joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ba70
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov eax, dword [0x4c0018]
xor eax, esp
mov dword [esp + 0xc], eax
lea ebp, [ecx + 0x10]
jmp 0x45bad1
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40000003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x45bb31
test bl, 1
jne 0x45bb00
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x45bb02
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45bb02
mov edi, eax
cmp eax, 0x217
je 0x45bb02
jmp 0x45bb8b
xor ebx, ebx
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x28]
mov dword [esp], edi
mov ecx, dword [eax]
mov edx, dword [esp]
push edx
push 0x45bc30
push eax
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x45ba90
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45ba90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.0042f950
add esp, 4
push eax
push str.Error_while_listening_to_named_pipe:__s
call fcn.004155a0
add esp, 8
mov ebx, eax
push dword [esi + 8]
call fcn.00410080
add esp, 4
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push edi
push ebx
push 0
push eax
push 1
push ecx
call dword [edx]
add esp, 0x18
push ebx
call fcn.00413500
add esp, 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0046c560
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edi, 0x3e5
jne 0x45bb39
jmp 0x45bb78
Function at 0x45f0b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x54]
imul eax, dword [esp + 0x24], 0x3e8
mov ecx, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp], edx
mov edi, 1
mov ebx, 1
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ebx
mov ebx, edi
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edi, eax
mov ebp, esi
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push ebx
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.0045e4a0
add esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edi, dword [esp + 4]
add edi, ebx
setb cl
cmp eax, dword [esp]
jae 0x45f154
test cl, cl
jne 0x45f154
push 0
mov esi, ebp
push ebp
call fcn.00413790
add esp, 8
jmp 0x45f0e0
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45f170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc08
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x4c0018]
xor ecx, ebp
mov dword [esp + 0xc00], ecx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [eax + ecx*8]
mov ebx, dword [eax + ecx*8 + 4]
xor edi, dword [edx + ecx*8]
xor ebx, dword [edx + ecx*8 + 4]
mov dword [esp + ecx*8 + 0x804], ebx
mov dword [esp + ecx*8 + 0x800], edi
add ecx, 1
cmp ecx, 0x80
jne 0x45f1a0
lea eax, [esp + 0x800]
lea edi, [esp + 0x400]
mov ecx, edi
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x880]
lea ecx, [esp + 0x480]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x900]
lea ecx, [esp + 0x500]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x980]
lea ecx, [esp + 0x580]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0xa00]
lea ecx, [esp + 0x600]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0xa80]
lea ecx, [esp + 0x680]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0xb00]
lea ecx, [esp + 0x700]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0xb80]
lea ecx, [esp + 0x780]
mov edx, 2
push 2
push eax
call fcn.0045f400
add esp, 8
mov ebx, esp
mov ecx, ebx
mov edx, 0x10
push 0x10
push edi
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x410]
lea ecx, [esp + 0x10]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x420]
lea ecx, [esp + 0x20]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x430]
lea ecx, [esp + 0x30]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x440]
lea ecx, [esp + 0x40]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x450]
lea ecx, [esp + 0x50]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x460]
lea ecx, [esp + 0x60]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
lea eax, [esp + 0x470]
lea ecx, [esp + 0x70]
mov edx, 0x10
push 0x10
push eax
call fcn.0045f400
add esp, 8
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [esp + eax*8]
mov edx, dword [esp + eax*8 + 4]
xor edx, dword [esp + eax*8 + 0x804]
xor ecx, dword [esp + eax*8 + 0x800]
xor dword [esi + eax*8], ecx
xor dword [esi + eax*8 + 4], edx
add eax, 1
cmp eax, 0x80
jne 0x45f390
push 0x400
lea eax, [esp + 0x804]
push eax
call fcn.0042f4b0
add esp, 8
push 0x400
push edi
call fcn.0042f4b0
add esp, 8
push 0x400
push ebx
call fcn.0042f4b0
add esp, 8
mov ecx, dword [esp + 0xc00]
xor ecx, ebp
call fcn.0046c560
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45fec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x45feea
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x45fef1
xor esi, esi
test ebx, ebx
jne 0x45ff3e
jmp 0x45ff53
mov eax, 1
jmp 0x45ff5d
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x45ff00
mov ebx, dword [esp]
test ebx, ebx
je 0x45ff53
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x45ff40
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46a540
Capabilities:
Hash data using sha512

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
cmp ebx, 0x41
jb 0x46a560
push pe_nt_image_headers32
push str._home_simon_mem_.build_workdirs_bob_fffbk9my_putty_crypto_blake2.c
push str.hashlen___ssh_blake2b.hlen
call fcn.0047ca64
add esp, 0xc
push 0
push 0xf0
push 1
call fcn.00413470
add esp, 0xc
lea edx, [eax + 0xe4]
mov dword [eax + 0xe4], 0x4a1218
mov dword [eax + 0x40], ebx
lea ecx, [eax + 0xd8]
mov dword [eax + 0xd8], 0x46a820
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], ecx
mov dword [eax + 0xe8], ecx
mov ecx, 0x10
mov edi, eax
mov esi, 0x4a1248
rep movsd dword es:[edi], dword [esi]
xor ebx, 0xf2bdc908
mov dword [eax], ebx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
mov dword [eax + 0xcc], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov eax, edx
pop esi
pop edi
pop ebx
ret
Function at 0x46cdbc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46cdfb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46cdfb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46cdfb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46cdfb
cmp dword [ecx + 0x74], 0xe
jbe 0x46cdfb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x481100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48112d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48112d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x481501
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4a2b50
push 0x4a2b48
push str.FlsAlloc
push 0x1e
call fcn.00481b94
mov esi, eax
add esp, 0x10
test esi, esi
je 0x481535
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x48153b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x48157f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4a2b60
push 0x4a2b58
push str.FlsGetValue
push 0x20
call fcn.00481b94
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4815b6
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x488be8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x488c85
push ebx
push esi
call fcn.00488cd6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00488b31
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x488c32
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x488c84
push edi
push eax
call fcn.00483824
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x488c52
call fcn.00482edd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x488c83
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00488b31
add esp, 0x20
test eax, eax
jne 0x488c71
push edi
call fcn.00482edd
jmp 0x488c79
push ebx
call fcn.00482edd
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x488c88
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x488c99
pop esi
ret
push ebx
push edi
push esi
call fcn.00488cd6
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00483824
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x488cc1
push ebx
push esi
push edi
call fcn.0046ed10
add esp, 0xc
push 0
call fcn.00482edd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x488d18
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488f81

Function at 0x489539
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00489544
Function at 0x48ae2c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048ae37
Function at 0x48be48
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4c1e30]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48be88
cmp byte [ebx], 0xa
jne 0x48be88
or byte [eax + edi + 0x28], 4
jmp 0x48be8d
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x48bf8b
mov al, byte [edx]
cmp al, 0x1a
je 0x48bf6d
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x48bebc
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x48bee1
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x48beeb
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x48be9e
jmp 0x48bf8b
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48bf68
cmp dword [ebp - 0xc], 0
je 0x48bf68
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4c1e30]
test byte [eax + edi + 0x28], 0x48
je 0x48bf42
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x48bf2d
mov byte [esi], dl
jmp 0x48bf3e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4c1e30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x48bf8b
cmp byte [ebp - 1], 0xa
jne 0x48bf51
cmp esi, ebx
jne 0x48bf51
mov byte [esi], 0xa
jmp 0x48bf8a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00491a40
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x48bf8b
mov byte [esi], 0xd
jmp 0x48bf8a
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4c1e30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x48bf87
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x48bf8b
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x48bf94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4c1e30]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48bfd7
cmp word [esi], dx
jne 0x48bfd7
or byte [edi + eax + 0x28], 4
jmp 0x48bfdc
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x48c12f
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x48c10f
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x48c01e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x48c054
cmp eax, edx
jae 0x48c060
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x48bff6
jmp 0x48c12f
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48c10b
cmp dword [ebp - 0x14], 0
je 0x48c10b
mov eax, dword [ebx*4 + 0x4c1e30]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x48c0e3
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x48c0ac
mov word [esi], cx
jmp 0x48c0df
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4c1e30]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4c1e30]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4c1e30]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x48c12f
pop ebx
cmp word [ebp - 4], bx
jne 0x48c0f4
cmp esi, dword [ebp + 0xc]
jne 0x48c0f4
mov word [esi], bx
jmp 0x48c12c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00491a40
add esp, 0x10
cmp word [ebp - 4], bx
je 0x48c12f
push 0xd
jmp 0x48c128
mov ecx, dword [ebx*4 + 0x4c1e30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x48c126
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x48c12f
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x48e4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
lea edi, [eax*4 + 0x4c20ac]
mov eax, dword [edi]
nop
or esi, 0xffffffff
cmp eax, esi
je 0x48e450
test eax, eax
jne 0x48e452
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0048e371
pop ecx
pop ecx
test eax, eax
je 0x48e44e
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48e44e
mov ecx, eax
xchg dword [edi], ecx
jmp 0x48e452
xchg dword [edi], esi
xor eax, eax
pop edi
pushal
pushfd
add eax, 0x5b76eb0
sal byte [eax - 0x8fa4892], 0xd7
mov eax, 0x2e2bdd5c
xor ebx, 0x1442df30
neg edx
not esi
mov eax, 0x7f31000
pop es
test esp, eax
jo 0x48e4e2
mov esi, eax
xor esi, dword [0x4c0920]
xor ebx, 0xe4220ca
and byte [edx + 0xe], al
dec esi
and esi, edi
mov edi, edi
add ecx, eax
not edx
call fcn.00401977
dec ebx
rol edi, 0xf
not eax
or esi, edi
ror edx, 0xa
sub edi, dword [0x4c08d2]
dec esp
add byte [esi + 0xfa01180], bh
adc byte [ecx], 0xa0
invalid
mov edi, ebp
xor eax, 0xb56ec0
or esi, edi
xor ebx, ecx
call fcn.0046cb0d
and esi, edi
sub esi, 0x144d183b
shr eax, 0x1c
test ecx, eax
jo 0x48e477
xor ebx, 0xb994e24
shr esi, 0xd
or eax, 0xd785d0f7
jo 0x48e4d8
rol esi, 0x15
not eax
neg esi
adc eax, 0xdef7d0f7
xor edx, eax
xor eax, eax
xor edi, esp
cld
rol edi, 1
shl edi, 0x19
mov eax, eax
xchg esi, eax
xor esi, eax
not esi
mov ebx, 0x31f962db
not esi
mov ecx, 0x42cf0
mov esi, dword [0x4c0328]
inc eax
rol edx, 0xb
neg eax
inc esi
rol eax, 0x18
mov dword [0x4c288f], ebx
add dword [0x4c2306], edi
mov edi, dword [0x4c09bc]
test esp, 0x24f076ef
jo 0x48e58f
loop 0x48e4fd
sub edi, 0x5303750
call fcn.0046c8b5
rol esi, 8
ror esi, 3
mov edx, 0x20b0e230
rol esi, 0x18
ror eax, 9
call fcn.0046c8b5
add ecx, eax
or esi, edi
shl edx, 0x1c
or edi, 0x8a828
mov edi, esi
mov ebx, edx
rol esi, 0xa
test edx, esp
jo 0x48e574
mov edi, edx
mov ecx, 0xa03e84
xchg ebp, eax
in eax, 0xfd
dec dword [ecx + 0x4c244c0d]
add bh, dh
fild word [edi - 0x46c2cc2a]
add al, 0x4c
add byte [ebp - 0x1daa8f0b], al
fcomi st(7)
rcl byte [edi + edx*8 + 0x42], 4
Function at 0x49369d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00493840
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x493815
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x493815
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4937c4
jg 0x4936f6
test eax, eax
je 0x4937ba
push 1
push 0x1000
call fcn.004836dc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x49371c
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4937b1
push 0x8000
push ebx
call fcn.0047c611
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x493748
jg 0x493743
cmp ecx, 0x1000
jb 0x493748
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0048a376
add esp, 0x10
cmp eax, 0xffffffff
je 0x49378d
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x493743
jl 0x493774
test ecx, ecx
jne 0x493735
push dword [ebp - 0xc]
push ebx
call fcn.0047c611
push esi
call fcn.00482edd
add esp, 0xc
xor edi, edi
jmp 0x493826
cmp byte [edi + 0x24], 0
je 0x4937a4
cmp dword [edi + 0x20], 5
jne 0x4937a4
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4937af
mov edi, dword [edi + 0x18]
jmp 0x4937b1
xor edi, edi
push esi
call fcn.00482edd
pop ecx
jmp 0x493826
test ecx, ecx
jg 0x493786
jl 0x4937c4
test eax, eax
jae 0x493786
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00491a40
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4937e7
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x493786
jmp 0x49381e
push ebx
call fcn.004895c2
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x493786
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x493826
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x493823
mov edi, dword [edi + 0x18]
jmp 0x493826
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00491a40
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4018bf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4018f6
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4018e9
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x401964
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + 0xa6c5c0]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + 0xa6c5c0]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + 0xa6c5c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0xa6c5c0]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x4019b1
cmp ebx, 4
jne 0x4019b4
cmp edi, 6
jbe 0x4019b4
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + 0xa6c5c0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + 0xa6c5c0]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0xa6c5c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0xa6c5c0]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x401905
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402b17
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0xaa606c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402b57
cmp dword [ebp - 0x364], 6
jne 0x402b57
cmp dword [ebp - 0x360], 0
je 0x402b81
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b81
push 0xc00
call eax
test eax, eax
jne 0x402c16
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c16
cmp eax, 0x104
ja 0x402c16
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402bc1
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x402c15
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x402bdc
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x402bda
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009f1976
leave
ret