joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x1000587f
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x1000587f
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x1000579f
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x1000588e
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x100057bc
mov dl, bl
xor edi, edi
jmp 0x100057ec
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x1000578e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x10005791
mov edx, ebx
cmp ebx, 0x800
jae 0x100057d1
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x100057ec
cmp ebx, 0x10000
jae 0x100057e3
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x100057eb
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x1000587f
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x10005823
cmp edi, 3
jae 0x1000582e
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x10005831
mov eax, dword [ebp - 8]
test eax, eax
je 0x10005856
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x10005838
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x10005749
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x10005887

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000654c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x471708]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x47170c]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x471710]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x471714]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x480954], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x480954]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x480950], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x4808a8], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x48094c], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408cfd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x471030]
jne 0x408d07
repz ret
jmp fcn.0040cf92

Function at 0x40a10d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004055a8
and dword [ebp - 4], 0
cmp dword [0x475944], 0
mov ebx, eax
jne 0x40a1be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a26f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a26f
push eax
call fcn.00405536
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x475944], eax
call esi
push eax
call fcn.00405536
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x475948], eax
call esi
push eax
call fcn.00405536
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47594c], eax
call esi
push eax
call fcn.00405536
pop ecx
mov dword [0x475954], eax
test eax, eax
je 0x40a1be
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405536
pop ecx
mov dword [0x475950], eax
mov eax, dword [0x475950]
cmp eax, ebx
je 0x40a216
cmp dword [0x475954], ebx
je 0x40a216
push eax
call fcn.004055b1
push dword [0x475954]
mov esi, eax
call fcn.004055b1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a216
test edi, edi
je 0x40a216
call esi
test eax, eax
je 0x40a20d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a20d
test byte [ebp - 0xc], 1
jne 0x40a216
or dword [ebp + 0x10], 0x200000
jmp 0x40a24f
mov eax, dword [0x475948]
cmp eax, ebx
je 0x40a24f
push eax
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a24f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a24f
mov eax, dword [0x47594c]
cmp eax, ebx
je 0x40a24f
push eax
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a24f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x475944]
call fcn.004055b1
pop ecx
test eax, eax
je 0x40a26f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a271
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4010e2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c004]
jne 0x4010ec
repz ret
jmp fcn.004018b5

Function at 0x404ecb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402a67
and dword [ebp - 0x14], 0
cmp dword [0x42eca0], 0
mov dword [ebp - 0x18], eax
jne 0x404f7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405026
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405026
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42eca0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42eca4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42eca8], eax
call edi
push eax
call esi
mov dword [0x42ecb0], eax
test eax, eax
je 0x404f7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ecac], eax
mov eax, dword [0x42ecac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404fd7
cmp dword [0x42ecb0], ecx
je 0x404fd7
push eax
call esi
push dword [0x42ecb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404fd7
test ebx, ebx
je 0x404fd7
call edi
test eax, eax
je 0x404fce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404fce
test byte [ebp - 8], 1
jne 0x404fd7
or dword [ebp + 0x10], 0x200000
jmp 0x40500a
mov eax, dword [0x42eca4]
cmp eax, dword [ebp - 0x18]
je 0x40500a
push eax
call esi
test eax, eax
je 0x40500a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40500a
mov eax, dword [0x42eca8]
cmp eax, dword [ebp - 0x18]
je 0x40500a
push eax
call esi
test eax, eax
je 0x40500a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42eca0]
call esi
test eax, eax
je 0x405026
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405028
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e2
leave
ret
Function at 0x4210a0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x4210b4
call fcn.00421020
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x4210a7
pop esi
cmp ebx, 0x2d
jne 0x4210ce
mov dword [0x2bd4700], 0xa62e7790
mov dword [0x2bd4704], 0xffffffff
ret

Function at 0x4210d0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42cde0]
push ebx
mov ebx, dword [0x2bd46f4]
push edi
mov edi, dword [0x2bd2274]
call fcn.00421070
cmp dword [0x2bd46f4], 0x2f
jne 0x42113d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004210a0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e2
add esp, 0x24
ret
Function at 0x401f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401fa5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401fe6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401fe2
nop word [eax + eax]
cmp esi, edx
jae 0x401fe6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401fd0
cmp esi, edx
jb 0x401feb
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x405670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [edi]
push 1
push dword [edi + 8]
push esi
call fcn.00434876
mov ecx, dword [edi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [edi + 0x18]
mov byte [ebp - 1], bl
mov dword [edi + 0x1c], eax
test bl, bl
je 0x4057d1
add dword [edi + 0x14], ecx
mov edx, 0x18
push 0xffffffffffffffff
push eax
mov eax, dword [edi + 0x24]
push ecx
mov ecx, esp
push ecx
mov dword [ecx], eax
mov eax, esp
lea ecx, [edi + 0x20]
mov dword [eax], str.read
call fcn.004038c0
mov ecx, dword [edi + 0x1c]
add esp, 0x10
mov edx, dword [edi + 0x18]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], edx
test ecx, ecx
je 0x405776
dec ecx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp - 8], 1
jne 0x4056f7
cmp byte [esi], cl
jmp 0x4056fa
cmp word [esi], cx
sete cl
test ecx, ecx
je 0x405724
test eax, eax
je 0x40571d
cmp esi, eax
je 0x40571d
mov ecx, esi
imul edx, ebx
sub ecx, eax
push ecx
push eax
sub eax, edx
push eax
call fcn.0042d680
add esp, 0xc
mov edx, dword [edi + 0x18]
inc ebx
lea eax, [edx + esi]
mov ecx, dword [ebp - 0xc]
add esi, edx
test ecx, ecx
jne 0x4056e7
test eax, eax
je 0x40574a
cmp esi, eax
je 0x40574a
mov ecx, dword [edi + 0x18]
sub esi, eax
imul ecx, ebx
push esi
push eax
sub eax, ecx
push eax
call fcn.0042d680
add esp, 0xc
test ebx, ebx
je 0x405776
push 0xffffffffffffffff
push ebx
push ecx
mov eax, esp
mov edx, 1
push ecx
lea ecx, [edi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.nulls_removed
call fcn.004038c0
add esp, 0x10
sub dword [edi + 0x1c], ebx
cmp dword [edi + 0x18], 1
jle 0x4057c5
test byte [edi + 4], 0x80
je 0x4057c5
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x4057a2
mov edx, dword [ebp + 8]
nop dword [eax]
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x405790
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov esi, esp
xor edx, edx
push ecx
lea ecx, [edi + 0x20]
mov dword [esi], 0
mov esi, esp
mov dword [esi], str.endian_swap
call fcn.004038c0
add esp, 0x10
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call fcn.00405420
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp + 8], 0
mov esi, edx
mov eax, dword [edi + 0x18]
mov ebx, dword [edi + 0x1c]
imul eax, ebx
mov dword [edi + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
cmovne esi, eax
test byte [edi + 4], 0x80
je 0x405d85
test edx, edx
jne 0x405d43
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00413cac
mov ecx, dword [edi + 0x1c]
mov ebx, eax
add ecx, ecx
mov dword [ebp + 8], ebx
push ecx
push esi
push ebx
call fcn.0042dfd0
add esp, 0x10
mov edx, ebx
mov esi, ebx
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x405d62
nop word [eax + eax]
movzx eax, word [edx + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edx + ecx*2], ax
test ecx, ecx
jne 0x405d50
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [edi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.004038c0
add esp, 0x10
push dword [edi]
push 1
push dword [edi + 8]
push esi
call fcn.00434bdf
add esp, 0x10
cmp eax, 1
mov eax, dword [ebp + 8]
sete bl
test eax, eax
je 0x405dab
push eax
call fcn.00413ca7
add esp, 4
test bl, bl
je 0x405de4
mov eax, dword [edi + 8]
mov edx, 0x18
add dword [edi + 0x14], eax
push 0xffffffffffffffff
push dword [edi + 0x1c]
push ecx
mov ecx, dword [edi + 0x24]
mov esi, esp
push ecx
mov dword [esi], ecx
mov ecx, esp
mov dword [ecx], str.write
lea ecx, [edi + 0x20]
call fcn.004038c0
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, edi
call fcn.00405420
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x40b3b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443d66
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x45d554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 4]
call fcn.0041ec19
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi], vtable.ScriptEngineFactory.0
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.ActiveScriptSite.1.0
mov dword [esi + 4], vtable.ActiveScriptSite.0
mov dword [esi + 8], vtable.CArray_class_ExposedObject___class_ExposedObject__.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.00413ef1
mov dword [esi + 0x44], 1
mov eax, edi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4442b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x45d554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x18]
push 0
push 0
push eax
push 0x400
call edi
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.00414495
mov ecx, eax
test ecx, ecx
jne 0x40f1a1
push 0x80004005
call fcn.004026b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push dword [ebp - 0x18]
call edi
push eax
lea eax, [ebp - 0x14]
push str.error__d_n_s
push eax
call fcn.00401f70
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.00401db0
mov byte [ebp - 4], 1
cmp dword [esi + 0x224], 0
jne 0x40f1ff
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f232
mov ecx, dword [edx]
push edx
jmp 0x40f22d
call fcn.00414d79
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [eax + 0x10]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40f232
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x411960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4446e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45d554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.004025f0
mov dword [ebp - 4], 0
push dword [ebx + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call edi
or esi, 0xffffffff
cmp dword [ebx + 0x24], 0
je 0x411a84
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
test al, 1
jne 0x411a66
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push esi
push dword [ebp + 8]
push 0
push 0xfde9
call edi
mov esi, eax
push esi
call fcn.00413cac
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call fcn.0042e550
add esp, 0x10
push 0
push 0
push esi
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call edi
mov edi, dword [ebp - 0x10]
mov byte [edi + esi - 1], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfde9
mov dword [ebp - 0x10], eax
call esi
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411a30
push 0
lea eax, [ebp - 0x18]
sub ecx, edx
push eax
push ecx
push edi
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 0x10]
call esi
push edi
call fcn.00413ca7
add esp, 4
or esi, 0xffffffff
jmp 0x411ac4
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x20]
call edi
jmp 0x411ac4
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040deb0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push 0
push ecx
push dword [eax - 0xc]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x20]
call edi
mov edx, dword [ebp - 0x10]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411ac4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x411ae3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412c50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x412c60
lea edi, [ecx + 0x20]
sub esi, edx
xor ebx, ebx
mov dword [ebp - 8], edi
sub ecx, edi
mov dword [ebp - 4], ecx
xor edx, edx
lea ecx, [edi + ebx]
mov eax, ebx
mov edi, dword [ebp + 8]
div esi
mov al, byte [edx + edi]
mov edx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov byte [ecx], bl
inc ebx
mov byte [edx + ecx + 0x120], al
cmp ebx, 0xff
jle 0x412c76
xor ebx, ebx
mov edx, edi
mov esi, 0x100
nop word [eax + eax]
mov al, byte [edx + 0x100]
lea edx, [edx + 1]
mov cl, byte [edx - 1]
add al, bl
add al, cl
movzx ebx, al
movzx eax, byte [ebx + edi]
mov byte [edx - 1], al
mov byte [ebx + edi], cl
sub esi, 1
jne 0x412cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412ce0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
inc esi
mov dword [ebp - 4], ebx
push esi
call fcn.00413cac
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 8], edi
call fcn.0042e550
add esp, 0x10
mov ecx, ebx
push dword [ebp + 0x10]
call fcn.00412c50
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x412d8b
mov eax, dword [ebp - 4]
xor ebx, ebx
add eax, 0x20
xor ecx, ecx
sub dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
nop word [eax + eax]
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [eax + ebx]
add cl, dl
movzx ecx, cl
mov dword [ebp + 0x10], ecx
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + ebx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], dl
movzx ecx, byte [eax + ebx]
movzx eax, dl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp - 4]
movzx eax, byte [eax + ecx + 0x20]
mov ecx, dword [ebp + 8]
xor al, byte [ecx + edi - 1]
mov ecx, dword [ebp + 0x10]
mov byte [edi - 1], al
mov eax, dword [ebp + 0xc]
sub esi, 1
jne 0x412d30
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc