joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x771958
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
push edi
push edi
lea ecx, [esi + 0x20]
mov dword [esp + 0x20], edi
call fcn.00737f30
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0x30
mov dword [esi + 0x28], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x41d2b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x771a1c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.EvtContext.0
call fcn.00737900
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], vtable.TSTimerPriority_unsigned_long_int_.0
mov dword [esi + 0x3c], edi
push 0x41cfa0
push 0x41d0c0
push 0x1d
push 0xc
lea eax, [esi + 0x5c]
push eax
mov byte [esp + 0x2c], 2
call fcn.00736657
lea eax, [esi + 0x1bc]
mov dword [eax + 4], edi
mov dword [eax], eax
mov ecx, 4
not eax
mov dword [esi + 0x1b8], ecx
mov dword [esi + 0x1c0], eax
lea eax, [esi + 0x1cc]
mov dword [eax + 4], edi
mov dword [eax], eax
not eax
mov dword [esi + 0x1c8], edi
mov dword [esi + 0x1d0], eax
mov dword [esi + 0x1d4], edi
mov dword [esi + 0x1d8], edi
mov dword [esi + 0x1dc], edi
mov dword [esi + 0x1e0], edi
mov dword [esi + 0x1e4], edi
mov dword [esi + 0x1e8], edi
mov dword [esi + 0x1ec], edi
mov dword [esi + 0x1f0], edi
mov dword [esi + 0x1f4], edi
mov dword [esi + 0x1fc], edi
mov dword [esi + 0x200], edi
mov dword [esi + 0x204], ecx
mov dword [esi + 0x1f8], edi
mov byte [esp + 0x18], 7
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x44], ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x1c4], edi
call fcn.0042a000
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x208], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x210], eax
mov dword [esi + 0x20c], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14
Function at 0x41dea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x4c
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x48], eax
xor ecx, ecx
call fcn.00429fa0
cmp dword [esp + 0x50], 0
je 0x41dec3
mov eax, dword [0x853650]
jmp 0x41dec8
call fcn.0041d780
push 0xffffffffffffffff
mov ecx, 0x853694
mov dword [esp + 4], eax
call fcn.007379f0
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push str.Engine__x
lea ecx, [esp + 0x10]
push 0x40
push ecx
call sub.Storm.dll_Ordinal_578
add esp, 0x10
lea ecx, [esp + 8]
call fcn.00747630
push ebx
push ebp
push esi
push edi
nop
call fcn.00417350
mov ecx, dword [0x853654]
cmp eax, ecx
je 0x41df14
call fcn.00417360
push 0
mov ecx, 0x853698
call fcn.007379f0
test eax, eax
je 0x41e0b8
mov ebx, dword [esp + 0x10]
mov eax, ebx
call fcn.0041d180
mov esi, eax
or edx, 0xffffffff
test esi, esi
je 0x41df4c
mov edi, dword [esi + 0x3c]
call sub.KERNEL32.dll_GetTickCount
sub edi, eax
mov edx, edi
jns 0x41df4c
xor edx, edx
cmp dword [0x853668], 0
je 0x41df6d
cmp edx, 0xffffffff
jne 0x41df5f
mov edx, 0x64
mov ecx, edx
call fcn.00743f60
mov edi, 0x102
jmp 0x41df7e
mov ecx, ebx
call fcn.0041ab10
push edx
mov ecx, eax
call fcn.007379f0
mov edi, eax
test esi, esi
je 0x41df00
mov ecx, dword [esi + 0x208]
call fcn.00429fa0
mov edx, dword [esi + 0xc]
xor ecx, ecx
call fcn.00429fe0
mov ecx, dword [esi + 0x20c]
call fcn.00746cb0
call sub.KERNEL32.dll_GetTickCount
cmp edi, 0x102
mov ebx, eax
mov dword [esi + 0x28], ebx
jne 0x41e021
mov ecx, esi
call fcn.0041b320
mov ecx, esi
call fcn.00423750
test byte [esi + 0x44], 2
mov dword [esp + 0x14], 0
je 0x41e009
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.0041f330
cmp dword [esp + 0x14], 0
je 0x41e009
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00737920
cmp dword [esi + 0x2c], 0
jne 0x41dffd
mov dword [esi + 0x2c], 1
mov ecx, edi
call fcn.00737930
call fcn.0041ab50
mov edi, esi
call fcn.0041b3d0
mov ecx, esi
call fcn.00420390
call fcn.0041b350
call fcn.0041b410
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00737920
xor edx, edx
cmp dword [esi + 0x2c], 1
mov ecx, edi
sete dl
mov ebp, edx
call fcn.00737930
test ebp, ebp
je 0x41e056
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.0041dbe0
call fcn.0041ca40
jmp 0x41df00
test byte [esi + 0x44], 4
je 0x41e060
xor edi, edi
jmp 0x41e08f
mov edx, ebx
mov ecx, esi
call fcn.00423400
mov ecx, dword [esi + 0x48]
cmp ecx, dword [esi + 0x4c]
mov edi, eax
je 0x41e075
mov edi, ecx
mov eax, dword [esi + 0x40]
sub eax, ebx
add eax, ecx
mov ecx, 0
sets cl
sub ecx, 1
and eax, ecx
cmp edi, eax
jb 0x41e08f
mov edi, eax
mov ecx, dword [esi + 0x20c]
call fcn.00746d00
xor ecx, ecx
call fcn.00429fa0
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x54]
lea eax, [edi + ebx]
push edx
mov edi, esi
call fcn.0041dca0
jmp 0x41df00
mov ecx, dword [esp + 0x10]
call fcn.0041d8f0
call fcn.007474a0
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00735f58
add esp, 0x4c
ret 4
Function at 0x41f150
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x8536a8]
test eax, eax
push ebp
mov ebp, dword [esp + 8]
je 0x41f183
push esi
nop
lea esi, [eax - 1]
xor esi, eax
and esi, eax
call sub.KERNEL32.dll_GetTickCount
push eax
push 1
push edi
push ebx
push ebp
mov eax, esi
call fcn.0041edd0
mov eax, dword [0x8536a8]
test eax, eax
jne 0x41f160
pop esi
pop ebp
ret 4

Function at 0x422cd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x771fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
xor edx, edx
mov dword [esp + 0x14], edx
call fcn.00421da0
movzx eax, word [ebx + 2]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 1]
sub eax, 1
and eax, dword [esp + 0x48]
mov dword [esp + 0x28], edx
lea edi, [ecx + eax*4]
mov dword [esp + 0x30], edx
mov eax, dword [edi]
cmp eax, edx
mov dword [esp + 0x40], edx
je 0x422d3f
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov ecx, dword [edi]
lea eax, [esp + 0x28]
mov dword [ecx], eax
jmp 0x422d47
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x28]
mov dword [edi], eax
mov esi, dword [esp + 0x28]
cmp esi, eax
mov ecx, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov ebp, esi
je 0x422e2d
jmp 0x422d72
xor edx, edx
mov ecx, dword [ebp + 8]
cmp ecx, edx
jne 0x422de2
cmp byte [ebx], 1
jne 0x422e09
test esi, esi
mov edx, esi
je 0x422dbe
mov ecx, dword [esp + 0x20]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [edi]
cmp esi, ecx
jne 0x422db6
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x422db0
mov dword [esp + 0x20], 0
mov dword [edi], 0
xor esi, esi
jmp 0x422db8
mov dword [edi], eax
xor esi, esi
jmp 0x422db8
mov esi, eax
mov dword [edx], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x422dd1
add dword [ecx + 4], 0xffffffff
jne 0x422dd1
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push 0
push 0
push ebp
mov ecx, 0x8536fc
call fcn.00429750
jmp 0x422e1b
mov edx, dword [esp + 0x48]
cmp dword [ebp + 4], edx
jne 0x422e09
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x4c]
mov dword [edx + 8], eax
mov eax, dword [ecx]
push edx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
je 0x422e09
mov dword [esp + 0x14], 1
test esi, esi
je 0x422e1b
cmp esi, dword [edi]
mov dword [esp + 0x20], esi
jne 0x422e19
xor esi, esi
jmp 0x422e1b
mov esi, dword [esi]
lea eax, [esp + 0x28]
cmp esi, eax
mov ebp, esi
jne 0x422d70
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.00421eb0
mov ecx, ebx
call fcn.00421db0
cmp byte [ebx], 0
jne 0x422e55
mov dx, word [esp + 0x18]
cmp word [ebx + 2], dx
jbe 0x422e55
call fcn.00422b70
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x40], 0xffffffff
je 0x422e79
add dword [eax + 4], 0xffffffff
mov ecx, eax
add eax, 4
cmp dword [eax], 0
jne 0x422e79
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8
Function at 0x42e4d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc8
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0xc4], eax
push ebx
push ebp
push esi
push edi
push 0x4fa7
mov esi, ecx
call dword [sym.imp.MSVCR80.dll_srand]
mov ebp, dword [sym.imp.MSVCR80.dll_rand]
add esp, 4
lea ebx, [esp + 0x10]
mov edi, 0x70
sub edi, 1
call ebp
mov byte [ebx], al
add ebx, 1
test edi, edi
jne 0x42e507
xor eax, eax
xor ecx, ecx
lea esp, [esp]
cmp byte [eax + esi], 0
jne 0x42e528
xor eax, eax
mov dl, byte [eax + esi]
add eax, 1
cmp byte [eax + esi], 0
mov byte [esp + ecx + 0x94], dl
jne 0x42e53d
xor eax, eax
mov dl, byte [eax + esi]
add eax, 1
cmp byte [eax + esi], 0
mov byte [esp + ecx + 0x95], dl
jne 0x42e552
xor eax, eax
mov dl, byte [eax + esi]
add eax, 1
cmp byte [eax + esi], 0
mov byte [esp + ecx + 0x96], dl
jne 0x42e567
xor eax, eax
mov dl, byte [eax + esi]
mov byte [esp + ecx + 0x97], dl
add ecx, 4
add eax, 1
cmp ecx, 0x40
jl 0x42e520
xor ecx, ecx
call fcn.0042f080
lea eax, [esp + 0x80]
push eax
lea edx, [esp + 0x98]
xor ecx, ecx
call fcn.0042f120
call fcn.0042f060
lea ecx, [esp + 0x10]
mov edi, 1
mov ebx, 2
mov edx, ecx
mov ebp, 3
mov eax, ecx
xor esi, esi
sub edi, ecx
sub ebx, edx
sub ebp, eax
lea ecx, [ecx]
mov eax, 0xcccccccd
mul esi
shr edx, 4
lea edx, [edx + edx*4]
add edx, edx
add edx, edx
lea ecx, [esp + esi + 0x10]
mov eax, esi
sub eax, edx
mov dl, byte [esp + eax + 0x80]
xor byte [ecx], dl
lea edx, [edi + ecx]
mov eax, 0xcccccccd
mul edx
shr edx, 4
lea eax, [edx + edx*4]
add eax, eax
add eax, eax
mov edx, esi
sub edx, eax
movzx eax, byte [esp + edx + 0x81]
xor byte [ecx + 1], al
lea edx, [ebx + ecx]
mov eax, 0xcccccccd
mul edx
shr edx, 4
lea eax, [edx + edx*4]
add eax, eax
add eax, eax
mov edx, esi
sub edx, eax
movzx eax, byte [esp + edx + 0x82]
xor byte [ecx + 2], al
lea edx, [ecx + ebp]
mov eax, 0xcccccccd
mul edx
shr edx, 4
lea eax, [edx + edx*4]
add eax, eax
add eax, eax
mov edx, esi
sub edx, eax
movzx eax, byte [esp + edx + 0x83]
xor byte [ecx + 3], al
add esi, 4
cmp esi, 0x70
jb 0x42e5c0
xor esi, esi
lea edi, [esp + 0x10]
lea ecx, [ecx]
mov edx, dword [esp + 0xdc]
push edi
mov ecx, esi
call fcn.0042f540
mov ecx, esi
call fcn.0042f080
push 0
lea edx, [esp + 0x44]
mov ecx, esi
call fcn.0042f120
add esi, 1
add edi, 0x10
cmp esi, 3
jl 0x42e660
mov ecx, dword [esp + 0xd4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00735f58
add esp, 0xc8
ret 4
Function at 0x42f080
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
ret
mov eax, ecx
imul eax, eax, 0x5c
add eax, 0x853a90
jmp 0x42ea60
Function at 0x4515c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0xffffffffffffffff
mov esi, ecx
lea edi, [eax + 1]
push str.new__
push edi
mov dword [esi], vtable.fd_scan.0
mov dword [esi + 8], eax
call sub.Storm.dll_Ordinal_401
mov dword [esi + 0x28], eax
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
push 0
push 0xffffffffffffffff
push str.new__
neg ecx
or ecx, eax
push ecx
call sub.Storm.dll_Ordinal_401
cmp dword [esi + 0x28], 0
mov dword [esi + 4], eax
je 0x451655
test eax, eax
je 0x451655
mov eax, dword [esp + 0xc]
mov edi, 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x2c], eax
call dword [sym.imp.MSVCR80.dll___iob_func]
add eax, 0x20
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], eax
pop edi
mov dword [esi + 0x38], 0
mov eax, esi
pop esi
ret 8
push str.No_space_for_scanner_
push esi
call fcn.004514a0
add esp, 8
push 1
call dword [sym.imp.MSVCR80.dll_exit]
int3

Function at 0x468e10
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x468e2f
push 0xf7200081
call sub.Storm.dll_Ordinal_465
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x468e5e
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x12
lea ebp, [esi + 8]
push ebp
push edi
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x468f27
cmp dword [esp + 0x10], 0x12
jne 0x468f27
mov al, byte [ebp]
test al, al
jbe 0x468eb8
mov ecx, dword [esi + 0x1c]
push 0
lea edx, [esp + 0x14]
push edx
movzx eax, al
push eax
push ecx
push edi
call ebx
test eax, eax
je 0x468f27
movzx edx, byte [ebp]
cmp dword [esp + 0x10], edx
jne 0x468f27
cmp byte [esi + 9], 0
je 0x468ee5
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00468250
mov ecx, dword [esi + 0x40]
push eax
push ecx
push edi
call ebx
test eax, eax
je 0x468f27
mov ecx, esi
call fcn.00468250
cmp dword [esp + 0x10], eax
jne 0x468f27
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push edi
call ebx
test eax, eax
je 0x468f27
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x3c]
jne 0x468f27
push 0
lea eax, [esp + 0x14]
push eax
push 0x1a
add esi, 0x20
push esi
push edi
call ebx
test eax, eax
je 0x468f27
cmp dword [esp + 0x10], 0x1a
jne 0x468f27
mov dword [esp + 0x14], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
test esi, esi
pop ebp
pop ebx
jne 0x468f43
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, esi
pop esi
add esp, 8
ret 4
Function at 0x468e13
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x468e2f
push 0xf7200081
call sub.Storm.dll_Ordinal_465
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x468e5e
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x12
lea ebp, [esi + 8]
push ebp
push edi
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x468f27
cmp dword [esp + 0x10], 0x12
jne 0x468f27
mov al, byte [ebp]
test al, al
jbe 0x468eb8
mov ecx, dword [esi + 0x1c]
push 0
lea edx, [esp + 0x14]
push edx
movzx eax, al
push eax
push ecx
push edi
call ebx
test eax, eax
je 0x468f27
movzx edx, byte [ebp]
cmp dword [esp + 0x10], edx
jne 0x468f27
cmp byte [esi + 9], 0
je 0x468ee5
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00468250
mov ecx, dword [esi + 0x40]
push eax
push ecx
push edi
call ebx
test eax, eax
je 0x468f27
mov ecx, esi
call fcn.00468250
cmp dword [esp + 0x10], eax
jne 0x468f27
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push edi
call ebx
test eax, eax
je 0x468f27
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x3c]
jne 0x468f27
push 0
lea eax, [esp + 0x14]
push eax
push 0x1a
add esi, 0x20
push esi
push edi
call ebx
test eax, eax
je 0x468f27
cmp dword [esp + 0x10], 0x1a
jne 0x468f27
mov dword [esp + 0x14], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
test esi, esi
pop ebp
pop ebx
jne 0x468f43
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x476530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x774c7d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
lea eax, [esi + 0xc]
mov dword [eax + 4], edi
mov dword [eax], eax
not eax
mov dword [esp + 0x1c], edi
mov dword [esi + 8], 8
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
lea ecx, [esi + 0x1c]
call fcn.00474bb0
lea ecx, [esi + 0x44]
call fcn.00473ed0
lea ebx, [esi + 0x6c]
mov ecx, ebx
call fcn.00474e60
mov dword [ebx], vtable.TAllocatorHashTable_struct_KERNNODE__class_KERNINGHASHKEY__128_.0
lea eax, [esi + 0x98]
mov dword [eax + 4], edi
mov dword [eax], eax
not eax
mov dword [esi + 0x94], 0x20
mov dword [esi + 0x9c], eax
fldz
push 0x4761f0
fstp dword [esi + 0x1c4]
push 0x4749f0
push 8
push 0x20
lea eax, [esi + 0x1c8]
push eax
mov byte [esp + 0x30], 6
mov dword [esi + 0x1b0], edi
call fcn.00736657
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x481590
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, eax
test edi, edi
mov esi, ecx
jle 0x4815c8
lea ebx, [ebx]
mov cl, byte [esi]
mov al, dh
xor al, cl
movzx cx, cl
add cx, dx
imul cx, cx, 0x3193
mov dx, 0x58bf
sub dx, cx
mov byte [esi], al
sub edi, 1
add esi, 1
test edi, edi
movzx edx, dx
jg 0x4815a0
pop edi
pop esi
ret
Function at 0x499c00
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x248
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
mov esi, dword [esp + 0x254]
test esi, esi
mov ebx, ecx
je 0x499d93
push ebp
push edi
mov eax, 0x18
mov edx, esi
mov edi, 0x860648
mov ecx, dword [edi]
cmp ecx, dword [edx]
jne 0x499c4d
sub eax, 4
add edx, 4
add edi, 4
cmp eax, 4
jae 0x499c35
test eax, eax
je 0x499caa
movzx ecx, byte [edi]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x499c9c
sub eax, 1
add edx, 1
add edi, 1
test eax, eax
je 0x499caa
movzx ecx, byte [edi]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x499c9c
sub eax, 1
add edx, 1
add edi, 1
test eax, eax
je 0x499caa
movzx ecx, byte [edi]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x499c9c
sub eax, 1
add edx, 1
add edi, 1
test eax, eax
je 0x499caa
movzx ecx, byte [edi]
movzx edx, byte [edx]
sub ecx, edx
je 0x499caa
test ecx, ecx
mov eax, 1
jg 0x499cac
or eax, 0xffffffff
jmp 0x499cac
xor eax, eax
test eax, eax
pop edi
pop ebp
je 0x499ddb
push 0x1a8
lea eax, [esp + 0xa8]
push 0
push eax
call sub.MSVCR80.dll_memset
push 0x9c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0xbc], 0x1a8
call sub.MSVCR80.dll_memset
mov eax, dword [esi]
add esp, 0x18
push 0
lea edx, [esp + 0xa8]
push edx
push eax
push 0
mov word [esp + 0x3c], 0x9c
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push edx
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
push 0
push 4
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xb8]
push edx
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExA]
mov eax, dword [esi]
mov dword [0x860648], eax
mov ecx, dword [esi + 4]
mov dword [0x86064c], ecx
mov edx, dword [esi + 8]
mov dword [0x860650], edx
mov eax, dword [esi + 0xc]
mov dword [0x860654], eax
mov ecx, dword [esi + 0x10]
mov dword [0x860658], ecx
mov edx, dword [esi + 0x14]
push 0x2108
mov dword [0x86065c], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [ebx + 0x578]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx + 0x578]
push 3
push eax
jmp 0x499dd5
cmp dword [0x860650], 0
je 0x499ddb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsExA]
xor eax, eax
mov dword [0x860648], eax
mov dword [0x86064c], eax
mov dword [0x860650], eax
mov dword [0x860654], eax
mov dword [0x860658], eax
mov dword [0x86065c], eax
mov ecx, dword [ebx + 0x578]
push 6
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x24c]
pop esi
pop ebx
xor ecx, esp
call fcn.00735f58
add esp, 0x248
ret 4
Function at 0x49b610
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
push str.DrawCaptions_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esi]
push 0xffffff
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esi]
push 6
push edx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov eax, dword [0x860874]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, dword [0x860978]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 8]
xor edi, edi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
cmp dword [0x860fac], edi
jbe 0x49b6cc
jmp 0x49b680
mov edx, dword [0x860fb0]
mov eax, dword [edx + edi*4]
mov ecx, dword [0x860fc0]
lea eax, [eax + eax*4]
mov ecx, dword [ecx + eax*4 + 8]
mov eax, ecx
lea edx, [eax + 2]
mov dword [esp + 0xc], edx
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x49b6a0
sub eax, dword [esp + 0xc]
sar eax, 1
push eax
mov eax, dword [esi]
push ecx
push ebx
push ebp
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
add edi, 1
add ebx, 0x20
cmp edi, dword [0x860fac]
jb 0x49b680
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
pop edi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x49e0b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
imul eax, eax, 0x74
push ebx
push ebp
mov ebp, ecx
lea ebx, [eax + ebp + 0x14f8]
xor eax, eax
cmp dword [ebx], 0xffffffff
push esi
mov esi, dword [esp + 0x18]
sete al
push edi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x49e0f7
mov ecx, esi
mov eax, 0x1a
xor edx, edx
mov edi, dword [ecx]
sub eax, 1
xor edi, eax
add edx, edi
add ecx, 4
test eax, eax
jne 0x49e0e2
cmp dword [ebx + 0x70], edx
je 0x49e13c
mov eax, dword [ebp + 0x584]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push esi
push edx
push eax
mov eax, dword [ecx + 0xb0]
call eax
lea eax, [ebx + 4]
mov edi, eax
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x1a
xor edx, edx
mov esi, dword [ecx]
sub eax, 1
xor esi, eax
add edx, esi
add ecx, 4
test eax, eax
jne 0x49e123
cmp dword [esp + 0x10], eax
mov dword [ebx + 0x70], edx
jne 0x49e153
mov esi, dword [esp + 0x20]
cmp dword [ebx + 0x6c], esi
jne 0x49e157
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [ebx], eax
pop ebx
pop ecx
ret 0xc
mov esi, dword [esp + 0x20]
mov ebp, dword [ebp + 0x584]
mov edi, dword [esp + 0x18]
mov ecx, dword [ebp]
mov edx, dword [ecx + 0xb8]
push esi
push edi
push ebp
call edx
mov dword [ebx], edi
pop edi
mov dword [ebx + 0x6c], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc