joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42d620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov al, byte [esp + 0x44]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0x4c]
xor ebx, ebx
mov byte [esp + 0x19], cl
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
mov byte [esp + 0x20], bl
call fcn.00410960
mov edx, dword [esp + 0x4c]
mov cl, byte [esp + 0x18]
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
mov eax, dword [edx]
mov dl, byte [esp + 0x19]
mov dword [esp + 0x28], eax
mov al, byte [esp + 0x20]
mov dword [esp + 0x44], ebx
mov byte [esp + 0x2d], dl
mov byte [esp + 0x34], al
call fcn.00410960
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x30]
call fcn.00410830
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c], 1
call fcn.0040f490
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], bl
push ecx
lea ecx, [esp + 0x30]
call fcn.0040bd90
mov edx, dword [esp + 0x30]
mov eax, dword [eax]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x38]
call fcn.0040d240
mov edx, dword [esp + 0x30]
push edx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e15c]
dec eax
mov dword [0x43e15c], eax
jne 0x40a95f
mov esi, dword [0x43e158]
mov dword [0x43e158], ebx
lea ecx, [esp + 0x4c]
call fcn.0042158c
cmp esi, ebx
je 0x40a975
push esi
call fcn.00425648
add esp, 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x48], 0xffffffff
call fcn.0040bd90
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.0040d240
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e15c]
dec eax
mov dword [0x43e15c], eax
jne 0x40a9da
mov esi, dword [0x43e158]
mov dword [0x43e158], ebx
lea ecx, [esp + 0x4c]
call fcn.0042158c
cmp esi, ebx
je 0x40aa0a
push esi
call fcn.00425648
mov edx, dword [esp + 0x14]
add esp, 4
pop esi
lea eax, [edx + 0x10]
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
pop esi
add eax, 0x10
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x41cacb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x43a188
cmp edx, dword [eax]
je 0x41caed
add eax, 8
inc ecx
cmp eax, 0x43a218
jl 0x41cade
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x43a188]
jne 0x41cc1b
mov eax, dword [0x440590]
cmp eax, 1
je 0x41cbf5
test eax, eax
jne 0x41cb1e
cmp dword [0x4398b4], 1
je 0x41cbf5
cmp edx, 0xfc
je 0x41cc1b
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41cb55
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041e120
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00419420
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41cb98
lea eax, [ebp - 0x1a4]
push eax
call fcn.00419420
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4305ac
push edi
call fcn.00420560
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041e120
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041e130
lea eax, [ebp - 0xa0]
push 0x43058c
push eax
call fcn.0041e130
push dword [esi + 0x43a18c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041e130
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004204ce
add esp, 0x2c
pop edi
jmp 0x41cc1b
lea eax, [ebp + 8]
lea esi, [esi + 0x43a18c]
push 0
push eax
push dword [esi]
call fcn.00419420
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4246b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00419620
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42477b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42477b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42472e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x424739
or bh, 8
and edi, 0x8000000
je 0x424754
mov eax, dword [0x441d5c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42477b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424b50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x424b7b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x424b9f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x424bba
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x424e18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x424e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00419c95
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x424e5b
test byte [esp + 8], 2
je 0x424e5b
call fcn.00419d08
mov dword [eax], 0xd
call fcn.00419d11
mov dword [eax], 5
jmp 0x424e34
xor eax, eax
ret
Function at 0x4286f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x428737
call fcn.0042b966
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x428737
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42872e
xor eax, eax
jmp 0x42873f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00428745
pop edi
pop esi
pop ebx
ret 4

Function at 0x42c961
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42c98f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42c9ad
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042c8c7
jmp 0x42c9ad
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42c9ad
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042c8c7
test edi, edi
mov eax, edi
jne 0x42c997
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x431283
Capabilities:
Encode data using xor

Disassembly:
salc
daa
sub al, byte [ebp - 0x6b8bd325]
imul edx, esp, 0xffffff9c
inc ecx
sal dword [ebx - 0x26ecde9d], 1
adc ebx, ecx
inc ecx
mov ebx, 0x430fa0c8
aam 0x9a
out 0x40, eax
mov ah, 0x1a
push eax
dec ebp
push esi
cmp byte [ebp + 0x4d], dh
jne 0x4312e4
fiadd dword [esi]
call 0xf925b596
test cl, 0x52
fdiv qword ss:[edi + 0x66]
inc ecx
xor bl, byte [ecx - 0x49]
pop edi
sbb eax, 0xb51dae7f
clc
jecxz 0x431295
hlt
mov byte [0xb61be331], al
or dword [ebp + 0x75], edi
loop 0x43132e
aam 0x27
push edi
nop
ret 0x1e55
and eax, 0x414dca61
mov al, byte [0x42530337]
sub esp, dword [esi + 0x74]
mov bl, 0x12
cmc
wait
jl 0x4312cf
sub eax, 0x11f34fa1
jle 0x431307
add al, 0x43
pop ss
loop 0x431323
imul ebp, dword [ebx], 0x54
push esp
popfd
add byte es:[edx], dl
fcomp qword [ebp + 0x22]
imul esi, ecx, 0x6e8d28dc
dec edx
adc byte [edx - 0xe], dl
sbb dword [ecx], ebp
clc
mov bl, 0x27
pop esp
vpmaxsw ymm2, ymm1, ymm0
sub eax, 0x7971bc6
pop es
jo 0x431327
mov bh, 0x9e
xor byte [eax], al
invalid

Function at 0x43207f
Capabilities:
Encode data using xor

Disassembly:
popal
dec esi
xlatb
lodsb al, byte [esi]
outsd dx, dword [esi]
xor al, 0xf4
add ebp, ebx
mov eax, 0xd2a29fad
mov ecx, 0xf34e46a0
mov al, 0x6c
push ebp
xor cl, byte [ebx - 0x47193cd6]
cmpsb byte [esi], byte es:[edi]
sar dword [eax + 0x7280324a], cl
shl dword [esi], cl
inc ebp
scasd eax, dword es:[edi]
rcl dword [ebx], 0x71
jno 0x4320d3
jno 0x432039
mov ebp, dword [0x6bc6c3ee]
enter 0xfffffffffffff469, 0x49
dec ebx
mov ah, 0x41
invalid
xor al, byte [ebx + 0x3524d596]
inc ebx
mov edi, dword [ebp - 0xc]
xchg esi, eax
aad 0x24
xor eax, 0xf47d8b43
mov eax, dword [0xee00360a]
rol ebp, cl
in al, dx
push eax
mov ah, 0xbe
jns 0x4320d1
mov al, 0xc6
scasd eax, dword es:[edi]
adc al, bh
cmpsd dword [esi], dword es:[edi]
cwde
movsd dword es:[edi], dword [esi]
xor bh, byte [ebx + 0x49a1db96]
cmpsd dword [esi], dword es:[edi]
jbe 0x432125
sti
fadd qword [ecx - 0x6e]
pop ebx
pop ds
sub eax, 0x244640be
int3
xchg dword [bx + si], ebp
mov edi, dword [edi*2 - 0x2c65401c]
cwde
inc esi
xor bh, byte [eax + 0x49b9db62]
cmpsd dword [esi], dword es:[edi]
xchg dword [ebx - 0x3e35db08], edi
sahf
stc
and edi, dword [ecx + 0x4c]
mov al, 0x91
les edi, [ebx + ecx*4 + 0x1927d06c]
retf

Function at 0x4948e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x600
push esi
push edi
jmp fcn.00653f0f
daa
jnp 0x49490a
add byte [eax], bl
jle 0x494883
cmp byte [eax], 0x2b
jae 0x49492a
int3
cmp al, 0x1e
Function at 0x49491f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc ch, byte [esi - 0x7f74c919]
sub byte [edx + 0x3da5e566], bl
add eax, 0x505d48b1
invalid
add cl, byte [edx + 0x79ca2b35]
invalid
mov dh, byte [0xc779ca2b]
dec ebp
fucomp st(1)
sbb eax, 0x1e3c6e2c
jns 0x49496a
loop 0x4948cd
xchg ecx, eax
mov ebx, 0x70dd2110
push 0x4e
mov dh, 7
mov byte [edi + 2], al
jp 0x4948fe
aas
pop ebx
jno 0x4948fd
fadd qword [esi + 0x2f]
mov ah, 0xe5
cmp bh, cl
mov ebp, 0xc8e3f9f0
sbb al, byte [eax - 0x43f5a3c3]
popfd
push edi
dec edx
salc
mov esp, 0x5957ec87
fsub st(3), st(0)
xchg esi, eax
sub ebx, ebp
push esi
push esp
push eax
mov eax, 0x4b99de8d
mov esp, 0x93cce087
push ds
scasd eax, dword es:[edi]
or al, 0x78
dec ebx
mov edi, 0x9b71fe54
inc edi
salc
adc dword ss:[edi + 0x76], ecx
scasd eax, dword es:[edi]
loope 0x494974
invalid
mov ebx, 0x77aa36da
out dx, al
stosb byte es:[edi], al
ja 0x49495a
leave
insb byte es:[edi], dx
sbb ecx, edi
and ebx, dword [esi - 0x154aeefb]
mov ch, 0xea
loopne 0x4949ab
jl 0x494968
xor dh, ch
jg 0x4949db
inc ebx
cmp byte [ebx - 0x70], al
xchg ebp, eax
ret 0x25e1
mov ecx, 0x5fce7053
jnp 0x494a25
or byte [edi + 0x2c], 2
add ah, byte [ebp + 0x14]
sub dh, cl
mov bl, 0xaa
stc
stosd dword es:[edi], eax
invalid
in eax, dx
mov ecx, ecx
mov ecx, ecx
mov ebp, ebp
mov edi, edi
mov edi, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp]
add ecx, 0xb3c
mov word [ecx], 0
inc edx
add ecx, 2
cmp edx, 0xf
jle 0x494a2e
invalid
mov edx, dword [esp]
mov ecx, dword [esp]
mov edx, dword [edx + 0x1454]
mov edx, dword [ecx + edx*4 + 0xb5c]
mov word [esi + edx*4 + 2], 0
mov ecx, dword [esp]
mov edx, dword [ecx + 0x1454]
inc edx
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], 0x23d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp]
lea ecx, [ecx + edx*4 + 0xb5c]
jge 0x494b23
mov ebx, dword [ecx]
movzx edx, word [esi + ebx*4 + 2]
movzx edx, word [esi + edx*4 + 2]
inc edx
cmp eax, edx
jge 0x494a97
mov edx, eax
inc dword [esp + 0x20]
mov word [esi + ebx*4 + 2], dx
cmp ebx, dword [esp + 4]
jg 0x494b0e
mov edi, dword [esp]
inc word [edi + edx*2 + 0xb3c]
xor edi, edi
mov dword [esp + 0x18], edi
cmp ebx, dword [esp + 0x10]
jl 0x494acb
mov edi, ebx
sub edi, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
mov edi, dword [ebp + edi*4]
mov dword [esp + 0x18], edi
mov di, word [esi + ebx*4]
mov word [esp + 0x1c], di
movzx edi, word [esp + 0x1c]
add edx, dword [esp + 0x18]
imul edi, edx
mov edx, dword [esp]
add dword [edx + 0x16a8], edi
cmp dword [esp + 8], 0
je 0x494b0e
mov edx, dword [esp + 8]
movzx edx, word [edx + ebx*4 + 2]
add edx, dword [esp + 0x18]
movzx ebx, word [esp + 0x1c]
imul edx, ebx
mov ebx, dword [esp]
add dword [ebx + 0x16ac], edx
push ss
add byte [eax], al
inc dword [esp + 0x14]
add ecx, 4
cmp dword [esp + 0x14], 0x23d
jl 0x494a80
cmp dword [esp + 0x20], 0
je fcn.00494be7
lea edx, [eax - 1]
mov ecx, dword [esp]
lea ecx, [ecx + edx*2 + 0xb3c]
Function at 0x4ac3d3
Capabilities:
Encode data using xor

Disassembly:
adc bh, byte [edx - 0x142c31e4]
inc ebx
mov eax, dword [0x2007699f]
lodsb al, byte [esi]
cmp al, 0x20
xchg dword [edi], ebx
pop ds
nop
jno 0x4ac41b
popal
and al, 0xf8
int1
std
jg 0x4ac411
mov esp, 0xe1c1f403
test dword [ebx - 0x71], esi
bound esi, qword [eax + esi]
adc byte [ebx + 0x5efdbff4], al
push esp
cwde
add bl, byte [eax - 0x4a]
xchg edx, eax
pop ds
call dword [esp + eax*8 - 0x68eb22ff]
bound ecx, qword [edi]
cmc
cdq
popfd
push ebp
loope 0x4ac3fb
cmp eax, 0x9cd9c09f
pushfd
fistp word [edi - 0x3e]
dec ebp
pop es
and byte [ebx], 0xc
mov ebx, 0x26f20356
lodsb al, byte [esi]
psllw mm2, 0xdd
and byte [eax - 0x11ce5840], bh
jo 0x4ac461
aas
lahf
mov eax, 0xd7d2107d
retf
mov al, byte [edx]
add eax, 0x90d1d18
or al, 0xcd
imul esi, dword [esi + edx - 0x7e], 0x3b4ac5c8
dec eax
mov cl, 0x6b
jnp 0x4ac48b
dec edx
cmp ecx, dword [eax - 0x4f]
imul edi, dword [ebx + 0x23], 0x18
mov cl, 0xc
cmp eax, 0x54efc64e
sbb byte [ecx - 0x39b1c2f4], dh
out dx, eax
push esp
xor byte [bx + 0x4d43], bl
xor al, 0xe5
aas
test al, 0x35
push cs
jp 0x4ac452
sub dword [ebp - 0x24ef04a4], edx
in al, 0xd7
push edi
loope 0x4ac412
and bh, dl
mov al, ah
jnp 0x4ac4e3
loopne 0x4ac508
push ebp
push edx
or ch, byte [esi - 0x57e27bac]
or dl, byte [ecx]
dec eax
cli
imul edx, ebx, 0x6b
push ds
sbb eax, 0xe0deae5d
ret 0x6043
cld
das
out 0x6c, al
stosb byte es:[edi], al
invalid
xor dword [ebp + 0x7a], edi
xchg al, dh
ljmp 0xfdd9
pop edx
dec ebx
and dl, byte [eax + 0x38]
daa
xchg dx, ax
xchg edx, eax
jnp 0x4ac569
daa
jge 0x4ac50f
xchg dword fs:[edx + 0x77], esi
mov ch, 0xd3
loop 0x4ac4d1
push ecx
mov ebx, dword [edi + 0x6e85d797]
sub eax, 0x13a33aa3
mov word [ebp + 0x66], fs
cmp ah, byte [ebx + 0x66658c13]
pop ds
or al, 0xf0
lcall 0x4df4, 0x374f42b3
and al, 0x3a
sub bl, byte [eax + 0x74]
jmp 0x53331c4b
enter 0xffffffffffffc34f, 0xffffffffffffffdf
dec edi
call 0x456c9070
inc ebp
and dh, 0x87
mov ah, 0x21
or al, 0x45
cmp esp, edx
jb 0x4ac592
push edi
into
xchg edx, eax
mov bl, 0x27
je 0x4ac536
int1
inc ecx
cwde
or byte [ebx - 0x14], bh
test dword [edx - 0x43d9013e], esi
retf 0x3a10
push ecx
movsb byte es:[edi], byte [esi]
adc bl, bl
jb 0x4ac526
or dh, byte [0xc481cc91]
jg 0x4ac560
push esp
sbb cl, byte [0xdcb4269a]
adc ecx, dword [edx]
adc esp, dword [ebp + 0x2e]
aam 0x13
dec esi
cld
test eax, 0xdd7bf03c
xchg edi, eax
jle 0x4ac58e
in al, dx
inc esi
and byte [ebx + 0x7e], ah
xchg esp, eax
pop ebp
push edx
xchg esp, eax
mov eax, ebp
test eax, 0xa2405365
jmp 0x4ac5c8
inc ebp
dec eax
out dx, al
into
add eax, 0x286d1d87
dec eax
xlatb
mov eax, 0x37b3b818
cmpsd dword [esi], dword es:[edi]
sbb dword [eax], 0x31aa827b
scasd eax, dword es:[edi]
cmc
sahf
int 0x50
iretd
Function at 0x4c6d35
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d1390
cmp edx, dword [eax]
je 0x4c6d57
add eax, 8
inc ecx
cmp eax, 0x4d1420
jl 0x4c6d48
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d1390]
jne 0x4c6e85
mov eax, dword [0x4d6dc4]
cmp eax, 1
je 0x4c6e5f
test eax, eax
jne 0x4c6d88
cmp dword [0x4d12bc], 1
je 0x4c6e5f
cmp edx, 0xfc
je 0x4c6e85
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6dbf
lea eax, [ebp - 0x1a4]
push 0x4ccd48
push eax
call fcn.004c7720
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7bb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6e02
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7bb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ccd44
push edi
call fcn.004c9a80
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4ccd28
push eax
call fcn.004c7720
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7730
lea eax, [ebp - 0xa0]
push 0x4ccd24
push eax
call fcn.004c7730
push dword [esi + 0x4d1394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7730
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cccfc
push eax
call fcn.004c99f4
add esp, 0x2c
pop edi
jmp 0x4c6e85
lea eax, [ebp + 8]
lea esi, [esi + 0x4d1394]
push 0
push eax
push dword [esi]
call fcn.004c7bb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x401036
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004c328d
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401094
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x516164
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401094
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov word [edi], cx
movzx ecx, word [eax + 0xe]
mov word [edi + 2], dx
movzx edx, word [eax + 0xc]
mov word [edi + 4], cx
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x4010a1
push esi
call fcn.004c31b0
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4010b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004cab10
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x401109
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004c31a1
add esp, 0x214
ret
push edi
push 0x516168
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.004c3833
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x14]
call fcn.00401000
add esp, 0x10
pop edi
test al, al
je 0x4010f2
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.004c31a1
add esp, 0x214
ret

Function at 0x4018b0
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi + 0x112], 0
push esi
lea esi, [edi + 4]
mov eax, esi
jne 0x4018c5
mov eax, dword [esi + 0x108]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x10e], 0
jne 0x4018e3
mov esi, dword [esi + 0x108]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401905
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
call fcn.00401660
test al, al
sete al
pop esi
ret
mov al, 1
pop esi
ret