joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46df50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00409540
mov eax, dword [ebx]
call fcn.00404938
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x46df96
mov eax, ebx
mov edx, 0x46dfa4
call fcn.00404940
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47150c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.00407520
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
jb 0x471540
cmp dword [esp + 8], 1
jb 0x471540
cmp dword [esp + 0x10], 2
je 0x471544
xor eax, eax
jmp 0x471546
mov al, 1
add esp, 0x94
ret

Function at 0x485260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00485228
mov eax, dword [ebx]
call fcn.00404938
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4852a6
mov eax, ebx
mov edx, 0x4852b4
call fcn.00404940
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4852b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.00485228
mov eax, dword [ebx]
call fcn.00404938
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4852fe
mov eax, ebx
mov edx, 0x48530c
call fcn.00404940
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x485694
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004710bc
mov eax, dword [ebx]
call fcn.00404938
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4856da
mov eax, ebx
mov edx, 0x4856e8
call fcn.00404940
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488578
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x48862a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x30]
call fcn.00487b50
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x2c]
mov eax, dword [eax + 0xc]
call fcn.00424914
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x30]
call fcn.00487b50
mov eax, dword [eax + 0x10]
call fcn.00424bd4
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x2c]
mov eax, dword [eax + 0xc]
call fcn.00424be0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x30]
call fcn.00487b50
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x2c]
mov eax, dword [eax + 0x14]
call fcn.004250e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48866d
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48b4a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x48b56c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x294]
mov eax, dword [eax + 0x30]
call fcn.00487b50
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x34]
mov eax, dword [eax + 0xc]
call fcn.00424914
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x294]
mov eax, dword [eax + 0x30]
call fcn.00487b50
mov eax, dword [eax + 0x10]
call fcn.00424bd4
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x34]
mov eax, dword [eax + 0xc]
call fcn.00424be0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x294]
mov eax, dword [eax + 0x30]
call fcn.00487b50
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x34]
mov eax, dword [eax + 0x14]
call fcn.004250e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48b5e0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48fe3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404b38
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48fe55
test al, 0x10
jne 0x48fe59
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x48fe60
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00404b28
xor eax, eax
push ebp
push 0x49004d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.004030dc
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.004030bc
cmp dword [ebp + 0x20], 0
je 0x48ff1b
cmp dword [ebp - 0x10], 0
je 0x48ff1b
mov eax, dword [ebp + 0x20]
call fcn.00409098
test al, al
jne 0x48fed1
mov eax, dword [ebp + 0x20]
call fcn.0048fe3c
test al, al
je 0x48fef4
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00404b38
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x48ff15
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00404b38
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x48ff42
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x490060
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x48ff61
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x490060
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0041985c
test bl, bl
je 0x48ffa1
cmp byte [ebp + 0x14], 0
jne 0x48ffa1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00425a08
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x490037
mov dl, 1
mov eax, dword [0x423968]
call fcn.00429934
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00429efc
call fcn.00425a08
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00402b48
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00402b48
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.0048fd60
mov eax, ebx
call fcn.004038a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490054
lea eax, [ebp + 0x20]
call fcn.00404678
ret
Function at 0x498e48
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0x28
push ebx
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x498e6b
xor eax, eax
jmp 0x498eef
push esp
push 0x498ef4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x498e90
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
jmp 0x498eef
lea eax, [esp + 0x10]
mov edx, 0x10
call fcn.00407520
mov dword [esp + 0x10], 1
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x498eec
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
jmp 0x498eef
or eax, 0xffffffff
add esp, 0x30
pop ebx
ret

Function at 0x49bc90
Capabilities:
Shutdown system

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x320]
add eax, 0x68
mov edx, 0x49bd00
call fcn.004046cc
mov eax, dword [ebx + 0x320]
mov edx, dword [eax]
call dword [edx + 0x30]
dec eax
jne 0x49bcf6
xor eax, eax
call fcn.00499c7c
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x2d4]
call fcn.0048a8dc
mov eax, dword [ebx + 0x320]
add eax, 0x68
mov edx, 0x49bd1c
call fcn.004046cc
mov eax, dword [ebx + 0x320]
mov edx, dword [eax]
call dword [edx + 0x30]
dec eax
jne 0x49bcf6
push 0
push 2
call sub.user32.dll_ExitWindowsEx
pop ebx
ret
Function at 0x41cfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov al, byte [eax + 8]
xor al, byte [edx + 0x1c]
push edi
imul edi, dword [edx + 0x18], 0x64
and al, 1
xor byte [edx + 0x1c], al
add edi, 0x50b410
movzx ebp, byte [edi + 5]
mov dword [esp + 0x18], ebp
test ebp, ebp
jne 0x41d022
movzx esi, byte [edi + 4]
xor ecx, ecx
test esi, esi
je 0x41d022
add edx, 0x40
nop dword [eax]
cmp byte [edi + ecx + 0xc], 0
jne 0x41d012
mov eax, dword [edx]
movzx eax, byte [eax + 0x10]
cmp ebp, eax
cmovbe ebp, eax
inc ecx
add edx, 0x20
cmp ecx, esi
jb 0x41d000
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], ebp
mov ebx, dword [edi + 8]
and ebx, 0x79
mov dword [esp + 0x10], ebx
jne 0x41d06b
movzx esi, byte [edi + 4]
test esi, esi
je 0x41d062
add edx, 0x40
lea ecx, [edi + 0x1c]
nop dword [eax]
test byte [ecx], 0x79
jne 0x41d04f
test ebx, ebx
jne 0x41d04f
mov eax, dword [edx]
movzx ebx, byte [eax + 0x11]
add ecx, 4
add edx, 0x20
sub esi, 1
jne 0x41d040
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x41d06b
mov ebx, 0x20
mov dword [esp + 0x10], ebx
xor edx, edx
mov dword [esp + 0x14], edx
cmp byte [edi + 4], dl
jbe 0x41d0e0
mov eax, dword [esp + 0x28]
mov ecx, 0xffffffc0
sub ecx, eax
mov ebp, eax
mov ebx, ecx
lea esi, [eax + 0x40]
nop dword [eax + eax]
mov eax, dword [esi]
movzx ecx, byte [eax + 0x10]
mov dword [esp + 0x1c], ecx
cmp ecx, 0x10
jae 0x41d0c8
add ecx, 0x44
lea eax, [ebx + esi]
add ecx, eax
mov edx, 0x10
add ecx, ebp
sub edx, dword [esp + 0x1c]
mov eax, dword [esi]
lea ecx, [ecx + 1]
mov al, byte [eax + 0x10]
dec al
mov byte [ecx - 1], al
sub edx, 1
jne 0x41d0b2
mov edx, dword [esp + 0x14]
movzx eax, byte [edi + 4]
inc edx
add esi, 0x20
mov dword [esp + 0x14], edx
cmp edx, eax
jb 0x41d090
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
push ebx
push ebp
lea edi, [esi + 0x20]
push edi
push esi
call fcn.00407af0
mov ebx, dword [esp + 0x34]
push esi
push dword [ebx + 4]
push dword [ebx]
call fcn.004090c0
add esp, 0x1c
cmp byte [ebx + 9], 0
je 0x41d114
push esi
push dword [ebx + 0xc]
call fcn.0045c330
add esp, 8
mov eax, edi
mov dword [ebx + 4], esi
pop edi
pop esi
pop ebp
mov dword [ebx], 3
pop ebx
add esp, 0x10
ret

Function at 0x41d9d0
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
shr ecx, 0xf
xor ecx, dword [esp + 4]
imul ecx, ecx, 0x85ebca77
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret

Function at 0x41da00
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [esp + 0xc]
and eax, 0xf
jmp dword [eax*4 + 0x41dc48]
Function at 0x421f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
push edi
push ebp
push 0x19a
push esi
call fcn.0041cd60
push ebp
push 0x19b
push esi
mov dword [esp + 0x54], eax
call fcn.0041cd60
mov edi, dword [esp + 0x64]
mov ebx, eax
push edi
push 0x19a
push esi
mov dword [esp + 0x68], ebx
call fcn.0041cd60
push edi
push 0x19b
push esi
mov dword [esp + 0x40], eax
call fcn.0041cd60
movzx ecx, byte [ebp + 0x10]
push 0x20
push ecx
push dword [esi + 0xc]
mov dword [esp + 0x68], eax
call fcn.004097b0
mov edi, eax
push edi
push esi
call fcn.0041d130
add esp, 0x44
lea eax, [edi + 0x18]
mov dword [esp + 0x14], eax
movzx eax, byte [ebp + 0x10]
push 0x20
push eax
push dword [esi + 0xc]
call fcn.004097b0
mov edi, eax
push edi
push esi
call fcn.0041d130
push dword [esp + 0x24]
lea ebp, [edi + 0x18]
mov dword [esp + 0x4c], ebx
push ebx
push 0x17e
push esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x5c], ebp
call fcn.0041cdb0
push 0
push 0
push dword [esp + 0x58]
mov edi, eax
push esi
call fcn.00410260
push edi
push eax
push 0x10d
push esi
call fcn.0041cdb0
add esp, 0x44
mov edi, eax
mov dword [esp + 0x1c], edi
push 1
push 0
push 0
call fcn.0040f5b0
push 1
push 1
push dword [esi + 0xc]
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], edx
call fcn.004097b0
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4220a7
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x24]
push ebx
push esi
mov dword [ebx + 0x34], eax
call fcn.0041d130
add esp, 8
add ebx, 0x18
movzx eax, byte [edi + 0x10]
movzx eax, byte [eax + 0x42266b]
jmp dword [eax*4 + 0x42264c]

Function at 0x424d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x30]
push esi
movzx eax, byte [ebx + 0x10]
cmp eax, ebp
jne 0x424d6c
xor dl, dl
xor ecx, ecx
test ebp, ebp
je 0x424d66
mov esi, 1
movzx eax, byte [esp + ecx + 0x24]
cmp eax, ecx
movzx edx, dl
cmovne edx, esi
inc ecx
cmp ecx, ebp
jb 0x424d50
test dl, dl
jne 0x424d6c
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov ebx, dword [esp + 0x10]
push edi
push 0x140
push dword [ebx + 0xc]
call fcn.00406d20
mov esi, eax
mov eax, dword [esp + 0x2c]
movzx ecx, byte [eax + 0x11]
lea edi, [esi + 0x20]
push ecx
push ebp
push edi
push esi
call fcn.00407af0
mov cl, byte [ebx + 8]
xor cl, byte [esi + 0x1c]
movups xmm0, xmmword [esp + 0x30]
and cl, 1
xor byte [esi + 0x1c], cl
movups xmmword [esi + 0x34], xmm0
push esi
movups xmm0, xmmword [esp + 0x44]
push ebx
movups xmmword [esi + 0x44], xmm0
call fcn.0041d130
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4262a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x4269a3]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42698c]
Function at 0x4284e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x428bdb]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x428bc4]
Function at 0x42b020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42b71b]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42b704]
Function at 0x42d1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42d8d7]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42d8c0]
Function at 0x42f4f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x42fbeb]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x42fbd4]
Function at 0x4316a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x431d97]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x431d80]
Function at 0x433a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x434173]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x43415c]
Function at 0x435d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c
movzx eax, byte [eax + 0x436467]
push ebx
push ebp
push esi
push edi
jmp dword [eax*4 + 0x436450]
Function at 0x440060
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
cmp eax, 0x10
je 0x440163
xor ecx, ecx
cmp eax, 0x20
je 0x4400fb
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x440200
test byte [esp + 0x28], 0x20
movsd xmm1, qword [0x528960]
jne 0x4400ba
mov edx, dword [esp + 0x24]
nop dword [eax]
mov eax, dword [edx]
movsd xmm0, qword [eax + ecx*8]
xorps xmm0, xmm1
movsd qword [esi + ecx*8], xmm0
inc ecx
cmp ecx, edi
jb 0x4400a0
pop edi
pop esi
add esp, 0xc
ret
xor ecx, ecx
nop dword [eax]
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
movsd xmm0, qword [eax + ecx*8]
xorps xmm0, xmm1
movsd qword [esi + ecx*8], xmm0
mov edx, dword [esi + ecx*8 + 4]
test edx, 0x7ff00000
jne 0x4400f0
and edx, 0x80000000
mov dword [esi + ecx*8], 0
mov dword [esi + ecx*8 + 4], edx
inc ecx
cmp ecx, edi
jb 0x4400c0
pop edi
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x440200
push 0x20
push dword [esp + 0x2c]
call fcn.0045af60
mov edi, dword [esp + 0x2c]
add esp, 8
movss xmm1, dword [0x528970]
mov byte [esp + 0x23], al
nop word [eax + eax]
cmp byte [esp + 0x23], 0
mov eax, dword [edi]
movss xmm0, dword [eax + ecx*8]
xorps xmm0, xmm1
movss dword [esi + ecx*8], xmm0
je 0x440158
mov eax, dword [esi + ecx*8]
test eax, 0x7f800000
jne 0x440158
and eax, 0x80000000
mov dword [esi + ecx*8], eax
inc ecx
cmp ecx, edx
jb 0x440130
pop edi
pop esi
add esp, 0xc
ret
xor edi, edi
cmp dword [esp + 0x1c], edi
jbe 0x440200
mov ecx, dword [esp + 0x28]
push 0x10
push ecx
call fcn.0045af90
push 0x10
push ecx
mov byte [esp + 0x33], al
call fcn.0045af60
add esp, 0x10
mov byte [esp + 0x13], al
nop
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
movzx ecx, word [ecx + edi*8]
push ecx
call fcn.004620c0
add esp, 4
cmp byte [esp + 0x23], 0
fstp dword [esp + 0xc]
movss xmm0, dword [esp + 0xc]
xorps xmm0, xmmword [0x528970]
push ecx
movss dword [esp], xmm0
je 0x4401c8
call fcn.00461fe0
jmp 0x4401cd
call fcn.00462000
movzx eax, ax
add esp, 4
cmp byte [esp + 0x13], 0
movzx ecx, ax
mov word [esi + edi*8], cx
je 0x4401f9
mov eax, ecx
xor edx, edx
and eax, 0x7c00
cmp dx, ax
jne 0x4401f9
and ecx, 0x8000
mov word [esi + edi*8], cx
inc edi
cmp edi, dword [esp + 0x1c]
jb 0x440190
pop edi
pop esi
add esp, 0xc
ret

Function at 0x447360
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
movzx eax, byte [eax + 0x4474c7]
push esi
push edi
jmp dword [eax*4 + 0x4474b0]

Function at 0x462110
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi]
push ebx
call fcn.004f59d7
mov ebp, eax
add esp, 4
test ebp, ebp
jle 0x46215a
lea ecx, [ebp + 1]
push esi
push ecx
call fcn.004edfe0
push 0
push 0
push ebx
mov esi, eax
call fcn.004f5345
push ebx
push ebp
push 1
push esi
call fcn.004f4f19
mov byte [esi + ebp], 0
add esp, 0x20
mov eax, dword [edi + 4]
mov dword [eax], esi
mov eax, dword [edi + 8]
pop esi
mov dword [eax], ebp
lea eax, [edi + 0xc]
push eax
call fcn.004f5a07
push ebx
call fcn.004e9f44
add esp, 8
pop edi
pop ebp
pop ebx
ret
Function at 0x462170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x886f80]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 8]
push eax
push 0x104
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x102
ja 0x462223
push edi
lea edi, [esi + 0xc]
push edi
push 0
push 0x52e15c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x462209
push 0x52e168
push edi
call fcn.004ea02b
mov ecx, eax
add esp, 8
test ecx, ecx
setne al
test ecx, ecx
je 0x4621f1
mov dword [esi], ecx
mov ecx, dword [esp + 0x11c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x120]
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e5b77
add esp, 0x108
ret
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e5b77
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.004e5b77
add esp, 0x108
ret
Function at 0x466090
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x467830
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp byte [0x887b38], 0
jne 0x46785a
push 0x887b38
push 0x465ee0
push 0x887b3c
call fcn.00465e80
add esp, 0xc
mov byte [0x887b38], 1
push 0x887b40
call fcn.00467f90
add esp, 4
cmp byte [0x887b34], 0
je 0x4678a5
mov ecx, dword [0x88a58c]
mov eax, dword fs:[0x2c]
push 0x7fff
mov eax, dword [eax + ecx*4]
lea esi, [eax + 0x18]
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
xor ecx, ecx
cmp eax, 0x7ffd
cmova esi, ecx
jmp 0x467930
mov eax, dword [0x887b58]
test eax, eax
jne 0x4678dc
push 0x462ed0
push 0x462530
push eax
call fcn.00462680
add esp, 0xc
mov dword [0x887b58], eax
test eax, eax
je 0x467930
push 0x467760
call fcn.004e6949
mov eax, dword [0x887b58]
add esp, 4
push edi
mov edi, dword [esp + 0xc]
push edi
push eax
call fcn.00462bf0
add esp, 8
test eax, eax
je 0x4678f4
mov esi, dword [eax + 8]
jmp 0x46792f
push ebx
push edi
push dword [0x887b58]
call fcn.00461960
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x46792e
push edi
call fcn.004677f0
push eax
push dword [0x887b58]
call fcn.00461960
mov esi, eax
push esi
push ebx
push dword [0x887b58]
call fcn.004628d0
add esp, 0x18
pop ebx
pop edi
cmp byte [0x887b38], 0
jne 0x467957
push 0x887b38
push 0x465ee0
push 0x887b3c
call fcn.00465e80
add esp, 0xc
mov byte [0x887b38], 1
push 0x887b40
call fcn.00467fa0
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x467970
Capabilities:
Print debug messages

Disassembly:
cmp dword [0x887b30], 0
jne 0x467988
push 2
call fcn.004e9cb4
add esp, 4
mov dword [0x887b30], eax
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x4679d1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4679d1
push 1
call fcn.004e9cb4
push eax
call fcn.004ed798
push dword [0x887b30]
push esi
call fcn.004edb3f
push dword [0x887b30]
call fcn.004ed798
add esp, 0x14
pop esi
ret
push 2
call fcn.004e9cb4
mov ecx, dword [0x887b30]
add esp, 4
cmp ecx, eax
je 0x4679fa
push ecx
push esi
call fcn.004edb3f
push dword [0x887b30]
call fcn.004ed798
add esp, 0xc
pop esi
ret