joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bb8
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push ebx
push esi
push edi
push 0x10
mov dword [ebp - 4], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
je 0x1002ca4
mov eax, dword [ebp + 0xc]
and dword [esi], 0
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
lea edi, [esi + 4]
mov dword [edi], 2
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push esi
push 0x1002b49
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp + 8], eax
je 0x1002c73
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1002c2d
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
jmp 0x1002c34
mov dword [ebp + 0xc], 0x8007041d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1002c4f
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebx
jbe 0x1002cab
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 4]
ja 0x1002c6b
sub ebx, eax
mov eax, dword [ebp + 0x10]
add dword [eax], ebx
jmp 0x1002cab
mov eax, dword [ebp + 0x10]
and dword [eax], 0
jmp 0x1002cab
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
call esi
cmp eax, 0x10000
jae 0x1002ca0
call esi
test eax, eax
jle 0x1002ca0
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x1002cab
call esi
jmp 0x1002c9b
mov dword [ebp + 0xc], 0x80070008
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002da9
Capabilities:
Enumerate services

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
push 0xf0008
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebx], edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x1002e05
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x10000
jae 0x1002dfb
call esi
test eax, eax
jle 0x1002dfb
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002dfd
call esi
mov dword [ebp - 4], eax
jmp 0x1002f18
cmp dword [ebp + 0x24], edi
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
je 0x1002e2b
push 0x24
pop edi
cmp eax, edi
mov dword [ebp - 8], edi
jb 0x1002e79
mov ecx, 0x10014fc
mov dword [esi + 4], ecx
mov dword [esi], ecx
mov dword [esi + 0xc], 4
push dword [ebp + 0x20]
lea ecx, [ebp + 0xc]
push ecx
sub eax, edi
push eax
mov eax, dword [ebp - 8]
add eax, esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x1002f0d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xea
jne 0x1002ee9
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
jne 0x1002e85
mov dword [ebp - 4], 0x80070008
jmp 0x1002f0f
mov ecx, dword [ebp - 8]
push dword [ebp + 0x20]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x1c]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp - 8]
push eax
push 2
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x1002f0f
call ebx
cmp eax, 0x10000
jae 0x1002ed7
call ebx
test eax, eax
jle 0x1002ed7
call ebx
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002ed9
call ebx
push dword [esi]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi], 0
jmp 0x1002f0f
call ebx
cmp eax, 0x10000
jae 0x1002f09
call ebx
test eax, eax
jle 0x1002f09
call ebx
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1002f0f
call ebx
jmp 0x1002f04
mov dword [ebx], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp + 0x24], 0
pop edi
pop esi
pop ebx
je 0x1002f2c
cmp dword [ebp - 4], 0
jl 0x1002f2c
mov eax, dword [ebp + 0x20]
inc dword [eax]
mov eax, dword [ebp - 4]
leave
ret 0x20
Function at 0x1002f38
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100152c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002f9e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x1001510
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002f92
cmp dword [ebp - 0xc], 1
sete al
mov esi, eax
jmp 0x1002f95
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x1004022
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x1004074
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x10000
jae 0x1004056
call esi
test eax, eax
jg 0x100405f
call esi
mov esi, eax
jmp 0x100419f
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100419f
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call ebx
mov edi, eax
cmp edi, esi
je 0x1004169
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10040cb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x10000
jae 0x10040c7
call esi
test eax, eax
jle 0x10040c7
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10040cb
call esi
mov esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
mov edi, 0x1001634
jl 0x1004122
cmp dword [ebp + 0xc], 0
jne 0x10040e7
cmp dword [ebp - 0x1c], 1
je 0x1004122
cmp dword [ebp - 0x1c], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
jne 0x1004109
push edi
push 0x100162c
call fcn.0100300f
push edi
push 0x100161c
call fcn.0100300f
lea eax, [ebp + 0x10]
push eax
push 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push 1
push eax
push dword [ebp - 4]
call fcn.010032c5
mov esi, eax
push 0xf01ff
push dword [ebp + 8]
push dword [ebp - 4]
call ebx
mov ebx, eax
test ebx, ebx
je 0x1004194
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1004160
cmp dword [ebp - 0x1c], 1
jne 0x1004160
push edi
push 0x100162c
call fcn.0100300f
push edi
push 0x100161c
call fcn.0100300f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1004194
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x10000
jae 0x1004190
call esi
test eax, eax
jle 0x1004190
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1004194
call esi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x10045ef
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1007070]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 8
pop ecx
mov dword [ebp - 0x224], eax
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
push 0x10013b0
push edx
mov dword [ebp - 0x21c], edx
mov byte [ebp - 0x20c], bl
mov byte [ebp - 0x20b], bl
mov byte [ebp - 0x20a], bl
mov byte [ebp - 0x209], bl
mov byte [ebp - 0x208], bl
mov byte [ebp - 0x207], 5
mov byte [ebp - 0x214], bl
mov byte [ebp - 0x213], bl
mov byte [ebp - 0x212], bl
mov byte [ebp - 0x211], bl
mov byte [ebp - 0x210], bl
mov byte [ebp - 0x20f], 1
mov dword [esi], 1
call edi
test eax, eax
pop ecx
pop ecx
jne 0x10046a9
push 0x20
lea eax, [ebp - 0x20c]
mov byte [ebp - 0x218], 2
pop ecx
mov dword [ebp - 0x244], 0x220
jmp 0x1004717
push 0x1001728
push dword [ebp - 0x21c]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x10046ce
push 0x12
lea eax, [ebp - 0x20c]
mov byte [ebp - 0x218], 1
pop ecx
jmp 0x1004717
push 0x1001710
push dword [ebp - 0x21c]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x10046e5
push 4
jmp 0x10046be
push 0x10016fc
push dword [ebp - 0x21c]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x1004709
lea eax, [ebp - 0x214]
mov byte [ebp - 0x218], 1
xor ecx, ecx
jmp 0x1004717
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x228]
mov dword [esi], ebx
cmp dword [esi], ebx
je 0x100475e
push dword [ebp - 0x224]
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
push dword [ebp - 0x234]
push dword [ebp - 0x238]
push dword [ebp - 0x23c]
push dword [ebp - 0x240]
push dword [ebp - 0x244]
push ecx
push dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x10047ee
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x224]
push dword [eax]
mov esi, 0xff
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], ebx
push ebx
mov dword [ebp - 0x218], esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10047fc
push dword [ebp - 0x220]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov ecx, dword [ebp - 0x224]
mov dword [ecx], eax
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x220]
push ecx
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], esi
push ebx
call edi
test eax, eax
jne 0x10047fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10047fc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010051f3
leave
ret 0xc
Function at 0x1004aaf
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0x10016ac
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1004b08
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
push eax
push dword [ebp + 0x14]
push 3
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1004b08
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
ret 0x10

Function at 0x1004b11
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
lea eax, [ebp + 0xc]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1004b64
cmp eax, 2
jne 0x1004c1d
mov edi, dword [ebp + 0x14]
push edi
mov dword [edi], ebx
call fcn.01004810
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x1004b97
mov dword [esi], 1
jmp 0x1004c1b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
cmp eax, ebx
je 0x1004bb2
cmp eax, 0x7a
je 0x1004bb2
mov edi, dword [ebp + 0x14]
push edi
mov dword [edi], ebx
call fcn.01004810
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x1004baa
mov edi, dword [edi]
cmp edi, ebx
je 0x1004ba5
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp + 0x14]
jmp 0x1004c1d
mov dword [esi], 1
jmp 0x1004c12
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
mov esi, dword [ebp + 0x14]
pop ecx
mov dword [esi], eax
je 0x1004be9
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
mov ecx, dword [esi]
cmp ecx, ebx
je 0x1004be9
cmp eax, ebx
je 0x1004c12
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push esi
mov dword [esi], ebx
call fcn.01004810
mov edi, eax
cmp edi, ebx
je 0x1004c09
mov esi, dword [esi]
cmp esi, ebx
je 0x1004c05
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
jmp 0x1004c1d
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1004dab
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.010045ef
cmp eax, edi
mov dword [ebp + 0xc], eax
jne 0x1004e64
push ebx
mov ebx, dword [ebp + 8]
push 2
push 0xc
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
cmp dword [ebp - 0x18], edi
jbe 0x1004e42
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1004e2e
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
test cl, cl
je 0x1004e19
cmp cl, 1
je 0x1004e19
cmp cl, 2
jne 0x1004e26
add eax, 8
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1004e39
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x1004df6
jmp 0x1004e41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
jmp 0x1004e41
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
pop esi
cmp dword [ebp - 4], 0
pop ebx
je 0x1004e61
cmp dword [ebp - 8], 0
push dword [ebp - 4]
je 0x1004e5a
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x1004e61
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 8
Function at 0x100530b
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001788
call fcn.0100552c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1005346
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005346
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100535e
cmp eax, 0x20b
je 0x100534b
mov dword [ebp - 0x1c], edi
jmp 0x1005372
cmp dword [ecx + 0x84], 0xe
jbe 0x1005346
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100536c
cmp dword [ecx + 0x74], 0xe
jbe 0x1005346
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100710c], 0xffffffff
or dword [0x1007110], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1007108]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1007104]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1007114], eax
call fcn.01005524
cmp dword [0x1007080], edi
jne 0x10053cd
push fcn.01005524
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100550d
push 0x1007010
push 0x100700c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1007100]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10070fc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1007008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002417
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1005444
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1005479
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01005567
ret
Function at 0x40c0d0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
lea esi, [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], esi
mov dword [esp + 0x1c], 0
mov word [esp + 0x1a], 0
call sub.msvcrt.dll_fread
dec eax
je 0x40c118
xor eax, eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
lea edi, [esp + 0x1a]
mov dword [edx], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], edi
call sub.msvcrt.dll_fread
dec eax
jne 0x40c10c
mov ecx, dword [esp + 0x34]
mov ax, word [esp + 0x1a]
mov word [ecx + 4], ax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], edi
call sub.msvcrt.dll_fread
dec eax
jne 0x40c10c
xor eax, eax
mov ecx, dword [esp + 0x34]
mov ax, word [esp + 0x1a]
mov dword [ecx + 8], eax
cmp eax, 0xffff
je 0x40c190
mov al, 1
jmp 0x40c10e
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], esi
call sub.msvcrt.dll_fread
dec eax
jne 0x40c10c
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 8], eax
mov al, 1
jmp 0x40c10e

Function at 0x40c1d0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x24
cmp dword [ecx + 8], 0xfffe
mov esi, dword [esp + 0x30]
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], 0
ja 0x40c290
sub eax, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 4]
mov word [esp + 0x16], ax
mov eax, dword [ebx + 8]
mov word [esp + 0x18], ax
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea eax, [esp + 0x16]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40c287
mov edx, dword [eax + 4]
inc edx
mov word [eax + 4], dx
add esp, 0x24
pop ebx
pop esi
ret 4
sub eax, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
mov word [esp + 0x14], ax
mov eax, dword [ebx + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
mov word [esp + 0x16], 0xffff
call sub.msvcrt.dll_fwrite
lea eax, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea eax, [esp + 0x16]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
jmp 0x40c278
Function at 0x40c8f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
mov ecx, edi
mov dword [esp + 0x18], eax
mov dword [esp], 0x488476
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
call fcn.00420400
mov ebx, eax
push ecx
mov ecx, edi
mov dword [esp], 0x48847a
call fcn.00420400
mov ebp, eax
mov eax, dword [0x4b610c]
push esi
mov cl, byte [ebx]
mov dword [esp + 0x10], eax
test cl, cl
je 0x40ca60
mov eax, ebx
xor edi, edi
inc eax
mov dl, 0x10
sub edx, eax
and ecx, 0xff
add edx, ebx
add edi, ecx
movsx esi, byte [eax]
movsx edx, dl
imul edx, esi
mov ecx, esi
test edx, edx
jne 0x40c948
mov ecx, 0x65
mov eax, edi
xor edx, edx
div ecx
lea eax, [edx + edx*2]
mov edi, dword [esp + 0x10]
mov esi, dword [edi + eax*4]
test esi, esi
jne 0x40c990
jmp 0x40c9c8
jg 0x40c9c8
mov esi, dword [esi]
test esi, esi
je 0x40c9c8
mov dword [esp + 4], ebx
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40c988
mov esi, dword [esi + 8]
test esi, esi
jne 0x40c9d2
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], str.Skipping_unknown__s_object__s_n
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004719d0
mov esi, dword [0x486270]
test esi, esi
je 0x40c9aa
mov eax, dword [0x486074]
mov dword [esp], str.cell_size
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x14]
call fcn.00420c70
mov dword [0x486078], ebp
cmp dword [0x486158], 1
push edx
mov dword [0x486064], eax
push edx
jg 0x40ca18
mov eax, dword [esi]
mov eax, dword [eax + 8]
cmp eax, 0x4730d0
jne 0x40ca38
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp], str.______packing__s._s_n
call fcn.004719d0
mov eax, dword [esi]
mov eax, dword [eax + 8]
cmp eax, 0x4730d0
je 0x40ca0d
mov edi, dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 8], edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x18]
mov dword [esp], edi
call eax
sub esp, 0xc
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
jmp 0x40c971
Function at 0x40cd40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0x5c
lea esi, [ebp - 0x28]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp], eax
lea edi, [ebp - 0x30]
call fcn.0040c0d0
test al, al
je 0x40cd7e
cmp dword [ebp - 0x3c], 0x54584554
je 0x40cdb8
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebx], eax
mov byte [ebx + 8], 0
mov edx, dword [ebp - 0x30]
cmp edx, esi
je 0x40cda5
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
inc eax
mov dword [esp + 4], eax
call fcn.00480000
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebp - 0x34]
cmp eax, 0xffffffff
je 0x40cd7e
inc eax
mov dword [esp], eax
call fcn.00480010
mov dword [ebp - 0x4c], eax
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], edi
mov dword [esp + 4], eax
lea edi, [ebp - 0x30]
call sub.msvcrt.dll_fread
dec eax
je 0x40ce08
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call fcn.0047ffe0
jmp 0x40cd7e
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x4c]
mov byte [edi + eax], 0
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea edi, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov ecx, edi
mov eax, dword [ebp - 0x4c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.0047bd90
sub esp, 0x10
mov eax, dword [ebp - 0x4c]
lea edi, [ebx + 8]
mov dword [esp], eax
call fcn.0047ffe0
mov eax, dword [ebp - 0x30]
mov dword [ebx], edi
cmp eax, esi
je 0x40ce6a
mov dword [ebx], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 4], eax
jmp 0x40cda5
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 1]
cmp edx, 4
jae 0x40ce94
xor ecx, ecx
test dl, 2
je 0x40ce87
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x40ce62
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
jmp 0x40ce62
test edi, 1
jne 0x40cead
test edi, 2
jne 0x40cebc
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x40ce75
mov dl, byte [esi]
lea edi, [ebx + 9]
mov byte [ebx + 8], dl
lea esi, [ebp - 0x27]
mov edx, eax
jmp 0x40ce9c
mov cx, word [esi]
add edi, 2
mov word [edi - 2], cx
add esi, 2
sub edx, 2
jmp 0x40cea4