joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44328e
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
push 0x10
pop ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
xor esi, esi
push str._nSAMKey_:
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], eax
call fcn.00407017
mov eax, dword [ebp + 8]
push esi
push 0x474854
push esi
push dword [ebp + 0xc]
lea edi, [ebp - 8]
call fcn.00408995
add esp, 0x14
test eax, eax
je 0x44341a
mov esi, dword [ebp - 8]
movzx eax, word [esi]
mov ecx, eax
dec ecx
dec ecx
je 0x443368
dec ecx
je 0x443305
push eax
push str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_F_revision___hu_
call fcn.00407017
pop ecx
pop ecx
jmp 0x443406
mov eax, dword [esi + 0x68]
cmp eax, 2
jne 0x443360
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x74]
lea eax, [esi + 0x88]
push eax
lea eax, [esi + 0x78]
push eax
push dword [ebp + 0x10]
call fcn.004035c7
add esp, 0x18
test eax, eax
je 0x443406
xor eax, eax
cmp dword [ebp - 0x10], ebx
sete al
mov dword [ebp - 4], eax
test eax, eax
je 0x443352
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x443406
push eax
push str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Struct_Key_revision___u_
jmp 0x4432f9
mov eax, dword [esi + 0x68]
cmp eax, 1
jne 0x44340f
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Init
push ebx
lea eax, [esi + 0x70]
push eax
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push 0x2f
push str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push 0x29
push str.0123456789012345678901234567890123456789
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Final
mov edi, dword [ebp + 0x14]
sub esi, 0xffffff80
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call sub.ADVAPI32.dll_SystemFunction032
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x443403
push 0x474858
call fcn.00407017
pop ecx
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x443425
push eax
push str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Classic_Struct_Key_revision___u_
jmp 0x4432f9
push str.ERROR_kuhl_m_lsadump_getSamKey___kull_m_registry_OpenAndQueryWithAlloc_KO
call fcn.00407017
pop ecx
cmp dword [ebp - 4], 0
je 0x443438
push ebx
push dword [ebp + 0x14]
xor eax, eax
call fcn.0040a596
pop ecx
pop ecx
push 0x45d6e4
call fcn.00407017
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448ace
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push esi
xor esi, esi
sub ecx, esi
mov eax, 0xc0000225
push edi
mov dword [ebp - 4], eax
je 0x448b0d
dec ecx
je 0x448aff
dec ecx
jne 0x448bd0
mov edi, 0x800
mov dword [ebp - 8], 0x479670
jmp 0x448b17
mov edi, 0x800
mov dword [ebp - 8], 0x47964c
jmp 0x448b17
xor edi, edi
inc edi
mov dword [ebp - 8], 0x479624
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
push 0x472c8c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a7d9
add esp, 0x14
test eax, eax
je 0x448bc1
push esi
push esi
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ebx, eax
add esp, 0xc
cmp ebx, esi
je 0x448bc1
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x448bad
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x448b78
dec eax
je 0x448b70
dec eax
jne 0x448b91
push edi
call sub.ntdll.dll_NtResumeProcess
jmp 0x448b7f
push edi
call sub.ntdll.dll_NtSuspendProcess
jmp 0x448b7f
push esi
push edi
call sub.ntdll.dll_NtTerminateProcess
cmp eax, esi
mov dword [ebp - 4], eax
jl 0x448b91
push ebx
push dword [ebp - 8]
push str._s_of__u_PID_:_OK___n
jmp 0x448b9c
push dword [ebp - 4]
push dword [ebp - 8]
push str.ERROR_kuhl_m_process_genericOperation____s_0x_08x_n
call fcn.00407017
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448bcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_process_genericOperation___OpenProcess__0x_08x__n
call fcn.00407017
pop ecx
jmp 0x448bcb
push str.ERROR_kuhl_m_process_genericOperation___pid___pid:123__is_missing
call fcn.00407017
pop ecx
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4507a2
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x480748
call fcn.00454c14
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x487280
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x4505c1
cmp eax, esi
jne 0x4505b4
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4505c4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45059b
xor esi, esi
inc esi
mov eax, dword [0x48727c]
cmp eax, esi
jne 0x4505d7
push 0x1f
call fcn.0051d000
pop ecx
jmp 0x450612
mov eax, dword [0x48727c]
test eax, eax
jne 0x45060c
mov dword [0x48727c], esi
push 0x4576fc
push 0x4576ec
call fcn.00450522
pop ecx
pop ecx
test eax, eax
je 0x450612
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4506dc
mov dword [0x486a2c], esi
mov eax, dword [0x48727c]
cmp eax, esi
jne 0x450636
push 0x4576e8
push 0x4576e0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x48727c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x450643
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x487284], ebx
je 0x450664
push 0x487284
call fcn.00454a74
pop ecx
test eax, eax
je 0x450664
push ebx
push 2
push ebx
call dword [0x487284]
push dword [0x486a14]
push dword [0x486a18]
push dword [0x486a10]
call fcn.00437fec
add esp, 0xc
mov dword [0x486a28], eax
cmp dword [0x486a1c], ebx
jne 0x4506c2
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x486a2c], ebx
jne 0x4506d0
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x486a28]
call fcn.00454c59
ret
call fcn.00454d40
jmp 0x450579
Function at 0x454e1a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x454e49
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0044fdf4
add esp, 0x14
jmp 0x454f27
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x454f27
test al, 0x40
jne 0x454f27
test al, 2
je 0x454e6b
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x454f27
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x454e2b
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x454f17
cmp eax, 0xffffffff
je 0x454f17
test byte [esi + 0xc], 0x82
jne 0x454eec
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x454ed7
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x454ed7
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x454edc
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x454eec
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x454f0a
mov eax, dword [esi + 0xc]
test al, 8
je 0x454f0a
test eax, 0x400
jne 0x454f0a
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x454f2a
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4567d1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x456800
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0044fdf4
add esp, 0x14
jmp 0x4568ea
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x4568ea
test al, 0x40
jne 0x4568ea
test al, 2
je 0x456822
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x4568ea
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x4567e2
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x4568da
cmp eax, 1
je 0x4568da
cmp eax, 0xffffffff
je 0x4568da
test byte [esi + 0xc], 0x82
jne 0x4568ac
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x456897
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x456897
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x45689c
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x4568ac
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x4568ca
mov eax, dword [esi + 0xc]
test al, 8
je 0x4568ca
test eax, 0x400
jne 0x4568ca
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x4568ef
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x404840
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x46d79b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00468538
push 4
mov dword [esp + 0x20], 0
call fcn.0042bcbe
mov edi, eax
add esp, 4
test edi, edi
je 0x4048be
call fcn.0046894d
mov dword [edi], eax
call fcn.0046877b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0046869f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4048b3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004686c7
jmp 0x4048c0
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406f80
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov byte [esi + 0x68], al
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [ecx + 0x18], 0x10
mov eax, dword [ecx + 0x14]
jb 0x406fc7
mov ecx, dword [ecx + 4]
push ecx
mov ecx, esi
call fcn.00406fe0
mov eax, esi
pop esi
ret 4
add ecx, 4
push ecx
mov ecx, esi
call fcn.00406fe0
mov eax, esi
pop esi
ret 4
Function at 0x408c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x46e1b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
cmp dword [esp + 0x54], 3
ja 0x408cde
cmp dword [esp + 0x58], 8
jb 0x408cc9
mov eax, dword [esp + 0x44]
push eax
call fcn.0042bced
add esp, 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x44]
mov edi, 8
cmp dword [esp + 0x58], edi
jae 0x408cf1
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408d29
test al, 0x10
je 0x408d29
cmp dword [esp + 0x58], edi
jb 0x408d14
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0042bced
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x58], edi
jae 0x408d37
lea eax, [esp + 0x44]
push eax
call fcn.004517df
add esp, 4
test eax, eax
jne 0x408d6c
cmp dword [esp + 0x58], edi
jb 0x408d14
mov edx, dword [esp + 0x44]
push edx
call fcn.0042bced
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
push 1
push 0x47c3f0
lea ebx, [esp + 0x48]
call fcn.0040ada0
mov esi, eax
mov eax, dword [esp + 0x54]
dec eax
cmp esi, eax
jne 0x408db0
mov ecx, ebx
push ecx
mov ecx, esi
xor edx, edx
lea esi, [esp + 0x18]
call fcn.00409420
push 1
push 0x47c3f0
mov ebx, eax
call fcn.0040ada0
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00402d40
test esi, esi
jg 0x408dd2
lea ecx, [esp + 0x40]
call fcn.00402d40
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
lea edx, [esp + 0x40]
push edx
mov ecx, esi
xor edx, edx
lea esi, [esp + 0x18]
call fcn.00409420
mov byte [esp + 0x38], 1
cmp dword [eax + 0x18], edi
jb 0x408df3
mov eax, dword [eax + 4]
jmp 0x408df6
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00402cd0
call fcn.00408c80
add esp, 0x1c
lea ecx, [esp + 0x14]
mov bl, al
call fcn.00402d40
test bl, bl
je 0x408db4
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x58], edi
jae 0x408e2a
lea eax, [esp + 0x44]
push eax
call fcn.004517df
add esp, 4
test eax, eax
lea ecx, [esp + 0x40]
sete bl
call fcn.00402d40
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40b3a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x46d74b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00468538
push 4
mov dword [esp + 0x24], 0
call fcn.0042bcbe
mov edi, eax
add esp, 4
test edi, edi
je 0x40b422
call fcn.0046894d
mov dword [edi], eax
call fcn.0046877b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0046869f
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40b417
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004686c7
jmp 0x40b424
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x40b830
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x46de48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.004039d0
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40b890
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040aaf0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.004039d0
cmp dword [esp + 0x28], 8
jb 0x40b8dd
mov eax, dword [esp + 0x14]
push eax
call fcn.0042bced
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x40cd20
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
push ebx
push ebp
push esi
mov esi, dword [edx + 4]
mov edx, eax
shr edx, 4
xor edx, esi
and edx, 0xf0f0f0f
xor esi, edx
shl edx, 4
xor eax, edx
mov edx, eax
shr edx, 0x10
xor edx, esi
and edx, 0xffff
xor esi, edx
shl edx, 0x10
xor eax, edx
mov edx, esi
shr edx, 2
xor edx, eax
and edx, 0x33333333
xor eax, edx
add edx, edx
add edx, edx
xor esi, edx
mov edx, esi
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor eax, edx
shl edx, 8
xor edx, esi
rol edx, 1
mov esi, edx
xor edx, eax
and edx, 0xaaaaaaaa
xor esi, edx
xor edx, eax
rol edx, 1
push edi
mov ecx, 0x490d68
mov edi, edx
mov dword [esp + 0x10], 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x48d2d0]
or edx, dword [ebx*4 + 0x48d4d0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x48d6d0]
and eax, 0x3f
or edx, dword [eax*4 + 0x48d8d0]
mov eax, dword [ecx]
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x48d3d0]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x48d5d0]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x48d7d0]
and eax, 0x3f
or ebx, dword [eax*4 + 0x48d9d0]
add ecx, 4
or ebx, edx
xor edi, ebx
mov eax, edi
ror eax, 4
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x48d2d0]
or edx, dword [ebx*4 + 0x48d4d0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x48d6d0]
and eax, 0x3f
or edx, dword [eax*4 + 0x48d8d0]
mov eax, dword [ecx]
xor eax, edi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x48d3d0]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x48d5d0]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x48d7d0]
and eax, 0x3f
or ebx, dword [eax*4 + 0x48d9d0]
add ecx, 4
or ebx, edx
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x40cda0
ror esi, 1
mov eax, esi
xor eax, edi
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, edi
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
add ecx, ecx
add ecx, ecx
xor eax, ecx
mov edx, dword [esp + 0x18]
mov ecx, esi
shr ecx, 0x10
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
pop esi
xor ecx, eax
pop ebp
mov dword [edx + 4], ecx
pop ebx
pop ecx
ret
Function at 0x40cf30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x48b998]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [esp + 0x24], 0x104
mov dword [esp + 0x28], 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cfbf
push esi
lea ecx, [esp + 0x1c]
push str._sConnection
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40cfd8
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0044b1f7
add esp, 0x11c
ret
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.PnpInstanceID
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d01e
push 3
lea ecx, [esp + 0x1c]
push 0x47c588
push ecx
call fcn.00451e15
add esp, 0xc
test eax, eax
jne 0x40d01e
mov bl, 1
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov ecx, dword [esp + 0x120]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0044b1f7
add esp, 0x11c
ret