joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418060
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4733cb
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x48f840]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0xa8]
call fcn.00414820
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xa8]
call fcn.00417d00
cmp dword [eax + 0x14], 8
jb 0x4180b6
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
sete bl
cmp dword [ebp - 0x14], 8
jb 0x4180d4
push dword [ebp - 0x28]
call fcn.0043d771
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0041e2c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d762
mov esp, ebp
pop ebp
ret

Function at 0x4181e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473440
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48f840]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
mov edx, edi
lea ecx, [ebp - 0x2c]
call fcn.0041e4a0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418223
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], 8
mov esi, eax
jb 0x41823d
push dword [ebp - 0x2c]
call fcn.0043d771
add esp, 4
test esi, esi
je 0x41825e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043d762
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, 0xda
call fcn.00411d20
int3

Function at 0x418270
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473478
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x48f840]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [ebp - 0x44]
call fcn.0041e4a0
add esp, 4
mov esi, eax
push 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041e4a0
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x4182ca
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4182d2
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
sete bl
cmp dword [ebp - 0x18], 8
jb 0x4182f0
push dword [ebp - 0x2c]
call fcn.0043d771
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x41831c
push dword [ebp - 0x44]
call fcn.0043d771
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
test bl, bl
je 0x418340
mov edx, edi
mov ecx, 0xdb
call fcn.00411d20
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043d762
mov esp, ebp
pop ebp
ret
Function at 0x419820
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473811
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x48f840]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0
movzx eax, word [ebx + 0x24]
cmp eax, dword [ebx + 8]
mov dword [ebp - 0x40], esi
sete byte [ebp - 0x30]
push dword [ebp - 0x30]
push esi
call fcn.00418fb0
mov dword [ebp - 4], 0
cmp dword [ebx + 0x40], 0
mov dword [ebp - 0x38], 1
je 0x419980
movzx eax, byte [ebp - 0x30]
xor edi, edi
neg eax
sbb eax, eax
mov dword [ebp - 0x30], eax
lea ecx, [ecx]
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x3c], ecx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
push 0xffffffffffffffff
push eax
push esi
mov dword [ebp - 4], 1
call fcn.00402ab0
push edi
push dword [ebp - 0x30]
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.0041a1e0
mov edx, dword [ebx + 0x40]
add edx, 4
cmp dword [edx + 0x14], 8
jb 0x4198e8
mov edx, dword [edx]
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041e4a0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4198fd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x18], 8
mov ebx, eax
jb 0x419917
push dword [ebp - 0x2c]
call fcn.0043d771
add esp, 4
cmp ebx, 0xffffffff
je 0x419932
test bl, 0x10
mov eax, 0
sete al
lea eax, [eax*2 - 1]
test eax, eax
jne 0x41993f
mov ebx, dword [ebp - 0x34]
mov edi, 5
jmp 0x4198a0
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebx + 0x40]
add eax, 4
cmp esi, eax
je 0x419958
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00402ab0
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043d762
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x14], 8
jb 0x41998a
mov ecx, dword [esi]
jmp 0x41998c
mov ecx, esi
call fcn.00417fe0
test eax, eax
jne 0x419958
cmp dword [esi + 0x14], 8
jb 0x41999d
mov esi, dword [esi]
mov edx, esi
mov ecx, 0xd9
call fcn.00411d20
int3
Function at 0x41b510
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x41b58a
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
sar eax, 8
xor byte [esi + ebx], al
movsx eax, byte [esi + ebx]
inc esi
mov edx, dword [ecx + 4]
xor eax, edx
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x47f450]
xor eax, edx
mov dword [ecx + 4], eax
movzx eax, al
add eax, dword [ecx + 8]
imul edx, eax, 0x8088405
mov eax, dword [ecx + 0xc]
inc edx
mov dword [ecx + 8], edx
shr edx, 0x18
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x47f450]
mov dword [ecx + 0xc], eax
cmp esi, edi
jb 0x41b522
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x41b590
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 0xc], ebx
jbe 0x41b60d
push esi
nop
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0xc]
mov esi, edx
and esi, 0xfffd
movsx eax, byte [ebx + eax]
or esi, 2
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x47f450]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 4], eax
movzx eax, al
add eax, dword [edi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x47f450]
mov eax, esi
xor eax, 1
mov dword [edi + 0xc], edx
imul eax, esi
sar eax, 8
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x41b5a0
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x41bd70
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x41bd88
xor al, al
pop edi
pop esi
pop ecx
pop ebp
ret 4
push dword [esi + 4]
call fcn.00442965
add esp, 4
cmp eax, 0xffffffff
je 0x41bdd2
push 0x482a20
push 0
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi], eax
test eax, eax
je 0x41bd7f
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov dword [edi + 4], eax
test eax, eax
pop edi
setne al
pop esi
pop ecx
pop ebp
ret 4
mov ecx, esi
call fcn.0041dc60
int3

Function at 0x41cdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x48f840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x24]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [esi + 0x1c]
add ebx, 0x16
mov dword [ebp - 0x10], ebx
mov edx, dword [eax + 4]
sub edx, dword [eax]
sar edx, 2
movzx eax, dx
xor edx, edx
mov dword [ebp - 0x1c], eax
cmp dx, ax
jae 0x41cef2
lea ebx, [ebx]
mov eax, dword [esi + 0x1c]
movzx ecx, cx
mov eax, dword [eax]
mov edi, dword [eax + ecx*4]
cmp dword [edi + 0x78], 0
je 0x41ce2c
cmp dword [edi + 0x7c], 0
jbe 0x41ce2c
mov esi, dword [edi + 0x7c]
jmp 0x41ce82
mov dword [ebp - 0x2c], vtable.CZipAutoBuffer.0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00413470
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.CZipAutoBuffer.0
test eax, eax
je 0x41ce82
push eax
call fcn.0043d771
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov ecx, edi
call fcn.00412340
add esi, 0x2e
xor ebx, ebx
add eax, esi
mov esi, dword [edi + 0x3c]
mov edi, dword [edi + 0x40]
sub edi, esi
mov dword [ebp - 0x18], eax
sar edi, 2
xor eax, eax
test edi, edi
jle 0x41cec6
cmp edi, eax
jbe 0x41cee8
mov ecx, dword [esi]
xor edx, edx
cmp byte [ecx + 0xc], dl
setne dl
inc eax
add esi, 4
lea edx, [edx*2 + 2]
add edx, dword [ecx + 8]
add ebx, edx
cmp edi, eax
jg 0x41cea6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov ebx, dword [ebp - 0x10]
inc ecx
add ebx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
cmp cx, word [ebp - 0x1c]
jae 0x41cef2
mov esi, dword [ebp - 0x20]
jmp 0x41ce10
push str.invalid_vector_T__subscript
call fcn.00425880
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41dfd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x41dfe6
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
call fcn.00442aa8
push esi
push dword [ebp + 8]
mov dword [eax], 0
push dword [edi + 4]
call fcn.0044396c
mov ebx, eax
add esp, 0xc
cmp ebx, esi
jge 0x41e011
call fcn.00442aa8
cmp dword [eax], 0
jne 0x41e01a
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov ecx, edi
call fcn.0041dc60
int3

Function at 0x41ef40
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x48f840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.0041f290
push 0xc
mov dword [ebp - 0x1c], vtable.CZipAutoBuffer.0
call fcn.0043d776
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xc
mov ecx, dword [ebp + 0x10]
push 0
push 0xc
push eax
mov dword [ebp - 4], 0
call fcn.004193c0
mov edx, dword [esi + 0xc]
mov ebx, dword [esi + 4]
mov edi, dword [esi + 8]
mov dword [ebp + 8], 0
mov esi, dword [ebp + 8]
mov eax, edx
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0x18]
sar ecx, 8
xor cl, byte [eax + esi]
mov esi, dword [ebp - 0x10]
movsx eax, cl
xor eax, ebx
shr ebx, 8
and eax, 0xff
xor ebx, dword [eax*4 + 0x47f450]
movzx eax, bl
add eax, edi
mov dword [esi + 4], ebx
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [esi + 8], edi
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x47f450]
mov eax, dword [ebp + 8]
inc eax
mov dword [esi + 0xc], edx
mov dword [ebp + 8], eax
cmp eax, 0xc
jl 0x41efb4
cmp byte [ebp + 0x14], 0
jne 0x41f04a
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 0xc]
shr al, 3
test al, 1
je 0x41f03a
xor eax, eax
cmp byte [edx + 0x11], cl
jmp 0x41f03f
xor eax, eax
cmp byte [edx + 0x17], cl
sete al
test eax, eax
jne 0x41f04a
xor bl, bl
jmp 0x41f04c
mov bl, 1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41f05c
push eax
call fcn.0043d771
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f080
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472cb8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x48f840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xc
mov dword [ebp - 0x18], vtable.CZipAutoBuffer.0
call fcn.0043d776
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xc
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0041f290
push 0
call fcn.00441a08
push eax
call fcn.0044442c
add esp, 8
mov dword [ebp + 8], 0
lea ecx, [ecx]
call fcn.0044440b
mov ecx, eax
mov edx, dword [esi + 0xc]
movzx eax, al
mov edi, edx
sar ecx, 6
test cl, cl
movzx ebx, cl
mov ecx, dword [esi + 4]
cmove ebx, eax
and edi, 0xfffd
movsx eax, bl
or edi, 2
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x47f450]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x47f450]
mov eax, edi
xor eax, 1
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 0x14]
imul eax, edi
sar eax, 8
xor al, bl
mov byte [edx + ecx], al
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0xa
jl 0x41f0f0
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov edi, edx
and edi, 0xfffd
movzx eax, word [eax + 0x10]
or edi, 2
shl eax, 0x10
mov ebx, eax
mov dword [ebp + 8], eax
sar ebx, 0x10
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
push 0
push 0xc
mov eax, dword [eax*4 + 0x47f450]
xor eax, ecx
mov ecx, dword [ebp - 0x14]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x47f450]
mov eax, edi
xor eax, 1
mov dword [esi + 0xc], edx
imul eax, edi
sar eax, 8
xor al, bl
mov ebx, dword [ebp + 8]
mov byte [ecx + 0xa], al
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov edi, edx
sar ebx, 0x18
and edi, 0xfffd
movsx eax, bl
or edi, 2
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x47f450]
xor eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x47f450]
mov eax, edi
xor eax, 1
mov dword [esi + 0xc], edx
imul eax, edi
sar eax, 8
xor al, bl
mov ebx, dword [ebp - 0x14]
push ebx
mov byte [ebx + 0xb], al
call fcn.0041a4f0
mov eax, dword [ebp + 0xc]
push ebx
add dword [eax + 0x18], 0xc
call fcn.0043d771
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41f290
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esi + 4], 0x12345678
mov dword [esi + 8], 0x23456789
mov dword [esi + 0xc], 0x34567890
cmp dword [ecx + 8], ebx
jbe 0x41f311
mov eax, dword [esi + 4]
mov edx, 0x34567890
push edi
mov edi, dword [esi + 8]
mov ecx, dword [ecx + 4]
movsx ecx, byte [ecx + ebx]
inc ebx
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x47f450]
movzx ecx, al
add ecx, edi
mov dword [esi + 4], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [esi + 8], edi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
and ecx, 0xff
xor edx, dword [ecx*4 + 0x47f450]
mov ecx, dword [ebp + 8]
mov dword [esi + 0xc], edx
cmp ebx, dword [ecx + 8]
jb 0x41f2c2
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41f5e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473ee8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x48f840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], vtable.CZipAutoBuffer.0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.ZipArchiveLib::CBaseLibCompressor.0
push 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041fee0
mov dword [esi + 0x2c], eax
mov eax, esi
mov byte [esi + 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x422290
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov edx, ecx
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4232dd
cmp dword [edx + 0x20], 0
je 0x4232dd
cmp dword [edx + 0x24], 0
je 0x4232dd
mov ecx, dword [edx + 0x1c]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x4232dd
cmp dword [ecx], edx
jne 0x4232dd
mov eax, dword [ecx + 4]
cmp eax, 0x3f34
jl 0x4232dd
cmp eax, 0x3f53
jg 0x4232dd
cmp dword [edx + 0xc], 0
je 0x4232dd
cmp dword [edx], 0
jne 0x4222ff
cmp dword [edx + 4], 0
jne 0x4232dd
cmp eax, 0x3f3f
jne 0x42230d
mov dword [ecx + 4], 0x3f40
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebx
mov ebx, dword [edx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 4]
push esi
mov esi, dword [ecx + 0x40]
sub eax, 0x3f34
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x38], ebx
push edi
mov edi, dword [edx]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edx
cmp eax, 0x1e
ja 0x42281d
lea edi, [ecx + 0x58]
mov dword [ebp - 0x2c], edi
lea edi, [ecx + 0x5c]
mov dword [ebp - 0x40], edi
mov edi, dword [ebp - 0x10]
jmp 0x422360
jmp dword [eax*4 + 0x4232e8]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
mov esp, ebp
pop ebp
ret
Function at 0x44ab46
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x461200
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48f840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00446f76
mov dword [ebp - 0x14], eax
cmp dword [0x496284], esi
jne 0x4612f3
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x461280
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4613d3
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4613d3
push 0x47d9f8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4613d3
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x496284], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x496288], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49628c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x496294], eax
test eax, eax
je 0x4612f0
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x496290], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x461318
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46130b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46132d
push 4
pop eax
jmp 0x4613d5
cmp dword [ebp - 0x14], esi
je 0x46132d
push dword [0x496284]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x461312
mov eax, dword [0x496290]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46138b
cmp dword [0x496294], edi
je 0x46138b
push eax
call ebx
push dword [0x496294]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46138b
test eax, eax
je 0x46138b
call ecx
test eax, eax
je 0x461380
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x461380
test byte [ebp - 8], 1
jne 0x46138b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4613bb
mov eax, dword [0x496288]
cmp eax, edi
je 0x4613b8
push eax
call ebx
test eax, eax
je 0x4613b8
call eax
mov esi, eax
test esi, esi
je 0x4613b8
mov eax, dword [0x49628c]
cmp eax, edi
je 0x4613b8
push eax
call ebx
test eax, eax
je 0x4613b8
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x496284]
call ebx
test eax, eax
je 0x4613d3
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4613d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d762
mov esp, ebp
pop ebp
ret
Function at 0x419a4f
Capabilities:
Encode data using xor

Disassembly:
xor byte [ebx + edx*4 - 0x2b094f9a], dh
sbb byte [edx - 0x3d9e18b4], dl
xchg esi, eax
fnstenv [edx]
wait
mov bl, 0x57
call [edi + 0x57]
das
pop ss
push 0xf22e173c
adc dh, cl
lcall 0x519e, 0x72dcae82
sub byte [esi + 0x519e72dc], 8
mov byte [esi - 0x1583e2e], dh
push cs
sub byte [esi + 0x519e72dc], 8
mov byte [esi - 0x1583e2e], dh
push cs
loopne 0x419a2f
into
or dword [edi], ebp
push ds
enter 0x12e7, 0xffffffffffffffe9
add byte [edx + 0xcaa5c14], cl
xchg ebp, eax
mov esp, 0xddd9a4ac
imul edx, dword [edx + 0x19728b86], 0xf214a340
fldcw word [edx - 0xe]
add al, 0xc2
pop es
add eax, edi
ret

Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call esi
cmp eax, 7
jne 0x44b624
push 1
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x660220], al
mov byte [0xa62704], al
mov eax, 0xd7b0
mov dword [0x660238], ecx
mov word [0xa6275c], ax
mov word [0xa6275e], ax
mov word [0x660634], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x660268], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b678
call esi
cmp al, 4
ja 0x44b67e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x660264], eax
pop esi
ret
Function at 0x458c9f
Capabilities:
Encode data using xor

Disassembly:
in al, dx
and eax, 0x32b358a8
mov al, byte [0xb0fde840]
scasb al, byte es:[edi]
add byte [eax + 0x5d], 0xba
rcl dword [ebp - 0x12c56849]
cld
in eax, dx
jne 0x458c63
push ecx
test byte [eax - 0x75cfd72d], bl
push esp
lodsb al, byte [esi]
push 0xffffffffffffff80
retf 0xd467
jmp 0x59c0dc5b
cmp al, 0xa6
fild qword [edi + ecx - 0x1058dbdb]
aas
mov edx, eax
mov bl, 0xef
jl 0x458c40
add edx, esi
xor eax, 0x22095b7a
xor cl, byte [eax + 0x766760ab]
in eax, dx
and ebp, eax
dec ebp
mov esp, 0xed2de9
push edi
jnp 0x458cb1
inc ebp
cmc
mov dh, 0x9e
push ecx
outsb dx, byte [esi]
salc
mov edx, ecx
div byte [edx]
xchg ecx, eax
movsd dword es:[edi], dword [esi]
pop esi
je 0x458c76
sti
fidivr dword [edi - 2]
shr ch, 0x2a
xchg esp, eax
outsd dx, dword [si]
and edx, dword [ecx]
invalid