joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426270
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x4262c3
mov dword [ebp - 0x14], 0xffffffff
jmp 0x42638d
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x4262de
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x426386
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x42631c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x426386
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x426344
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x455b48
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42636b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x455b40]
shl eax, 8
add eax, 0x455c48
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x455b40]
add ecx, 1
mov dword [0x455b40], ecx
cmp dword [ebp - 0x10], 0
je 0x426381
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x4262d5
jmp 0x42638d
cmp dword [ebp - 0x10], 0
je 0x42639c
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x4263ab
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x426670
Capabilities:
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], str.Accept:___r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_n
mov dword [ebp - 0x20], str.Content_Type:_application_x_www_form_urlencoded_r_n
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x43a1dc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4266c6
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x10], 0
je 0x4266ec
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
mov eax, dword [0x43dd74]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x248
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x426734
mov dword [ebp - 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x426795
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x42676b
mov dword [ebp - 0x1c], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x426795
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x42678e
mov dword [ebp - 0x1c], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x426795
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x426850
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [0x43dd74], 0x100
push 0
push 0
push 0
push 0
push str.UserAgent_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x4268a3
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4269ea
cmp dword [ebp + 0x10], 0
je 0x4268bd
push 4
lea eax, [ebp + 0x10]
push eax
push 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x3c
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x100
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x800
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x42692d
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4269ea
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 2
jne 0x426963
mov dword [ebp - 0xc], 0xa00
push 4
lea edx, [ebp - 0xc]
push edx
push 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov edx, dword [0x43dd74]
or edx, 0x800000
mov dword [0x43dd74], edx
mov dword [0x454e94], 1
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [0x455b38], eax
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov dword [0x455b3c], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x24]
mov dword [0x44edc8], eax
push 0
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x4269e3
mov dword [ebp - 8], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [0x454e94], 0
mov dword [0x455b3c], 0
jmp 0x4269ea
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429970
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x4299ea
mov dword [ebp - 4], 0
jmp 0x429a33
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x429a33
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401af7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429d00
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x43e580], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00401b10
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00401b10
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x429e56
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x429da9
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x429e02
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x429e00
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x429e00
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x429d9a
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x429e23
xor edx, edx
mov word [0x454e98], dx
jmp 0x429e56
lea eax, [ebp - 0x218]
push eax
push 0x43a3c8
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x429e44
xor ecx, ecx
mov word [0x454e98], cx
jmp 0x429e56
lea edx, [ebp - 0x108]
push edx
push 0x454e98
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.00429a50
push 0x43a3d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x429e9f
push 0x43a3f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x429e9f
mov dword [0x43e584], 2
jmp 0x429ed9
cmp dword [ebp - 0x10c], 0
je 0x429ed2
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x43e584], eax
cmp dword [0x43e584], 0
jne 0x429ed2
mov dword [0x43e584], 3
jmp 0x429ed9
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401af7
mov esp, ebp
pop ebp
ret 4
Function at 0x42d7bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x42d7cc
pop dword [ebp - 0x20]
mov eax, 0x42d7cc
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x81b3cb2a
sub dword [ebp - 0x30], 0x336185df
mov dword [ebp - 0x2c], 0x8a049637
add dword [ebp - 0x2c], 0xa82eb60e
mov dword [ebp - 0x28], 0xface671
sub dword [ebp - 0x28], 0xc360a243
mov dword [ebp - 0x24], 0xd7f908a4
sub dword [ebp - 0x24], 0xd7f908a4
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xc329b943
sub dword [ebp - 0x30], 0x4eb74fed
mov dword [ebp - 0x2c], 0x3d0e305d
add dword [ebp - 0x2c], 0x45e3118
mov dword [ebp - 0x28], 0xd1e4c034
add dword [ebp - 0x28], 0x918aac38
mov dword [ebp - 0x24], 0x7f15387e
add dword [ebp - 0x24], 0x80eac782
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x6c118878
sub eax, 0x6bcbd7f8
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x53562
push 0
call eax
mov ecx, 0x4d1fdb4
sub ecx, 0x4d1a49a
mov esi, eax
mov edx, 0x39c0e20a
sub edx, 0x3979820a
add edx, dword [ebp - 0x20]
mov edi, 0xafc0c6ad
sub dword [ebp - 4], 0x9eff4b6c
mov ebx, dword [edx]
mov dword [ebp - 0xc], 0xd157f68a
sub ebx, edi
add dword [ebp - 0x14], 0x103d9fba
mov dword [esi], ebx
xor dword [ebp - 0x1c], 0xac8e00f2
add esi, 0x650faf68
add esi, 0x9af0509c
add edx, 0xbaf5a020
sub edx, 0xbaf5a01c
loop 0x42d8de
add eax, 0xa81e5176
sub eax, 0xa81cfa3b
mov ebx, eax
add eax, 0x64fadd40
sub eax, 0x64fadd3b
mov ecx, 0xd502dcc4
sub ecx, 0xd4c2dcc4
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x14004
call fcn.00488720
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x14000], eax
xor eax, eax
push 0x13ffe
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.00487ce0
mov eax, dword [esp + 0x14014]
lea edx, [esp + 0x14018]
push edx
push eax
push 0x13fff
lea ecx, [esp + 0x18]
push 0xa000
push ecx
call fcn.00486d08
add esp, 0x20
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
mov ecx, dword [esp + 0x14000]
xor ecx, esp
call fcn.004874cc
add esp, 0x14004
ret

Function at 0x4016f0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x401810
mov eax, str.URL:run_Protocol
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401730
mov ecx, dword [esp + 4]
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push str.URL:run_Protocol
push 1
push 0
push 0
push ecx
call edi
mov edx, dword [esp + 0xc]
push 0
push 0
push 1
push 0
push str.URL_Protocol
push edx
call edi
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.shellopencommand
push edx
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401807
push 0x800
call fcn.00441b61
push 0x800
mov esi, eax
push 0
push esi
call fcn.00487ce0
mov eax, dword [esp + 0x30]
push eax
push str.__s_____1_
push 0x400
push esi
call fcn.0048836c
mov eax, esi
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4017d5
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push 0
push edx
call edi
push esi
call fcn.00487783
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call ebx
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0xc
ret

Function at 0x4034a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4034b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x4034f4
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4034f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4034f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4034e0
cmp esi, eax
jb 0x4034fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4071d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4aad0e
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cdbb4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
mov edi, ecx
mov dword [esp + 0x14], edi
xor eax, eax
mov dword [esp + 0x38], eax
lea esi, [edi + 4]
mov dword [edi], vtable.CStatisticsManager.0
mov ecx, 7
xor edx, edx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov word [esi + 4], dx
lea ebx, [edi + 0x20]
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x14], eax
mov word [ebx + 4], ax
mov edx, dword [esp + 0x44]
push 0xa
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x48], 2
call fcn.004895bc
mov eax, ebp
add esp, 0x10
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407260
sub eax, edx
sar eax, 1
push eax
mov eax, ebp
call fcn.00401c20
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407280
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
mov esi, ebx
call fcn.00401c20
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004874cc
add esp, 0x28
ret 8
Function at 0x409420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, ecx
test ebp, ebp
je 0x4094f0
test ebx, ebx
je 0x4094f0
test edi, edi
je 0x4094f0
push esi
push 0x100
call fcn.00441b61
push ebx
mov ebx, dword [esp + 0x24]
mov esi, eax
call fcn.00409500
add esp, 8
test eax, eax
jne 0x409466
pop esi
pop edi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x18]
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x4094d9
sub ebp, edi
mov dword [esp + 0x14], edx
inc eax
and eax, 0x800000ff
jns 0x409487
dec eax
or eax, 0xffffff00
inc eax
movzx edx, byte [eax + esi]
add ecx, edx
and ecx, 0x800000ff
jns 0x40949d
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [ecx + esi]
mov dl, byte [eax + esi]
mov byte [eax + esi], bl
mov byte [ecx + esi], dl
movzx edx, byte [eax + esi]
movzx ebx, byte [ecx + esi]
add edx, ebx
and edx, 0x800000ff
jns 0x4094c3
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [edx + esi]
xor dl, byte [edi + ebp]
inc edi
sub dword [esp + 0x14], 1
mov byte [edi - 1], dl
jne 0x409478
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push esi
mov dword [eax], edx
call fcn.00487783
add esp, 4
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x409500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
je 0x409560
test esi, esi
je 0x409560
xor eax, eax
nop
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x409510
push edi
xor edi, edi
xor ecx, ecx
mov eax, ecx
cdq
idiv ebx
movzx eax, byte [edx + ebp]
movzx edx, byte [ecx + esi]
add eax, edi
add edx, eax
mov edi, edx
and edi, 0x800000ff
jns 0x409543
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ecx + esi]
mov dl, byte [edi + esi]
mov byte [ecx + esi], dl
inc ecx
cmp ecx, 0x100
mov byte [edi + esi], al
jl 0x409520
pop edi
mov eax, 0xffffffff
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40b480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x40b487
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40b564
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4bddd0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x40b4a0
pop edi
test edx, edx
je 0x40b58b
jmp 0x40b570
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4bddd0]
inc ecx
sub edx, 1
jne 0x40b570
not eax
pop esi
ret

Function at 0x40b590
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4bddd0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4bddd0]
mov dword [edx + 8], ecx
ret

Function at 0x40b5e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x4bddd0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4bddd0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x40be10
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x40be42
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40be38
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x40be55
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.00488930
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x40be70
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x40bea3
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40be9d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x40becf
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x40beb5
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.00488930
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x40bee6
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x40bee0
cmp byte [esi + 8], 0
je 0x40bee0
or eax, 0xffffffff
add esp, 8
ret