joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f9e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor edx, edx
lea ecx, [esi + 0x19c]
mov dword [esi + 0x3bcd4], edx
mov dword [esi + 0x3bcd0], edx
push ebx
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
mov dword [ebp - 4], edx
lea eax, [ecx + 0x70]
push edi
mov edi, dword [ebp - 4]
mov dword [ebp - 8], 8
mov ebx, edi
and ebx, 1
dec ebx
not ebx
and ebx, 0xedb88320
shr edi, 1
xor edi, ebx
dec dword [ebp - 8]
jne 0x440feb
inc dword [ebp - 4]
mov dword [eax], edi
add eax, 4
cmp dword [ebp - 4], 0x100
jb 0x440fe1
mov dword [esi + 0x118], edx
lea eax, [esi + 0x148]
mov dword [eax], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], edx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], edx
lea eax, [ebp - 0x38]
mov dword [esi + 0x198], ecx
call fcn.0043f0f0
mov ebx, esi
call fcn.0043f1f3
push 2
pop edi
mov byte [esi + 0x306a0], 0
mov byte [esi + 0x306a1], 1
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
xor ebx, ebx
sar ecx, 1
dec ecx
inc ebx
shl ebx, cl
test ebx, ebx
jbe 0x4410a2
push ebx
push dword [ebp - 4]
lea eax, [edi + esi + 0x306a0]
push eax
call fcn.00497210
add esp, 0xc
add edi, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x16
jl 0x44107d
push 8
pop edi
mov edx, 0x10000
push 4
mov eax, edi
xor ecx, ecx
pop ebx
imul eax, eax
add ecx, ecx
jmp 0x4410c4
shr eax, 1
inc ecx
cmp eax, edx
jae 0x4410c1
dec ebx
jne 0x4410ba
mov eax, 0xa1
sub eax, ecx
mov ecx, edi
shr ecx, 4
add edi, 0x10
cmp edi, 0x800
mov dword [esi + ecx*4 + 0x30ea0], eax
jb 0x4410b3
and dword [esi + 0x325ac], ebx
and dword [esi + 0x3bd14], ebx
pop edi
pop ebx
leave
ret

Function at 0x441b2a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.0049bc8f
mov ecx, dword [ebp + 8]
add esp, 0x18
test eax, eax
mov dword [ecx], eax
je 0x441b53
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x441b5e
inc eax
leave
ret
Function at 0x44511c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4dd714
call fcn.004daf98
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], vtable.CObjectVector_struct_NArchive::N7z::CMethodFull_.0
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], vtable.CRecordVector_struct_NArchive::N7z::CBind_.0
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], al
lea eax, [esi + 0x30]
mov dword [esi + 0x28], 1
call fcn.00437162
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x44dd14
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4de538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x258]
push dword [esi + 8]
mov eax, dword [esi]
xor ebx, ebx
push ebx
mov ecx, esi
call dword [eax + 4]
lea eax, [esp + 0xc]
add edi, 0x1c8
push eax
call fcn.0043a04c
push 0xe
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], ebx
call fcn.0044dc90
pop ecx
push 0xf
lea ecx, [esp + 0x10]
call fcn.0044dc90
pop ecx
push 0x11
push esi
lea edi, [esp + 0x14]
call fcn.0044dc4c
push 0x10
push esi
call fcn.0044dc4c
push 9
push esi
call fcn.0044dc4c
push 6
push esi
call fcn.0044dc4c
push 0x12
push esi
call fcn.0044dc4c
push 0x14
push esi
call fcn.0044dc4c
push 0x13
push esi
call fcn.0044dc4c
push 0x15
push esi
call fcn.0044dc4c
add esp, 0x40
push 0xa
push esi
call fcn.0044dc4c
push 0x16
push esi
call fcn.0044dc4c
add esp, 0x10
mov eax, esi
call fcn.0043a2e3
push ebx
push 0x61
call fcn.0044666d
push ebx
push 0x62
call fcn.0044666d
push ebx
push 0x63
call fcn.0044666d
push 0x14
mov eax, esi
call fcn.0044dcc6
pop ecx
push 6
mov eax, esi
call fcn.0044dcc6
pop ecx
push 9
mov eax, esi
call fcn.0044dcc6
pop ecx
push 0x11
mov eax, esi
call fcn.0044dcc6
or dword [esp + 0x30], 0xffffffff
pop ecx
mov ecx, edi
call fcn.00441cfa
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451dc6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e183f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x51e6c8]
push ebx
push esi
push edi
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
and dword [esp + 0x50], 0
lea ebx, [edi + 8]
push ebx
mov dword [esp + 0x2c], ebx
call fcn.004080b5
mov esi, ebx
call fcn.00452cb2
push dword [ebx]
call fcn.00452d40
mov eax, dword [edi + 0x20]
mov eax, dword [eax]
add edi, 0x1c
pop ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
cmp dword [esp + 0x30], 0
mov esi, dword [edi + 4]
je 0x451e46
cmp dword [esp + 0x30], edi
je 0x451e4b
call fcn.004949bc
cmp dword [esp + 0x34], esi
je 0x451f42
lea esi, [esp + 0x30]
call fcn.0045339c
mov dword [esp + 0x14], eax
call fcn.0045339c
mov esi, eax
push 0x4f4a60
push dword [esp + 0x18]
add esi, 4
mov dword [esp + 0x28], esi
call fcn.00407898
test eax, eax
je 0x451ec1
push dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call fcn.00408d0a
pop ecx
pop ecx
lea edi, [esp + 0x10]
mov byte [esp + 0x4c], 1
call fcn.00407a9f
mov byte [esp + 0x4c], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.0040763c
push dword [esp + 0x10]
call fcn.00452d40
mov edi, dword [esp + 0x1c]
pop ecx
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x28], 0
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], eax
je 0x451ee2
cmp dword [esp + 0x28], esi
je 0x451ee7
call fcn.004949bc
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x2c], eax
je 0x451f34
cmp dword [esp + 0x28], 0
jne 0x451efd
call fcn.004949bc
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
cmp eax, dword [ecx + 4]
jne 0x451f0f
call fcn.004949bc
mov eax, dword [esp + 0x2c]
push dword [ebx]
mov ebx, dword [eax + 8]
call fcn.0045277f
lea esi, [esp + 0x28]
call fcn.00453ddc
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
jmp 0x451ece
lea esi, [esp + 0x30]
call fcn.0040a27c
jmp 0x451e36
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.0040763c
mov ecx, dword [esp + 0x44]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x452372
Capabilities:
Copy file

Disassembly:
mov eax, 0x4e1809
call fcn.004daf98
mov eax, dword [ebx + 0x14]
sub esp, 0x14
cmp eax, 0xffffffff
push esi
push edi
je 0x4524c8
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x18]
lea ecx, [ebx + 8]
push eax
call fcn.00408d0a
pop ecx
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00452de0
test eax, eax
je 0x4524bd
mov eax, dword [0x51e6c8]
mov esi, 0x51e6c8
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov eax, dword [0x51e6c8]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00452e84
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00407a9f
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040763c
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push eax
call fcn.00452f2e
pop ecx
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00407a9f
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040763c
mov eax, edi
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00408d0a
mov eax, dword [eax]
pop ecx
pop ecx
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov esi, eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040763c
test esi, esi
mov edi, dword [ebp - 0x10]
je 0x4524aa
push ecx
lea eax, [edi - 0x10]
mov dword [ebp - 0x20], esp
mov esi, esp
call fcn.00407666
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00408d0a
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
mov byte [ebp - 4], 7
call fcn.00452f87
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.0040763c
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040763c
lea eax, [edi - 0x10]
call fcn.0040763c
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040763c
mov ecx, dword [ebp - 0xc]
or dword [ebx + 0x14], 0xffffffff
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x4529ef
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x452a2b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x452b28
mov esi, dword [ebp + 8]
push edi
push dword [esi + 4]
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
cmp ebx, edi
mov dword [ebp - 8], eax
je 0x452a59
push dword [esi + 4]
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x452a64
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x452af4
lea ebx, [esi + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], edi
mov eax, dword [ebx + 4]
mov dword [ebp - 0x1c], eax
je 0x452a85
cmp dword [ebp - 0x18], ebx
je 0x452a8a
call fcn.004949bc
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
je 0x452ae4
lea esi, [ebp - 0x18]
call fcn.00469cac
mov esi, dword [eax]
mov ecx, dword [esi + 4]
cmp ecx, edi
jne 0x452aa7
xor eax, eax
jmp 0x452aac
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edi
call fcn.0040dadb
push eax
push dword [ebp - 4]
call fcn.00498c30
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, edi
jne 0x452aca
xor esi, esi
jmp 0x452acf
mov esi, dword [esi + 8]
sub esi, eax
add dword [ebp - 4], esi
lea edi, [ebp - 0x28]
lea esi, [ebp - 0x18]
call fcn.004533bc
mov esi, dword [ebp + 8]
xor edi, edi
jmp 0x452a75
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov dword [ebp - 4], 1
cmp dword [ebp - 8], edi
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x452b04
push dword [ebp - 8]
call ebx
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 4], edi
je 0x452b28
push dword [ebp + 0xc]
mov eax, esi
call fcn.00452b32
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x452b28
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x452b32
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x14], ebx
jne 0x452b70
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x452c56
push edi
push dword [esi + 4]
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
cmp ebx, edi
mov dword [ebp - 0xc], eax
jne 0x452b91
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x452c41
push dword [esi + 4]
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x452bb1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x452c33
lea ebx, [esi + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], edi
mov esi, dword [ebx + 4]
je 0x452bcf
cmp dword [ebp - 0x1c], ebx
je 0x452bd4
call fcn.004949bc
cmp dword [ebp - 0x18], esi
je 0x452c2c
lea esi, [ebp - 0x1c]
call fcn.00469cac
mov esi, dword [eax]
mov ecx, dword [esi + 4]
cmp ecx, edi
jne 0x452bee
xor eax, eax
jmp 0x452bf3
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edi
call fcn.0040dadb
push eax
push dword [ebp + 8]
call fcn.004952ce
add esp, 0xc
test eax, eax
jne 0x452c33
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x452c15
xor esi, esi
jmp 0x452c1a
mov esi, dword [esi + 8]
sub esi, eax
add dword [ebp + 8], esi
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x1c]
call fcn.004533bc
xor edi, edi
jmp 0x452bc2
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], edi
je 0x452c41
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
cmp dword [ebp - 0xc], edi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x452c51
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x452cef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ebx, ecx
push 0
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 8], eax
push eax
jmp 0x452d26
mov eax, dword [ebp - 4]
add ebx, eax
sub dword [ebp - 8], eax
je 0x452d32
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x452d13
jmp 0x452d39
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret
Function at 0x452d40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4e0841
call fcn.004daf98
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00407fa9
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x452d8b
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040763c
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x452d6c
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x452d6c
lea ecx, [ebp - 0x10]
call fcn.00452c60
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x452dc2
xor esi, esi
jmp 0x452d6f
push eax
call fcn.00452d40
test eax, eax
pop ecx
je 0x452dbe
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x452d6c
call edi
cmp eax, ebx
jne 0x452dbe
jmp 0x452d6c

Function at 0x452e84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and dword [ebp - 4], 0
test byte [0x520304], 1
jne 0x452ec1
mov eax, dword [0x51e6c8]
or dword [0x520304], 1
mov ecx, 0x51e6c8
call dword [eax + 0xc]
add eax, 0x10
push 0x4e403e
mov dword [0x520300], eax
call fcn.004993f9
pop ecx
mov eax, dword [0x520300]
cmp dword [eax - 0xc], 0
jne 0x452f1d
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x452f18
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0049795c
pop ecx
lea ecx, [ebp - 0x20c]
mov ebx, eax
mov esi, 0x520300
push ecx
mov eax, esi
call fcn.00407ae0
call fcn.00452cb2
push str.drivers_
push esi
call fcn.00408f40
pop esi
pop ebx
mov eax, dword [0x520300]
add eax, 0xfffffff0
call fcn.00407666
add eax, 0x10
mov dword [edi], eax
mov eax, edi
leave
ret

Function at 0x4547bf
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
jne 0x4547d2
xor al, al
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
setne al
ret
Function at 0x454b14
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x454b2d
mov eax, dword [ebp - 4]
jmp 0x454c07
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x454be2
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4f22b8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4f22b8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4f22b8]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4f22b8]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4f22b8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4f22b8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4f22b8]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4f22b8]
dec ebp
jne 0x454b4c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x454bfe
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4f22b8]
dec ecx
jne 0x454bec
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x454c79
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0xc], ebx
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00455318
push dword [ebp + 8]
mov dword [0x51fffc], eax
push 0x51ffd4
call fcn.004080b5
call fcn.00455265
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
push 0x51ffd8
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateEventW]
push ebx
push edi
push edi
lea eax, [ebp - 0xc]
push eax
call esi
push ebx
push ebx
push edi
push ebx
mov dword [0x51ffc8], eax
call esi
cmp dword [0x51ffc8], ebx
mov dword [0x51ffcc], eax
je 0x454d3b
cmp eax, ebx
je 0x454d3b
push ebx
push ebx
push 0x51ffc0
push 0x4550af
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [0x51ffd0], eax
mov eax, ecx
jmp 0x454d3d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x454d44
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x51ffd0], 0
mov dword [0x51ffc0], 1
je 0x454d8d
mov eax, dword [0x51ffcc]
test eax, eax
je 0x454d67
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push 0xea60
push dword [0x51ffd0]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x454d8d
push 0
push dword [0x51ffd0]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [0x51ffcc]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x454da7
push eax
call esi
and dword [0x51ffcc], 0
mov eax, dword [0x51ffd0]
test eax, eax
je 0x454dba
push eax
call esi
and dword [0x51ffd0], 0
pop esi
ret
Function at 0x4550bb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e0a44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov esi, ecx
call fcn.004554ac
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
push 0xffffffffffffffff
mov dword [esp + 0x50], ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, ebx
jne 0x45523e
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x38], eax
push dword [esi + 0xc]
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [esp + 0x20], ebx
je 0x455227
cmp dword [esi + 4], ebx
jne 0x455164
mov eax, dword [esi + 0x14]
push 0x4f9500
push eax
call fcn.0049487f
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 4], eax
je 0x455227
push ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
call fcn.00404c8d
mov byte [esp + 0x4c], 1
cmp dword [esp + 0x20], ebx
je 0x4551f8
mov eax, dword [esp + 0x1c]
mov edi, dword [eax]
cmp edi, eax
jne 0x455190
call fcn.004949bc
push 0xffffffffffffffff
push ebx
add edi, 8
push edi
lea ecx, [esp + 0x30]
call fcn.004047f9
mov eax, dword [esp + 0x1c]
push dword [eax]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
lea ebx, [esp + 0x24]
call fcn.00455456
cmp dword [esp + 0x3c], 0x10
mov ecx, dword [esp + 0x28]
jae 0x4551c8
lea ecx, [esp + 0x28]
mov eax, dword [esi + 4]
test eax, eax
je 0x4551f0
push eax
push dword [esp + 0x3c]
push 1
push ecx
call fcn.00499ba9
push dword [esi + 4]
push 2
push 1
push 0x4f4e80
call fcn.00499ba9
add esp, 0x20
xor ebx, ebx
cmp dword [esp + 0x20], ebx
jne 0x455181
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x455212
push eax
call fcn.0049a174
pop ecx
push dword [esi + 4]
call fcn.0049473d
pop ecx
mov dword [esi + 4], ebx
push ebx
push 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], bl
call fcn.004048fa
jmp 0x455104
cmp dword [esi], ebx
jne 0x45523e
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x455104
lea esi, [esp + 0x18]
call fcn.004554c4
push dword [esp + 0x1c]
call fcn.00494c70
pop ecx
mov ecx, dword [esp + 0x44]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret