joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f6e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d3dbd
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x138]
push 0
push eax
call fcn.004a15c0
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
push str.RtlGetVersion
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45f751
lea ecx, [ebp - 0x13c]
push ecx
call eax
cmp dword [ebp - 0x138], 0xa
jb 0x45f81c
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x45f837
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.sesAppX43hnxtbyyps62jhe9s
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push str.SoftwareClas_sqpdzxn1790zetc
push eax
call fcn.0041f6f0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x2001f
push esi
push SysReAllocString
call fcn.0045d1a0
mov edi, dword [ebp - 0x20]
push 0
push 0
push 0
push 0
push str.NoOpenWith
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x45f7f2
push eax
push 0x4e5478
push 1
push 0
push str.NoOpenWith
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test edi, edi
je 0x45f7fd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45f81c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3
Function at 0x462c60
Capabilities:
Check os version
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov dword [ebp - 0x140], ebx
xor esi, esi
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push pe_nt_image_headers32
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.004a15c0
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 6
jae 0x462d3c
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp + 0xc]
cmp eax, ebx
je 0x462d3c
mov ecx, 0x2710
nop dword [eax + eax]
cmp dword [ebp + 0x10], eax
jne 0x462d54
cmp esi, 5
ja 0x462d54
mov eax, 0xaaaaaaab
mul dword [ebp - 8]
shr edx, 1
cmp edx, 0x3e8
jae 0x462d13
mov edx, 0x3e8
jmp 0x462d1c
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
inc esi
push eax
push dword [ebp - 0x140]
call edi
mov eax, dword [ebp - 0x1c]
mov ecx, 0x2710
cmp eax, ebx
jne 0x462cf0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x462d70
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x21c], edi
test edi, edi
jne 0x462dac
pop edi
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 0xc
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004a15c0
push edi
push str._sRes.cab
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00455490
add esp, 0x1c
test esi, esi
jne 0x462dee
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x462efa
movzx ecx, word [ebp + 8]
push ebx
push 0xa
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x214], eax
test eax, eax
je 0x462ed4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x462ed4
push dword [ebp - 0x214]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 4
push 0
push 2
mov edi, eax
lea eax, [ebp - 0x20c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x218], ecx
cmp ecx, 0xffffffff
je 0x462f0e
test ecx, ecx
je 0x462f0e
xor esi, esi
mov dword [ebp - 0x214], 0
test edi, edi
je 0x462eb7
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
test eax, eax
je 0x462eb1
mov ecx, dword [ebp - 0x218]
cmp esi, edi
jb 0x462e74
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x214], 0
je 0x462ef9
mov edi, dword [ebp - 0x21c]
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.0046d5a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x462ef9
Function at 0x463940
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x4dbedc
push 1
push 0
push 0x4dbf2c
mov dword [ebp - 8], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x463a3e
cmp dword [edi + 0x60], 7
lea edx, [edi + 0x4c]
mov dword [ebp - 0xc], 0
jbe 0x46398d
mov edx, dword [edx]
mov eax, dword [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [edi + 0x48], 7
lea edx, [edi + 0x34]
jbe 0x4639a2
mov edx, dword [edx]
mov eax, dword [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
cmp dword [edi + 0x74], 0
je 0x4639c7
cmp dword [edi + 0x78], 7
lea edx, [edi + 0x64]
jbe 0x4639bd
mov edx, dword [edx]
mov eax, dword [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push esi
push edx
push 0x4dbf0c
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x463a32
cmp dword [edi + 0x90], 7
lea esi, [edi + 0x7c]
mov eax, esi
jbe 0x4639ef
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463a09
cmp dword [esi + 0x14], 7
jbe 0x463a02
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 0x7c
cmp dword [edi + 0x14], 7
jbe 0x463a14
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
push 0
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 4
Function at 0x463a50
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d42eb
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x4c4]
push edi
call fcn.0045afc0
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004a15c0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x490]
add esp, 0xc
cmp dword [ebp - 0x47c], 7
cmova eax, dword [ebp - 0x490]
push eax
lea eax, [ebp - 0x21c]
push 0x4e9080
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x424]
push 0x208
push 0
push eax
call fcn.004a15c0
add esp, 0xc
lea eax, [ebp - 0x4c0]
cmp dword [ebp - 0x4ac], 7
cmova eax, dword [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x424]
push str._s.lnk
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463b30
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x448]
call fcn.00454eb0
lea eax, [ebp - 0x4c4]
push eax
call fcn.00463940
test eax, eax
js 0x463c18
cmp dword [edi + 0x90], 7
lea eax, [edi + 0x7c]
jbe 0x463b74
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x463c79
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x428], eax
push str.barP
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 1
push str.Task_sin
push eax
call fcn.0041f6f0
add esp, 0xc
lea eax, [ebp - 0x448]
cmp dword [ebp - 0x434], 7
cmova eax, dword [ebp - 0x448]
push 0
push 0
push 0
push eax
push 0x4e5478
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x434], 7
lea eax, [ebp - 0x448]
cmova eax, dword [ebp - 0x448]
push eax
call esi
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x428]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x463c18
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x448]
call fcn.00425dd0
lea ecx, [ebp - 0x460]
call fcn.00425dd0
lea ecx, [ebp - 0x478]
call fcn.00425dd0
lea ecx, [ebp - 0x490]
call fcn.00425dd0
lea ecx, [ebp - 0x4a8]
call fcn.00425dd0
lea ecx, [ebp - 0x4c0]
call fcn.00425dd0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00404d50
int3
Function at 0x4646b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x464774
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x46475e
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004a15c0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x464742
lea eax, [ebp - 0x210]
push eax
jmp 0x464779
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x214], 0
push 0x4e5478
mov ecx, esi
call fcn.00425ca0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 8

Function at 0x4647a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x20a
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004a15c0
add esp, 0xc
cmp dword [ebx + 0x10], 0
je 0x464838
cmp dword [ebx + 0x14], 7
jbe 0x4647f2
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 7
jbe 0x4647fa
mov edi, dword [edi]
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [ebp + 0x18], 0
je 0x464830
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x464830
push eax
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 0x10], 0
je 0x46487e
jmp 0x46485b
cmp dword [esi + 0x10], 0
je 0x46487e
cmp dword [edi + 0x14], 7
jbe 0x464846
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b5d9b
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
cmp dword [esi + 0x14], 7
jbe 0x464870
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..lnk
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004b788a
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
call fcn.00425ca0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 0x14
Function at 0x467c00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x5010c0]
xor eax, esp
mov dword [esp + 0x70], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x10], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.00468ca0
add esp, 4
lea ecx, [esp + 8]
call fcn.00468d60
movups xmm0, xmmword [esp + 0x60]
mov ecx, dword [esp + 0x74]
mov eax, 1
movups xmmword [esi], xmm0
pop esi
xor ecx, esp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
Function at 0x467c80
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4f9658
push 0x4a1b90
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5010c0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x467e23
cmp dword [ebp + 8], 0
je 0x467e23
test edi, edi
je 0x467e23
xor esi, esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 4], esi
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov ecx, eax
call fcn.00467c00
add esp, 8
test eax, eax
je 0x467e08
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
mov edx, edi
mov ecx, dword [ebp - 0x24]
call fcn.00467b70
add esp, 8
test eax, eax
je 0x467e08
xor eax, eax
mov dword [ebp - 0x20], eax
xor edi, edi
mov dword [ebp - 0x28], edi
mov esi, dword [ebp + 8]
mov dl, byte [ebp + eax - 0x34]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 8
jb 0x467d39
mov byte [ebp - 0x19], 0
jmp 0x467d44
mov cl, byte [ebp + eax - 0x34]
mov byte [ebp - 0x19], cl
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 8
jb 0x467d4f
mov byte [ebp - 0x1a], 0
jmp 0x467d5a
mov cl, byte [ebp + eax - 0x34]
mov byte [ebp - 0x1a], cl
inc eax
mov dword [ebp - 0x20], eax
movzx edx, dl
mov ecx, edx
shr ecx, 2
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + edi*2], cx
movzx esi, byte [ebp - 0x19]
mov ecx, esi
shr ecx, 4
and edx, 3
shl edx, 4
or ecx, edx
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp + 8]
mov word [edx + edi*2 + 2], cx
movzx edx, byte [ebp - 0x1a]
mov ecx, edx
shr ecx, 6
and esi, 0xf
shl esi, 2
or ecx, esi
movzx ecx, word [ecx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [ebp + 8]
mov word [esi + edi*2 + 4], cx
and edx, 0x3f
movzx ecx, word [edx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [esi + edi*2 + 6], cx
add edi, 4
mov dword [ebp - 0x28], edi
cmp eax, 8
jb 0x467d26
mov dword [esi + edi*2 - 2], 0x3d
mov esi, 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4a10
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5010c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x515fa0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esi + 0x34], 0x515fa0
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x34]
cmp dword [eax + 4], 0x18
ja 0x469f5a
mov dword [eax], 0
mov eax, dword [esi + 0x34]
mov byte [eax + 8], 0
jmp 0x469f71
mov dword [esi + 0x34], 0x515fa0
cmp eax, 0x515fa0
je 0x469f71
push eax
call fcn.0049fc53
add esp, 4
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x469fa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x469fdc
cmp byte [esi + 0x2c], bl
jne 0x46a0c6
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x469fd0
jmp 0x46a0ac
mov edi, dword [esi + 0x18]
test edi, edi
je 0x469ff2
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x469fe3
push 2
push 0
push ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.004b4fcc
push ebx
call fcn.004b562b
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.004b4fcc
add esp, 0x1c
test edi, edi
jg 0x46a05d
cmp byte [esi + 0x2c], 0
jne 0x46a0c6
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46a054
jmp 0x46a0ac
lea eax, [edi + 1]
push eax
call fcn.004a00d6
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.004b5834
add esp, 0x14
cmp eax, 1
je 0x46a0cf
push edi
call fcn.0049fc53
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x46a0c6
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46a0a5
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.00468f90
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
mov dl, byte [edi]
mov ecx, edi
test dl, dl
je 0x46a0fe
nop dword [eax]
inc eax
lea ebx, [ecx + 1]
cmp dl, 0xd
jne 0x46a0f4
mov byte [ecx], 0xa
cmp byte [eax], 0xa
jne 0x46a0f6
inc eax
jmp 0x46a0f6
mov byte [ecx], dl
mov dl, byte [eax]
mov ecx, ebx
test dl, dl
jne 0x46a0e0
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push 0
push edi
call dword [eax + 8]
push edi
call fcn.0049fc53
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x470850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x4708b5
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x4708a8
test ecx, ecx
je 0x4708b5
test esi, esi
je 0x4708b5
mov ecx, dword [ebp - 4]
jmp 0x47086b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4737b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4737d0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 4], edx
nop dword [eax]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4737f9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4737f6
inc esi
cmp esi, edx
jb 0x4737e7
mov ecx, dword [ebp - 8]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x47390f
cmp ecx, 3
jbe 0x473838
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x473876
cmp cl, 0xff
je 0x473876
mov edx, dword [ebp - 4]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x4737e0
dec ecx
shl eax, cl
and eax, 7
je 0x473810
cmp byte [eax + 0x4e5298], 0
je 0x473863
movzx ecx, byte [eax + 0x4e52a0]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x473860
cmp cl, 0xff
jne 0x473810
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4737e0
movzx ebx, cl
movzx ecx, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
sub ebx, edi
sub ebx, 5
test eax, eax
je 0x4738da
nop dword [eax]
movzx edx, byte [eax + 0x4e52a0]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4738c1
cmp dl, 0xff
jne 0x4738da
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor ebx, edx
sub ebx, edi
sub ebx, 5
jmp 0x4738a0
mov edx, dword [ebp - 4]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
neg cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 8]
jmp 0x4737e0
pop esi
pop ebx
cmp ecx, 3
jbe 0x473924
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret