jne 0x4d1697
call fcn.0047e95d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x20], 0
je 0x4d16ee
push 0x5094ec
call sub.WSOCK32.dll_getprotobyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d16be
call fcn.0047e95d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov dword [ebp - 4], 1
push 4
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4d16ee
call fcn.0047e95d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret
Function at 0x4ed4d4
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4ed4f5
lea eax, [ebp - 4]
push eax
call fcn.00497bcd
mov eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
lea edi, [ebp - 8]
lea eax, [edi + 4]
push eax
call fcn.004981cb
test eax, eax
pop ecx
jne 0x4ed516
call fcn.004980c9
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x4ed617
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x4ed608
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4ed608
push edi
call fcn.004981cb
test eax, eax
pop ecx
je 0x4ed608
mov cx, word [eax + 0x14]
add cx, 0x76c
mov word [ebp - 0x30], cx
mov cx, word [eax + 0x10]
inc cx
mov word [ebp - 0x2e], cx
mov cx, word [eax + 0xc]
mov word [ebp - 0x2a], cx
mov cx, word [eax + 8]
mov word [ebp - 0x28], cx
mov cx, word [eax + 4]
mov word [ebp - 0x26], cx
mov ax, word [eax]
and word [ebp - 0x22], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
je 0x4ed608
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4ed608
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call fcn.004a1e76
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x4ed608
xor eax, eax
jmp 0x4ed616
call fcn.004980c9
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x406389
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4063ad
xor eax, eax
test eax, eax
je 0x4063c0
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4063c0
xor ecx, ecx
jmp 0x4063c3
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x409014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
leave
ret 4

Function at 0x4064a6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426dac], 0
push esi
jne 0x4064dd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064b7
mov dword [ecx*4 + 0x426da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4064b2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40650e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426da8]
xor eax, esi
inc ecx
dec edx
jne 0x4064f0
pop edi
not eax
pop esi
ret 0xc

Function at 0x484cdf
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x484a08
sub ebx, 1
mov ebx, edx
call fcn.00484d20
and ebx, edx
xor dword [eax], esi
mov ebx, edx
add eax, 2
sub ebx, 0x6885c398
inc edx
sub ebx, 1
cmp eax, ecx
jl fcn.00484cdf
add edx, 0x743a46c
add edx, 1
dec ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x58255b8a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x549758b3
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4031d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [section..data]
push ebx
cdq
and edx, 0x3f
push ebp
add eax, edx
push esi
sar eax, 6
xor ebx, ebx
push edi
mov dword [section..data], eax
mov eax, dword [0x4053ac]
push ebx
push 0x61
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ecx, dword [section..data]
mov eax, 0x43b3d5b
imul ecx
sar edx, 1
mov edi, dword [esp + 0x14]
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
xor eax, eax
mov dword [section..data], edx
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jl 0x40321a
mov byte [edi + 0x100], bl
mov byte [edi + 0x101], bl
mov ecx, dword [0x405004]
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
mov ecx, dword [str.Djs]
sar edx, 5
mov eax, edx
mov ebp, dword [esp + 0x1c]
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
mov dword [0x405004], edx
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
xor esi, esi
mov dword [str.Djs], edx
mov eax, esi
mov ecx, dword [esp + 0x18]
cdq
idiv ebp
xor eax, eax
push 0xc8
mov al, byte [edx + ecx]
xor edx, edx
mov dl, byte [esi + edi]
add edx, ebx
lea ebx, [edx + eax]
mov eax, dword [0x4053ac]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and ebx, 0xff
xor eax, eax
mov al, byte [esi + edi]
inc esi
mov cl, byte [ebx + edi]
cmp esi, 0x100
mov byte [esi + edi - 1], cl
mov byte [ebx + edi], al
jl 0x403273
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4032d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4053ac]
push ebx
push ebp
push esi
push edi
push 0
push 0x9fc
push 0xdf
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [esp + 0x14]
mov ecx, dword [0x4053b8]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
push 0x73ef
mov dword [0x405004], 0x7c4f
mov al, byte [esi + 0x101]
xor ebx, ebx
mov bl, byte [esi + 0x100]
push 0x625e
push 0x3a13
push ecx
mov dword [esp + 0x24], eax
mov dword [0x40500c], 0x27be
call ebp
mov eax, dword [esp + 0x1c]
xor edi, edi
test eax, eax
jle 0x4033ea
mov edx, dword [0x4053ac]
push 0x3b59
push 0x1016
push 0x43ee
push edx
call ebp
mov eax, dword [esp + 0x14]
inc ebx
mov edx, dword [0x4053c0]
and ebx, 0xff
xor ecx, ecx
mov dword [str.Djs], 0x5297
mov cl, byte [ebx + esi]
push 0x7e2
add eax, ecx
push 0x3b2d
and eax, 0xff
push 0x42fb
push edx
mov dword [0x405004], 0x68d6
mov dword [esp + 0x24], eax
call ebp
mov ecx, dword [esp + 0x14]
xor eax, eax
mov al, byte [ebx + esi]
push 2
mov dl, byte [ecx + esi]
mov byte [ebx + esi], dl
mov byte [ecx + esi], al
mov cl, byte [ebx + esi]
add ecx, eax
mov eax, dword [esp + 0x1c]
and ecx, 0xff
mov dl, byte [ecx + esi]
mov cl, byte [edi + eax]
xor cl, dl
mov byte [edi + eax], cl
mov eax, dword [0x4053c4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, eax
jl 0x403344
mov cl, byte [esp + 0x14]
mov eax, 0x3159721f
mov byte [esi + 0x101], cl
mov ecx, dword [0x405014]
imul ecx
sar edx, 4
mov eax, edx
pop edi
shr eax, 0x1f
add edx, eax
mov eax, 0x514c2d41
mov dword [0x405014], edx
mov byte [esi + 0x100], bl
mov ecx, dword [0x40501c]
pop esi
imul ecx
sar edx, 0xd
mov ecx, edx
pop ebp
shr ecx, 0x1f
add edx, ecx
pop ebx
mov dword [0x405004], edx
ret