joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d43fc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x541530]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x415504
mov dword [ebx], 0x4e2280
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 4]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 8], esi
call fcn.0040330a
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004026ee
mov esi, eax
add esp, 4
test esi, esi
je 0x415561
push 1
mov byte [ebp - 4], 2
call fcn.004055e7
add esp, 4
mov dword [esi + 4], eax
jmp 0x415563
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402140
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4bc1f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x118], ecx
mov eax, dword [0x4b5420]
mov dword [ebp - 4], eax
mov byte [ebp - 0x111], 0x61
jmp 0x402179
mov cl, byte [ebp - 0x111]
add cl, 1
mov byte [ebp - 0x111], cl
movsx edx, byte [ebp - 0x111]
cmp edx, 0x7a
jg 0x402201
push 5
movzx eax, byte [ebp - 0x111]
push eax
mov ecx, dword [ebp - 0x118]
call fcn.00402220
movzx ecx, al
cmp ecx, 1
jne 0x4021fc
mov dl, byte [ebp - 0x111]
mov byte [ebp - 4], dl
push 0
push 0
push 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
lea edx, [ebp - 0x110]
push edx
mov ecx, dword [ebp - 0x118]
add ecx, 0x38
mov eax, dword [ebp - 0x118]
mov edx, dword [eax + 0x38]
mov eax, dword [edx + 0xc]
call eax
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x4021fc
mov al, byte [ebp - 0x111]
jmp 0x402203
jmp 0x40216a
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00483c0e
mov esp, ebp
pop ebp
ret

Function at 0x402220
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [0x4b5424]
mov dword [ebp - 4], eax
mov cl, byte [ebp + 8]
mov byte [ebp - 4], cl
lea edx, [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, dword [ebp + 0xc]
jne 0x40224a
mov al, 1
jmp 0x40224c
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x4032c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4bc1f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x57c], ecx
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x580], eax
mov ecx, dword [ebp - 0x42c]
cmp dword [ecx + 0x57c], 8
je 0x403315
mov edx, dword [ebp - 0x42c]
cmp dword [edx + 0x57c], 0xc
jne 0x403359
mov eax, dword [ebp - 0x42c]
mov ecx, dword [eax + 0x580]
mov dword [ebp - 0x430], ecx
cmp dword [ebp - 0x430], 8
jl 0x40333d
cmp dword [ebp - 0x430], 0xf
jle 0x40333b
jmp 0x40333d
jmp 0x403357
mov edx, dword [ebp - 0x42c]
cmp dword [edx + 0x580], 1
je 0x403357
mov ecx, dword [ebp - 0x42c]
call fcn.00402e70
jmp 0x403383
mov ecx, dword [ebp - 0x42c]
call fcn.00403290
push 0x4b551c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
movzx edx, byte [ebp + 0x10]
cmp edx, 1
jne 0x40339c
mov ecx, dword [ebp - 0x42c]
call fcn.004034c0
jmp 0x4034ad
lea ecx, [ebp - 0x310]
call fcn.00402ad0
push 0x304
push 0
lea eax, [ebp - 0x310]
push eax
call fcn.00484dc0
add esp, 0xc
mov dword [ebp - 0x310], 0x1964
fldz
fstp dword [ebp - 0x2f4]
fldz
fstp dword [ebp - 0x2f0]
fldz
fstp dword [ebp - 0x2ec]
mov dword [ebp - 0x2d4], 0x500
mov dword [ebp - 0x2d0], 0x2d0
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0x500
mov dword [ebp - 0x2c0], 0x2d0
push ecx
fldz
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
lea ecx, [ebp - 0x428]
call fcn.0040a690
mov ecx, dword [eax]
mov dword [ebp - 0x2e4], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x2e0], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2dc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x2d8], edx
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x30c], 0x6d
mov byte [ebp - 0x300], 1
lea eax, [ebp - 0x310]
push eax
mov ecx, 0x2070f48
call fcn.0040ac70
push ecx
fld dword [0x4b6088]
fstp dword [esp]
push 0xc8
mov ecx, dword [ebp - 0x310]
push ecx
mov ecx, 0x2070f48
call fcn.0040e880
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483c0e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406a10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x18
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0xc]
call eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_lstrcpyA]
push 0x4b566c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_lstrcatA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406a9c
push 0x4b5674
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
call fcn.00402140
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_lstrcatA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406a9c
xor al, al
jmp 0x406a9e
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x42a8c0
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6482
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4bc1f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4b58ac
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
call fcn.0042aa60
push 0x436860
push 0x64
push 0x18
mov ecx, dword [ebp - 0x10]
add ecx, 0x3eafd0
push ecx
call fcn.004846ee
mov byte [ebp - 4], 0xc
push fcn.00436650
push 0xa
push 0x1c
mov edx, dword [ebp - 0x10]
add edx, 0x3ead9c
push edx
call fcn.004846ee
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead80
call fcn.00436650
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead64
call fcn.00436650
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead48
call fcn.00436650
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead2c
call fcn.00436650
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x3ead10
call fcn.00436650
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x313bcc
call fcn.0047e620
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x313bb0
call fcn.00482840
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0xc7428
call fcn.00482400
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xc7404
call fcn.0047fd10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00482840
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00482670
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00482840
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0047efd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44d4a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 5], 0
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x44d56e
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x44d56c
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x44d561
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
jne 0x44d53e
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
jmp 0x44d55f
cmp dword [ebp - 0x14], 0x102
jne 0x44d554
mov byte [ebp - 5], 4
mov eax, dword [ebp - 0x18]
mov byte [eax + 8], 0
jmp 0x44d55f
mov byte [ebp - 5], 5
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 8], 0
jmp 0x44d56c
mov byte [ebp - 5], 5
mov edx, dword [ebp - 0x18]
mov byte [edx + 8], 0
jmp 0x44d572
mov byte [ebp - 5], 2
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8

Function at 0x44d580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4bc1f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0044d080
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x4b59d4
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x70], 0
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x6c], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0x3c
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x31
mov byte [ebp - 0x10], 0x35
mov byte [ebp - 0xf], 0x32
mov byte [ebp - 0xe], 0x30
mov byte [ebp - 0xd], 0x30
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x30
mov byte [ebp - 9], 1
mov byte [ebp - 8], 2
mov byte [ebp - 7], 3
mov byte [ebp - 6], 0x68
mov byte [ebp - 5], 0x3e
mov ecx, dword [ebp - 0x18]
add ecx, 0x48
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483c0e
mov esp, ebp
pop ebp
ret
Function at 0x45ab40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x4bc1f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1b0], ecx
push 0x64
lea eax, [ebp - 0x1a8]
push eax
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ecx + 0x234]
push edx
call dword [sym.imp.user32.dll_GetWindowTextA]
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0xd8], 0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xe0]
jge 0x45ac4e
mov edx, dword [ebp - 8]
movsx eax, byte [ebp + edx - 0x1a8]
and eax, 0xff
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x81
jl 0x45abda
cmp dword [ebp - 0x1ac], 0xfe
jle 0x45abf2
cmp dword [ebp - 0x1ac], 0xe0
jl 0x45ac40
cmp dword [ebp - 0x1ac], 0xfc
jg 0x45ac40
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov al, byte [ebp + edx - 0x1a8]
mov byte [ebp + ecx - 0xd8], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ebp + ecx - 0x1a8]
mov byte [ebp + eax - 0xd8], dl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0xd8], 0
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x45ab9d
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jg 0x45ac61
jmp 0x45ac77
lea ecx, [ebp - 0xd8]
push ecx
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 0x64
jle 0x45ac77
mov byte [ebp - 0x74], 0
mov ecx, 0x27d77d8
call fcn.00454db0
mov dword [ebp - 0xdc], eax
lea edx, [ebp - 0xd8]
push edx
mov eax, dword [ebp + 8]
imul eax, eax, 0x399e0
mov ecx, dword [ebp - 0xdc]
lea edx, [ecx + eax + 9]
push edx
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x45acae
jmp 0x45acd9
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x399e0
mov edx, dword [ebp - 0xdc]
lea eax, [edx + ecx + 9]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
mov ecx, 0x27d77d8
call fcn.00429aa0
mov ecx, dword [ebp - 0x1b0]
call fcn.004589f0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00483c0e
mov esp, ebp
pop ebp
ret 4
Function at 0x482170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x482189
mov eax, 0xc
jmp 0x4821f1
cmp dword [ebp + 8], 0
jne 0x482196
mov eax, 3
jmp 0x4821f1
cmp dword [ebp + 0xc], 0
jne 0x4821a3
mov eax, 2
jmp 0x4821f1
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x4821ec
cmp dword [ebp - 8], 0
jne 0x4821d9
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 1
jmp 0x4821e8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
xor eax, eax
jmp 0x4821f1
mov eax, 0xe
mov esp, ebp
pop ebp
ret 8

Function at 0x483c0e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bc1f0]
jne 0x483c18
repz ret
jmp fcn.00485a00

Function at 0x48daf3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00486af1
and dword [ebp - 4], 0
cmp dword [0x4c1458], 0
mov ebx, eax
jne 0x48dba4
push 0x4aa924
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x48dc55
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x4aa918
push edi
call esi
test eax, eax
je 0x48dc55
push eax
call fcn.00486a7f
mov dword [esp], 0x4aa908
push edi
mov dword [0x4c1458], eax
call esi
push eax
call fcn.00486a7f
mov dword [esp], 0x4aa8f4
push edi
mov dword [0x4c145c], eax
call esi
push eax
call fcn.00486a7f
mov dword [esp], 0x4aa8d8
push edi
mov dword [0x4c1460], eax
call esi
push eax
call fcn.00486a7f
pop ecx
mov dword [0x4c1468], eax
test eax, eax
je 0x48dba4
push 0x4aa8c0
push edi
call esi
push eax
call fcn.00486a7f
pop ecx
mov dword [0x4c1464], eax
mov eax, dword [0x4c1464]
cmp eax, ebx
je 0x48dbfc
cmp dword [0x4c1468], ebx
je 0x48dbfc
push eax
call fcn.00486afa
push dword [0x4c1468]
mov esi, eax
call fcn.00486afa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x48dbfc
test edi, edi
je 0x48dbfc
call esi
test eax, eax
je 0x48dbf3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x48dbf3
test byte [ebp - 0xc], 1
jne 0x48dbfc
or dword [ebp + 0x10], 0x200000
jmp 0x48dc35
mov eax, dword [0x4c145c]
cmp eax, ebx
je 0x48dc35
push eax
call fcn.00486afa
pop ecx
test eax, eax
je 0x48dc35
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x48dc35
mov eax, dword [0x4c1460]
cmp eax, ebx
je 0x48dc35
push eax
call fcn.00486afa
pop ecx
test eax, eax
je 0x48dc35
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c1458]
call fcn.00486afa
pop ecx
test eax, eax
je 0x48dc55
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x48dc57
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a1910
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4a19b0
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x4a1962
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4bfc64]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4a1943
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x4a198b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4bfc64]
xor eax, edx
inc esi
cmp esi, edi
jl 0x4a196e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x9d6494
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9d649a
pop ebp
sub ebp, 6
sub ebp, 0x5d6494
jmp 0x9d64f8
jmp 0x9d6501
mov eax, 0x5d6494
add eax, ebp
add eax, 0x93
mov ecx, 0x620
mov edx, 0xdc499fc6
xor byte [eax], dl
inc eax
dec ecx
jne 0x9d6518
jmp 0x9d652b
lodsb al, byte [esi]
xchg byte [esi - 0x3939293a], ch
scasb al, byte es:[edi]
invalid
Function at 0x403a7d
Capabilities:
Allocate or change rwx memory
Read .ini file

Disassembly:
mov eax, 0x4adbab
call fcn.004adab8
sub esp, 0x178
push ebx
push esi
mov eax, 0xb2d3b
add dword [0x4ed314], eax
xor ebx, ebx
cmp dword [0x4ed314], 0x20a
jne 0x403b10
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x402c08
push ebx
push 0x402c2c
push 0x402c54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call fcn.00403030
lea eax, [ebp - 0x3c]
call fcn.00403d3a
push ebx
mov dword [ebp - 4], ebx
call fcn.00404bcf
push ebx
push ebx
push ebx
call fcn.004051cd
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea edi, [ebp - 0x3c]
call fcn.00403d5f
pop edi
xor eax, eax
cmp eax, 0xf027935
jg 0x403b21
inc eax
cmp eax, 0x736251e2
jl 0x403b12
push 0x4c0b08
mov byte [0x4c0b0d], 0x6c
mov byte [0x4c0b0f], 0x32
mov byte [0x4c0b10], 0x2e
mov byte [0x4c0b0b], 0x6e
mov byte [0x4c0b0c], 0x65
mov byte [0x4c0b11], 0x64
mov byte [0x4c0b0e], 0x33
mov byte [0x4c0b12], 0x6c
mov byte [0x4c0b13], 0x6c
mov byte [0x4c0b14], bl
mov byte [0x4c0b08], 0x6b
mov byte [0x4c0b09], 0x65
mov byte [0x4c0b0a], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x4ed314]
mov dword [0x4ed284], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push dword [0x4ed314]
mov dword [0x4ed280], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x4bb03c]
xor esi, esi
mov dword [0x4ed3ec], eax
cmp dword [0x4ed314], ebx
jbe 0x403c13
mov eax, dword [0x4ed3ec]
mov dword [ebp - 0x14], eax
mov eax, 0xb2d3b
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + esi]
mov ecx, dword [0x4ed280]
mov byte [ecx + esi], al
cmp dword [0x4ed314], 0x44
jne 0x403c0a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalShrink]
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
inc esi
cmp esi, dword [0x4ed314]
jb 0x403bc4
call fcn.004039c0
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
cmp esi, 0x770e
jne 0x403c37
call fcn.00403a57
inc esi
cmp esi, 0x286c535
jl 0x403c1a
push 0x7b
pop esi
cmp dword [0x4ed314], 0xd
jne 0x403c78
push 0x30
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call fcn.00405d70
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
push 0x402c98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec esi
jne 0x403c43
call fcn.00403a71
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4059ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ba168]
jne 0x4059b5
repz ret
jmp fcn.0040c75c
Function at 0x40ccee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408f0d
and dword [ebp - 4], 0
cmp dword [0x4c09f4], 0
mov ebx, eax
jne 0x40cd9f
push 0x401ae4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ce50
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ad8
push edi
call esi
test eax, eax
je 0x40ce50
push eax
call fcn.00408e9b
mov dword [esp], 0x401ac8
push edi
mov dword [0x4c09f4], eax
call esi
push eax
call fcn.00408e9b
mov dword [esp], 0x401ab4
push edi
mov dword [0x4c09f8], eax
call esi
push eax
call fcn.00408e9b
mov dword [esp], 0x401a98
push edi
mov dword [0x4c09fc], eax
call esi
push eax
call fcn.00408e9b
pop ecx
mov dword [0x4c0a04], eax
test eax, eax
je 0x40cd9f
push 0x401a80
push edi
call esi
push eax
call fcn.00408e9b
pop ecx
mov dword [0x4c0a00], eax
mov eax, dword [0x4c0a00]
cmp eax, ebx
je 0x40cdf7
cmp dword [0x4c0a04], ebx
je 0x40cdf7
push eax
call fcn.00408f16
push dword [0x4c0a04]
mov esi, eax
call fcn.00408f16
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cdf7
test edi, edi
je 0x40cdf7
call esi
test eax, eax
je 0x40cdee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40cdee
test byte [ebp - 0xc], 1
jne 0x40cdf7
or dword [ebp + 0x10], 0x200000
jmp 0x40ce30
mov eax, dword [0x4c09f8]
cmp eax, ebx
je 0x40ce30
push eax
call fcn.00408f16
pop ecx
test eax, eax
je 0x40ce30
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ce30
mov eax, dword [0x4c09fc]
cmp eax, ebx
je 0x40ce30
push eax
call fcn.00408f16
pop ecx
test eax, eax
je 0x40ce30
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c09f4]
call fcn.00408f16
pop ecx
test eax, eax
je 0x40ce50
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ce52
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret