joyce8/EMBER2024-capa huggingface dataset:
Function at 0x669dff10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x66b1a5d0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x669e0070
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.66989b80
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x669e0059
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.669b1500
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.669b1be0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.669b1be0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x669dffe0
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.669d2660
mov eax, dword [0x66b1a6c0]
test eax, eax
jne 0x669dffc7
mov eax, dword [esp + 0x20]
jmp 0x669dffd5
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.669e32a0
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x669e0017
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.669d2660
mov eax, dword [0x66b1a6c0]
test eax, eax
jne 0x669e0002
mov eax, dword [esp + 0x20]
jmp 0x669e0010
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.669e32a0
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.66989d80
mov eax, dword [esp + 0x14]
test eax, eax
je 0x669e003d
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.669b19c0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x669e0055
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.669b19c0
add esp, 0x1c
ret
lea eax, [0x66a614ff]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.669b7030
nop
call fcn.669e1e80
jmp fcn.669dff10
Function at 0x669e3130
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x66b1a7c0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x669e18db
je 0x669e192e
cmp ebx, 0x20
jbe 0x669e1934
cmp ebx, 0x40
jbe 0x669e197a
jmp 0x669e1a1b
test ebx, ebx
je 0x669e1924
add eax, 0x10
test ax, 0xff0
je 0x669e1910
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x66a7fb20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x66a7fc20]
jmp 0x669e18f8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x669e18f8
pxor xmm1, xmmword [0x66b1a7d0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x66b1a7d0]
pxor xmm2, xmmword [0x66b1a7e0]
pxor xmm3, xmmword [0x66b1a7f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x66b1a7d0]
pxor xmm2, xmmword [0x66b1a7e0]
pxor xmm3, xmmword [0x66b1a7f0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x669e1a7a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x66b1a4a5], 0
je 0x669e314a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x669e18a0
jmp fcn.66988560
Function at 0x669e3150
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x66b1a5d0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6698337c
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.66988560
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.669e1e80
jmp 0x66983340
cmp byte [0x66b1a4a5], 0
je 0x669e316b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x669e18a0
jmp 0x66983340
Function at 0x669ff140
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x66b1a5d0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x669ff1e6
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x669ff199
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x669ff1d0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.669e1e80
jmp fcn.669ff140
Function at 0x66a06fb0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x66b1a5d0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66a0719a
sub esp, 0x48
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 0xa]
mov edx, dword [0x66a35928]
movzx ebx, word [eax + 0xc]
movzx ebp, word [eax + 8]
movzx esi, word [eax + 2]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
call fcn.66a03d10
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.669e396e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.669e396e
call fcn.66a035d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call fcn.669dc530
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x66a07087
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x66a070a1
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x66a07118
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x66a070ee
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x66a070ea
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x66a070e3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x66a070f0
mov ebx, 0x1d
jmp 0x66a0710e
mov ebp, eax
jmp 0x66a070f0
mov ebp, eax
cmp ebp, 0xd
jae 0x66a0718d
lea eax, [ebp - 1]
lea edx, [0x66a2e660]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x66a07183
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x66a07118
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x66a0714a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x66a07152
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call fcn.669e3300
mov eax, ebp
mov ecx, 0xd
call fcn.669e3300
nop
call fcn.669e1e80
jmp fcn.66a06fb0
Function at 0x66a103b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x66b1a5d0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x66a104a1
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x66a103ec
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x66a10425
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.669813c0
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x66a103e1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x66a1042f
inc eax
cmp eax, 4
jge 0x66a10444
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x66a1049a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.66981410
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x66a1046b
jmp 0x66a1042e
call fcn.669e1e80
jmp fcn.66a103b0
Function at 0x66a2c260
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [0x66b201fc], eax
sub esp, 0x10
test eax, eax
je 0x66a2c2a6
mov dword [esp], 0x66b20200
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
add esp, 0x1c
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x3d
mov dword [esp + 4], 1
add eax, 0x40
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]
lea esi, [esi]

Function at 0x66a2c9d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x66b20244
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x66b2023c]
sub esp, 4
test ebx, ebx
je 0x66a2ca1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x66a2ca14
test esi, esi
je 0x66a2ca14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66a2c9f0
mov dword [esp], 0x66b20244
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x66a2cc00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x66af3a50
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x66a2cc50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x66a2cd24
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x66a2cc8e
cmp eax, 4
jne 0x66a2ccb0
test esi, esi
je 0x66a2cca2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x66a2cc94
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x66a2ccef
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x66a2cce1
cmp ecx, 0x40
je 0x66a2cca2
cmp ecx, 4
je 0x66a2cca2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.66a2cc00
lea esi, [esi]
Function at 0x40d360
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d1cb
mov eax, dword fs:[0]
push eax
sub esp, 0x51c
mov eax, dword [0x496104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x518], esi
mov dword [ebp - 0x524], edi
mov ebx, 1
mov dword [ebp - 4], ebx
push 0x13
push 0x477c5c
mov ecx, 0x497808
call fcn.00403980
mov ecx, esi
call fcn.00402f90
mov ecx, dword [ebp + 0xc]
push edi
push edi
lea eax, [ebp - 0x520]
push eax
push ecx
push edi
mov dword [ebp - 0x524], ebx
call sub.urlmon.dll_URLOpenBlockingStreamW
mov ebx, 0x500
mov eax, dword [ebp - 0x520]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [ebp - 0x528]
push ecx
push ebx
lea ecx, [ebp - 0x510]
push ecx
push eax
call edx
mov dword [ebp - 0x51c], eax
call fcn.0042b8c3
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40d523
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x514], eax
mov byte [ebp - 4], 3
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, ebx
or ecx, edx
jge 0x40d450
push ebx
lea ecx, [ebp - 0x514]
call fcn.0040add0
mov eax, dword [ebp - 0x514]
cmp dword [eax - 8], ebx
jl 0x40d52d
mov dword [eax - 0xc], ebx
mov byte [eax + 0x500], 0
mov ecx, 0x140
lea esi, [ebp - 0x510]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
cmp dword [eax - 8], ebx
jl 0x40d52d
mov dword [eax - 0xc], ebx
push 0x20
lea ecx, [ebp - 0x514]
mov byte [eax + 0x500], 0
call fcn.0040b990
push 8
lea ecx, [ebp - 0x514]
call fcn.0040b990
push 0xa
lea ecx, [ebp - 0x514]
call fcn.0040b990
mov esi, dword [ebp - 0x514]
mov eax, dword [esi - 0xc]
mov edi, dword [ebp - 0x518]
push eax
push esi
mov ecx, edi
call fcn.0040bac0
mov byte [ebp - 4], 1
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d4e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x51c]
test eax, eax
jl 0x40d4f7
cmp eax, 1
jne 0x40d3e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0040b040
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ecf7
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00401090
push 0x80070057
call fcn.00401090
int3
Function at 0x40f290
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46da96
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x496104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push 0x17
push str.openUrlOnDefaultBrowser
mov ecx, 0x497808
call fcn.00403980
mov byte [ebp - 4], 1
push 1
push esi
push esi
mov eax, dword [ebp + 8]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ecf7
mov esp, ebp
pop ebp
ret 4
Function at 0x41c650
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470389
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x496104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [eax + 0x18], 0xf
mov dword [eax + 0x14], esi
mov dword [ebp - 0x18], eax
mov byte [eax + 4], 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 1
cmp dword [ebp + 0x10], esi
je 0x41c809
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x14], cl
mov bl, byte [ebp - 0x13]
inc esi
inc eax
mov dword [ebp + 0xc], eax
cmp esi, 3
jne 0x41c738
mov al, byte [ebp - 0x14]
mov dl, al
shr dl, 2
and al, 3
shl al, 4
mov byte [ebp - 0x10], dl
mov cl, bl
shr cl, 4
add al, cl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x12]
mov dl, bl
and dl, 0xf
add dl, dl
mov cl, al
add dl, dl
shr cl, 6
add dl, cl
and al, 0x3f
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xd], al
xor esi, esi
movzx edi, byte [ebp + esi - 0x10]
cmp edi, dword [0x494860]
jbe 0x41c709
call fcn.0044efe3
cmp dword [0x494864], 0x10
mov eax, dword [0x494850]
jae 0x41c71c
mov eax, 0x494850
mov dl, byte [eax + edi]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], dl
mov eax, dword [ebp - 0x1c]
push eax
push 1
call fcn.00403d70
inc esi
cmp esi, 4
jl 0x41c6f7
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x41c6a7
test esi, esi
je 0x41c806
cmp esi, 3
jge 0x41c769
mov ecx, 3
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x14]
push 0
push eax
call fcn.0044edc0
mov bl, byte [ebp - 0x13]
add esp, 0xc
mov al, byte [ebp - 0x14]
mov dl, al
mov cl, bl
and al, 3
shl al, 4
shr cl, 4
add al, cl
shr dl, 2
and bl, 0xf
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x12]
add bl, bl
mov byte [ebp - 0x10], dl
mov dl, al
add bl, bl
shr dl, 6
add bl, dl
mov byte [ebp - 0xe], bl
and al, 0x3f
lea edi, [esi + 1]
xor ebx, ebx
mov byte [ebp - 0xd], al
test edi, edi
jle 0x41c7e9
movzx eax, byte [ebp + ebx - 0x10]
cmp eax, dword [0x494860]
jbe 0x41c7b7
call fcn.0044efe3
cmp dword [0x494864], 0x10
mov ecx, dword [0x494850]
jae 0x41c7cb
mov ecx, 0x494850
movzx eax, byte [ebp + ebx - 0x10]
mov al, byte [ecx + eax]
mov byte [ebp - 0x1c], al
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
push 1
call fcn.00403d70
inc ebx
cmp ebx, edi
jl 0x41c7a5
cmp esi, 3
jge 0x41c806
mov edi, 3
sub edi, esi
mov ecx, dword [ebp - 0x18]
push 0x3d
push 1
call fcn.00403d70
sub edi, 1
jne 0x41c7f5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fb90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470b90
mov eax, dword fs:[0]
push eax
sub esp, 0x4cc
mov eax, dword [0x496104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x42c], 0
mov edi, 1
mov dword [ebp - 4], edi
push str.getTempPath
mov ecx, 0x497808
call fcn.00404b00
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp byte [ebp + 0xc], 0
je 0x41fc1c
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, esi
call fcn.004052e0
mov dword [ebp - 0x42c], edi
jmp 0x41fd5e
lea edx, [ebp - 0x424]
push edx
push 0
push 0x476bd4
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x424]
push ecx
mov ecx, esi
call fcn.004052e0
mov dword [ebp - 0x42c], edi
jmp 0x41fd5e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ecf7
mov esp, ebp
pop ebp
ret
Function at 0x420950
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470efc
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x496104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
push 0xe
push 0x477be8
mov ecx, 0x497808
call fcn.00403980
mov byte [ebp - 4], 1
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x254]
call fcn.004081a0
mov bl, 2
mov byte [ebp - 4], bl
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x254]
call fcn.0041e320
mov esi, eax
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x254]
call fcn.0041e2e0
mov edx, dword [esi + 4]
push edx
mov ecx, dword [esi]
push ecx
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x238]
call fcn.0041f4a0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x220], 0x10
mov eax, dword [ebp - 0x234]
jae 0x420a20
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or esi, 0xffffffff
cmp eax, esi
jne 0x420a50
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x238]
call fcn.004037f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.00407880
mov dword [ebp - 4], esi
jmp 0x420aa7
test al, 0x10
je 0x420a80
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x238]
call fcn.004037f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.00407880
mov dword [ebp - 4], esi
lea ecx, [ebp + 8]
call fcn.0040b040
mov al, 1
jmp 0x420ab1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x238]
call fcn.004037f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.00407880
mov dword [ebp - 4], edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b040
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044ecf7
mov esp, ebp
pop ebp
ret