joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463ddc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x463de4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x463fd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x463fec
mov eax, esi
call fcn.00461c68
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404d3c
lea ecx, [ebp - 0x10]
mov edx, 0x464000
mov eax, esi
call fcn.00461c68
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404d3c
lea ecx, [ebp - 0x14]
mov edx, 0x464018
mov eax, esi
call fcn.00461c68
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404d3c
lea ecx, [ebp - 0x18]
mov edx, 0x464034
mov eax, esi
call fcn.00461c68
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404d3c
lea ecx, [ebp - 0x1c]
mov edx, 0x464050
mov eax, esi
call fcn.00461c68
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404d3c
lea ecx, [ebp - 0x24]
mov edx, 0x464068
mov eax, esi
call fcn.00461c68
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408ff0
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040958c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x464080
mov eax, esi
call fcn.00461c68
mov eax, dword [ebp - 0x28]
call fcn.0045b660
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x464090
mov eax, esi
call fcn.00461c68
mov eax, dword [ebp - 0x2c]
call fcn.0045b660
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4640a8
mov eax, esi
call fcn.00461c68
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040958c
inc eax
je 0x463f79
lea ecx, [ebp - 0x34]
mov edx, 0x4640a8
mov eax, esi
call fcn.00461c68
mov eax, dword [ebp - 0x34]
call fcn.00409550
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ad00
fstp qword [ebp - 0x3c]
wait
call fcn.0040b070
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x463f94
lea ecx, [ebp - 0x40]
mov edx, 0x4640a8
mov eax, esi
call fcn.00461c68
mov eax, dword [ebp - 0x40]
call fcn.0045b660
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4640b8
mov eax, esi
call fcn.00461c68
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404d3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463fdd
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404d0c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404d0c
ret
Function at 0x46e340
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405198
xor eax, eax
push ebp
push 0x46e3d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, 0x46e3e8
call fcn.00404fb0
mov eax, dword [ebp - 4]
call fcn.004051a8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x46e380
jmp dword [eax*4 + 0x46e387]
xor ebx, ebx
jmp case.default.0x46e380
mov bl, 1
jmp case.default.0x46e380
mov bl, 2
jmp case.default.0x46e380
mov bl, 3
jmp case.default.0x46e380
mov bl, 4
jmp case.default.0x46e380
mov bl, 5
jmp case.default.0x46e380
mov bl, 6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e3da
lea eax, [ebp - 4]
call fcn.00404ce8
ret
Function at 0x46fb04
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46fd59
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x34], eax
test byte [ebx + 0x1c], 0x10
jne 0x46fd3b
mov eax, ebx
call fcn.0046fda0
xor esi, esi
cmp word [ebx + 0x122], 0
je 0x46fb4d
or esi, 0x8000000
cmp word [ebx + 0x12a], 0
je 0x46fb5d
or esi, 0x800
cmp word [ebx + 0x132], 0
je 0x46fb6a
or esi, 2
cmp word [ebx + 0x13a], 0
je 0x46fb77
or esi, 4
cmp word [ebx + 0x142], 0
je 0x46fb87
or esi, 0x100
cmp word [ebx + 0x14a], 0
je 0x46fb97
or esi, 0x10000
cmp word [ebx + 0x152], 0
je 0x46fba7
or esi, 0x80
cmp word [ebx + 0x15a], 0
je 0x46fbb4
or esi, 0x20
cmp word [ebx + 0x162], 0
je 0x46fbc1
or esi, 0x40
cmp word [ebx + 0x16a], 0
je 0x46fbce
or esi, 8
cmp word [ebx + 0x172], 0
je 0x46fbde
or esi, 0x200
cmp word [ebx + 0x17a], 0
je 0x46fbee
or esi, 0x400
cmp word [ebx + 0x182], 0
je 0x46fbfe
or esi, 0x20000
cmp word [ebx + 0x18a], 0
je 0x46fc0b
or esi, 1
cmp word [ebx + 0x192], 0
je 0x46fc18
or esi, 0x10
cmp word [ebx + 0x19a], 0
je 0x46fc28
or esi, 0x4000
cmp word [ebx + 0x1a2], 0
je 0x46fc38
or esi, 0x1000
cmp word [ebx + 0x1aa], 0
je 0x46fc48
or esi, 0x8000
cmp word [ebx + 0x1b2], 0
je 0x46fc58
or esi, 0x2000
test esi, esi
je 0x46fd3b
cmp byte [ebx + 0x31], 0
je 0x46fcd2
mov edi, 0x41
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00404ed0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x46fd70
call fcn.00404ff4
mov eax, dword [ebp - 4]
call fcn.004051a8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x46fcca
inc dword [ebx + 0x34]
mov eax, dword [ebx + 0x34]
lea eax, [ebx + eax*8 + 0x34]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004051a8
push eax
call sub.shell32.dll_SHILCreateFromPath
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov byte [eax + 4], 1
inc edi
cmp edi, 0x5b
jne 0x46fc6b
jmp 0x46fce4
mov dword [ebx + 0x34], 1
lea eax, [ebx + 0x3c]
xor edx, edx
mov dword [eax], edx
mov byte [eax + 4], 1
lea eax, [ebx + 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x11c]
push eax
push esi
push 3
mov eax, dword [ebx + 4]
mov edx, dword [0x431848]
call fcn.004040ac
call fcn.0043bafc
push eax
call sub.shell32.dll_SHChangeNotifyRegister
mov edi, eax
mov dword [ebx + 0x38], edi
test edi, edi
jne 0x46fd3b
mov eax, ebx
call fcn.0046fda0
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x408124]
call fcn.0040ce34
call fcn.00404678
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fd60
lea eax, [ebp - 0x18]
call fcn.00404ce8
lea eax, [ebp - 4]
call fcn.00404ce8
ret
Function at 0x47097c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x470ab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00419c18
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x4709f8
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4709f8
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408dac
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x47e8d4]
mov ebx, dword [ebx]
mov eax, 0x470acc
call ebx
dec eax
jne 0x4709f8
mov ebx, 1
jmp 0x4709fa
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x470a9b
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00466688
test al, al
jne 0x470a8f
mov eax, dword [ebp - 4]
call fcn.00470970
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404d3c
xor edx, edx
push ebp
push 0x470a7d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x470a73
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00470d90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x470a8f
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x470a12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470abd
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404d0c
ret

Function at 0x4749e0
Capabilities:
Stop service

Disassembly:
push ebx
add esp, 0xffffffc8
mov ebx, eax
mov edx, dword [ebx + 0x50]
mov eax, ebx
call fcn.004748ac
cmp dword [ebx + 0x3c], 0
je 0x474a45
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.00474970
cmp dword [esp + 0x20], 1
je 0x474a45
push esp
push 1
mov eax, dword [ebx + 0x3c]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x474a1f
call fcn.0040e454
jmp 0x474a45
mov edx, 1
mov eax, ebx
call fcn.0047499c
test al, al
jne 0x474a45
mov ecx, 0x474a54
mov dl, 1
mov eax, dword [0x474624]
call fcn.0040ce34
call fcn.00404678
add esp, 0x38
pop ebx
ret
Function at 0x474f8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x475012
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
test edi, edi
je 0x474ff7
mov ebx, dword [ebp - 4]
dec ebx
test ebx, ebx
jl 0x474fe1
inc ebx
xor esi, esi
lea eax, [ebp - 0x10]
mov dl, byte [edi + esi]
xor dl, 0xa
call fcn.00404ed0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404fb0
inc esi
dec ebx
jne 0x474fc4
mov eax, dword [ebp - 4]
call fcn.00402ad0
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00474f60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475019
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404d0c
ret

Function at 0x4751c4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x4751e0
Capabilities:
Check for peb beingdebugged flag
Check for trap flag exception

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.004751c4
test eax, eax
je 0x4751fb
call fcn.0047516c
call fcn.004751d4
test eax, eax
jne 0x475234
xor eax, eax
push ebp
push 0x47522a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov dr0, edx
mov dr1, edx
mov dr2, edx
mov dr3, edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475234
xor eax, eax
push ebp
push 0x475251
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_DebugBreak
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47525b
xor eax, eax
push ebp
push 0x475277
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
idiv ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475281
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
test eax, eax
je 0x4752a0
call fcn.0047516c
xor eax, eax
push ebp
push 0x4752cf
push dword fs:[eax]
mov dword fs:[eax], esp
pushf
pop eax
or eax, 0x100
push eax
popf
call fcn.0047516c
Function at 0x4761d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], eax
xor eax, eax
push ebp
push 0x476364
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.004744b8
mov dword [ebp - 8], eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.004744d8
mov dword [ebp - 4], eax
jmp 0x476333
mov bl, 0x11
mov esi, 0x480028
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404f58
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00409bc0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408dac
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [esi]
call fcn.00408dac
mov eax, dword [ebp - 0x140]
pop edx
call fcn.004052ec
test eax, eax
jg 0x4762fd
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404f58
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00408dac
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [esi]
call fcn.00408dac
mov eax, dword [ebp - 0x14c]
pop edx
call fcn.004052ec
test eax, eax
jle 0x476317
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
add esi, 4
dec bl
jne 0x476256
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.004744f8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47624f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47636b
lea eax, [ebp - 0x14c]
mov edx, 7
call fcn.00404d0c
ret
Function at 0x47c2b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x47bf04
call fcn.00406f54
xor eax, eax
push ebp
push 0x47c39f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.00409cfc
mov edx, dword [ebp - 0x14]
mov eax, 0x4800f0
call fcn.00404d3c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4800f0]
call fcn.00404fa8
mov edx, eax
mov ecx, 1
mov eax, dword [0x4800f0]
call fcn.00405208
mov eax, dword [ebp - 0x18]
mov edx, 0x47c3b4
call fcn.004050f4
jne 0x47c343
push 5
push 0
push 0
mov eax, dword [0x4800f0]
call fcn.004051a8
push eax
push 0x47c3b8
mov eax, dword [0x47ecec]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x47ecec]
mov eax, dword [eax]
call fcn.004549b0
mov eax, dword [0x47ecec]
mov eax, dword [eax]
mov edx, 0x47c3c8
call fcn.00454598
mov ecx, dword [0x47e8b0]
mov eax, dword [0x47ecec]
mov eax, dword [eax]
mov edx, dword [0x475778]
call fcn.004549c8
mov eax, dword [0x47ecec]
mov eax, dword [eax]
call fcn.00454a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c3a6
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404d0c
ret
Function at 0xa09510
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x87f015
lea edi, [esi - 0x47e015]
push edi
or ebp, 0xffffffff
jmp 0xa09532
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa09539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa09528
mov eax, 1
add ebx, ebx
jne 0xa0954b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa0955c
jne 0xa0957b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa0957b
dec eax
add ebx, ebx
jne 0xa09568
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa09540
add ebx, ebx
jne 0xa09577
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa095cd
xor ecx, ecx
sub eax, 3
jb 0xa09593
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa09602
sar eax, 1
mov ebp, eax
jmp 0xa0959e
add ebx, ebx
jne 0xa0959e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa0956c
inc ecx
add ebx, ebx
jne 0xa095ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa0956c
add ebx, ebx
jne 0xa095b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa095ae
jne 0xa095ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa095ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa095ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa095de
jmp 0xa0952e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa095ec
add edi, ecx
jmp 0xa0952e
pop esi
mov edi, esi
mov ecx, 0x8058
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa0960a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa0960f
lea edi, [esi + 0x607000]
mov eax, dword [edi]
or eax, eax
je 0xa09677
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x609000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x609078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa09635
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x60907c]
or eax, eax
je 0xa09671
mov dword [ebx], eax
add ebx, 4
jmp 0xa09652
call dword [esi + 0x60908c]
mov ebp, dword [esi + 0x609080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa096ab
sub esp, 0xffffff80
jmp 0x424b60
Function at 0x40f1fb
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b61d9
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1014
call fcn.00476b40
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x1010], eax
push ebx
push esi
push edi
mov eax, dword [0x4f3bd0]
xor eax, esp
push eax
lea eax, [esp + 0x1028]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, 0x4d3260
push esi
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.00402766
mov ecx, dword [esp + 0x18]
push esi
call fcn.00402766
push 0x4f9e00
lea ecx, [esp + 0x18]
call fcn.004027fb
and dword [esp + 0x1030], 0
mov esi, 0x800
push esi
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00475420
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0040ff61
test eax, eax
jne 0x40f2d3
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00402820
xor eax, eax
mov ecx, dword [esp + 0x1028]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.0047549a
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call fcn.00402766
push esi
lea eax, [esp + 0x820]
push 0
push eax
call fcn.00475420
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push dword [edi + 0x138]
lea eax, [esp + 0x20]
push dword [esp + 0x18]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
lea eax, [esp + 0x1c]
je 0x40f34a
push 0
push eax
call fcn.0040224e
pop ecx
test eax, eax
pop ecx
lea eax, [esp + 0x81c]
je 0x40f37d
push 0x400
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0043a124
add esp, 0xc
jmp 0x40f38d
push str.safemon360tray.exe
push dword [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
jne 0x40f376
xor esi, esi
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00402820
mov eax, esi
jmp 0x40f2ad
lea eax, [esp + 0x81c]
push 0x4d4870
push 0x400
push eax
call fcn.00402287
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00401c3e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x81c]
push eax
call fcn.00402766
xor esi, esi
inc esi
jmp 0x40f363
Function at 0x1001aed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1010e774], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1001af8a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x1010e770], eax
inc ebx
cmp ebx, 0x100
jb 0x1001aef0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x1001afb6
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1010e770]
sub edi, 1
jne 0x1001af95
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1001afe8
nop dword [eax]
cmp cl, 0x23
jne 0x1001afcf
cmp byte [esi], cl
jne 0x1001afcf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1010e770]
test cl, cl
jne 0x1001afc0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1001b8f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x1001b902
mov dword [ebx], 0
mov edx, 0x100d1928
call fcn.1001b6f0
mov esi, eax
test esi, esi
jne 0x1001b916
pop esi
pop ebx
pop ebp
ret
push edi
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1001b9e5
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x1001b9e5
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1001b9e5
mov eax, dword [0x1010d048]
inc dword [eax + 0x318]
mov ecx, dword [eax + 0xc0]
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
call ecx
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1001b9e5
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, edi
je 0x1001b9b5
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1010d048]
mov ecx, dword [ebp + 8]
push ecx
dec dword [eax + 0x318]
mov eax, dword [eax + 0xc4]
call eax
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x1001b9cd
push eax
mov eax, dword [ebp + 8]
add eax, edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1001b9dd
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret