joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x474ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a3140]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4a3140]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
cmp dword [esi + 0x78], ecx
jne 0x45f4df
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x45f4df
mov ecx, dword [esi + 0x84]
cmp dword [ecx - 4], edi
jle 0x45f4df
mov eax, dword [eax + 0x18]
test al, 3
jne 0x45f47b
test eax, 0x1000000
je 0x45f4df
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x18]
call fcn.0040f8a0
mov edi, dword [esi + 0x64]
sub edi, dword [esi + 0x5c]
xor eax, eax
sar edi, 1
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov dword [esp + 0x64], eax
mov byte [ecx], al
lea eax, [esp + 0x3c]
push eax
call fcn.004024f0
push edi
push 0x11
mov ecx, esi
call fcn.0045e3a0
cmp dword [esp + 0x28], 0x10
jb 0x45f4d8
mov ecx, dword [esp + 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x45f560
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x45f55e
mov eax, dword [esi + 0x84]
cmp dword [eax - 4], edi
jle 0x45f55e
mov edx, dword [eax - 4]
cmp dword [esi + 0x80], eax
je 0x45f512
add eax, 0xfffffffc
mov dword [esi + 0x84], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
mov ebx, dword [eax + 0x140]
sub ebx, ecx
add ebx, 3
and ebx, 0xfffffffc
add ebx, ecx
mov dword [eax + 0x140], ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
mov eax, dword [eax + 0x13c]
sub ecx, edx
mov dword [eax + edx + 8], ecx
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
test ecx, 0xfffffffc
jne 0x45f4f3
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00456bde
add esp, 0x30
ret 4
Function at 0x46dba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x486b30
mov dword [esp], eax
mov dword [esp + 4], 0x482968
mov dword [esp + 8], 0x48605c
mov dword [esp + 0xc], 0x482964
mov dword [esp + 0x10], 0x482960
mov dword [esp + 0x14], 0x485220
mov dword [esp + 0x18], 0x48726c
mov dword [esp + 0x1c], 0x487468
mov dword [esp + 0x20], 0x48295c
mov dword [esp + 0x24], 0x481554
mov dword [esp + 0x28], 0x48154c
mov dword [esp + 0x2c], 0x482958
mov dword [esp + 0x30], 0x486120
mov dword [esp + 0x34], str.___
mov dword [esp + 0x38], 0x485268
mov dword [esp + 0x3c], 0x481548
mov dword [esp + 0x40], str.:___
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x482694
mov dword [esp + 0x4c], 0x487264
mov dword [esp + 0x50], 0x482944
mov dword [esp + 0x54], 0x482940
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x48293c
mov dword [esp + 0x64], 0x482938
mov dword [esp + 0x68], 0x48777c
mov dword [esp + 0x6c], 0x481550
mov dword [esp + 0x70], 0x482698
mov dword [esp + 0x74], 0x482684
mov dword [esp + 0x78], 0x482664
mov dword [esp + 0x7c], 0x482654
mov dword [esp + 0x80], 0x48264c
mov dword [esp + 0x84], 0x482644
mov dword [esp + 0x88], 0x48263c
mov dword [esp + 0x8c], 0x482690
mov dword [esp + 0x90], 0x481544
mov dword [esp + 0x94], 0x482934
mov dword [esp + 0x98], 0x482688
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x48725c
mov dword [esp + 0xc0], 0x487230
mov dword [esp + 0xc4], 0x48721c
mov dword [esp + 0xc8], 0x487270
mov dword [esp + 0xcc], 0x487214
mov dword [esp + 0xd0], 0x487254
mov dword [esp + 0xd4], 0x482930
mov dword [esp + 0xd8], 0x48265c
mov dword [esp + 0xdc], 0x487234
mov dword [esp + 0xe0], 0x48723c
mov dword [esp + 0xe4], 0x48292c
mov dword [esp + 0xe8], 0x487248
mov dword [esp + 0xec], 0x48722c
cmp cl, 0x3c
jae 0x46ddbd
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x46ddf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x4a3140]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
lea eax, [esp + 2]
cmp dx, cx
jae 0x46df5b
add eax, 4
cmp word [eax], cx
jb 0x46df53
sub eax, 2
cmp cx, word [eax]
jb 0x46df80
cmp cx, word [eax + 2]
ja 0x46df80
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00456bde
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor ecx, esp
xor al, al
call fcn.00456bde
add esp, 0x9c
ret

Function at 0x46e6f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475f09
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4a3140]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov dword [esp + 4], 0
lea eax, [ecx - 0x30]
mov dword [esp + 0x30], 0x482e4c
mov dword [esp + 0x38], vtable.boost::exception_detail::clone_base.0
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0
mov dword [esp + 8], 1
call fcn.0046e410
mov eax, dword [esp + 0x30]
mov dword [esp + 8], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
mov dword [esp + 0x1c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov edx, dword [esp + 0x30]
mov eax, dword [edx + 4]
push 0x493b08
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + eax + 0x34], 0
mov dword [esp + 0x4c], 0xffffffff
call sub.MSVCR100.dll__CxxThrowException
int3
sub ecx, dword [ecx - 4]
jmp 0x46e6f0
Function at 0x4708e4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x52b394], 0
push esi
push edi
jne 0x47085a
call fcn.004707c6
test eax, eax
je 0x47089f
mov eax, dword [0x52b394]
cmp eax, 1
jne 0x47087b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x47089f
jmp 0x4708e1
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4708e1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4708a3
xor eax, eax
jmp 0x4708e1
mov eax, dword [esi]
push dword [0x52b394]
call edi
mov edi, eax
test edi, edi
je 0x4708c5
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4708e1
lea edi, [esi + 0xff0]
push esi
push dword [0x52b394]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4708cb
mov eax, esi
pop edi
pop esi
ret
jmp 0x470846
Function at 0x471bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x476590
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4a3140]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3140]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
jb 0x471bfc
mov eax, dword [edi]
jmp 0x471bfe
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x471c1c
push esi
push edi
push ebp
call fcn.00471910
add esp, 0xc
jmp 0x471d6f
test ebx, 0x400
je 0x471d2b
cmp dword [edi + 0x14], 8
jb 0x471c32
mov edx, dword [edi]
jmp 0x471c34
mov edx, edi
xor eax, eax
mov word [esp + 0x20], ax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x471c50
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.004042f0
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 0
jae 0x471c81
lea eax, [esp + 0x20]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x48], 2
jb 0x471cb6
mov ecx, dword [esp + 0x20]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, 0xffffffff
jne 0x471ce6
mov eax, dword [esp + 0x1c]
push eax
push edi
push ebp
call fcn.00471910
add esp, 0xc
jmp 0x471d6f
push edi
call fcn.00470b70
add esp, 4
test al, al
jne 0x471d18
push ebx
push edi
call fcn.00470f90
add esp, 8
push esi
mov dword [ebp], 9
mov dword [ebp + 4], eax
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x471d6f
push esi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x471d3d
mov dword [esi], 0
call fcn.004577d0
mov dword [esi + 4], eax
push ebx
push edi
mov dword [esp + 0x1c], 3
test bl, 0x10
jne 0x471d54
mov dword [esp + 0x1c], 2
call fcn.00470f90
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 8
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00456bde
add esp, 0x38
ret
Function at 0x4144a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e44a
and dword [ebp - 0x14], 0
cmp dword [0x41f284], 0
mov dword [ebp - 0x18], eax
jne 0x41455a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414602
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x414602
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41f284], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41f288], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41f28c], eax
call edi
push eax
call esi
mov dword [0x41f294], eax
test eax, eax
je 0x41455a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41f290], eax
mov eax, dword [0x41f290]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4145b3
cmp dword [0x41f294], ecx
je 0x4145b3
push eax
call esi
push dword [0x41f294]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4145b3
test ebx, ebx
je 0x4145b3
call edi
test eax, eax
je 0x4145aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4145aa
test byte [ebp - 8], 1
jne 0x4145b3
or dword [ebp + 0x10], 0x200000
jmp 0x4145e6
mov eax, dword [0x41f288]
cmp eax, dword [ebp - 0x18]
je 0x4145e6
push eax
call esi
test eax, eax
je 0x4145e6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4145e6
mov eax, dword [0x41f28c]
cmp eax, dword [ebp - 0x18]
je 0x4145e6
push eax
call esi
test eax, eax
je 0x4145e6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41f284]
call esi
test eax, eax
je 0x414602
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x414604
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407166
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x6a1f69e5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, str.Lj
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x4c1e06da
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402fd0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x830
mov eax, dword [esp + 0x834]
mov ecx, dword [eax]
push ebx
mov ebx, dword [0x430f5c]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [0x430f58]
xor ebp, ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x38], 0x9e3779b9
call fcn.00402fa0
mov eax, dword [0x430f60]
mov edx, dword [0x430f64]
add dword [esp + 0x14], 0x23f
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x2adda24]
shl ecx, 4
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
cmp eax, 0xfa9
jne 0x403060
mov dword [0x2adda20], 0xedeb2e40
jmp 0x40306d
cmp eax, 0x3eb
jne 0x40306d
mov dword [0x2ada92c], ebp
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x18]
mov dword [0x2adda1c], 0xf4ea3dee
call fcn.00402fb0
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0x18], eax
cmp dword [0x2adda24], 0x213
jne 0x4030ec
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [esp + 0x40]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
mov eax, esi
mov dword [esp + 0x34], esi
call fcn.00402f90
add dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x14]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov edx, esi
shr edx, 5
add edx, ebx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
cmp dword [0x2adda24], 0x121
jne 0x40314c
push ebp
push ebp
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ecx
call fcn.00402fc0
mov eax, dword [esp + 0x38]
sub dword [esp + 0x14], eax
sub dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x28]
jne 0x403030
mov eax, dword [esp + 0x844]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x830
ret 4
Function at 0x409d40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430bc0]
jne 0x409d4a
repz ret
jmp fcn.0040ddbb

Function at 0x40d614
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004090a0
and dword [ebp - 4], 0
cmp dword [0x432d30], 0
mov ebx, eax
jne 0x40d6c5
push 0x401b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d776
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b0c
push edi
call esi
test eax, eax
je 0x40d776
push eax
call fcn.0040902e
mov dword [esp], 0x401afc
push edi
mov dword [0x432d30], eax
call esi
push eax
call fcn.0040902e
mov dword [esp], 0x401ae8
push edi
mov dword [0x432d34], eax
call esi
push eax
call fcn.0040902e
mov dword [esp], 0x401acc
push edi
mov dword [0x432d38], eax
call esi
push eax
call fcn.0040902e
pop ecx
mov dword [0x432d40], eax
test eax, eax
je 0x40d6c5
push 0x401ab4
push edi
call esi
push eax
call fcn.0040902e
pop ecx
mov dword [0x432d3c], eax
mov eax, dword [0x432d3c]
cmp eax, ebx
je 0x40d71d
cmp dword [0x432d40], ebx
je 0x40d71d
push eax
call fcn.004090a9
push dword [0x432d40]
mov esi, eax
call fcn.004090a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d71d
test edi, edi
je 0x40d71d
call esi
test eax, eax
je 0x40d714
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d714
test byte [ebp - 0xc], 1
jne 0x40d71d
or dword [ebp + 0x10], 0x200000
jmp 0x40d756
mov eax, dword [0x432d34]
cmp eax, ebx
je 0x40d756
push eax
call fcn.004090a9
pop ecx
test eax, eax
je 0x40d756
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d756
mov eax, dword [0x432d38]
cmp eax, ebx
je 0x40d756
push eax
call fcn.004090a9
pop ecx
test eax, eax
je 0x40d756
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432d30]
call fcn.004090a9
pop ecx
test eax, eax
je 0x40d776
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d778
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448735
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x465124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x46632c
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00423f40
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x465cb4
push eax
call fcn.00423f40
mov esi, dword [0x46633c]
xor ebx, ebx
mov edi, dword [0x466340]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x468ac8], bl
mov eax, ebx
mov ecx, 0x46632c
cmovae ecx, dword [0x46632c]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x468bd8], al
inc ebx
cmp ebx, 0x100
jl 0x404de0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x468ac8]
movzx eax, byte [esi + 0x468bd8]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404e34
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x468ac8]
mov byte [esi + 0x468ac8], al
inc esi
mov byte [edi + 0x468ac8], dl
cmp esi, 0x100
jl 0x404e10
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404a40
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404e89
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404e7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404edf
push edx
push ecx
call fcn.00429d26
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404ecb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ec1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404edf
push edx
push ecx
call fcn.00429d26
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042ea38
int3
Function at 0x406320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4488a5
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x465124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x414], edi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.0042b340
add esp, 0xc
mov dword [ebp - 0x414], 0x400
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x418]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4063d0
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
mov dword [edi], 0
mov dword [edi + 0x10], 0
lea edx, [ecx + 1]
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406400
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, edi
call fcn.00423f40
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x406448
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40643e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4064a7
push edx
push ecx
call fcn.00429d26
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x40648a
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406480
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4064a7
push edx
push ecx
call fcn.00429d26
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004296b0
mov esp, ebp
pop ebp
ret
call fcn.0042ea38
int3