joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9d43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004d9ce8
add esp, 0xc
cmp dword [esp + 4], 0x1770376
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
jb 0x4d9d99
jae 0x4d9d99
daa
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
clc
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
jbe 0x4d9dfe
ja 0x4d9dfe
mov ebx, 0xffa17be8
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 7], dh
call fcn.004d3f7e
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4d9e13
mov eax, 1
jmp 0x4d9e6a
cmp dword [esp + 4], 0x1770376
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004d66a8
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004d9ce8
add esp, 0xc
jns 0x4d9e40
js 0x4d9e40
call 0x13a1bc7
cmp dword [ebp - 0x14], 0
jne 0x4d9e4d
mov eax, 1
jmp 0x4d9e6a
jb 0x4d9e52
jae 0x4d9e52
call 0x5139e3e1
mov eax, dword [ebp - 0x14]
push eax
call fcn.004d0bd7
add esp, 4
jo 0x4d9e63
jno 0x4d9e63
jmp 0x4d9def
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4017e0
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffffffffff
push 0x461139
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4770d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor edi, edi
mov dword [esp + 0x20], edi
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], edi
mov dword [esp + 0x24], ebp
mov byte [ebp + 4], 0
xor esi, esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], 1
cmp dword [esp + 0x40], edi
je 0x4019c0
mov eax, dword [esp + 0x3c]
mov cl, byte [eax]
dec dword [esp + 0x40]
mov byte [esp + esi + 0x18], cl
mov bl, byte [esp + 0x19]
inc esi
inc eax
mov dword [esp + 0x3c], eax
cmp esi, 3
jne 0x4018e2
mov al, byte [esp + 0x18]
mov dl, al
shr dl, 2
and al, 3
shl al, 4
mov byte [esp + 0x14], dl
mov cl, bl
shr cl, 4
add al, cl
mov byte [esp + 0x15], al
mov al, byte [esp + 0x1a]
mov dl, bl
and dl, 0xf
add dl, dl
mov cl, al
add dl, dl
shr cl, 6
add dl, cl
and al, 0x3f
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], al
xor esi, esi
lea esp, [esp]
movzx edi, byte [esp + esi + 0x14]
cmp edi, dword [0x47604c]
jbe 0x4018b2
call fcn.00431733
cmp dword [0x476050], 0x10
mov eax, dword [0x47603c]
jae 0x4018c5
mov eax, 0x47603c
mov dl, byte [eax + edi]
mov byte [esp + 0x1c], dl
mov eax, dword [esp + 0x1c]
push eax
push 1
mov ecx, ebp
call fcn.00401510
inc esi
cmp esi, 4
jl 0x4018a0
xor esi, esi
xor edi, edi
cmp dword [esp + 0x40], edi
jne 0x40183b
cmp esi, edi
je 0x4019c0
cmp esi, 3
jge 0x401915
mov ecx, 3
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x1c]
push edi
push eax
call fcn.00431510
mov bl, byte [esp + 0x25]
add esp, 0xc
mov al, byte [esp + 0x18]
mov dl, al
mov cl, bl
and al, 3
shl al, 4
shr cl, 4
add al, cl
shr dl, 2
and bl, 0xf
mov byte [esp + 0x15], al
mov al, byte [esp + 0x1a]
add bl, bl
mov byte [esp + 0x14], dl
mov dl, al
add bl, bl
shr dl, 6
add bl, dl
mov byte [esp + 0x16], bl
and al, 0x3f
lea ebx, [esi + 1]
mov byte [esp + 0x17], al
test ebx, ebx
jle 0x4019a4
jmp 0x401960
movzx eax, byte [esp + edi + 0x14]
cmp eax, dword [0x47604c]
jbe 0x401972
call fcn.00431733
cmp dword [0x476050], 0x10
mov eax, dword [0x47603c]
jae 0x401985
mov eax, 0x47603c
movzx ecx, byte [esp + edi + 0x14]
mov al, byte [eax + ecx]
mov byte [esp + 0x1c], al
mov ecx, dword [esp + 0x1c]
push ecx
push 1
mov ecx, ebp
call fcn.00401510
inc edi
cmp edi, ebx
jl 0x401960
cmp esi, 3
jge 0x4019c0
mov edi, 3
sub edi, esi
push 0x3d
push 1
mov ecx, ebp
call fcn.00401510
sub edi, 1
jne 0x4019b0
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x408ed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4617a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4770d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x465af0
push esi
mov dword [esp + 0x18], 1
call fcn.0044d29f
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x408f21
mov eax, dword [esi + 0x1c]
push eax
call fcn.004238c9
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], 0x4658cc
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x41bf40
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462c60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4770d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
call dword [0x465550]
test eax, eax
jl 0x41c074
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.004066e0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0x20
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.SELECT__FROM_Win32_DiskDrive_WHERE_InterfaceType___USB_
mov byte [ebp - 4], 6
call fcn.00402850
lea ecx, [ebp - 0x34]
call fcn.00403dd0
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], ebx
cmp eax, ebx
jne 0x41bfda
push 0x80004003
call fcn.004237f0
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 1
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, ebx
jne 0x41c00e
cmp dword [0x478f58], ebx
jne 0x41c023
call fcn.00419230
mov dword [0x478f58], 1
jmp 0x41c023
push 0x465a1d
mov ecx, 0x478fa0
mov dword [0x478f58], ebx
call fcn.004058c0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x41c036
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x41c049
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x41c05c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x41c06e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [0x465554]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420b40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x420b4b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x420c29
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x466a48]
inc ecx
sub edx, 8
sub esi, 1
jne 0x420b65
pop edi
test edx, edx
je 0x420c4b
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x466a48]
inc ecx
sub edx, 1
jne 0x420c30
not eax
pop esi
ret

Function at 0x420c50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
movsx ecx, byte [esp + 8]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x466a48]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x466a48]
mov dword [edx + 8], ecx
ret
Function at 0x420e50
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x48
push esi
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x18]
push eax
push esi
call dword [0x465268]
test eax, eax
jne 0x420e72
mov eax, 0x200
pop esi
add esp, 0x48
ret
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x420e87
mov ebp, 1
test al, 2
je 0x420e8e
or ebp, 2
test al, 4
je 0x420e95
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x420e9f
or ebp, 0x10
test al, 0x20
je 0x420ea6
or ebp, 0x20
test ecx, ecx
je 0x420eb2
or ebp, 0x40000000
jmp 0x420eb8
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x420ec8
or ebp, 0x800000
push 0
push esi
call dword [0x46526c]
mov dword [esp + 0x14], eax
cmp eax, 0x28
jbe 0x420f76
mov edi, dword [0x465270]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x465274]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x420f76
mov eax, dword [esp + 0x1c]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x14], ecx
jbe 0x420f76
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x2c]
push eax
push esi
call ebx
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x420f70
cmp eax, 0x454e
je 0x420f70
cmp eax, 0x454c
je 0x420f70
cmp eax, 0x4550
jne 0x420f76
or ebp, 0x400000
mov eax, dword [esp + 0x60]
test eax, eax
je 0x420f80
mov dword [eax], ebp
mov eax, dword [esp + 0x64]
test eax, eax
je 0x420f8e
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov esi, dword [esp + 0x68]
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
test esi, esi
je 0x420fd7
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.00420dc0
push edi
push ebx
mov dword [esi], eax
mov dword [esi + 4], edx
call fcn.00420dc0
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x38]
push ecx
push edx
mov dword [esi + 8], eax
call fcn.00420dc0
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x6c]
test esi, esi
je 0x421004
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
call fcn.00420de0
movzx edx, word [esp + 0x20]
movzx eax, word [esp + 0x24]
shl edx, 0x10
add esp, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x48
ret
Function at 0x421470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
sub esp, 0x18
push esi
mov esi, ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x7c], eax
mov dword [esi + 0x84], edx
mov byte [esi + 0x80], al
mov dword [esi + 0x78], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x88], ecx
mov dword [esi + 0x8c], eax
cmp edx, eax
je 0x42153a
cmp ecx, eax
je 0x42153a
lea eax, [esp + 0xc]
push eax
mov dword [esi + 0x4c], 0x80000000
mov dword [esi + 0x70], ecx
mov byte [esi + 0x6c], 1
call dword [0x465250]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [0x465254]
mov edx, dword [esp + 8]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.00420de0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
call fcn.00420dc0
mov dword [esi + 0x50], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
movzx eax, word [esp + 0x38]
mov ecx, edx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x64], ecx
movzx ecx, word [esp + 0x3c]
shl eax, 0x10
or eax, ecx
add esp, 0x18
mov dword [esi + 0x68], eax
mov dword [esi + 0x54], edx
xor eax, eax
pop esi
add esp, 0x18
ret 8
mov eax, 0x10000
pop esi
add esp, 0x18
ret 8
Function at 0x422800
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
lea ebp, [ebx + 1]
cmp dword [esi + 0x6af90], ebx
je 0x422a22
cmp dword [esi + 0x6af90], 3
jb 0x422879
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x4228b9
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x4228b9
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x4228a1
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.0041fee0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x4228b9
mov edi, eax
cmp edi, 3
jb 0x42299e
mov ecx, dword [esi + 0x6af84]
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.0041f8b0
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov edx, eax
mov eax, dword [esi + 0x6af90]
cmp edi, dword [esi + 0x6af98]
ja 0x422957
cmp eax, 3
jb 0x422957
sub edi, ebp
lea esp, [esp]
add dword [esi + 0x6af84], ebp
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [esi + ecx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor eax, ebx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
sub edi, ebp
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x422900
jmp 0x4229c0
add dword [esi + 0x6af84], edi
mov eax, dword [esi + 0x6af84]
lea ecx, [eax + esi]
movzx eax, byte [ecx + 0x1af70]
mov dword [esi + 0x6af7c], eax
movzx ecx, byte [ecx + 0x1af71]
shl eax, 5
push str.Call_UPDATE_HASH___MIN_MATCH_3_more_times
xor ecx, eax
and ecx, 0x7fff
push ebp
push esi
xor edi, edi
mov dword [esi + 0x6af7c], ecx
call fcn.0041f410
add esp, 0xc
jmp 0x4229c6
mov edx, dword [esi + 0x6af84]
movzx eax, byte [edx + esi + 0x1af70]
push eax
push 0
push esi
call fcn.0041f8b0
add esp, 0xc
dec dword [esi + 0x6af90]
mov edx, eax
add dword [esi + 0x6af84], ebp
test edx, edx
je 0x422a00
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x4229dd
lea ecx, [eax + esi + 0x1af70]
jmp 0x4229df
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.00422640
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x422a15
push esi
call fcn.004200c0
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x422825
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x422a35
lea ecx, [eax + esi + 0x1af70]
jmp 0x422a37
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push ebp
sub edx, eax
push edx
push ecx
push esi
call fcn.00422640
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x44fe67
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x463869
call fcn.00435d65
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x44ff79
cmp byte [esi + 0x42], bl
je 0x44ff79
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x44fea3
xor al, al
jmp 0x44ff7b
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407010
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405a70
mov ecx, eax
call fcn.00403fd0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405a70
mov ecx, eax
call fcn.00403fd0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x44ff13
dec eax
je 0x44ff17
dec eax
dec eax
je 0x44ff75
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004011e0
mov al, bl
jmp 0x44ff7b
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405a70
mov ecx, eax
call fcn.00403fd0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x44ff57
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405a70
mov ecx, eax
call fcn.00403fd0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004333cd
add esp, 0x10
cmp edi, eax
jne 0x44ff01
cmp byte [esi + 0x42], 0
je 0x44ff75
test edi, edi
jne 0x44feb1
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00401510
jmp 0x44feb1
mov bl, 1
jmp 0x44ff03
mov al, 1
call fcn.00435de8
ret
Function at 0xac2350
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x812015
lea edi, [esi - 0x411015]
mov dword [edi + 0x6b3b10], 0x30f505b1
push edi
or ebp, 0xffffffff
jmp 0xac237a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xac2381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac2370
mov eax, 1
add ebx, ebx
jne 0xac2393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xac23a4
jne 0xac23c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac23c3
dec eax
add ebx, ebx
jne 0xac23b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xac2388
add ebx, ebx
jne 0xac23bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xac2415
xor ecx, ecx
sub eax, 3
jb 0xac23db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xac244a
sar eax, 1
mov ebp, eax
jmp 0xac23e6
add ebx, ebx
jne 0xac23e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac23b4
inc ecx
add ebx, ebx
jne 0xac23f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac23b4
add ebx, ebx
jne 0xac2401
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xac23f6
jne 0xac2412
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xac23f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xac2434
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xac2426
jmp 0xac2376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xac2434
add edi, ecx
jmp 0xac2376
pop esi
mov edi, esi
mov ecx, 0x4e6bf5
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xac246f
cmp byte [edi], 0x2c
jne 0xac2454
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xac2452
lea edi, [esi + 0x6bf000]
mov eax, dword [edi]
or eax, eax
je 0xac24b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6c3178]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6c3254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xac2475
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6c3258]
or eax, eax
je 0xac24b1
mov dword [ebx], eax
add ebx, 4
jmp 0xac2492
call dword [esi + 0x6c3268]
mov ebp, dword [esi + 0x6c325c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x6c2512]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xac2503
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x402ac0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x402b03
push edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.004038d0
add esp, 8
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x402b10
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x402b9b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402b9b
test esi, esi
je 0x402b55
cmp esi, 0xffffffff
je 0x402b55
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x402be1
mov eax, dword [esp + 0x160]
test eax, eax
je 0x402b84
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x402b9b
jmp 0x402b93
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x402b9b
mov dword [esp + 0x10], 1
test esi, esi
je 0x402be1
cmp esi, 0xffffffff
je 0x402be1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x402c18
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x402bee
call edi
test eax, eax
je 0x402be1
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x402c18
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x402bc9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x402be1
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x402c18
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x402bfb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00402240
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret