joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407708
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4077a5
push ebx
push esi
call fcn.004076d1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407665
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407752
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4077a4
push edi
push eax
call fcn.0040606b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407772
call fcn.004061c6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4077a3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407665
add esp, 0x20
test eax, eax
jne 0x407791
push edi
call fcn.004061c6
jmp 0x407799
push ebx
call fcn.004061c6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4089b4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411028
push 0x411020
push str.FlsAlloc
push 0x1f
call fcn.00408873
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4089e8
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f134]
call esi
jmp 0x4089ee
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408a32
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411038
push 0x411030
push str.FlsGetValue
push 0x21
call fcn.00408873
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408a69
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408a71
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411040
push 0x411038
push str.FlsSetValue
push 0x22
call fcn.00408873
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408aab
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40de70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40de9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40de9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40538e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [eax], eax
add byte [eax], al
jmp 0x405258
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp - 0xc8c], ecx
jmp 0x4052ca
mov edx, dword [ebp - 0xc8c]
mov dword [ebp - 0x15d4], edx
cmp dword [ebp - 0x15d4], 0
jne 0x40531f
push edx
add edx, 0x9f4
or edx, 0x775f
jmp 0x4052f2
pop edx
push edx
push edi
add esp, 4
or edx, 0xaf27
add edx, 0x185e0
add edx, 0x18446
and edx, 0x13366
pop edx
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xab8], eax
jmp 0x405360
jmp 0x40506d
push edx
push eax
add esp, 4
sub edx, 0x162dd
pop edx
push ecx
or ecx, 0x6eb9
jmp 0x40537b
add ecx, 0x308d
call 0x40538e
add byte [ebp + 0x4c], cl
xor al, 0x47
inc esp
cmp eax, 0x4c48338
pop ecx
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
test dword [edi + 0x63fffff7], ecx
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
idiv edi
push dword [ebx - 0x3a]
test dword [edx + 0x73fffff7], edx
mov byte [ebp - 0x86d], 0
push eax
sub eax, 0x1841
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x1600b
int1
or esp, dword [eax + 1]
add byte [ecx + 0x14bbfe1], al
add byte [ecx + 0x9943e9], al
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [edx], dh
aas
inc edx
inc ebx
cmp dh, byte [edx + eax*2]
aas
aas
add esp, 4
pop ecx
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
invalid
invalid
xchg ebp, eax
Function at 0x4058c0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
lea edx, [esi - 0x45000018]
xor eax, dword [eax]
add byte [eax], al
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push ebx
push esi
add esp, 4
sub ebx, 0x4482
jmp 0x40592e
pop ebx
push ebx
push ecx
add esp, 4
or ebx, 0x24bf
add byte [eax], al
and ebx, 0xb30f

Function at 0x405940
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add ebx, 0x13a91
add ebx, 0xec8d
pop ebx
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
idiv edi
inc dword [eax]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push ebx
push esi
add esp, 4
call 0x4059e2
add byte [0x333b3549], dh
inc edx
inc edx
add esp, 4
call 0x4059f1
add byte [edi + 0x4b], cl
inc ebp
inc eax
inc ebx

Function at 0x405d65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec edx
push edi
push edi
add esp, 4
les eax, [ebx + ebp*8]
invalid
sub edi, 0x16b0
pop edi
push eax
xor eax, 0x8104
and eax, 0x1068a
call 0x405d03
add byte [edi + 0x48], al
dec esp
cmp al, byte [esi + 0x50]
dec esp
inc esi
add esp, 4
pop eax
cmp dword [ebp - 0x750], 0
jne 0x405d51
push edi
push eax
add esp, 4
sub edi, 0x11771
pop edi
push ecx
push eax
add esp, 4
xor ecx, 0x116b0
call 0x405d36
add byte [edi + 0x4d], al
cmp dword [ecx + 0x4b], ecx
xor eax, 0x83434e32
les eax, [ebx + ebp*8]
push es
cmp eax, 0x433f4338
inc ebx
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x406878
push ebx
push eax
add esp, 4
call 0x405d65
add byte [edx + 0x50], cl
aas
xor esi, dword [edx]
xor al, 0x36
add esp, 4
sub ebx, 0x1796
xor ebx, 0x139d5
and ebx, 0xf400
pop ebx
push ecx
and ecx, 0x1273c
pop ecx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x405dc2
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x4060b3
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
invalid
push ecx
Function at 0x406208
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebx + 0x565b04c4]
push ebx
add esp, 4
and esi, 0x4e57
pop esi
cmp dword [ebp - 0x15fc], 0
jne 0x406231
mov dword [ebp - 0x31c], 0
jmp 0x4064d8
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push esi
push ecx
add esp, 4
add esi, 0xfe79
add esi, 0x520e
and esi, 0x15129
pop esi
push edx
push ebx
push eax
add esp, 4
add ebx, 0x85ef
pop ebx
push esi
push ebx
add esp, 4
add al, 0x81
out 0xb, al
test byte [ecx], al
add byte [esi + 0x53], bl
push eax
add esp, 4
xor ebx, 0x4c86
add ebx, 0xeeda
pop ebx
push ecx
xor ecx, 0x38af
pop ecx
invalid
invalid

Function at 0x406209
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebx + 0x565b04c4]
push ebx
add esp, 4
and esi, 0x4e57
pop esi
cmp dword [ebp - 0x15fc], 0
jne 0x406231
mov dword [ebp - 0x31c], 0
jmp 0x4064d8
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push esi
push ecx
add esp, 4
add esi, 0xfe79
add esi, 0x520e
and esi, 0x15129
pop esi
push edx
push ebx
push eax
add esp, 4
add ebx, 0x85ef
pop ebx
push esi
push ebx
add esp, 4
add al, 0x81
out 0xb, al
test byte [ecx], al
add byte [esi + 0x53], bl
push eax
add esp, 4
xor ebx, 0x4c86
add ebx, 0xeeda
pop ebx
push ecx
xor ecx, 0x38af
pop ecx
invalid
invalid

Function at 0x406428
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, 0xffffe9fc
add byte [ebp + 0x40], dh
push eax
push edi
add esp, 4
or eax, 0xec99
in al, dx
add byte [eax], al
sub eax, 0x1665a
pop eax
push eax
jmp 0x40644a
xor eax, 0x64ca
add eax, 0x50da
pop eax
push ebx
push esi
add esp, 4
jmp 0x406461
pop ebx
mov ecx, dword [ebp - 0x50c]

Function at 0x4064e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
out 0xb, al
test byte [ecx], al
add byte [esi + 0x53], bl

Function at 0x406b5f
Capabilities:
Get number of processors

Disassembly:
push ecx
call fcn.00406b5f
add byte [eax + 0x3a], al
cmp bh, byte [eax]
inc ecx
inc edx
dec ecx
cmp eax, dword [ebx - 0x367efb3c]
add esp, 4
invalid
leave
jecxz 0x406b6f
add esp, 4
or ecx, 0x109e3
add dword [eax], eax
xor ecx, 0x136de
jmp 0x406b73
add edi, dword [esp + esi]
dec ebx
pop ecx
push ebx
or ebx, 0x15437
or ebx, 0xbab8
pop ebx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
jmp 0x406bb4
sub eax, 0xa9c6
add eax, 0x65ce
into
add byte gs:[eax], al
or eax, 0x1499c
pop eax
push edi
xor edi, 0x5522
xor edi, 0xa91c
jmp 0x406bdd
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
invalid
xchg ebp, eax
inc eax
invalid
invalid
Function at 0x406cd8
Capabilities:
Get number of processors

Disassembly:
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406d27
push esi
push edi
add esp, 4
add esi, 0x1d85
pop esi
push ecx
call 0x406d02
add byte [edi], bh
inc edx
cmp dword ds:[esi + 0x3e], eax
aaa
aaa
add esp, 4
xor ecx, 0x6602
pop ecx
push esi
push eax
add esp, 4
or esi, 0x295c
xor esi, 0x1034e
pop esi
push ecx
or ecx, 0xe180
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x17cc9
pop ebx
push ebx
push eax
add esp, 4
sub ebx, 0xbddc
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d85
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b50
mov dword [ebp - 0x2fc], 0

Function at 0x406d02
Capabilities:
Get number of processors

Disassembly:
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406d27
push esi
push edi
add esp, 4
add esi, 0x1d85
pop esi
push ecx
call 0x406d02
add byte [edi], bh
inc edx
cmp dword ds:[esi + 0x3e], eax
aaa
aaa
add esp, 4
xor ecx, 0x6602
pop ecx
push esi
push eax
add esp, 4
or esi, 0x295c
xor esi, 0x1034e
pop esi
push ecx
or ecx, 0xe180
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x17cc9
pop ebx
push ebx
push eax
add esp, 4
sub ebx, 0xbddc
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d85
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b50
mov dword [ebp - 0x2fc], 0
Function at 0x40729f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
les eax, [eax + ebx*2]
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
invalid
je 0x407203
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x406fce
mov dword [ebp - 0x774], 0
push esi
push edx
add esp, 4
xor esi, 0xaf33
xor esi, 0x6ca6
xor esi, 0x174b4
pop esi
push ebx
or ebx, 0x74fc
add ebx, 0x1776a
or ebx, 0xeeda
xor ebx, 0x2a9b
pop ebx
cmp dword [ebp - 0x774], 0
jne 0x407289
push edx
push edi
add esp, 4
add edx, 0x1108
xor edx, 0x18043
pop edx
push ecx
push eax
add esp, 4
add ecx, 0x16c5d
or ecx, 0x104e3
pop ecx
push ecx
add ecx, 0x150a1
push eax
add dword [eax], eax
and ecx, 0x12b7d
pop ecx
mov dword [ebp - 0xab4], 0
jmp 0x407db1
push edi
add edi, 0x183c6
call 0x40729f
add byte [0x3b3b4c43], dh
cmp edi, dword [eax]
cmp al, 0x4d
add esp, 4
pop edi
push ecx
push ebx
add esp, 4
or ecx, 0x846a
add ecx, 0xbc4c
xor ecx, 0x15459
pop ecx
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 0
jne 0x4072fa
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4075eb
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x407322
mov ecx, dword [ebp - 0x784]
invalid
Function at 0x407984
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push es
adc eax, 0xe9810000
in al, dx
and al, byte [ecx]
add byte [ecx + 0x51], bl

Function at 0x42f11c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42f122
ret

Function at 0x4810c4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x4aa864
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x5022e8
mov eax, esi
mov edx, 8
test al, 1
je 0x4aa880
shr eax, 1
xor eax, 0xedb88320
jmp 0x4aa882
shr eax, 1
dec edx
jne 0x4aa873
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4aa86c
pop esi
ret

Function at 0x4aa8af
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x5022e4], 0
jne 0x4aa8bb
call fcn.004aa864
push 1
push 0x5022e4
call fcn.00409040
mov eax, edi
test esi, esi
je 0x4aa8e6
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x5022e8]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4aa8c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4bb47c
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x4fc34c]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x4bb4c0
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bb4b5
mov eax, dword [esp + 4]
jmp 0x4bb4b7
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x4bb49f
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x4fc34c]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x4bb4c0
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bb4b5
mov eax, dword [esp + 4]
jmp 0x4bb4b7
xor eax, eax
add esp, 0x2b4
pop ebx
ret
Function at 0x4c0400
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c0587
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b0]
mov edx, 0x20
call fcn.00459ec4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b0]
mov edx, 0x20
call fcn.00459ef8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b4]
mov edx, 0x20
call fcn.00459ec4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b4]
mov edx, 0x20
call fcn.00459ef8
xor eax, eax
push ebp
push 0x4c0567
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
push 0x4c0598
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c04da
cmp word [ebp - 0x2ac], 0
je 0x4c04da
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x4ffb20]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4b0]
call fcn.004c0340
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.004d9034
cmp dword [ebp - 4], 0
jne 0x4c04fe
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.004d9034
cmp dword [ebp - 4], 0
je 0x4c055d
push 0x1000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00406348
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c055d
cmp word [ebp - 0x2ac], 0
je 0x4c055d
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x4ffb20]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4b4]
call fcn.004c0340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c0571
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c058e
lea eax, [ebp - 4]
call fcn.004062ac
ret

Function at 0x4c75d4
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffbc
mov esi, eax
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.004a9d20
lea edx, [esp + 4]
mov ecx, 0x40
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
cmp eax, 0x40
jne 0x4c763a
cmp byte [esp + 4], 0x4d
jne 0x4c763a
cmp byte [esp + 5], 0x5a
jne 0x4c763a
cmp dword [esp + 0x40], 0
je 0x4c763a
mov edx, dword [esp + 0x40]
mov eax, esi
call fcn.004a9d20
mov edx, esp
mov ecx, 4
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
cmp eax, 4
jne 0x4c763a
cmp dword [esp], 0x4550
jne 0x4c763a
mov bl, 1
mov eax, ebx
add esp, 0x44
pop edi
pop esi
pop ebx
ret
Function at 0x4ddd0c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4ddd31
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406b01
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x8008
call fcn.0040ae54
mov eax, 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0x8000
push eax
mov eax, 1
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov dword [ebp - 0x8008], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x8008]
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x8008]
cmp eax, 0x8000
jae 0x406b5d
jmp 0x406b5f
jmp 0x406b13
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp - 4]
leave
ret

Function at 0x406d91
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0x41097e
push eax
call sub.msvcrt.dll_remove
add esp, 4
movzx eax, word [0x41048c]
cmp eax, 0
je 0x406dc7
mov eax, 0x41093d
push eax
call sub.msvcrt.dll_remove
add esp, 4
leave
ret

Function at 0x406f4a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a0c
add ecx, eax
movzx eax, byte [ebp + 8]
shl eax, 2
mov edx, 0x410a24
add edx, eax
movzx eax, byte [ebp + 8]
shl eax, 2
mov dword [ebp - 4], ecx
mov ecx, 0x410a00
add ecx, eax
mov eax, dword [ecx]
push eax
mov eax, dword [edx]
push eax
mov eax, 1
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a18
add ecx, eax
movzx eax, byte [ebp + 8]
shl eax, 2
mov edx, 0x410a0c
add edx, eax
mov eax, dword [edx]
mov dword [ecx], eax
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a24
add ecx, eax
mov eax, 0
mov dword [ecx], eax
leave
ret

Function at 0x40712b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a0c
add ecx, eax
mov eax, dword [ecx]
cmp eax, 0
je 0x4071cc
movzx eax, word [ebp + 0x10]
mov ecx, eax
add eax, 0xffffffff
mov word [ebp + 0x10], ax
cmp ecx, 0
je 0x4071c7
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a18
add ecx, eax
mov eax, dword [ecx]
mov edx, eax
inc eax
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
inc eax
mov dword [ebp + 0xc], eax
movsx eax, byte [ecx]
mov byte [edx], al
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a24
add ecx, eax
mov eax, dword [ecx]
mov edx, eax
inc eax
mov dword [ecx], eax
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a24
add ecx, eax
mov eax, dword [ecx]
cmp eax, 0x8000
jne 0x4071c5
movzx eax, byte [ebp + 8]
push eax
call fcn.00406f4a
add esp, 4
jmp 0x40714e
jmp 0x4071f4
movzx eax, byte [ebp + 8]
shl eax, 2
mov ecx, 0x410a00
add ecx, eax
mov eax, dword [ecx]
push eax
movzx eax, word [ebp + 0x10]
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
leave
ret
Function at 0x4078cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
nop
call fcn.0040445a
movzx eax, al
mov byte [ebp - 1], al
mov eax, dword [0x410a04]
push eax
mov eax, 1
push eax
mov eax, 4
push eax
lea eax, [ebp + 8]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [0x410a04]
push eax
mov eax, 1
push eax
mov eax, 1
push eax
lea eax, [ebp - 1]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [0x410a04]
push eax
call sub.msvcrt.dll_fflush
add esp, 4
leave
ret

Function at 0x407930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
nop
mov eax, dword [0x410a04]
push eax
mov eax, 1
push eax
mov eax, 4
push eax
lea eax, [ebp - 4]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 0
je 0x4079d8
mov eax, dword [0x410a04]
push eax
mov eax, 1
push eax
mov eax, 1
push eax
lea eax, [ebp - 5]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
movsx eax, byte [0x418a41]
cmp eax, 0
je 0x4079b5
mov eax, dword [0x418a44]
mov dword [0x418a3c], eax
movzx eax, byte [0x418a40]
mov byte [0x418a38], al
mov eax, 1
mov byte [0x418a39], al
mov eax, dword [ebp - 4]
mov dword [0x418a44], eax
movzx eax, byte [ebp - 5]
mov byte [0x418a40], al
mov eax, 1
mov byte [0x418a41], al
jmp 0x407a07
mov eax, dword [0x418a44]
mov dword [0x418a3c], eax
movzx eax, byte [0x418a40]
mov byte [0x418a38], al
mov eax, 1
mov byte [0x418a39], al
mov eax, 0
mov byte [0x418a41], al
leave
ret
Function at 0x401b1f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x401b27
mov eax, esi
pop esi
ret