joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4b9170]
mov edi, ecx
mov ecx, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
dec ebx
mov dword [esp + 0x18], eax
mov byte [esp + 0xf], 0xff
cmp ecx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
je 0x411c80
mov byte [esp + 0xf], cl
cmp byte [edi + 0x2c], 0
je 0x411bf3
xor esi, esi
lea eax, [esp + 0xf]
inc esi
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.0048b35d
add esp, 0x10
mov ecx, dword [ebp + 8]
cmp eax, esi
je 0x411c80
jmp 0x411c8d
lea esi, [esp + 0xf]
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
mov dword [ecx], eax
mov dword [esp + 4], 0xffffffff
lea edx, [esp + 8]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x20]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [esp + 4], esi
je 0x411c8a
mov ebx, eax
cmp eax, 3
je 0x411c68
cmp ebx, 1
ja 0x411c8a
mov esi, dword [esp + 8]
lea eax, [esp + 0x10]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0048b35d
add esp, 0x10
cmp eax, esi
jne 0x411c8a
mov esi, dword [esp + 4]
cmp ebx, 1
je 0x411c01
jmp 0x411c7d
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0048b35d
add esp, 0x10
cmp eax, ebx
jne 0x411c8a
mov ecx, dword [ebp + 8]
xor ebx, ebx
cmp ecx, 0xffffffff
cmovne ebx, ecx
jmp 0x411c8d
xor ebx, ebx
dec ebx
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004771d1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x411ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x411d04
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.0048b35d
add esp, 0x14
jmp 0x411d34
test esi, esi
jle 0x411d2d
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x411d2f
inc edi
mov eax, ebx
cmp esi, edi
jne 0x411d0d
mov edi, esi
jmp 0x411d2f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x411d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4b9170]
movzx ebx, word [ebp + 8]
xor eax, ebp
mov dword [esp + 0x18], eax
xor eax, eax
dec eax
cmp bx, ax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov word [esp + 0xe], ax
je 0x411e39
mov word [esp + 0xe], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x411da7
xor esi, esi
lea eax, [esp + 0xe]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.0048b35d
add esp, 0x10
cmp eax, esi
je 0x411e39
xor ebx, ebx
dec ebx
jmp 0x411e42
lea esi, [esp + 0xe]
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
mov dword [ecx], eax
mov dword [esp + 4], 0xffffffff
lea edx, [esp + 8]
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x20]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [esp + 4], esi
je 0x411d9f
mov ebx, eax
cmp eax, 3
je 0x411e1c
cmp ebx, 1
ja 0x411d9f
mov esi, dword [esp + 8]
lea eax, [esp + 0x10]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0048b35d
add esp, 0x10
cmp eax, esi
jne 0x411d9f
mov esi, dword [esp + 4]
cmp ebx, 1
je 0x411db5
jmp 0x411e35
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0048b35d
add esp, 0x10
cmp eax, ebx
jne 0x411d9f
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004771d1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x411fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x411fff
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x411fe1
pop esi
pop edi
pop ebp
ret 8

Function at 0x412100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x412131
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x412111
pop esi
pop edi
pop ebp
ret 8
Function at 0x417530
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
xor eax, eax
lea ecx, [esi + 0x38]
dec eax
mov dword [ecx - 4], esp
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0x425a10
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x49fae2
push eax
call fcn.004171dc
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea ecx, [ebx + 0x17]
mov dword [esi], ecx
sub esp, 0x18
mov edi, esp
mov eax, 0xff
push ecx
push eax
push edi
call fcn.0047b380
add esp, 0xc
lea eax, [esi + 0x28]
push eax
call fcn.00414000
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi]
push edi
call fcn.004279b3
add esp, 0x1c
add eax, edi
mov dword [esi + 0x1c], edi
mov dword [esi], eax
push dword [ebp + 0x10]
push eax
push edi
call fcn.00417246
add esp, 0xc
mov dword [esi + 0x18], eax
lea eax, [ebx + ebx + 0x2e]
lea ecx, [ebx + ebx + 0x2b]
and eax, 0xfffffffc
call fcn.00477520
mov edi, esp
push ecx
mov eax, 0xff
push eax
push edi
call fcn.0047b380
add esp, 0xc
xor eax, eax
lea ecx, [esi + 0xc]
lea ebx, [esi + 4]
dec eax
mov dword [ecx], eax
lea ecx, [esi + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0040f39a
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 8]
push eax
lea eax, [esi + 0xc]
push eax
mov dword [esi + 0x10], edi
push edi
push dword [esi]
push dword [esi + 0x18]
push dword [esi + 0x1c]
call fcn.004172a0
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x417674
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00403d70
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x417870
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
xor eax, eax
lea ecx, [esi + 0x38]
dec eax
mov dword [ecx - 4], esp
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0x425a30
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0x20]
inc edx
mov dword [eax + 4], ecx
mov dword [eax], 0x25
or eax, edx
mov edx, dword [ebp + 0x10]
push dword [edx + 4]
mov edi, edx
push ecx
push 0x49fae2
push eax
call fcn.004171dc
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
xor eax, eax
inc eax
and ebx, eax
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
mov ecx, esp
mov eax, 0xff
mov dword [esi], ecx
push edi
push eax
push ecx
call fcn.0047b380
add esp, 0xc
lea eax, [esi + 0x28]
push eax
call fcn.00414000
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi]
push edi
call fcn.004279b3
add esp, 0x1c
add eax, edi
mov dword [esi + 0x18], eax
push dword [ebp + 0x10]
push eax
push edi
call fcn.00417246
add esp, 0xc
mov dword [esi + 0x1c], eax
lea eax, [ebx + ebx + 0x2e]
lea ecx, [ebx + ebx + 0x2b]
and eax, 0xfffffffc
call fcn.00477520
mov ebx, esp
push ecx
mov eax, 0xff
push eax
push ebx
call fcn.0047b380
add esp, 0xc
xor eax, eax
lea ecx, [esi + 0xc]
lea edi, [esi + 4]
dec eax
mov dword [ecx], eax
lea ecx, [esi + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
push edi
call fcn.0040f39a
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
push edi
lea eax, [esi + 8]
push eax
lea eax, [esi + 0xc]
push eax
mov dword [esi + 0x10], ebx
push ebx
push dword [esi + 0x18]
push dword [esi + 0x1c]
push dword [esi]
call fcn.004172a0
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x4179b5
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00403d70
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x418690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, esp
mov dword [esi + 0x78], ebp
xor edx, edx
lea ecx, [esi + 0x80]
lea edi, [esi + 0x50]
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x70]
dec edx
mov dword [ecx - 4], esp
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x425a70
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea ecx, [esi + 0x18]
mov dword [edi + 0x10], edx
movdqa xmmword [edi], xmm0
mov word [ecx + 4], 0
mov dword [ecx], 0x7025
push ebx
call fcn.00414000
add esp, 4
push dword [ebp + 0x18]
lea eax, [esi + 0x18]
push eax
push dword [ebx + 4]
push dword [ebx]
push 0x14
push edi
call fcn.004279b3
add esp, 0x18
mov dword [esi + 0x14], eax
lea eax, [esi + eax + 0x50]
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
push eax
push edi
call fcn.00417246
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
pcmpeqd xmm0, xmm0
lea edi, [esi + 8]
dec eax
movdqa xmmword [esi + 0x20], xmm0
mov dword [esi + 0x3d], eax
mov dword [esi + 0x41], eax
movdqa xmmword [esi + 0x30], xmm0
push edi
call fcn.0040f39a
lea eax, [esi + 0x80]
mov ecx, edi
mov dword [eax + 8], 0
push 0x4baea0
call fcn.00421478
mov ecx, dword [esi + 8]
mov ebx, eax
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x418775
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
lea edx, [esi + 0x20]
mov ecx, ebx
mov eax, dword [eax + 0x18]
mov dword [esi + 0x88], 0xffffffff
push edx
mov edi, dword [esi + 0x10]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0xc]
movsx edx, byte [ebp + 0x14]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 0x14]
lea eax, [esi + eax + 0x20]
lea ecx, [esi + ecx + 0x20]
cmove eax, ecx
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00403d70
add esp, 0x1c
mov eax, dword [esi + 0x80]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x418fc0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
xor eax, eax
lea ecx, [esi + 0x38]
dec eax
mov dword [ecx - 4], esp
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0x425ac0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x49fae2
push eax
call fcn.004171dc
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea ecx, [ebx + 0x17]
mov dword [esi], ecx
sub esp, 0x18
mov edi, esp
mov eax, 0xff
push ecx
push eax
push edi
call fcn.0047b380
add esp, 0xc
lea eax, [esi + 0x28]
push eax
call fcn.00414000
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi]
push edi
call fcn.004279b3
add esp, 0x1c
add eax, edi
mov dword [esi + 0x1c], edi
mov dword [esi], eax
push dword [ebp + 0x10]
push eax
push edi
call fcn.00417246
add esp, 0xc
mov dword [esi + 0x18], eax
lea eax, [ebx*4 + 0x58]
call fcn.00477520
lea eax, [ebx*4 + 0x56]
mov edi, esp
push eax
mov eax, 0xff
push eax
push edi
call fcn.0047b380
add esp, 0xc
xor eax, eax
lea ecx, [esi + 0xc]
lea ebx, [esi + 4]
dec eax
mov dword [ecx], eax
lea ecx, [esi + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0040f39a
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 8]
push eax
lea eax, [esi + 0xc]
push eax
mov dword [esi + 0x10], edi
push edi
push dword [esi]
push dword [esi + 0x18]
push dword [esi + 0x1c]
call fcn.00418b60
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x419109
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00418e00
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x419320
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
xor eax, eax
lea ecx, [esi + 0x38]
dec eax
mov dword [ecx - 4], esp
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0x425ae0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0x20]
inc edx
mov dword [eax + 4], ecx
mov dword [eax], 0x25
or eax, edx
mov edx, dword [ebp + 0x10]
push dword [edx + 4]
mov edi, edx
push ecx
push 0x49fae2
push eax
call fcn.004171dc
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
xor eax, eax
inc eax
and ebx, eax
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
mov ecx, esp
mov eax, 0xff
mov dword [esi], ecx
push edi
push eax
push ecx
call fcn.0047b380
add esp, 0xc
lea eax, [esi + 0x28]
push eax
call fcn.00414000
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi]
push edi
call fcn.004279b3
add esp, 0x1c
add eax, edi
mov dword [esi + 0x1c], eax
push dword [ebp + 0x10]
push eax
push edi
call fcn.00417246
add esp, 0xc
mov dword [esi + 0x18], eax
lea eax, [ebx*4 + 0x58]
call fcn.00477520
lea eax, [ebx*4 + 0x56]
mov edi, esp
push eax
mov eax, 0xff
push eax
push edi
call fcn.0047b380
add esp, 0xc
xor eax, eax
lea ecx, [esi + 0xc]
lea ebx, [esi + 4]
dec eax
mov dword [ecx], eax
lea ecx, [esi + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.0040f39a
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
push ebx
lea eax, [esi + 8]
push eax
lea eax, [esi + 0xc]
push eax
mov dword [esi + 0x10], edi
push edi
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi]
call fcn.00418b60
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41946a
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00418e00
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41bf08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004252a2
mov ebx, eax
test esi, esi
je 0x41bf41
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41bf2e
movzx eax, word [eax]
jmp 0x41bf35
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x41bf41
test bl, bl
jne 0x41bf47
jmp 0x41bfa4
xor esi, esi
test bl, bl
jne 0x41bf95
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41bf56
movzx eax, word [eax]
jmp 0x41bf5b
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
movzx eax, ax
mov edx, dword [ecx]
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x41bf86
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41bf7f
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x41bf14
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x41bf14
mov ecx, edi
call fcn.004252a2
mov ebx, eax
test esi, esi
jne 0x41bfad
jmp 0x41bf9e
mov ecx, edi
call fcn.004252a2
mov ebx, eax
test bl, bl
jne 0x41bfcc
jmp 0x41bfd2
mov ecx, edi
call fcn.004252a2
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41bfba
movzx eax, word [eax]
jmp 0x41bfc1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x41bfd2
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x41d3e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
xor edx, edx
pcmpeqd xmm0, xmm0
dec edx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
mov dword [eax + 8], edx
mov dword [eax + 4], 0x425bf0
mov ecx, dword fs:[0]
mov dword [eax], ecx
lea ecx, [esi + 0x20]
mov dword fs:[0], eax
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [esi + 0x14], edx
mov dword [esi + 8], ecx
mov dword [ecx + 0x60], edx
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.0040d920
mov dword [eax], edx
push eax
call fcn.0040f39a
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x4baea0
call fcn.00421478
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea edx, [esi + 3]
lea ecx, [esi + 0x84]
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
mov byte [edx], 0
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.0041c930
add esp, 0x2c
test al, al
je 0x41d540
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x41d4da
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
jmp 0x41d4e6
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x41d502
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
mov ecx, dword [ebp + 0x20]
movsx eax, al
push eax
call fcn.0042657c
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edi, dword [esi + 0x14]
mov edx, dword [esi + 8]
lea ebx, [edi - 1]
cmp edx, ebx
jae 0x41d52c
lea ecx, [edx + 1]
cmp ebx, ecx
cmova ecx, ebx
cmp byte [edx], al
jne 0x41d52c
inc edx
cmp ecx, edx
jne 0x41d521
mov edx, ecx
mov ecx, dword [ebp + 0x20]
mov dword [esi + 0x98], 2
push edi
push edx
call fcn.004252e0
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.004108a4
mov edi, dword [ebp + 8]
test al, al
je 0x41d559
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov dword [edi], eax
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41d572
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [esi + 8], ecx
test eax, eax
je 0x41d592
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x42c060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
cmp dword [0x4bb548], 0
jne 0x42c0f6
push 0x1c
call fcn.00477160
add esp, 4
mov esi, eax
push 0xc
call fcn.00477160
add esp, 4
mov dword [esi], eax
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [esi + 0x10]
mov dword [0x4bb548], esi
mov dword [esi + 8], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x42c0eb
cmp word [eax], 0
je 0x42c0eb
xor ebx, ebx
nop dword [eax]
cmp word [eax + ebx*2 + 2], 0
lea ebx, [ebx + 1]
jne 0x42c0e0
mov ecx, esi
push ebx
push eax
call fcn.0042c100
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret