joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002560
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
mov dword [ebp - 0x10], 0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10002510
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10002510
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10002510
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10002510
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
cmp dword [ebp + 0x10], 4
jbe 0x10002636
mov eax, 8
imul eax, eax, 3
add eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp + 0x10]
sub ecx, 4
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*8]
xor edx, edx
mov ecx, 0x10
div ecx
mov eax, dword [ebp - 0x18]
add edx, dword [ebp - 4]
lea ecx, [edx + eax*8]
mov dword [ebp - 4], ecx
push edi
push esi
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0x10002645
add dword [esp], 5
retf

Function at 0x100026b0
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x100028b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call fcn.100027e0
test eax, eax
jne 0x100028f6
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
jmp 0x10002908
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jne 0x100028da
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10002910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call fcn.100027e0
test eax, eax
jne 0x10002956
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x28]
jmp 0x10002968
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jne 0x1000293a
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x100029d3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x18]
jae 0x10002a12
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10002a20
cmp eax, dword [ebp + 0xc]
jne 0x10002a10
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
jmp 0x10002a14
jmp 0x100029ca
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xfde008], 0x8088405
inc edx
mov dword [ebx + 0xfde008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xfc756f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xfc7576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0xfc7f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0xfe0248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0xfe0248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0xfdf0d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xfc7f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x437860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c82e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0046cd7f
mov edi, eax
add esp, 4
test edi, edi
je 0x4378f2
push 1
call fcn.00451fdc
add esp, 4
mov dword [edi + 4], eax
jmp 0x4378f4
xor edi, edi
mov eax, dword [ebp + 8]
push ebx
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov edi, dword [eax + 4]
mov ecx, edi
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 1
push eax
call fcn.00418f50
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx ebx, ax
mov eax, 1
mov dword [ebp - 0x10], eax
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x437967
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x437967
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], bx
pop ebx
jne 0x437985
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4379a6
cmp byte [ebp + 0xc], 0
je 0x437994
push esi
call fcn.0045643a
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4379b2
mov esi, str.ios_base::badbit_set
jmp 0x4379c2
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.00437f10
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.0041f670
push 0x4c37f8
lea eax, [ebp - 0x2c]
push eax
call fcn.0046e111
int3
Function at 0x411052
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
mov dword [ebp - 0x208], ecx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x20c], 0x100
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x41112d
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
push dword [ebp - 0x208]
call fcn.00411052
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
jmp 0x411135
cmp esi, 0x80070103
je 0x411140
test esi, esi
jne 0x411142
xor ecx, ecx
jmp 0x411072
xor esi, esi
cmp dword [ebp - 0x208], 0
je 0x411157
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411786
mov esp, ebp
pop ebp
ret 4

Function at 0x41116b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x411195
xor esi, esi
inc esi
jmp 0x4111dc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4111dc
push dword [ebp - 4]
call fcn.00411052
mov esi, eax
test esi, esi
js 0x4111dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x4111eb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x41177c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
push ebp
mov ebp, esp
sub esp, 0x108

Function at 0x411786
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0xc], 0xa
mov eax, 0x82
mov ecx, 0xa
add byte [eax], al
mov edx, 0x66666667
push ecx
mov ecx, eax
imul edx
sar edx, 2
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x44], 0x2a82
mov dword [ebp - 0x10], 0x1a1f
mov eax, 0x194
mul dword [ebp - 0x44]
mov dword [ebp - 0x70], eax
Function at 0x411795
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 0xc], 0xa
mov eax, 0x82
mov ecx, 0xa
add byte [eax], al
mov edx, 0x66666667
push ecx
mov ecx, eax
imul edx
sar edx, 2
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x44], 0x2a82
mov dword [ebp - 0x10], 0x1a1f
mov eax, 0x194
mul dword [ebp - 0x44]
mov dword [ebp - 0x70], eax

Function at 0x41181e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x74], eax
mov eax, 0x34
mov ecx, dword [ebp - 8]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x74]
xor edx, edx
div ecx
mov dword [ebp - 0x78], eax
mov edi, eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 8]
inc ebp
clc
inc ebp
clc
sub eax, 0xa
mov esi, eax
add esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
cmp esi, eax
jae 0x411853
mov al, byte [ebx + esi]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x1c]
and edx, 0xff
xor eax, edx
mov byte [ebp - 1], al
mov byte [ebx + esi], al
inc esi
jmp 0x411828
mov dword [ebp - 0x48], 0x4334f6
mov dword [ebp - 0x3c], 0x4c4000
inc dword [ebp - 0x34]
mov eax, dword [ebp - 8]
sub eax, 9
cmp dword [ebp - 0x34], eax
jbe 0x4117fb
mov eax, dword [ebp - 0xc]
sub eax, 0xa
mov dword [ebp - 0x24], eax
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x662200], al
mov byte [0xa646e4], al
mov eax, 0xd7b0
push esi
mov dword [0x662218], ecx
mov word [0xa6473c], ax
mov word [0xa6473e], ax
mov word [0x662614], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x662248], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b665
call esi
cmp al, 4
ja 0x44b66b
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x662244], eax
pop esi
ret

Function at 0x608443
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx], ah
in al, 0x1b
insb byte es:[edi], dx
invalid
jb 0x60849e
nop
add dword [ecx - 0x3a], esp
jp 0x6083f2
and eax, dword [eax + ebx]
mov al, byte [0x320c2c83]
and byte [ebp - 0x23], dl
adc byte [edx], bh
push ecx
sar dword [esi + 0x25fb0273], 1
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
sbb eax, 0x8f16d832
fiadd dword [edx]
inc ebp
sbb al, byte [ecx - 0x19cc7afc]
mov ebp, 0xfdcb29e8
popal
and byte [ecx], cl
mov cl, 0xf3
adc al, byte [edx + 0x4e03527d]
xchg ebx, eax
jge 0x6084d0
add ecx, dword [esi - 0x6d]
push edx
cmpsd dword [esi], dword es:[edi]
shl byte [eax], cl
mov dword [ebx - 0x61], ebp
popfd
xor esp, dword [esi - 0x79afdab9]
sbb dword [esi - 6], esi
cli
jb 0x6084c5
dec ecx
movsd dword es:[edi], dword [esi]
ret
inc ecx
sbb byte gs:[edi], 0x54
jecxz 0x608491
wait
adc bh, byte [ebx - 0x3b454f0e]
loope 0x6084ec
jge 0x60847c
mov cl, 0x6d
push esp
invalid
jecxz 0x608499
ljmp 0xd0a4:0xebcb0203
add esi, dword [edx + 0x61d6197c]
mov dh, 0x45
and bh, byte [esi - 0x6e]
xchg ebx, eax
int1
or eax, 0x53f9b291
in eax, 0x38
xlatb
xchg esi, eax
sahf
sbb dword [ebp - 0xe], 0xfffffffa
xchg ecx, eax
mov ebp, 0xf5aabed0
or eax, dword [edx + 0x41511a26]
xchg ecx, eax
cmp al, 0x96
add ebx, dword [esi + 0x29]
les ecx, [edx + 2]
stc
bound esi, qword fs:[edi + edx*4 - 0x3f1b3c25]
xor byte [ecx + 0x6c6ca6c9], 0x4d
aaa
arpl word [edx + 0x7d], dx
cmp al, 0x63
add dh, byte [ebx]
shr dword [esi + 0x3041b6a2], 0x71
or dword [ebp + 0x38], ecx
jbe 0x6084f8
sub dword [ebx + 0x1bcf2698], 7
cmp byte [ecx], dh
loopne 0x608546
adc al, 0x3d
invalid
dec esp
and dword [ebx - 0x7220379c], esi
arpl word [eax + 0x502d99e3], bp
sub al, 0x93
xor bl, dl
mov ah, 0x90
wait
adc ah, cl
jns 0x608570
add al, 0xb4
mov al, 9
adc esp, 0x75
in al, dx
jno 0x608573
xchg edx, eax
retf 0x28ab
clc
rcl dword [eax], 0xf4
lds ebp, [0x91eb0143]
daa
inc eax
out 0x62, ax
fnstenv [ebx - 0x7a1f4d1f]
into
dec edi
arpl word [edi - 0x744eb64], ax
salc
invalid
hlt
Function at 0x15650
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov byte [ebp - 0x235], 0
push 0x15640
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntoskrnl.exe_wcscpy]
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntoskrnl.exe_wcscat]
add esp, 8
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.00014220
push 0
push 0
push 0
push 1
push 1
push 0
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x234]
push eax
push 1
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x15827
mov dword [ebp - 0x244], 0
push 0
push 0
lea edx, [ebp - 0x234]
push edx
call fcn.00014220
mov eax, dword [ebp - 0x21c]
push eax
push 0x8000000
push 2
push 0
lea ecx, [ebp - 0x234]
push ecx
push 0xf0005
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
jl 0x15807
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
push 2
push 0
push 1
lea eax, [ebp - 0x248]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jl 0x157fa
cmp dword [ebp - 0x24c], 0
je 0x157fa
push 5
push 0x18
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x270]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x157eb
cmp dword [ebp + 0x14], 0
je 0x157b6
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x260]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x157c7
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x260]
jbe 0x157d0
mov eax, dword [ebp - 0x260]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call fcn.00013910
mov byte [ebp - 0x235], 1
mov ecx, dword [ebp - 0x24c]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp + 0x18], 0
je 0x1581a
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
jmp 0x15827
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, byte [ebp - 0x235]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x78b370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x78b38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x7b4074
push ecx
mov edi, eax
call fcn.0079f198
mov esi, eax
add esp, 8
test esi, esi
jne 0x78b3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0079f02e
push esi
call fcn.0079efb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret