joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e8d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c723b
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
lea esi, [edi + 0x40]
xor ebx, ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], bx
mov eax, edx
mov dword [esp + 0x18], ebx
lea ebp, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x48e910
sub eax, ebp
sar eax, 1
push eax
push edx
call fcn.004028c0
mov ecx, dword [esp + 0x10]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x30], 0xc8
mov dword [edi + 8], 8
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4

Function at 0x48f6a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push ebp
mov ebp, ecx
jne 0x48f6bd
push ebx
push ebx
push ebx
push 2
call fcn.00491610
pop ebp
xor al, al
pop ebx
ret 8
push edi
call fcn.0048f4a0
push 2
or eax, 0xffffffff
push 0
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call fcn.00498188
push ebx
call fcn.00498093
push 0
push 0
push ebx
mov edi, eax
call fcn.00498188
add esp, 0x1c
test edi, edi
jg 0x48f706
push 0
push 0
push 0
push 0xc
mov ecx, ebp
call fcn.00491610
pop edi
pop ebp
xor al, al
pop ebx
ret 8
lea eax, [edi + 1]
push esi
push eax
call fcn.00493af6
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.00497ee0
add esp, 0x14
cmp eax, 1
je 0x48f748
push esi
call fcn.00493b60
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebp
call fcn.00491610
pop esi
pop edi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x48f779
mov dl, byte [eax]
cmp dl, 0xd
jne 0x48f76c
mov byte [ecx], 0xa
add eax, 1
add ecx, 1
cmp byte [eax], 0xa
jne 0x48f774
jmp 0x48f771
mov byte [ecx], dl
add ecx, 1
add eax, 1
cmp byte [eax], 0
jne 0x48f755
mov eax, dword [esp + 0x18]
push eax
mov byte [ecx], 0
mov edx, dword [ebp]
mov edx, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call edx
push esi
call fcn.00493b60
add esp, 4
pop esi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop edi
pop ebp
sete al
pop ebx
ret 8
Function at 0x48ffb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c4b53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0xc], esi
call fcn.0048fca0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x14], ebx
mov dword [ecx], 0x4fe900
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x4d426f
mov byte [esp + 0x1c], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.00490f60
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x497c44
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x497c81
cmp dword [ebp + 0x14], edi
je 0x497c81
cmp ecx, edi
jne 0x497c88
call fcn.0049b55e
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00494569
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x497c9c
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x497cbd
cmp ebx, 0xffffffff
je 0x497cac
push ebx
push edi
push ecx
call fcn.0049d900
add esp, 0xc
cmp esi, edi
je 0x497c69
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x497c69
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x497cd9
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x497ce0
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x497dd1
test word [esi + 0xc], 0x10c
je 0x497d34
mov eax, dword [esi + 4]
test eax, eax
je 0x497d34
jl 0x497e32
cmp ebx, eax
mov edi, ebx
jb 0x497d05
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x497dd9
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00493dc9
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x497dc9
cmp ebx, dword [ebp - 0xc]
jb 0x497da1
cmp dword [ebp - 0xc], 0
je 0x497d5e
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x497d53
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x497d5a
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x497d69
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x497d69
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x497e05
push eax
push dword [ebp - 8]
push esi
call fcn.004a0595
pop ecx
push eax
call fcn.004a7baf
add esp, 0xc
test eax, eax
je 0x497e44
cmp eax, 0xffffffff
je 0x497e32
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x497dc9
push esi
call fcn.004a74ce
cmp eax, 0xffffffff
pop ecx
je 0x497e36
cmp dword [ebp - 4], 0
je 0x497e05
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x497ce8
mov eax, dword [ebp + 0x14]
jmp 0x497c83
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x497df0
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0049d900
add esp, 0xc
call fcn.0049b55e
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x497c79
cmp dword [ebp + 0xc], 0xffffffff
je 0x497e1b
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0049d900
add esp, 0xc
call fcn.0049b55e
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x497c79
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x497c83
or dword [esi + 0xc], 0x10
jmp 0x497e36
Function at 0x4b4880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c5634
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x26c
push ebx
push ebp
push esi
xor al, al
xor esi, esi
push edi
mov byte [esp + 0x17], al
mov dword [esp + 0x18], esi
or ebx, 0xffffffff
mov edi, edi
test al, al
jne 0x4b4a9e
push 0x200
lea eax, [esp + 0x78]
push 0
push eax
call fcn.0049d900
push esi
push 0x4e3334
push ebx
lea ecx, [esp + 0x8c]
push 0xff
push ecx
call fcn.004945be
add esp, 0x20
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
lea edx, [esp + 0x8c]
push edx
call dword [0x4cf3a8]
mov ebp, eax
cmp ebp, ebx
je 0x4b4a8a
mov esi, dword [0x4cf104]
xor eax, eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x24]
push eax
push 0x18
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push 0x74080
push ebp
mov dword [esp + 0x40], 0
call esi
test eax, eax
je 0x4b4a7f
push 0x221
call fcn.00495125
mov edi, eax
add esp, 4
test edi, edi
je 0x4b4a7f
push 0
lea edx, [esp + 0x20]
push edx
push 0x221
push edi
push 0x21
push edi
push 0x7c088
push ebp
mov byte [edi + 0xa], 0xec
mov dword [esp + 0x3c], 0
call esi
test eax, eax
je 0x4b4a76
mov eax, dword [edi]
lea esi, [edi + 0x10]
test esi, esi
je 0x4b4a76
cmp eax, 0x2e
jbe 0x4b4a76
lea eax, [esp + 0x3c]
mov ecx, 0x13
push esi
push eax
lea edx, [ecx - 9]
call fcn.004b4510
add esp, 8
mov ecx, dword [esp + 0x28c]
push ebx
push 0
push eax
mov dword [esp + 0x290], 0
call fcn.00403bc0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x284], ebx
call fcn.004040a0
lea ecx, [esp + 0x3c]
push esi
push ecx
mov ecx, 0x2e
lea edx, [ecx - 0x13]
call fcn.004b4510
add esp, 8
mov ecx, dword [esp + 0x290]
push ebx
push 0
push eax
mov dword [esp + 0x290], 1
call fcn.00403bc0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x284], ebx
call fcn.004040a0
lea edx, [esp + 0x58]
push esi
mov ecx, 0x1a
push edx
lea edx, [ecx - 3]
call fcn.004b4510
add esp, 8
mov ecx, dword [esp + 0x294]
push ebx
push 0
push eax
mov dword [esp + 0x290], 2
call fcn.00403bc0
lea ecx, [esp + 0x58]
mov dword [esp + 0x284], ebx
call fcn.004040a0
mov byte [esp + 0x17], 1
push edi
call fcn.00495048
add esp, 4
push ebp
call dword [0x4cf2e8]
mov esi, dword [esp + 0x18]
mov al, byte [esp + 0x17]
add esi, 1
cmp esi, 0x10
mov dword [esp + 0x18], esi
jl 0x4b48b0
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x278
ret
Function at 0x4b5b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c51dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x248]
mov dword [esp + 0xc], ebx
mov esi, 7
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], ebx
mov word [edi + 4], bx
push 0x208
lea eax, [esp + 0x30]
push ebx
mov dword [esp + 0x248], ebx
push eax
mov dword [esp + 0x18], 1
call fcn.0049d900
mov cl, byte [esp + 0x258]
add esp, 0xc
neg cl
push 1
lea edx, [esp + 0x30]
sbb ecx, ecx
and ecx, 0xfffffff7
add ecx, 0x23
push ecx
push edx
push ebx
call dword [0x4cf418]
test eax, eax
je 0x4b5c92
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
lea edx, [eax + 2]
jmp 0x4b5c00
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b5c00
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
push eax
lea esi, [esp + 0x18]
call fcn.004028c0
mov ecx, esi
push ebx
push ecx
or eax, 0xffffffff
mov esi, edi
mov dword [esp + 0x248], 1
call fcn.00407e40
mov byte [esp + 0x240], bl
cmp dword [esp + 0x28], 8
jb 0x4b5c52
mov edx, dword [esp + 0x14]
push edx
call fcn.00493b60
add esp, 4
cmp byte [esp + 0x24c], bl
mov ecx, edi
je 0x4b5c66
push 0x13
push str.TencentDeskUpdate
jmp 0x4b5c6d
push 0x10
push str.TencentDesktop
call fcn.00407d70
mov ecx, edi
call fcn.004b5540
test al, al
jne 0x4b5c84
mov ecx, edi
call fcn.004b56a0
push 0xa
push str.Global.db
mov ecx, edi
call fcn.00407d70
mov ecx, dword [esp + 0x238]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x238
ret
Function at 0x4b8d80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x9c
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa8]
push 8
push eax
lea edi, [esp + 0x10]
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.004b8cc0
mov ecx, dword [esp + 0xb4]
push ecx
mov esi, edi
call fcn.004b8c10
add esp, 0xc
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x4ba130
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
jne 0x4ba1a4
cmp dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
jne 0x4ba168
lea eax, [esi + 0x14]
push eax
push edi
push esi
push 0x4ba0c0
push edi
push edi
call fcn.00499d7d
mov dword [esi + 4], eax
add esp, 0x18
xor eax, eax
cmp dword [esi + 4], edi
pop edi
setne al
ret
lea ecx, [esi + 0x14]
push ecx
push 4
push esi
push 0x4ba0c0
push edi
push edi
call fcn.00499d7d
add esp, 0x18
cmp eax, edi
mov dword [esi + 4], eax
je 0x4ba19a
mov edx, dword [esi + 0x10]
push edx
push eax
call dword [0x4cf1c0]
mov eax, dword [esi + 4]
push eax
call dword [0x4cf1b8]
xor eax, eax
cmp dword [esi + 4], edi
pop edi
setne al
ret
cmp dword [esi + 0x1c], edi
je 0x4ba1bf
mov ecx, dword [esi + 4]
push ecx
call dword [0x4cf1b8]
cmp eax, 0xffffffff
jne 0x4ba1bc
xor eax, eax
pop edi
ret
mov dword [esi + 0x1c], edi
mov eax, 1
pop edi
ret

Function at 0x4bae70
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4bae8a
push 0
push eax
call dword [0x4cf2ec]
test eax, eax
je 0x4bae8a
xor eax, eax
pop ecx
ret
lea eax, [esp]
push eax
push 0
push esi
push 0x4bae40
push 0
push 0
mov dword [esp + 0x18], 0
call fcn.00499d7d
xor ecx, ecx
add esp, 0x18
cmp eax, 0xffffffff
setne cl
mov dword [esi + 4], eax
mov eax, ecx
pop ecx
ret

Function at 0x4bbf10
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4bbf4a
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push 1
push ecx
call fcn.00494974
mov edx, dword [esi + 4]
push edx
push 2
push 1
push 0x4d96e8
call fcn.00494974
mov eax, dword [esi + 4]
push eax
call fcn.00499662
add esp, 0x24
pop esi
ret 8

Function at 0x4bbf50
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4bbf8a
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push 1
push ecx
call fcn.00494974
mov edx, dword [esi + 4]
push edx
push 2
push 1
push 0x4d96e8
call fcn.00494974
mov eax, dword [esi + 4]
push eax
call fcn.00499662
add esp, 0x24
pop esi
ret 8
Function at 0x4bc9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c54ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [edi + 0x50]
push esi
push 0x20
push eax
lea esi, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.0047be60
mov eax, esi
push 0
push eax
lea esi, [edi + 0x30]
or eax, 0xffffffff
mov dword [esp + 0x30], 0
call fcn.0041f1f0
cmp dword [esp + 0x1c], 0x10
pop esi
jb 0x4bca2a
mov ecx, dword [esp + 4]
push ecx
call fcn.00493b60
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4c0140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c55de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x14]
sub eax, 2
cmp esi, eax
mov ebx, 1
ja 0x4c019c
cmp dword [edi + 0x18], eax
je 0x4c019c
push ebx
push eax
call fcn.00403d30
test al, al
je 0x4c019c
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x4c0195
mov eax, dword [edi + 4]
jmp 0x4c0198
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
cmp esi, ecx
mov dword [esp + 0x10], ecx
je 0x4c0383
jmp 0x4c01b8
mov ecx, dword [esp + 0x10]
mov al, byte [esi]
add esi, ebx
cmp al, 0x22
mov byte [esp + 0x18], al
je 0x4c0383
cmp al, 0x5c
jne 0x4c02bb
cmp esi, ecx
je 0x4c02d6
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
cmp eax, 0x53
mov dword [esp + 0x84], esi
ja case.0x4c01f9.35
movzx eax, byte [eax + 0x4c03c4]
jmp dword [eax*4 + 0x4c039c]
push 0x22
jmp 0x4c02c0
push 0x2f
jmp 0x4c02c0
push 0x5c
jmp 0x4c02c0
push 8
jmp 0x4c02c0
push 0xc
jmp 0x4c02c0
push 0xa
jmp 0x4c02c0
push 0xd
jmp 0x4c02c0
push 9
jmp 0x4c02c0
mov eax, dword [esp + 0x80]
lea edx, [esp + 0x14]
push edx
push ecx
push eax
lea ecx, [esp + 0x90]
mov edx, ebp
call fcn.004bffd0
test al, al
je 0x4c0312
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.004bfb70
add esp, 4
push 0
push eax
or eax, 0xffffffff
mov esi, edi
mov dword [esp + 0x80], ebx
call fcn.0041f1f0
mov dword [esp + 0x78], 0xffffffff
cmp dword [esp + 0x50], 0x10
jb 0x4c029d
mov edx, dword [esp + 0x3c]
push edx
call fcn.00493b60
add esp, 4
mov esi, dword [esp + 0x84]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
jmp 0x4c02c7
mov eax, dword [esp + 0x18]
push eax
mov eax, ebx
call fcn.0041ee70
cmp esi, dword [esp + 0x10]
jne 0x4c01b4
jmp 0x4c0383
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x58]
call fcn.004040d0
mov edx, dword [esp + 0x80]
push esi
push ebp
lea ecx, [esp + 0x5c]
push ecx
push edx
mov dword [esp + 0x88], 0
call fcn.004bfdc0
cmp dword [esp + 0x6c], 0x10
mov bl, al
jb 0x4c0383
mov eax, dword [esp + 0x58]
jmp 0x4c037a
xor al, al
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 8
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00403fd0
mov edx, dword [esp + 0x80]
push esi
push ebp
lea ecx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x88], 2
call fcn.004bfdc0
cmp dword [esp + 0x34], 0x10
mov bl, al
jb 0x4c0383
mov eax, dword [esp + 0x20]
push eax
call fcn.00493b60
add esp, 4
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0x6c
ret 8
Function at 0x402b60
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0xb07064]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402ba9
push str.SetDefaultDllDirectories
push 0xac1750
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402ba9
push 0xc00
call eax
test eax, eax
jne 0x402c47
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c47
cmp eax, 0x104
ja 0x402c47
cmp word [ebp + eax*2 - 0x2d6], 0x5c
je 0x402be7
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402c46
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov al, byte [esi]
mov ecx, edi
inc esi
test al, al
je 0x402c20
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x402c10
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
cmp byte [esi], 0
jne 0x402c07
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a2a9da
mov esp, ebp
pop ebp
ret
Function at 0x407e70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.00a7dc30
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [ecx + eax]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x407f07
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0xac1780]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x407f50
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x407f34
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x407f30
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x407fa0
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x407f90
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x408f70
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x408fb9
cmp edx, 0x40
je 0x408fab
mov ecx, 0x40
lea edi, [esi + 0x40]
sub ecx, edx
add edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi]
lea edx, [esi + 0x40]
push 1
lea ecx, [esi + 0x20]
call eax
xor edx, edx
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.00a7dc30
mov ecx, dword [esi + 8]
lea edx, [esi + 0x40]
mov eax, dword [esi + 0xc]
add esp, 0xc
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
lea ecx, [esi + 0x20]
push 1
call eax
mov edi, dword [ebp + 0xc]
lea edx, [esi + 0x20]
mov ebx, 4
nop
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x409000
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409060
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [section..data]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x409810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.00a821c4
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x40983d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c320
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push 0x2002
call fcn.0040f5f0
test al, al
jne 0x40c353
lea ecx, [ebp - 4]
xor bl, bl
call fcn.0040f620
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40c3a3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00a7d6b0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x40c3a3
pop edi
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
mov bl, 1
call fcn.0040f620
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
lea ecx, [ebp - 4]
xor bl, bl
call fcn.0040f620
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc