joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x405b9c
cmp byte [esi + 0x3d], 0
je 0x405b9c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x405b8a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x405b52
sub eax, 1
je 0x405b56
sub eax, 2
jne 0x405b8a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405b73
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00451e92
add esp, 0x10
cmp edi, eax
jne 0x405b8a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0044b98f
mov esp, ebp
pop ebp
ret

Function at 0x406520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471cd0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x491130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0044bbbe
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00439581
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20ec
call fcn.0044cf20
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2090], ecx
mov ecx, str._nodel
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x208c], eax
call fcn.00403950
push 0x2080
mov bl, al
lea eax, [ebp - 0x2088]
push 0
push eax
call fcn.0044e240
xorps xmm0, xmm0
add esp, 0xc
cmp dword [edi + 0x14], 8
mov eax, edi
movlpd qword [ebp - 0x20e4], xmm0
movlpd qword [ebp - 0x20dc], xmm0
movlpd qword [ebp - 0x20d4], xmm0
movlpd qword [ebp - 0x20cc], xmm0
movlpd qword [ebp - 0x20c4], xmm0
movlpd qword [ebp - 0x20bc], xmm0
movlpd qword [ebp - 0x20b4], xmm0
movlpd qword [ebp - 0x20ac], xmm0
movups xmmword [ebp - 0x20a0], xmm0
jb 0x40a302
mov eax, dword [edi]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x2088]
push eax
call esi
push str.GoToAssistService.exe
lea eax, [ebp - 0x2088]
push eax
call esi
push 0x486374
lea eax, [ebp - 0x2088]
mov dword [ebp - 0x20e8], 0x44
push 0x1040
push eax
call fcn.00451913
mov eax, dword [ebp - 0x208c]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x2088]
push 0x1040
push eax
call fcn.00451913
mov eax, dword [ebp - 0x2090]
add esp, 0xc
cmp byte [eax + 0x18], 0
je 0x40a384
push 0x486378
lea eax, [ebp - 0x2088]
push 0x1040
push eax
call fcn.00451913
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x40a38c
mov edi, dword [edi]
lea eax, [ebp - 0x20a0]
push eax
lea eax, [ebp - 0x20e8]
push eax
push edi
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2088]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40a3e4
push str.Failed_to_start_client_application.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00403630
add esp, 8
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x209c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40a401
push eax
call esi
mov dword [ebp - 0x209c], 0
mov eax, dword [ebp - 0x20a0]
test eax, eax
je 0x40a418
push eax
call esi
mov dword [ebp - 0x20a0], 0
test bl, bl
jne 0x40a44d
mov ecx, str._destination
call fcn.00403950
test al, al
jne 0x40a44d
push 0x1040
lea eax, [ebp - 0x2088]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a44d
lea ecx, [ebp - 0x2088]
call fcn.0040d9e0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b98f
mov esp, ebp
pop ebp
ret 8
Function at 0x40c560
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0044cf20
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.00455af8
lea ecx, [ebp - 0x2004]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c595
push ebx
sub ecx, edx
lea eax, [ebp - 0x2004]
sar ecx, 1
lea ebx, [ebp - 0x2004]
push 0x5c
push eax
lea ebx, [ebx + ecx*2]
call fcn.0044d75e
add esp, 8
test eax, eax
je 0x40c66e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2004]
push 0x5c
push eax
call fcn.0044d75e
add esp, 8
test eax, eax
je 0x40c5fb
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2004]
push 0x5c
push eax
call fcn.0044d75e
add esp, 8
test eax, eax
jne 0x40c5e1
lea ecx, [ebp - 0x2004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c604
sub ecx, edx
sar ecx, 1
push esi
lea esi, [ebp - 0x2004]
lea esi, [esi + ecx*2]
cmp esi, ebx
je 0x40c66d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [eax + eax]
push 0
lea eax, [ebp - 0x2004]
push eax
call edi
test esi, esi
je 0x40c66c
mov eax, 0x5c
mov word [esi], ax
lea eax, [ebp - 0x2004]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c650
sub eax, edx
lea esi, [ebp - 0x2004]
sar eax, 1
lea esi, [esi + eax*2]
cmp esi, ebx
jne 0x40c630
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0044b98f
mov esp, ebp
pop ebp
ret

Function at 0x40c680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
jne 0x40c6a1
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x8000080
push 2
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c6cc
pop esi
mov eax, 0x52
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c6f8
cmp dword [ebp - 4], edi
jne 0x40c6f8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x1d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8a40
call fcn.0044cf20
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, edx
push 0
push eax
mov ebx, ecx
call fcn.0044e240
add esp, 0xc
mov dword [ebp - 0x8a18], 0x104
lea eax, [ebp - 0x8a40]
mov dword [ebp - 0x8a14], 0
mov dword [ebp - 0x8a10], 0
push eax
lea eax, [ebp - 0x8a28]
push eax
lea eax, [ebp - 0x8a2c]
push eax
lea eax, [ebp - 0x8a30]
push eax
lea eax, [ebp - 0x8a10]
push eax
lea eax, [ebp - 0x8a34]
push eax
lea eax, [ebp - 0x8a38]
push eax
lea eax, [ebp - 0x8a14]
push eax
push 0
lea eax, [ebp - 0x8a18]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x8a10]
test eax, eax
je 0x40d66c
xor esi, esi
test eax, eax
je 0x40d66c
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x8a1c], 0x3fff
push eax
push eax
push eax
push eax
mov word [ebp - 0x8a0c], ax
lea eax, [ebp - 0x8a1c]
push eax
lea eax, [ebp - 0x8a0c]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40d65f
lea eax, [ebp - 0x8a0c]
push edi
push eax
call fcn.0044d7ff
add esp, 8
test eax, eax
jne 0x40d67f
push 0x800
push eax
lea eax, [ebp - 0xa0c]
push eax
call fcn.0044e240
add esp, 0xc
mov dword [ebp - 0x8a20], 0x400
lea eax, [ebp - 0x8a20]
mov dword [ebp - 0x8a24], 1
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x8a24]
push eax
push 0
lea eax, [ebp - 0x8a0c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d65f
lea eax, [ebp - 0xa0c]
push edi
push eax
call fcn.0044d7ff
add esp, 8
test eax, eax
jne 0x40d67f
inc esi
cmp esi, dword [ebp - 0x8a10]
jb 0x40d5b0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
Function at 0x40d6a0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.IsWow64Process
mov esi, ecx
mov dword [ebp - 0x80c], 0
push str.kernel32
mov dword [ebp - 0x814], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40d6f5
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x808]
push eax
mov eax, dword [ebp - 0x80c]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40d7ae
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x818], 7
push 0
push eax
call fcn.0044e240
add esp, 0xc
mov dword [ebp - 0x810], 0x400
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x808]
mov esi, eax
call edi
test esi, esi
mov esi, dword [ebp - 0x814]
jne 0x40d7ae
mov edx, dword [ebp - 0x810]
lea ecx, [ebp - 0x804]
push esi
call fcn.0040d470
add esp, 4
test al, al
jne 0x40d7f5
lea eax, [ebp - 0x808]
push eax
mov eax, dword [ebp - 0x80c]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call ebx
test eax, eax
jne 0x40d80a
mov ecx, dword [ebp - 0x808]
mov edx, esi
call fcn.0040d4f0
push dword [ebp - 0x808]
test al, al
je 0x40d808
call edi
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
call edi
lea eax, [ebp - 0x808]
push eax
mov eax, dword [ebp - 0x80c]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call ebx
test eax, eax
jne 0x40d851
mov ecx, dword [ebp - 0x808]
mov edx, esi
call fcn.0040d4f0
push dword [ebp - 0x808]
test al, al
jne 0x40d7f3
call edi
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
Function at 0x40d870
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40d887
sub edi, ecx
sar edi, 1
cmp word [ebx + edi*2 - 2], 0x5c
je 0x40d8ae
mov eax, 0x5c
mov word [ebx + edi*2], ax
inc edi
xor eax, eax
mov word [ebx + edi*2], ax
push 0x486418
push ebx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp + 8]
add edi, 3
mov ebx, 1
lea ecx, [eax + edi*2]
mov edi, eax
mov dword [ebp - 4], ecx
lea eax, [edi + esi*2]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp + 8], eax
nop dword [eax + eax]
push ebx
push str._04X.tmp
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 8]
add esp, 0xc
inc ebx
call fcn.0040d6a0
test al, al
jne 0x40d913
push 0
push edi
call esi
test eax, eax
jne 0x40d920
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d92c
cmp ebx, 0xffff
jge 0x40d92c
mov ecx, dword [ebp - 4]
jmp 0x40d8e0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d940
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push str.shell32.dll
mov edi, edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d9ce
cmp ebx, 0xffffffff
je 0x40d9ce
push str.SHGetSpecialFolderPathW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d9c7
push 0
push 0x1c
push edi
push 0
call eax
test eax, eax
je 0x40d9c7
push str.GoToAssist_Remote_Support
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Applet
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40d9a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d9c7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40d9b3
sub edi, ecx
sar edi, 1
mov eax, edi
pop edi
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
xor eax, eax
pop ebx
ret
Function at 0x40dea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x40decb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40deb4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x418a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472c07
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
lea eax, [ebx + 8]
mov dword [ebp - 4], 1
lea ecx, [edi + 4]
mov dword [edi], vtable.common::Logger.0
push eax
call fcn.00405600
xorps xmm0, xmm0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
lea eax, [edi + 0x40]
mov byte [edi + 0x3c], 1
push 0x102
push eax
call fcn.0043aa97
lea esi, [edi + 0x70]
mov byte [ebp - 4], 5
push 0x30
mov dword [ebp - 0x30], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0044bbbe
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 7
push eax
mov ecx, edi
call fcn.004196b0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x418b85
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418b7b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418bde
push ecx
push edx
call fcn.0044b9a2
add esp, 8
mov ecx, edi
call fcn.00418c40
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x418bbc
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418bb2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418bde
push ecx
push edx
call fcn.0044b9a2
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
call fcn.00451171
int3
Function at 0x4335c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x433620
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x433620
jne 0x433618
cmp eax, edx
jge 0x433618
mov ecx, dword [ebp + 8]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x433648
inc eax
cmp eax, edx
jl 0x433607
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x4335e6
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x433660
mov esi, dword [ebp + 0x18]
nop
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x433651
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x433653
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x433660
inc eax
xor bl, 1
cmp eax, edi
jb 0x433630
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4349f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x434a03
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x434a2b
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004348c0
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x434a44
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x486420
test ebx, 0x400
je 0x434a7a
push esi
call fcn.004346a0
add esp, 4
test al, al
je 0x434a6f
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x434df0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x434e15
mov eax, dword [esp + 0xc]
test eax, eax
je 0x434e12
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x486420
xor al, al
ret
push esi
push edi
cmp eax, 3
je 0x434e38
cmp eax, 0xb
je 0x434e38
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x434e2f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x434e4d
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x434e46
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x434ea1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x434ea1
cmp eax, 3
je 0x434ea1
cmp eax, 0x7b
je 0x434ea1
cmp eax, 0xf
je 0x434ea1
cmp eax, 0x15
je 0x434ea1
cmp eax, 0x57
je 0x434ea1
cmp eax, 0xa1
je 0x434ea1
cmp eax, 0x35
je 0x434ea1
call edi
test eax, eax
je 0x434ea1
push str.boost::filesystem::remove
push dword [esp + 0x18]
push esi
push eax
call fcn.004379a0
add esp, 0x10
xor al, al
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x434eba
mov dword [eax + 8], 0x486420
mov byte [eax + 4], 0
mov dword [eax], 0
pop edi
mov al, 1
pop esi
ret
Function at 0x434ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474765
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x491130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x68], esi
test esi, esi
je 0x434f0c
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0x486420
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x434f16
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
jne 0x434f35
push esi
push ebx
push edi
call fcn.004348c0
add esp, 0xc
jmp 0x435056
push eax
push ebx
call fcn.00434790
add esp, 8
mov esi, eax
test dword [ebp - 0x60], 0x400
mov dword [ebp - 0x64], esi
je 0x435030
push ebx
call fcn.004346a0
add esp, 4
test al, al
jne 0x434f69
mov dword [edi], 9
jmp 0x435053
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x434f73
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ba80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x60], esi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x434fc2
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004012b0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
cmp esi, 0xffffffff
jne 0x434fee
push dword [ebp - 0x68]
push ebx
push edi
call fcn.004348c0
add esp, 0xc
jmp 0x435056
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x43501a
push dword [ebp - 0x68]
push ebx
push edi
call fcn.004348c0
add esp, 0xc
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x435056
mov ebx, dword [ebp - 0x5c]
push esi
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x64]
jmp 0x435033
mov ebx, dword [ebp - 0x60]
and ebx, 0x10
je 0x43503d
mov ecx, dword [ebp - 0x64]
jmp 0x435042
mov ecx, esi
mov esi, dword [ebp - 0x64]
xor eax, eax
test ebx, ebx
setne al
add eax, 2
test ebx, ebx
mov dword [edi], eax
cmove esi, ecx
mov dword [edi + 4], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b98f
mov esp, ebp
pop ebp
ret
Function at 0x44cc9d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44ccdc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44ccdc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44ccdc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44ccdc
cmp dword [ecx + 0x74], 0xe
jbe 0x44ccdc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x462c69
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00462adf

Function at 0x470820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47084d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47084d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx