joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd2ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 6]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp edx, dword [ebp + 0xc]
jne 0x4dd2f3
test edx, edx
jbe 0x4dd2ef
movzx ebx, word [ebp - 2]
shr ebx, 8
xor bl, byte [eax]
mov byte [ecx], bl
mov bl, byte [eax]
add bl, byte [ebp - 2]
and ebx, 0xff
imul bx, word [ebp - 6]
add bx, word [ebp - 4]
mov word [ebp - 2], bx
inc eax
inc ecx
dec edx
jne 0x4dd2c7
mov al, 1
jmp 0x4dd2f5
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4dd300
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 6]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp edx, dword [ebp + 0xc]
jne 0x4dd348
mov esi, eax
mov eax, ecx
test edx, edx
jbe 0x4dd344
movzx ecx, word [ebp - 2]
shr ecx, 8
xor cl, byte [esi]
mov byte [eax], cl
add cl, byte [ebp - 2]
and ecx, 0xff
imul cx, word [ebp - 6]
add cx, word [ebp - 4]
mov word [ebp - 2], cx
inc esi
inc eax
dec edx
jne 0x4dd31e
mov al, 1
jmp 0x4dd34a
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4ddb1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ddcf9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x114]
push eax
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsA
lea eax, [ebp - 0x10]
call fcn.00403e24
lea eax, [ebp - 0x14]
call fcn.00403e24
xor edi, edi
mov esi, 0x101
lea ebx, [ebp - 0x114]
cmp byte [ebx], 0
je 0x4ddba0
lea eax, [ebp - 0x118]
mov dl, byte [ebx]
call fcn.00403fcc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x14]
call fcn.004040ac
jmp 0x4ddcc0
cmp dword [ebp - 8], 0xffffffff
jne 0x4ddbc3
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4ddd10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404164
jmp case.0x4ddbda.0
mov eax, dword [ebp - 0x14]
call fcn.00404268
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4ddbda.0
jmp dword [eax*4 + 0x4ddbe1]
cmp dword [ebp - 8], 0
jne case.0x4ddbda.0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4ddd10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404164
jmp case.0x4ddbda.0
cmp dword [ebp - 8], 1
jne case.0x4ddbda.0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4ddd10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404164
jmp case.0x4ddbda.0
cmp dword [ebp - 8], 2
jne case.0x4ddbda.0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4ddd10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404164
jmp case.0x4ddbda.0
cmp dword [ebp - 8], 3
jne case.0x4ddbda.0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4ddd10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404164
jmp case.0x4ddbda.0
cmp dword [ebp - 8], 4
jne case.0x4ddbda.0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x4ddd10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404164
cmp edi, dword [ebp - 4]
jne 0x4ddcb1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00403e78
jmp 0x4ddcd3
lea eax, [ebp - 0x14]
call fcn.00403e24
inc edi
cmp byte [ebx + 1], 0
je 0x4ddcc8
inc ebx
dec esi
jne 0x4ddb7b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00403e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddd00
lea eax, [ebp - 0x118]
call fcn.00403e24
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403e48
ret

Function at 0x4dedd0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404258
xor eax, eax
push ebp
push 0x4dee24
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00404268
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_DeleteFileA_1
neg eax
sbb eax, eax
neg eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dee2b
lea eax, [ebp - 4]
call fcn.00403e24
ret

Function at 0x4def3c
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x4def48
call fcn.004deeb4
ret
Function at 0x4df380
Capabilities:
Extract resource via kernel32 functions
Persist via windows service
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4df579
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004df178
mov ebx, eax
test bl, bl
jne 0x4df556
mov eax, 0x4df58c
mov dword [ebp - 8], eax
push 0xa
push 1
push 0
call sub.kernel32.dll_FindResourceA
mov esi, eax
push esi
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x20], eax
push esi
push 0
call sub.kernel32.dll_SizeofResource
mov edi, eax
lea edx, [ebp - 0x28]
mov eax, 0x4df5a8
call fcn.004df104
mov edx, dword [ebp - 0x28]
mov eax, 0x5384dc
call fcn.00403e78
mov eax, dword [0x5384dc]
call fcn.004dedd0
push 0
push 1
push 2
push 0
push 0
push 0x40000000
mov eax, dword [0x5384dc]
call fcn.00404268
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4df556
test esi, esi
je 0x4df556
push 0
lea eax, [ebp - 0x14]
push eax
push edi
mov eax, dword [ebp - 0x20]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4df556
cmp edi, dword [ebp - 0x14]
jne 0x4df556
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov ecx, dword [0x5384dc]
mov edx, 0x4df5b8
call fcn.004040f0
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00403fdc
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4df5c8
call fcn.004040f0
mov eax, dword [ebp - 0x2c]
call fcn.00404268
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push 0x4df5ec
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
call fcn.004040a4
push eax
lea eax, [ebp - 4]
call fcn.00404274
push eax
push 2
push 0
push 0x4df5fc
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegSetValueExA
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x4df608
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegSetValueExA
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x4df610
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.004df1c4
mov ebx, eax
call fcn.004df2a8
mov eax, 0x4df5a8
call fcn.004dedd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df580
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00403e48
lea eax, [ebp - 4]
call fcn.00403e24
ret
Function at 0x4df8d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df946
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004df8c4
test al, al
jne 0x4df930
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004df674
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x4df930
cmp ebx, 0xffffffff
je 0x4df930
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df94d
lea eax, [ebp - 8]
call fcn.00403e24
ret
Function at 0x4ec2dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x154], ecx
mov esi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00404258
xor eax, eax
push ebp
push 0x4ec4d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403e24
mov al, byte [0x4ec4e8]
push eax
lea eax, [ebp - 0x154]
push eax
mov ecx, 0x4ec4f4
mov edx, 0x4ec500
mov eax, dword [ebp - 8]
call fcn.0040cf64
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 8]
call fcn.00403ebc
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 8]
call fcn.00404268
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ec4b2
test byte [ebp - 0x150], 0x10
jne 0x4ec4ac
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x13c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_FileTimeToDosDateTime
test eax, eax
je 0x4ec4ac
cmp dword [ebp - 4], 0xffffffff
setne al
test al, al
je 0x4ec4ac
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 8]
call fcn.004097e8
push dword [ebp - 0x158]
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404054
push dword [ebp - 0x15c]
push 0x4ec50c
mov eax, esi
mov edx, 3
call fcn.00404164
jmp 0x4ec489
mov eax, dword [0x536040]
mov eax, dword [eax]
call fcn.004505b4
test byte [ebp - 0x150], 0x10
jne 0x4ec489
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x13c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_FileTimeToDosDateTime
test eax, eax
je 0x4ec489
cmp dword [ebp - 4], 0xffffffff
setne al
test al, al
je 0x4ec4ac
push dword [esi]
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 8]
call fcn.004097e8
push dword [ebp - 0x160]
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00404054
push dword [ebp - 0x164]
push 0x4ec50c
mov eax, esi
mov edx, 4
call fcn.00404164
lea eax, [ebp - 0x150]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4ec401
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x12
jne 0x4ec401
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec4df
lea eax, [ebp - 0x164]
mov edx, 5
call fcn.00403e48
lea eax, [ebp - 8]
call fcn.00403e24
ret
Function at 0x4fc0e4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4fc0ed
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4fc329
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x458670]
call fcn.00458770
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fc307
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, 0x4fc340
call fcn.004041b4
je 0x4fc1a6
lea ecx, [ebp - 0x14]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, 0x4fc350
call fcn.004041b4
je 0x4fc1a6
lea ecx, [ebp - 0x18]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
mov edx, 0x4fc360
call fcn.004041b4
je 0x4fc1a6
lea ecx, [ebp - 0x1c]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, 0x4fc370
call fcn.004041b4
jne 0x4fc1b5
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00458810
jmp 0x4fc1c2
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00458810
mov eax, esi
call fcn.00462010
test al, al
je 0x4fc226
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, 0x4fc384
call fcn.00404390
test eax, eax
jle 0x4fc20a
lea eax, [ebp - 8]
mov edx, 0x4fc390
call fcn.00403ebc
lea eax, [ebp - 0xc]
mov edx, 0x4fc3d0
call fcn.00403ebc
jmp 0x4fc27d
lea eax, [ebp - 8]
mov edx, 0x4fc414
call fcn.00403ebc
lea eax, [ebp - 0xc]
mov edx, 0x4fc44c
call fcn.00403ebc
jmp 0x4fc27d
lea ecx, [ebp - 0x24]
mov eax, dword [esi + 8]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, 0x4fc384
call fcn.00404390
test eax, eax
jle 0x4fc263
lea eax, [ebp - 8]
mov edx, 0x4fc3d0
call fcn.00403ebc
lea eax, [ebp - 0xc]
mov edx, 0x4fc390
call fcn.00403ebc
jmp 0x4fc27d
lea eax, [ebp - 8]
mov edx, 0x4fc44c
call fcn.00403ebc
lea eax, [ebp - 0xc]
mov edx, 0x4fc414
call fcn.00403ebc
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00458954
test al, al
je 0x4fc2f1
test bl, bl
jne 0x4fc2af
lea ecx, [ebp - 0x28]
mov eax, dword [esi + 8]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 4]
call fcn.00458f68
jmp 0x4fc2ba
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov eax, dword [ebp - 4]
call fcn.004587e0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00458954
test al, al
je 0x4fc2e6
mov edx, dword [esi + 0x24]
mov eax, dword [ebp - 4]
call fcn.00458cd8
mov eax, dword [ebp - 4]
call fcn.004587e0
test bl, bl
je 0x4fc2f1
mov eax, esi
call fcn.00461fb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc30e
mov eax, dword [ebp - 4]
call fcn.004030bc
ret
Function at 0x5046a4
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404258
xor eax, eax
push ebp
push 0x504867
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x458670]
call fcn.00458770
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x50483d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00458810
xor ecx, ecx
mov edx, 0x50487c
mov eax, dword [ebp - 8]
call fcn.00458954
test al, al
je 0x5047e4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5048b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp dword [ebp - 0xc], 7
jne 0x50476b
mov edx, dword [ebp - 0x10]
dec edx
lea eax, [ebp - 0x14]
call fcn.004043d8
cmp dword [ebp - 0x10], 1
jbe 0x50476b
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5048b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004090ac
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004090ac
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.0040c874
test eax, eax
jne 0x5047b4
push dword [ebp - 0x14]
push 0x5048d4
push dword [ebp - 4]
push 0x5048e4
push 0x5048e4
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404164
mov eax, dword [ebp - 0x14]
call fcn.004040a4
inc eax
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404268
push eax
push 7
push 0
push 0x5048b0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
call fcn.004587e0
mov eax, dword [ebp - 8]
call fcn.004587e0
xor ecx, ecx
mov edx, 0x5048f0
mov eax, dword [ebp - 8]
call fcn.00458954
test al, al
je 0x504827
push 0x50492c
push dword [ebp - 4]
push 0x50494c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404164
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00458f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504844
mov eax, dword [ebp - 8]
call fcn.004030bc
ret

Function at 0x50a0cc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 5
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404054
add esp, 0x10c
pop ebx
ret
Function at 0x50c4c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404258
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x50c635
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004681fc
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.0046821c
jmp 0x50c5fa
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404054
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004098b0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408f68
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408f68
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004041b4
je 0x50c5da
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404054
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408f68
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408f68
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004041b4
jne 0x50c5f1
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0046823c
test eax, eax
jne 0x50c53b
test esi, esi
jne 0x50c609
or esi, 0xffffffff
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c63c
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403e48
lea eax, [ebp - 4]
call fcn.00403e24
ret

Function at 0x50c648
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x800
call fcn.00404054
add esp, 0x800
pop ebx
ret

Function at 0x50c758
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, eax
push 0x800
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x800
call fcn.00404054
add esp, 0x800
pop ebx
ret
Function at 0x401b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401cd8
mov edi, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x401be7
test byte [0x402018], 8
jne 0x401c80
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x402028], 8
jne 0x401c40
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b89
cmp esi, 3
jbe 0x401bf8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401b9a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030e4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401b89
mov dword [esp], 0x402028
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x401b60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x401b60
mov dword [esp], 0x402018
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x401b4b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x401b53
mov eax, 0xffffffff
jmp 0x401be7

Function at 0x401d50
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x10002dc0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov word [ebp - 2], 0
mov word [ebp - 4], 0
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10002e90
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0x8004
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10002e90
push 0
push 0x10
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10002e90
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.1001e830
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10002e90
mov dword [ebp - 0x30], 0x14
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 2
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x10002e90
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x10002e90
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x10002e94
xor eax, eax
jmp 0x10002ed4
mov dword [ebp - 0x30], 0
jmp 0x10002ea6
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0x14
jae 0x10002ecf
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x24]
push ecx
push str._02X
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*2]
push ecx
call fcn.1001e7d5
add esp, 0xc
jmp 0x10002e9d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret