joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e8a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47a873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046e24e
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004738e7
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00474e03
test eax, eax
je 0x43e9bc
mov ecx, dword [esp + 0x3c]
call fcn.00473914
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43e980
push edi
mov ecx, esi
call fcn.00470f81
mov ecx, esi
call fcn.0043eb60
cmp dword [esp + 0x38], 1
jne 0x43e9b5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004710bc
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x440ba0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440bd3
push esi
call fcn.0044ef60
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x440bcc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x440c59
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x440c42
mov eax, dword [esi + 8]
test eax, eax
je 0x440bf7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x440c3e
cmp eax, 2
je 0x440c42
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x440bea
cmp eax, 3
je 0x440c1d
cmp eax, 1
jne 0x440bea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x440bea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x440bea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00440c80
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x440c68
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00440c80
add esp, 4
pop esi
ret

Function at 0x441500
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x441521
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x441521
mov eax, dword [eax + 0x44]
test eax, eax
je 0x441521
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46f044
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46f07c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046d0fb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046d0d3
jmp 0x46f088
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x470739
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47077b
call fcn.004761f3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47077b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x470772
xor eax, eax
jmp 0x470783
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00470789
pop edi
pop esi
pop ebx
ret 4
Function at 0x476723
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x476751
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47676f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00476689
jmp 0x47676f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47676f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00476689
test edi, edi
mov eax, edi
jne 0x476759
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4021e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x4021f0
repz ret
jmp fcn.00402501

Function at 0x402b20
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push esi
push edi
je 0x402b3a
mov edi, 0x1000020
mov eax, 0xa0000000
jmp 0x402b44
mov edi, 0x8000002
mov eax, 0x80000000
push 0
push 0x80
push 3
push 0
push 1
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402b6b
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x402b63
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x402b63
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor esi, esi
call ebx
test eax, eax
je 0x402bfa
lea ecx, [ecx]
cmp dword [ebp - 0xc], 0x1000
jne 0x402bec
add esi, dword [ebp - 0x10]
push 0x1c
lea edx, [ebp - 0x1c]
push edx
lea eax, [esi + edi]
push eax
call ebx
test eax, eax
jne 0x402bd0
test esi, esi
jbe 0x402bfa
push esi
push edi
call fcn.00402ae0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100010a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006e80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push 0x10007730
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x42
call fcn.1000243a
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x45
mov byte [ebp - 0x23], al
mov byte [ebp - 0x20], al
mov al, 0x6c
push str.HeapFree
push str.kernel32.dll
mov byte [ebp - 0x24], 0x4b
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x1f], 0x4c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov edi, eax
nop
nop
nop
nop
nop
nop
mov cl, 0x73
lea edx, [ebp - 0x24]
mov byte [ebp - 0x2c], cl
mov byte [ebp - 0x2b], cl
lea ecx, [ebp - 0x34]
mov al, 0x65
push ecx
push edx
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x50
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], al
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x70
mov byte [ebp - 0x26], 0
call esi
push eax
call ebx
mov ecx, eax
nop
nop
nop
nop
nop
nop
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
mov eax, dword [ebp + 8]
push eax
push 0
call ecx
push eax
call edi
mov eax, 0x1000119c
ret
Function at 0x10001580
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10006eb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
push str.VirtualAlloc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x24], edx
mov si, word [eax + 0x14]
lea esi, [esi + eax + 0x18]
mov dword [ebp - 0x18], esi
mov eax, dword [ecx]
xor ecx, ecx
mov cx, word [eax + 6]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
jge 0x100016da
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x10001640
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x100016c2
mov ecx, dword [esi + 0xc]
push 4
push 0x1000
add ecx, edx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100016c2
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
push 4
push 0x1000
add ecx, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
inc eax
inc ebx
sub ebx, 2
dec eax
inc ebx
lea edx, [ebp - 0x20]
push 0x10007730
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x55
call fcn.1000243a
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov eax, ecx
add esi, edi
mov edi, dword [ebp - 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x100016b2
and ecx, 3
rep movsb byte es:[edi], byte [esi]
ret
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
inc ecx
add esi, 0x28
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], esi
jmp 0x100015e8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf04000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xf0400a
jmp 0xf0600f
jmp fcn.00aa2160
Function at 0x4384a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438651
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405400
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x438668
call fcn.0040505c
mov eax, ebx
call fcn.00428bc0
mov edi, eax
dec edi
test edi, edi
jl 0x438558
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00428b94
mov edx, dword [0x462d14]
call fcn.0040403c
test al, al
je 0x438554
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00428b94
lea edx, [ebp - 0x14]
call fcn.0046da98
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405400
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050d0
inc esi
dec edi
jne 0x438506
mov al, byte [0x43866c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x438678
mov eax, dword [ebp - 0xc]
call fcn.0040f218
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404de8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0046da98
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x438668
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0046da98
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x438668
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x438668
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x438684
call fcn.0040ade4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438658
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404d74
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404d74
lea eax, [ebp - 0x14]
call fcn.00404d50
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404d74
ret

Function at 0x44adac
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44adb2
ret
Function at 0x4684a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438651
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00435400
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x438668
call fcn.0043505c
mov eax, ebx
call fcn.00458bc0
mov edi, eax
dec edi
test edi, edi
jl 0x468558
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00458b94
mov edx, dword [0x462d14]
call fcn.0043403c
test al, al
je 0x468554
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00458b94
lea edx, [ebp - 0x14]
call fcn.0049da98
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00435400
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004350d0
inc esi
dec edi
jne 0x468506
mov al, byte [0x43866c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x438678
mov eax, dword [ebp - 0xc]
call fcn.0043f218
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00434de8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0049da98
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x438668
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0049da98
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x438668
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x438668
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x438684
call fcn.0043ade4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438658
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00434d74
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00434d74
lea eax, [ebp - 0x14]
call fcn.00434d50
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00434d74
ret
Function at 0x475a8c
Capabilities:
Get number of processors

Disassembly:
clc
add byte [esp + eax - 0x4d], dh
add ch, bl
sbb ecx, dword [ebp + 0x74a1e055]
fistp dword [esi]
call fcn.00478be0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x475aad
xor ebx, ebx
jmp 0x475aaf
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x5e7148]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.004742d0
push eax
call dword [0x5e7040]
mov eax, dword [0x5ebf50]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.004719cc
push 4
mov eax, dword [ebp - 4]
call fcn.004742d0
push eax
call fcn.00408310
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475b28
call fcn.00407960
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret

Function at 0x49859c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax - 0x77], cl
inc esp
and al, 0xc
jmp 0x498607
mov edx, dword [esp]
mov eax, dword [esp]
mov ecx, dword [edx + 0x98]
cmp ecx, dword [eax + 0x90]
jne 0x4985f1
mov edx, dword [esp]
cmp dword [edx + 0x190], 0
jne 0x4985cb
mov ecx, 1
jmp 0x4985cd
xor ecx, ecx
mov dword [esp + 0x90], ecx
mov eax, dword [esp]
mov edx, dword [eax + 0x94]
mov eax, dword [esp]
mov ecx, dword [eax + 0x9c]
add ecx, dword [esp + 0x90]
and al, 0x90
add byte [eax], al
add byte [ebx], bh
sal dword [edi + 0x3d], 1
mov eax, dword [esp]
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x498607
xor eax, eax
jmp 0x498d3d
mov edx, dword [esp]
mov eax, dword [esp]
mov ecx, dword [edx + 0x98]
cmp ecx, dword [eax + 0x90]
jl 0x49862e
mov edx, dword [esp]
mov ecx, dword [edx + 0x1b4]
cmp dword [ecx + 0x14], 0
je 0x4985a4
xor eax, eax
mov dword [esp + 0x18], eax
mov edx, dword [esp]
mov ecx, dword [edx + 0xd8]
mov dword [esp + 0x40], ecx
jmp 0x498d07
Function at 0x4a04a4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [edx + 0x1c]
shl ecx, 3
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, edx
push edx
mov edx, dword [eax + 0xe8]
mov ecx, dword [eax + 0x1c]
mov eax, ebx
call fcn.004a022c
xor ecx, ecx
mov eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x10], ecx
jmp 0x4a04db
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
dec ebp
in al, dx
xor esi, esi
mov edx, dword [eax]
mov eax, dword [ecx]
xor ecx, ecx
cmp esi, dword [ebp - 0xc]
jae 0x4a04d0
movzx edi, byte [eax + 1]
xor ebx, ebx
inc esi
mov bl, byte [eax]
add eax, 2
add ebx, edi
add ebx, ecx
xor ecx, 1
sar ebx, 1
mov byte [edx], bl
inc edx
cmp esi, dword [ebp - 0xc]
jb 0x4a04b3
inc dword [ebp - 8]
add dword [ebp - 0x14], 4
add dword [ebp - 0x10], 4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
cmp edx, dword [ebp - 8]
jg 0x4a04a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f9dfc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0xc0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
invalid
invalid
push eax
invalid
invalid
Function at 0x4fa6d4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
call 0x894ecae1
inc edi
add dword [ebx], esi
ror byte [edx - 0x2dcc6fbb], 0x8a
pop ss
Function at 0x401a70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x10]
call fcn.00401120
add esp, 4
xor eax, eax
pop ebp
ret 0x10
Function at 0x4013e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], eax
call dword [0x417c70]
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x1a
push esi
call ebx
test eax, eax
je 0x401455
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 5
push esi
call ebx
push 0x415a60
push edi
call sub.MSVCR80.dll_wcsstr
cmp eax, esi
pop ecx
pop ecx
jne 0x40147b
push 0x5c
push str.SoftwareMicrosoftVisualStudio8.0
call sub.MSVCR80.dll_wcschr
cmp eax, esi
pop ecx
pop ecx
je 0x40149c
add eax, 2
mov edi, dword [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0x10]
push str._s_s
dec eax
call fcn.00401000
add esp, 0xc
jmp 0x4014a7
mov edx, dword [ebp - 0x210]
call fcn.00401051
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bb82
leave
ret 0xc

Function at 0x401501
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0x10
push 0x414954
push dword [ebp + 8]
call dword [sym.imp.MSVCR80.dll__wfsopen]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x401571
push edi
call dword [sym.imp.MSVCR80.dll__fileno]
push eax
call dword [sym.imp.MSVCR80.dll__filelength]
cmp eax, 0x200000
pop ecx
pop ecx
ja 0x401569
push edi
push 1
test eax, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
jne 0x401576
and dword [ebp - 4], 0
and dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x51534356
mov dword [ebp - 0xc], 1
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x4015a4
push edi
call dword [sym.imp.MSVCR80.dll_fclose]
pop ecx
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x401569
cmp dword [ebp - 0x10], 0x51534356
jne 0x401569
cmp dword [ebp - 0xc], eax
jne 0x401569
push 2
push 0
push edi
call dword [sym.imp.MSVCR80.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x401569
mov eax, edi
jmp 0x401573

Function at 0x401d7d
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [sym.imp.MSVCR80.dll_wcsstr]
mov ebx, 0x414960
mov esi, eax
push ebx
push esi
call edi
test eax, eax
pop ecx
pop ecx
je 0x401def
cmp eax, esi
je 0x401def
movzx ecx, word [eax - 2]
cmp cx, 0x20
je 0x401db6
cmp cx, 9
jne 0x401def
movzx eax, word [eax + 4]
cmp ax, 0x20
je 0x401dcb
cmp ax, 9
je 0x401dcb
test ax, ax
jne 0x401def
mov esi, dword [esp + 0x14]
jmp 0x401de0
add ebp, 4
push ebx
push dword [ebp]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x401def
dec esi
test esi, esi
jg 0x401dd1
mov dword [0x41919c], 1
pop edi
pop esi
pop ebp
pop ebx
ret