joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x66c
mov eax, dword [0x628560]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push ebp
push edi
mov edi, ecx
mov ebx, edx
jmp 0x4b8b50
mov ecx, dword [edi + 8]
mov eax, dword [esi + 0x2c]
sub ecx, 2
push 0
add eax, 0x10
neg ecx
push 0
sbb ecx, ecx
and ecx, 0xc
lea edx, [esp + 0x18]
push edx
mov edx, dword [edi + 0xc]
push ebx
add ecx, 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
push 2
lea ebp, [esi + 0x24]
push ebp
push edx
mov dword [esp + 0x38], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
jne 0x4b8c31
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x4b8c31
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0xfed8d0e6
jne 0x4b8c4f
cmp eax, 0x10
jb 0x4b8c4f
mov edx, dword [edi + 0xc]
mov eax, dword [ebx]
mov ebp, dword [ebp]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x28]
push ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x28], ecx
call fcn.004ffc50
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
push ecx
push edx
lea eax, [esp + ebp + 0x48]
push eax
call fcn.004ffc50
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 4]
push edx
lea eax, [esp + 0x34]
mov dword [esp + 0x4c], ecx
mov ecx, dword [edi]
push eax
call ecx
add esp, 0x20
jmp 0x4b8b50
pop edi
or eax, 0xffffffff
pop ebp
mov dword [esi + 0x2c], eax
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.004f2a78
add esp, 0x66c
ret
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
add eax, 0xfffffff0
mov dword [esi + 0x2c], eax
lea edi, [esi + 0x14]
mov ebx, 4
mov edx, dword [edi]
push edx
call ebp
mov dword [edi], eax
add edi, 4
sub ebx, 1
jne 0x4b8c63
test dword [esi + 0x14], 0x80000000
je 0x4b8caa
mov eax, dword [esi + 0x2c]
cdq
and edx, 3
add eax, edx
mov ebx, eax
sar ebx, 2
xor edi, edi
test ebx, ebx
jle 0x4b8caa
nop
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + edi*4]
push edx
call ebp
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov dword [edx + edi*4], eax
add edi, 1
cmp edi, ebx
jl 0x4b8c90
mov ecx, dword [esp + 0x674]
mov eax, dword [esi + 0x2c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f2a78
add esp, 0x66c
ret
Function at 0x4bb370
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmp eax, 0x20
push esi
jg 0x4bb423
mov esi, 1
mov ecx, eax
shl esi, cl
cmp edx, esi
jae 0x4bb423
mov ecx, 0x20
sub ecx, eax
xor esi, esi
shl edx, cl
mov ecx, esi
shl ecx, 0x18
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
bswap eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 4]
mov dword [edi + esi*4], ecx
add esi, 1
cmp esi, 0x100
jl 0x4bb397
mov dword [edi + 0x400], 1
xor eax, eax
pop esi
pop ecx
ret
or eax, 0xffffffff
pop esi
pop ecx
ret

Function at 0x4d6c52
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4d6c98
call fcn.004d8fd9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d6c98
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4d6cdb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4d6cc4
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4d6cc4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4d6cd8
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4e0884
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4e08bd
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041c880
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00453de0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x4e2489
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4e24cc
call fcn.004d8fd9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4e24cc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4e24e7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004e2040
test ebx, ebx
mov esi, eax
je 0x4e24e5
test edi, edi
je 0x4e24e5
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4e3497
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x4e34a0
xor eax, eax
jmp 0x4e3509
cmp dword [esp + 8], 0
jne 0x4e34ac
call fcn.004d66ad
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.004f648a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4e34e7
push dword [esi + 0x10]
call fcn.004fb0dd
test eax, eax
pop ecx
jne 0x4e34e7
mov esi, dword [esi + 0xc]
call fcn.004fa4b2
push esi
push dword [eax]
push 1
call fcn.004e32fc
push dword [esi + 0x10]
call fcn.004fb10c
test eax, eax
pop ecx
je 0x4e3506
push dword [esi + 0x10]
call fcn.004fb031
push eax
call fcn.00404000
pop ecx
pop ecx
jmp 0x4e34d5
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4e3512
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4e351c
call fcn.004d66ad
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.004f680f
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x4e3549
mov esi, dword [esi + 0xc]
call fcn.004fa4b2
push esi
push dword [eax]
push 1
call fcn.004e32fc
pop esi
ret 8

Function at 0x4e65e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e660f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e662d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e654b
jmp 0x4e662d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e662d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004e654b
test edi, edi
mov eax, edi
jne 0x4e6617
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x62e810]
test ecx, ecx
je 0x4e66f0
jmp 0x4e65e0
ret 8

Function at 0x4f2a78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x628560]
jne 0x4f2a82
repz ret
jmp fcn.004fc340
Function at 0x5093af
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004fd778
xor ebx, ebx
cmp dword [0x62f334], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x509484
push 0x5ddf84
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x5093ef
xor eax, eax
jmp 0x509548
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ddf78
push edi
call esi
cmp eax, ebx
je 0x5093e8
push eax
call fcn.004fd715
mov dword [esp], 0x5ddf68
push edi
mov dword [0x62f334], eax
call esi
push eax
call fcn.004fd715
mov dword [esp], 0x5ddf54
push edi
mov dword [0x62f338], eax
call esi
push eax
call fcn.004fd715
mov dword [0x62f33c], eax
lea eax, [ebp - 8]
push eax
call fcn.004f7a06
test eax, eax
pop ecx
pop ecx
je 0x509452
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004f434a
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x509484
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004fd715
cmp eax, ebx
pop ecx
mov dword [0x62f344], eax
je 0x509484
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004fd715
pop ecx
mov dword [0x62f340], eax
mov eax, dword [0x62f340]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x5094fd
cmp dword [0x62f344], esi
je 0x5094fd
push eax
call fcn.004fd781
pop ecx
call eax
cmp eax, ebx
je 0x5094ca
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x62f344]
call fcn.004fd781
pop ecx
call eax
test eax, eax
je 0x5094ca
test byte [ebp - 0x18], 1
jne 0x5094fd
lea eax, [ebp - 0xc]
push eax
call fcn.004f7a3d
test eax, eax
pop ecx
je 0x5094e5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004f434a
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x5094f4
or dword [ebp + 0x10], 0x200000
jmp 0x50952e
or dword [ebp + 0x10], 0x40000
jmp 0x50952e
mov eax, dword [0x62f338]
cmp eax, esi
je 0x50952e
push eax
call fcn.004fd781
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x50952e
mov eax, dword [0x62f33c]
cmp eax, esi
je 0x50952e
push dword [ebp - 4]
push eax
call fcn.004fd781
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x62f334]
call fcn.004fd781
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x568332
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x628560]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.005682c7
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004f9940
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x568381
cmp dword [ebp - 0x1c], 5
jb 0x568399
jmp 0x568395
cmp dword [ebp - 0x10], 1
jne 0x568399
cmp dword [ebp - 0x1c], 4
ja 0x568395
jne 0x568399
cmp dword [ebp - 0x18], 0
jbe 0x568399
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x5e4630
call fcn.005681b8
test eax, eax
jge 0x5683ba
mov byte [0x6311c6], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004f2a78
add ebp, 0x78
leave
ret

Function at 0x568630
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esi + 0x15c]
push edi
push 0x5e4e98
push eax
call fcn.004f621a
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 8], edi
je 0x568710
mov ecx, dword [esi + 0x18f8]
mov eax, dword [ecx + 0x18]
imul eax, dword [esi + 0xc]
imul eax, dword [esi + 0x10]
lea eax, [eax + eax*2]
cdq
sub eax, edx
sar eax, 1
cdq
push 0
push edx
push eax
push edi
call fcn.005c5439
mov edx, dword [esi + 0x18f8]
xor ecx, ecx
add esp, 0x10
cmp dword [edx + 0x2c], ecx
mov dword [esp + 4], ecx
jle 0x568707
mov eax, dword [esi + 0x10]
push ebx
push ebp
mov ebp, 0x60
xor ebx, ebx
xor edi, edi
test ecx, ecx
setne bl
mov edx, eax
mov ecx, ebx
sar edx, cl
test edx, edx
jle 0x5686e8
jmp 0x5686b0
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x18f8]
mov edx, dword [esi + 0xc]
push ecx
mov ecx, ebx
sar edx, cl
mov ecx, dword [eax + ebp - 0x30]
imul ecx, edi
add ecx, dword [eax + ebp]
push edx
push 1
push ecx
call fcn.004f680f
mov eax, dword [esi + 0x10]
mov edx, eax
mov ecx, ebx
sar edx, cl
add edi, 1
add esp, 0x10
cmp edi, edx
jl 0x5686b0
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18f8]
add ecx, 1
add ebp, 4
cmp ecx, dword [edx + 0x2c]
mov dword [esp + 0xc], ecx
jl 0x568698
mov edi, dword [esp + 0x10]
pop ebp
pop ebx
push edi
call fcn.004f6518
add esp, 4
pop edi
add esp, 8
ret
Function at 0x56ec90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0x60c908
push eax
call fcn.004f621a
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x56ecab
pop ebx
ret
push esi
push edi
push 2
push 0
push 0
push ebx
call fcn.005c5439
xor ecx, ecx
test eax, eax
setl cl
push ebx
mov esi, ecx
call fcn.005c57a6
push 0
push 0
push 0
push ebx
mov edi, eax
call fcn.005c5439
xor edx, edx
add esp, 0x24
test eax, eax
setl dl
xor eax, eax
test edi, edi
setle al
or edx, eax
or esi, edx
jne 0x56ed4c
push ebp
lea ebp, [edi + 2]
lea ecx, [ebp + 0x17]
push ecx
call fcn.004f2efe
lea esi, [eax + 0x17]
push ebx
mov edx, esi
and edx, 0xf
sub esi, edx
push edi
push 1
push esi
mov dword [esi - 4], eax
mov dword [esi - 8], ebp
call fcn.004f648a
xor ecx, ecx
add esp, 0x14
cmp eax, edi
setne cl
cmp byte [esi + edi - 1], 0xa
mov ebp, ecx
je 0x56ed2e
mov byte [esi + edi], 0xa
add edi, 1
push ebx
mov byte [esi + edi], 0
call fcn.004f6518
add esp, 4
test ebp, ebp
pop ebp
je 0x56ed52
mov edx, dword [esi - 4]
push edx
call fcn.004f2cc4
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x570940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 8]
mov dword [esi], eax
mov edx, dword [ecx]
mov dword [esi + 4], edx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x78]
mov dword [esi + 8], eax
xor ecx, ecx
mov edx, 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
mov eax, dword [edi + 0x16c]
neg eax
sbb eax, eax
and eax, 2
mov dword [esi + 0x20], eax
cmp dword [edi + 0x1bc], 2
mov eax, 0x1a
je 0x570999
mov eax, dword [edi + 0x1c0]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0x1a
mov eax, dword [edi + 0x174]
mov dword [esi + 0x2c], eax
xor eax, eax
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
cmp dword [edi + 0x168], ecx
setne al
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x84]
mov dword [esi + 0x40], eax
sub eax, ecx
je 0x570ae4
sub eax, edx
je 0x570aad
sub eax, edx
jne 0x570afb
push ebx
push ebp
lea ebp, [edi + 0x8c]
push 4
push ebp
call fcn.0056f600
lea ebx, [edi + 0x9c]
push 4
push ebx
call fcn.0056f600
lea eax, [edi + 0xac]
push 4
push eax
mov dword [esp + 0x2c], eax
call fcn.0056f600
lea eax, [edi + 0xbc]
push 4
push eax
mov dword [esp + 0x38], eax
call fcn.0056f600
lea eax, [edi + 0xcc]
push 8
push eax
mov dword [esp + 0x48], eax
call fcn.0056f600
add edi, 0x10c
push 8
push edi
call fcn.0056f600
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
add esp, 0x30
lea eax, [esi + 0x44]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax], ebp
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ecx
pop ebp
mov dword [esi + 0x50], edx
mov dword [esi + 0x58], edi
xor ecx, ecx
mov esi, eax
pop ebx
nop
xor edx, edx
xor eax, eax
cmp ecx, 4
setge dl
sub edx, 1
and edx, 0xffffffd0
add edx, 0x40
test edx, edx
jle 0x570a9f
mov edi, dword [esi]
cmp byte [eax + edi], 0
jne 0x570a98
mov edi, dword [ecx*4 + 0x5e6680]
mov dword [esi], edi
add eax, 1
cmp eax, edx
jl 0x570a87
add ecx, 1
add esi, 4
cmp ecx, 6
jl 0x570a70
pop edi
pop esi
ret
mov edx, dword [0x5e6680]
mov dword [esi + 0x44], edx
mov eax, dword [0x5e6684]
mov dword [esi + 0x48], eax
mov ecx, dword [0x5e6688]
mov dword [esi + 0x4c], ecx
mov edx, dword [0x5e668c]
mov dword [esi + 0x50], edx
mov eax, dword [0x5e6690]
mov dword [esi + 0x54], eax
mov ecx, dword [0x5e6694]
pop edi
mov dword [esi + 0x58], ecx
pop esi
ret
mov eax, 0x5e6640
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
pop edi
pop esi
ret
Function at 0x579cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [edi + 0x10]
and ecx, 0xff
cmp ecx, 1
mov dword [esp + 8], ecx
je 0x579ceb
cmp ecx, 4
je 0x579ceb
mov eax, dword [esp + 0x10]
push str.Arg_invalid_CSP_n
push 0
push eax
call fcn.0056ea40
add esp, 0xc
or eax, 0xffffffff
pop edi
add esp, 8
ret
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
mov dword [eax + 4], edx
mov edx, dword [edi + 4]
mov dword [eax + 8], edx
mov edx, dword [edi + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [eax + 0x10], edx
mov edx, dword [edi + 0xc]
push esi
mov dword [eax + 0x14], edx
xor esi, esi
add eax, 0x60
mov dword [esp + 0x10], eax
jmp 0x579d24
mov ecx, dword [esp + 0x14]
cmp ecx, 4
jne 0x579d34
test esi, esi
je 0x579d34
mov eax, esi
xor eax, 3
jmp 0x579d36
mov eax, esi
mov ecx, dword [edi + eax*4 + 0x28]
mov ebx, dword [edi + eax*4 + 0x18]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x24], ecx
xor ecx, ecx
test esi, esi
setne cl
sar edx, cl
sar eax, cl
test dword [edi + 0x10], 0x1000
je 0x579d6c
mov ebp, dword [esp + 0x1c]
lea ecx, [eax - 1]
imul ecx, ebx
add dword [esp + 0x24], ecx
neg ebx
push eax
push edx
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx - 0x30]
mov ecx, dword [ebx]
push edx
mov edx, dword [ebp + 0x4d20]
push eax
push ecx
call edx
add esi, 1
add ebx, 4
add esp, 0x18
cmp esi, 3
mov dword [esp + 0x10], ebx
jl 0x579d20
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 8
ret
Function at 0x5b6390
Capabilities:
Encode data using xor

Disassembly:
push esi
add eax, 0xffffffff
xor esi, esi
test eax, eax
jle 0x5b63cf
push ebx
push edi
add ecx, 2
mov edi, eax
movsx edx, word [ecx + 2]
movsx eax, word [ecx - 2]
sub eax, edx
cdq
mov ebx, eax
movsx eax, word [ecx]
xor ebx, edx
sub ebx, edx
movsx edx, word [ecx + 4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add eax, esi
add ecx, 4
sub edi, 1
lea esi, [eax + ebx]
jne 0x5b63a1
pop edi
pop ebx
mov eax, esi
pop esi
ret
Function at 0x5c85c2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004fd778
xor ebx, ebx
cmp dword [0x631098], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x5c8697
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
jne 0x5c8602
xor eax, eax
jmp 0x5c875b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x5c85fb
push eax
call fcn.004fd715
mov dword [esp], 0x5ddf68
push edi
mov dword [0x631098], eax
call esi
push eax
call fcn.004fd715
mov dword [esp], 0x5ddf54
push edi
mov dword [0x63109c], eax
call esi
push eax
call fcn.004fd715
mov dword [0x6310a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004f7a06
test eax, eax
pop ecx
pop ecx
je 0x5c8665
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004f434a
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x5c8697
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.004fd715
cmp eax, ebx
pop ecx
mov dword [0x6310a8], eax
je 0x5c8697
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004fd715
pop ecx
mov dword [0x6310a4], eax
mov eax, dword [0x6310a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x5c8710
cmp dword [0x6310a8], esi
je 0x5c8710
push eax
call fcn.004fd781
pop ecx
call eax
cmp eax, ebx
je 0x5c86dd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x6310a8]
call fcn.004fd781
pop ecx
call eax
test eax, eax
je 0x5c86dd
test byte [ebp - 0x18], 1
jne 0x5c8710
lea eax, [ebp - 0xc]
push eax
call fcn.004f7a3d
test eax, eax
pop ecx
je 0x5c86f8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004f434a
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x5c8707
or dword [ebp + 0x10], 0x200000
jmp 0x5c8741
or dword [ebp + 0x10], 0x40000
jmp 0x5c8741
mov eax, dword [0x63109c]
cmp eax, esi
je 0x5c8741
push eax
call fcn.004fd781
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5c8741
mov eax, dword [0x6310a0]
cmp eax, esi
je 0x5c8741
push dword [ebp - 4]
push eax
call fcn.004fd781
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x631098]
call fcn.004fd781
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a5c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004047e0
test esi, esi
jne 0x402a92
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004048d0
jmp 0x402ab0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402970
mov edi, eax
test esi, esi
je 0x402ab0
cmp dword [ebx], 0
je 0x402ab0
dec esi
jmp 0x402a99
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40382c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x48c020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4038c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4038a4
xor eax, eax
push ebp
push 0x40389d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4038e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x48c020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x48c020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4045c0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48f048], 0
je 0x404621
cmp word [0x48f21c], 0xd7b2
jne 0x4045e9
cmp dword [0x48f224], 0
jbe 0x4045e9
mov eax, 0x48f218
call dword [0x48f234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48c070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404648
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48c030], 0
jne 0x40463d
push 0
push 0x48c068
push 0x48c070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404794
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402734
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x48f049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40475c
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc