joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405027
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x51c628
call fcn.004ac5bf
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x405127
cmp byte [ebx + 0x3d], 0
je 0x405127
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x405061
xor al, al
jmp 0x405129
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.00404c23
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4050bf
sub eax, 1
je 0x4050c3
dec eax
sub eax, 1
je 0x405115
xor bl, bl
jmp 0x405117
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x4050fb
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004f23b6
add esp, 0x10
cmp esi, eax
jne 0x4050bb
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x405115
test esi, esi
jne 0x405085
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00404d80
jmp 0x40507f
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004049c9
mov al, bl
jmp 0x405129
mov al, 1
call fcn.004ac569
ret

Function at 0x406b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406b64
xor eax, eax
jmp 0x406be4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406b7b
xor eax, eax
jmp 0x406be4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x406bc7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x406bc7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x406b9e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x406bd3
xor eax, eax
jmp 0x406be4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x406be1
xor eax, eax
jmp 0x406be4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x409ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 1], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 2], al
mov ecx, 1
imul edx, ecx, 0
add edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
jmp 0x409d1e
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jae 0x409dce
movzx edx, byte [ebp - 1]
add edx, 1
and edx, 0x800000ff
jns 0x409d41
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
movzx eax, byte [ebp - 2]
add edx, eax
and edx, 0x800000ff
jns 0x409d65
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 2], dl
movzx ecx, byte [ebp - 2]
add ecx, dword [ebp - 8]
push ecx
movzx edx, byte [ebp - 1]
add edx, dword [ebp - 8]
push edx
call fcn.00409df0
add esp, 8
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + eax]
add edx, eax
and edx, 0x800000ff
jns 0x409da8
dec edx
or edx, 0xffffff00
inc edx
mov byte [ebp - 3], dl
movzx ecx, byte [ebp - 3]
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov byte [eax], dl
jmp 0x409d15
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x100], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 2]
mov byte [eax + 0x101], cl
mov esp, ebp
pop ebp
ret

Function at 0x40d990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x48
mov edi, ecx
call fcn.004ac2cd
push 0x48
mov esi, eax
push 0
push esi
call fcn.004e9750
add esp, 0x10
mov ecx, esi
call fcn.0040d6c0
mov edx, dword [ebp + 8]
mov ebx, eax
mov dword [edi + 0x68], ebx
cmp byte [edx], 0
jne 0x40d9c6
xor ecx, ecx
jmp 0x40d9d9
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d9d0
sub ecx, esi
push ecx
push edx
lea ecx, [ebx + 8]
call fcn.00404c71
mov eax, dword [edi + 0x68]
push 9
push str.GET_test1
mov dword [eax + 4], 1
mov ecx, dword [edi + 0x68]
add ecx, 0x2c
call fcn.00404c71
lea eax, [edi + 0x10]
push eax
push 0
push edi
push 0x40da40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x14], eax
pop edi
pop esi
pop ebx
test eax, eax
je 0x40da2d
cmp eax, 0xffffffff
je 0x40da2d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebp
ret 4
Function at 0x40e3d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
test esi, esi
je 0x40e52f
lea ecx, [esi*8]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esi*8]
lea eax, [ecx + ecx*2]
add eax, eax
sub edx, eax
sub edx, 2
je 0x40e419
sub edx, 2
jne 0x40e41c
add ecx, 2
jmp 0x40e41c
add ecx, 3
mov eax, dword [ebp + 0xc]
inc ecx
cmp dword [eax], ecx
jge 0x40e431
pop esi
mov dword [eax], ecx
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x55555556
imul esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
xor eax, eax
test ecx, ecx
jle 0x40e4c6
dec ecx
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + 0x54b0f0]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
movzx eax, byte [eax + 0x54b0f0]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
movzx eax, byte [eax + 0x54b0f0]
mov byte [edi + 2], al
movzx eax, byte [esi + 0x54b0f0]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x40e462
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, esi
jge 0x40e521
movzx edx, byte [ebx]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, esi
jge 0x40e4db
movzx ecx, byte [ebx + 1]
jmp 0x40e4dd
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
movzx eax, byte [eax + 0x54b0f0]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + 0x54b0f0]
mov byte [edi + 1], al
cmp dword [ebp - 0xc], esi
jge 0x40e516
and ecx, 0xf
mov al, byte [ecx*4 + 0x54b0f0]
mov byte [edi + 2], al
jmp 0x40e51a
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov ecx, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 8]
mov byte [edi], 0
pop edi
mov dword [ecx], eax
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f650
Capabilities:
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cb77
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x569564]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00411f00
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x20]
mov byte [ebp - 4], 3
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 4
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 5
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x38]
mov byte [ebp - 4], 6
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x40]
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0
push 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 8
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x50]
mov byte [ebp - 4], 9
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x58]
mov byte [ebp - 4], 0xa
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x60]
mov byte [ebp - 4], 0xb
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x68]
mov byte [ebp - 4], 0xc
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
lea esi, [edi + 0x70]
mov byte [ebp - 4], 0xd
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00411f00
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4101b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cc28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x410240
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
jb 0x4101fb
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
push ecx
call fcn.00516250
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.004130d0
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00407590
push eax
call ebx
lea ecx, [ebp - 0x2c]
test eax, eax
je 0x410260
mov dword [ebp - 4], 0xffffffff
call fcn.00409ad0
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x4101f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ac267
mov esp, ebp
pop ebp
ret 4
call fcn.00409ad0
xor al, al
jmp 0x410242

Function at 0x410270
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cc28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x410300
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
jb 0x4102bb
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
push ecx
call fcn.00516250
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.004130d0
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00407590
push eax
call ebx
lea ecx, [ebp - 0x2c]
test eax, eax
jne 0x410320
mov dword [ebp - 4], 0xffffffff
call fcn.00409ad0
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x4102b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ac267
mov esp, ebp
pop ebp
ret 4
call fcn.00409ad0
xor al, al
jmp 0x410302
Function at 0x414210
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51d560
mov eax, dword fs:[0]
push eax
mov eax, 0x1044
call fcn.004ac2a0
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x104c], ebx
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 0x1050], ebx
mov dword [ebp - 0x1048], 0
mov dword [ebp - 4], 1
call fcn.004075e0
push 0x1000
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x1048], 1
push 0
push eax
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x103c], 0
call fcn.004e9750
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 0x1040]
add esp, 0xc
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push eax
call esi
test eax, eax
jne 0x4142db
push eax
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea eax, [ebp - 0x1040]
push eax
call esi
test eax, eax
je 0x414436
push 0x54d160
lea ecx, [ebp + 8]
call fcn.00407590
push eax
call fcn.004f15f0
mov esi, eax
add esp, 8
test esi, esi
je 0x414428
lea eax, [ebp - 0x103c]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x1040]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ebx, 0x100
push esi
call fcn.004f140d
add esp, 4
test eax, eax
jne 0x414379
nop
push 0x1000
lea eax, [ebp - 0x1020]
push 0
push eax
call fcn.004e9750
push esi
push 0x1000
lea eax, [ebp - 0x1020]
push 1
push eax
call fcn.004f17f5
add esp, 0x1c
push 0
push eax
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x103c]
call edi
push esi
call fcn.004f140d
add esp, 4
test eax, eax
je 0x414330
sub ebx, 1
jne 0x414322
push esi
call fcn.004f138d
add esp, 4
mov dword [ebp - 0x1044], 0x10
lea eax, [ebp - 0x1044]
mov byte [ebp - 0x20], bl
xorps xmm0, xmm0
mov dword [ebp - 0x17], ebx
movq qword [ebp - 0x1f], xmm0
push ebx
push eax
lea eax, [ebp - 0x20]
mov word [ebp - 0x13], bx
push eax
push 2
push dword [ebp - 0x103c]
mov byte [ebp - 0x11], bl
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x103c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1038]
call fcn.00414030
add esp, 4
mov esi, eax
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x104c]
cmp ebx, esi
je 0x41441d
push 0
push 1
mov ecx, ebx
call fcn.00409a10
mov ecx, esi
call fcn.00407ad0
mov ecx, ebx
call fcn.00407ad0
mov ecx, esi
call fcn.00407ad0
mov ecx, ebx
call fcn.00407ad0
push esi
mov ecx, ebx
call fcn.004140f0
lea ecx, [ebp - 0x1038]
call fcn.00409ad0
push 0
push dword [ebp - 0x1040]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [ebp + 8]
call fcn.00409ad0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac267
mov esp, ebp
pop ebp
ret
Function at 0x414b03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov al, byte [edi + 0x208]
mov ebx, dword [edi + 0x200]
sub edx, ebx
mov byte [ebp - 1], al
sub ecx, ebx
mov eax, dword [ebp + 0xc]
add eax, ebx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
cmp ebx, eax
jae 0x414b70
sub edx, ecx
mov dword [ebp + 0xc], edx
push esi
mov al, byte [ebp - 1]
movzx esi, bl
mov dl, byte [esi + edi]
add al, dl
movzx ecx, al
mov byte [ebp - 1], al
mov al, byte [ecx + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
mov al, byte [esi + edi]
mov ecx, dword [ebp + 8]
add al, dl
mov edx, dword [ebp + 0xc]
add ecx, ebx
movzx eax, al
mov al, byte [eax + edi]
xor al, byte [edx + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [ebp - 8]
jb 0x414b37
pop esi
mov al, byte [ebp - 1]
mov dword [edi + 0x200], ebx
mov byte [edi + 0x208], al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414b85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov al, byte [edi + 0x209]
mov ebx, dword [edi + 0x204]
sub edx, ebx
mov byte [ebp - 1], al
sub ecx, ebx
mov eax, dword [ebp + 0xc]
add eax, ebx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
cmp ebx, eax
jae 0x414c0a
sub edx, ecx
mov dword [ebp + 0xc], edx
push esi
mov al, byte [ebp - 1]
movzx esi, bl
mov dl, byte [esi + edi + 0x100]
add al, dl
movzx ecx, al
mov byte [ebp - 1], al
mov al, byte [ecx + edi + 0x100]
mov byte [esi + edi + 0x100], al
mov byte [ecx + edi + 0x100], dl
mov al, byte [esi + edi + 0x100]
mov ecx, dword [ebp + 8]
add al, dl
mov edx, dword [ebp + 0xc]
add ecx, ebx
movzx eax, al
mov al, byte [eax + edi + 0x100]
xor al, byte [edx + ecx]
inc ebx
mov byte [ecx], al
cmp ebx, dword [ebp - 8]
jb 0x414bb9
pop esi
mov al, byte [ebp - 1]
mov dword [edi + 0x204], ebx
mov byte [edi + 0x209], al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415de9
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
test edi, edi
jne 0x415df8
xor al, al
jmp 0x415e35
push 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
jne 0x415e18
mov byte [ebp - 1], 0
jmp 0x415e1c
mov byte [ebp - 1], 1
push 0
call dword [sym.imp.USER32.dll_BlockInput]
cmp byte [ebp - 1], 0
je 0x415e33
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
jmp 0x415df4
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41eb6e
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x4ac
mov eax, 0x51ea3a
call fcn.004ac5bf
mov esi, ecx
lea ecx, [ebp - 0x460]
call fcn.004075e0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x478]
push 4
push 0x54b5fc
call fcn.00414928
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x448]
push ecx
mov ecx, eax
call fcn.0041864e
push str.HKCU
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 2
call fcn.004075b0
lea eax, [ebp - 0x460]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x448]
push eax
lea edx, [esi + 0x34]
lea ecx, [ebp - 0x430]
call fcn.00420d11
pop ecx
mov bl, al
pop ecx
neg bl
lea ecx, [ebp - 0x430]
sbb bl, bl
call fcn.00409ad0
lea ecx, [ebp - 0x448]
call fcn.00409ad0
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 0
call fcn.00409ad0
add bl, 1
jne 0x41edb9
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004e9750
add esp, 0xc
lea ecx, [ebp - 0x460]
call fcn.00407590
push eax
lea eax, [ebp - 0x218]
push 0x54ae30
push eax
call fcn.0041e49d
add esp, 0xc
lea ecx, [esi + 0x94]
call fcn.00407590
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41edbb
push 0x200
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.004e9750
add esp, 0xc
lea ecx, [ebp - 0x430]
push 5
push 0x54b604
call fcn.00414928
mov esi, eax
push 3
push 0x54b648
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 4
call fcn.00414928
mov ebx, eax
push 6
push 0x54b690
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 5
call fcn.00414928
mov ecx, esi
mov edi, eax
call fcn.00407590
mov ecx, ebx
mov esi, eax
call fcn.00407590
push dword [ebp + 8]
mov ecx, edi
push esi
push eax
call fcn.00407590
push eax
lea eax, [ebp - 0x418]
push str.___strue____strue____s_d
push eax
call fcn.0041e49d
add esp, 0x18
lea ecx, [ebp - 0x478]
call fcn.00409ad0
lea ecx, [ebp - 0x448]
call fcn.00409ad0
xor ebx, ebx
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], bl
call fcn.00409ad0
push 0x38
lea eax, [ebp - 0x4b4]
push ebx
push eax
call fcn.004e9750
lea eax, [ebp - 0x218]
mov dword [ebp - 0x4b8], 0x3c
mov dword [ebp - 0x4a8], eax
add esp, 0xc
lea eax, [ebp - 0x418]
mov dword [ebp - 0x4b4], 0x140
mov dword [ebp - 0x4a4], eax
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x49c], ebx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41edbb
cmp dword [ebp - 0x498], 0x20
jg 0x41ed79
push dword [ebp - 0x480]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41edbb
push 0x1388
push dword [ebp - 0x480]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x47c], ebx
push eax
push dword [ebp - 0x480]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41ed6b
cmp dword [ebp - 0x47c], 9
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
jmp 0x41ed6b
xor ebx, ebx
lea ecx, [ebp - 0x460]
call fcn.00409ad0
mov al, bl
call fcn.004ac569
ret 4
Function at 0x421179
Capabilities:
Enumerate processes

Disassembly:
push 0x264
mov eax, 0x51ecd6
call fcn.004ac5bf
mov edi, ecx
push 0x22c
xor ebx, ebx
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.004e9750
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4211b7
xor al, al
jmp 0x421239
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x42122c
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x258]
call fcn.004075b0
lea edx, [ebp - 0x258]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x270]
call fcn.00414c1f
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00403840
push ebx
push 1
lea ecx, [ebp - 0x270]
call fcn.004049c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00409ad0
lea eax, [ebp - 0x240]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4211d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
call fcn.004ac569
ret

Function at 0x42135f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
test esi, esi
je 0x421381
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x42137d
mov eax, dword [esi]
jmp 0x42137f
mov eax, esi
mov byte [eax], bl
push 0x40
push 0x54d160
call fcn.00407590
push eax
call fcn.004f1607
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4213a3
xor al, al
jmp 0x42142c
push 0x10000
call fcn.004ac30e
mov ecx, eax
mov dword [ebp - 4], ebx
push edi
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
push 0x10000
push eax
push ecx
mov dword [ebp - 0xc], eax
call fcn.004f17f5
add esp, 0x14
jmp 0x42140d
test esi, esi
je 0x4213e9
mov ecx, dword [ebp + 8]
mov eax, ebx
sub ecx, dword [ebp - 4]
cmp ecx, ebx
cmovb eax, ecx
mov ecx, esi
push eax
push dword [ebp - 8]
call fcn.00404de0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, ecx
cmp eax, ebx
jb 0x42141e
push edi
push 0x10000
push 1
push dword [ebp - 8]
add ecx, ebx
mov dword [ebp - 4], ecx
call fcn.004f17f5
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x4213cd
push edi
call fcn.004f1438
pop ecx
test eax, eax
je 0x421422
mov byte [ebp - 0xc], 0
push edi
call fcn.004f138d
mov al, byte [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret