joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4574f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x664ee8
push fcn.0053f0e0
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x67f4f4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x45765b
cmp word [esi], 0
je 0x45765b
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457550
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x45765b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45765b
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.0053dd00
add esp, 0xc
push esi
lea ecx, [ebp - 0x81d]
call fcn.00456730
push eax
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.00409cf0
push 0x3c
push 0
lea eax, [ebp - 0x85c]
push eax
call fcn.0053dd00
add esp, 0x1c
mov dword [ebp - 0x85c], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x850], 0x60f11c
mov dword [ebp - 0x848], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x858], 0x440
lea eax, [ebp - 0x85c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x457622
cmp dword [ebp + 0x18], 0
je 0x457622
push dword [ebp + 0x20]
push dword [ebp - 0x824]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x457637
test esi, esi
je 0x457647
push edi
push dword [ebp - 0x824]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x457647
push dword [ebp - 0x824]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x457664
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x457710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x45772c
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x457d30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x457d47
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
test eax, eax
jne 0x457d74
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x457d6e
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x457e8d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x457dab
cmp byte [edi + 0x18], al
je 0x457d9f
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00413460
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x457de4
call fcn.00413460
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.00457ec0
test eax, eax
jns 0x457e8a
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.00457960
mov dword [ebp - 4], eax
test eax, eax
jns 0x457e14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.00457ec0
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x457dbb
push 0
push 0
push ebx
mov ecx, esi
call fcn.00457960
mov edi, eax
test edi, edi
jns 0x457e52
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.00457ec0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4581d0
push 0
push 0
call fcn.0057072d
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x457dbb
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x457e8a
call fcn.00413460
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4582b0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x214], 0x104
test edi, edi
je 0x458374
lea eax, [ebp - 0x218]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x458374
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x458374
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x458374
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x45836d
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00478a88
mov esp, ebp
pop ebp
ret 4
Function at 0x4587c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x438], eax
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x428], edi
test eax, eax
jne 0x4587fb
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x14
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x42c]
push ecx
push ebx
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x42c], ebx
push ecx
push ebx
push ebx
push 4
push dword [ebp + 0xc]
mov dword [ebp - 0x418], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x4589d2
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 2
je 0x458841
cmp esi, 1
jne 0x4588e0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x4588e0
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x424], ebx
push ecx
lea ecx, [ebp - 0x424]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
jne 0x4588e0
mov esi, dword [ebp - 0x424]
sub esi, 1
js 0x4588dd
mov ebx, dword [ebp - 0x428]
mov edi, esi
shl edi, 5
nop word [eax + eax]
mov eax, dword [ebp - 0x430]
cmp dword [edi + eax + 4], 3
jne 0x4588cd
test ebx, ebx
je 0x4588c0
cmp dword [edi + eax + 0x14], 0
jne 0x4588cd
add eax, 0xc
push ebx
add eax, edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetTrusteeNameW]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4588cd
push esi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
sub edi, 0x20
sub esi, 1
jns 0x458890
mov edi, dword [ebp - 0x428]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
push 0x208
xorps xmm0, xmm0
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x20c]
push 0
push eax
movups xmmword [ebp - 0x458], xmm0
movups xmmword [ebp - 0x448], xmm0
call fcn.0053dd00
add esp, 0xc
mov dword [ebp - 0x434], 0x104
test edi, edi
je 0x458955
lea eax, [ebp - 0x430]
mov dword [ebp - 0x420], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
push 3
push esi
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x458]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x4589c4
push 0
push dword [ebp - 0x41c]
push 0
push 0
push 4
push dword [ebp + 0xc]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 0x41c]
inc ebx
test eax, eax
je 0x4589c4
push eax
call esi
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x4589d1
push eax
call esi
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
xor ecx, ebp
pop edi
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x14
Function at 0x459cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x68], 0x590053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x68]
mov eax, 0x68adc8
mov dword [ebp - 0x64], 0x540053
push edi
mov dword [ebp - 0x60], 0x4d0045
mov edx, 0x31
mov dword [ebp - 0x5c], 0x43005c
sub esi, eax
mov dword [ebp - 0x58], 0x720075
mov dword [ebp - 0x54], 0x650072
mov dword [ebp - 0x50], 0x74006e
mov dword [ebp - 0x4c], 0x6f0043
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x6f0072
mov dword [ebp - 0x40], 0x53006c
mov dword [ebp - 0x3c], 0x740065
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x6e006f
mov dword [ebp - 0x30], 0x720074
mov dword [ebp - 0x2c], 0x6c006f
mov dword [ebp - 0x28], 0x53005c
mov dword [ebp - 0x24], 0x730065
mov dword [ebp - 0x20], 0x690073
mov dword [ebp - 0x1c], 0x6e006f
mov dword [ebp - 0x18], 0x4d0020
mov dword [ebp - 0x14], 0x6e0061
mov dword [ebp - 0x10], 0x670061
mov dword [ebp - 0xc], 0x720065
lea ecx, [edx + 0x7fffffcd]
test ecx, ecx
je 0x459dbe
movzx ecx, word [esi + eax]
test cx, cx
je 0x459dbe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x459da0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret
Function at 0x45a310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x67f4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
xor ebx, ebx
mov dword [ebp - 0x10], 0x80000
nop dword [eax + eax]
mov eax, dword [0x68607c]
test al, 1
jne 0x45a38f
or eax, 1
mov dword [0x68607c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x60b2d0
mov dword [0x686070], 0x60eb54
mov dword [0x686074], eax
mov byte [0x686078], 0
call fcn.00478e94
mov eax, dword [0x68607c]
add esp, 4
test al, 2
jne 0x45a3eb
or eax, 2
mov dword [0x686080], 0x60eb6c
mov dword [0x68607c], eax
xor eax, eax
push 0x60b300
mov dword [0x686084], 0x686070
mov dword [0x686094], 2
mov dword [0x68608c], 0
mov dword [0x686090], 0
mov dword [0x686098], eax
mov dword [0x686088], 0x686080
call fcn.00478e94
add esp, 4
mov eax, dword [0x686080]
mov ecx, 0x686080
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 0
test edi, edi
js 0x45a553
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x45a42d
push edi
lea ecx, [ebp - 0x14]
call fcn.004094a0
mov esi, dword [ebp - 0x14]
cmp edi, dword [esi - 8]
jg 0x45a553
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push dword [0x68ae74]
push dword [0x68ae70]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [esi - 8]
mov edi, eax
push esi
call fcn.00562507
add esp, 8
test eax, eax
js 0x45a553
cmp eax, dword [esi - 8]
jg 0x45a553
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x45a508
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xea
jne 0x45a4dd
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [ebp - 0x10], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45a4ba
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
cmp ebx, 0xa
jl 0x45a350
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45a4f2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + 4]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push esi
call fcn.0045a0d0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45a53a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004084c0
int3
Function at 0x45a620
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa628
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x67f4f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00407fb0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + 4]
mov ecx, esi
push eax
call fcn.00459ef0
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x45a695
push dword [ebp - 0x14]
push esi
push 7
push dword [0x68ae74]
push dword [0x68ae70]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45a6b4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x68af68
mov dword [ebp - 0x60], 0x6f0053
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x740066
push edi
mov dword [ebp - 0x58], 0x610077
mov edx, 0x2e
mov dword [ebp - 0x54], 0x650072
sub esi, eax
mov dword [ebp - 0x50], 0x4d005c
mov dword [ebp - 0x4c], 0x630069
mov dword [ebp - 0x48], 0x6f0072
mov dword [ebp - 0x44], 0x6f0073
mov dword [ebp - 0x40], 0x740066
mov dword [ebp - 0x3c], 0x57005c
mov dword [ebp - 0x38], 0x6e0069
mov dword [ebp - 0x34], 0x6f0064
mov dword [ebp - 0x30], 0x730077
mov dword [ebp - 0x2c], 0x43005c
mov dword [ebp - 0x28], 0x720075
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x74006e
mov dword [ebp - 0x1c], 0x650056
mov dword [ebp - 0x18], 0x730072
mov dword [ebp - 0x14], 0x6f0069
mov dword [ebp - 0x10], 0x5c006e
mov dword [ebp - 0xc], 0x750052
mov dword [ebp - 8], 0x6e
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x45b731
movzx ecx, word [esi + eax]
test cx, cx
je 0x45b731
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45b713
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret
Function at 0x45b910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x68b0e0
mov dword [ebp - 0x60], 0x6f0053
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x740066
push edi
mov dword [ebp - 0x58], 0x610077
mov edx, 0x2e
mov dword [ebp - 0x54], 0x650072
sub esi, eax
mov dword [ebp - 0x50], 0x4d005c
mov dword [ebp - 0x4c], 0x630069
mov dword [ebp - 0x48], 0x6f0072
mov dword [ebp - 0x44], 0x6f0073
mov dword [ebp - 0x40], 0x740066
mov dword [ebp - 0x3c], 0x57005c
mov dword [ebp - 0x38], 0x6e0069
mov dword [ebp - 0x34], 0x6f0064
mov dword [ebp - 0x30], 0x730077
mov dword [ebp - 0x2c], 0x43005c
mov dword [ebp - 0x28], 0x720075
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x74006e
mov dword [ebp - 0x1c], 0x650056
mov dword [ebp - 0x18], 0x730072
mov dword [ebp - 0x14], 0x6f0069
mov dword [ebp - 0x10], 0x5c006e
mov dword [ebp - 0xc], 0x750052
mov dword [ebp - 8], 0x6e
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x45b9f1
movzx ecx, word [esi + eax]
test cx, cx
je 0x45b9f1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45b9d3
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret

Function at 0x45bbd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x68b1b8
mov dword [ebp - 0x60], 0x6f0053
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x740066
push edi
mov dword [ebp - 0x58], 0x610077
mov edx, 0x2e
mov dword [ebp - 0x54], 0x650072
sub esi, eax
mov dword [ebp - 0x50], 0x4d005c
mov dword [ebp - 0x4c], 0x630069
mov dword [ebp - 0x48], 0x6f0072
mov dword [ebp - 0x44], 0x6f0073
mov dword [ebp - 0x40], 0x740066
mov dword [ebp - 0x3c], 0x57005c
mov dword [ebp - 0x38], 0x6e0069
mov dword [ebp - 0x34], 0x6f0064
mov dword [ebp - 0x30], 0x730077
mov dword [ebp - 0x2c], 0x43005c
mov dword [ebp - 0x28], 0x720075
mov dword [ebp - 0x24], 0x650072
mov dword [ebp - 0x20], 0x74006e
mov dword [ebp - 0x1c], 0x650056
mov dword [ebp - 0x18], 0x730072
mov dword [ebp - 0x14], 0x6f0069
mov dword [ebp - 0x10], 0x5c006e
mov dword [ebp - 0xc], 0x750052
mov dword [ebp - 8], 0x6e
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x45bcb1
movzx ecx, word [esi + eax]
test cx, cx
je 0x45bcb1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45bc93
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret
Function at 0x461480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0053dd00
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0x400
push 0x400
push eax
call fcn.00407ce0
push dword [eax + 4]
push dword [eax]
call fcn.00561129
add esp, 0x20
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret

Function at 0x466bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push 0
push 0x80
push 2
push 1
push 0x40000000
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00465910
mov edi, dword [ebp - 0xc]
test eax, eax
js 0x466c63
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x466c23
mov esi, dword [esi]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x466c41
call fcn.00413460
mov esi, eax
test esi, esi
js 0x466c5c
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x466c5a
call fcn.00413460
mov esi, eax
not esi
shr esi, 0x1f
jmp 0x466c65
xor esi, esi
not esi
shr esi, 0x1f
jmp 0x466c65
xor esi, esi
test edi, edi
je 0x466c70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00478a88
mov esp, ebp
pop ebp
ret
Function at 0x469ed0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fbfb6
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ecx + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x469fbd
test edi, edi
je 0x469fe9
mov edx, dword [ebp + 0x10]
test edx, 0xf
jne 0x46a015
lea eax, [edx - 0x10]
cmp dword [ebp + 0xc], eax
jbe 0x46a041
cmp byte [ecx + 0x10], 0
je 0x46a06d
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edx
push eax
push edi
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, eax
test ecx, ecx
je 0x46a099
jmp 0x469f95
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.00468b40
push 0x667fcc
lea eax, [ebp - 0xc0]
push eax
call fcn.0053defc
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.00468b40
push 0x667fcc
lea eax, [ebp - 0xcc]
push eax
call fcn.0053defc
push 0x80090005
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Data_size_is_not_a_multple_of_block_size
lea ecx, [ebp - 0xd8]
call fcn.00468b40
push 0x667fcc
lea eax, [ebp - 0xd8]
push eax
call fcn.0053defc
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xe4]
call fcn.00468b40
push 0x667fcc
lea eax, [ebp - 0xe4]
push eax
call fcn.0053defc
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xf0]
call fcn.00468b40
push 0x667fcc
lea eax, [ebp - 0xf0]
push eax
call fcn.0053defc
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.0046c360
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.004687e0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Decrypt_1_:_CryptDecrypt_failed__
push eax
call fcn.00468200
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.0046aae0
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00468200
add esp, 0xc
lea eax, [ebp - 0xb0]
push str.__0x
push eax
call fcn.00468200
add esp, 8
mov ecx, eax
push 0x46ce10
call fcn.00469830
mov edi, eax
call esi
push eax
mov ecx, edi
call fcn.00469570
push 0x61ef74
push eax
call fcn.00468200
add esp, 8
mov dword [ebx], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0xb0]
push eax
call fcn.0046d5a0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0046392e
push eax
lea ecx, [ebp - 0xfc]
call fcn.00468b40
push 0x667fcc
lea eax, [ebp - 0xfc]
push eax
call fcn.0053defc
push 0
push 0
call fcn.0053defc
int3