joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ff4
Capabilities:
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4055b0], eax
cmp byte [0x4055ac], 0
jne 0x40202c
call fcn.00401778
test al, al
jne 0x40202c
mov dword [0x4055b0], 8
mov dword [ebp - 4], 8
jmp 0x40218d
xor ecx, ecx
push ebp
push 0x402186
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x405035], 0
je 0x40204d
push 0x4055b4
call sub.KERNEL32.DLL_TlsSetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402068
mov dword [0x4055b0], 9
jmp 0x40215d
dec dword [0x40559c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4055a0], eax
test bl, 1
je 0x4020c8
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402098
test edx, 0x80000003
je 0x4020a7
mov dword [0x4055b0], 0xa
jmp 0x40215d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4020bf
mov dword [0x4055b0], 0xa
jmp 0x40215d
add ebx, edx
mov esi, eax
call fcn.0040191c
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x405608]
jne 0x402108
sub dword [0x405608], ebx
add dword [0x405604], ebx
cmp dword [0x405604], 0x3c00
jle 0x4020f9
call fcn.00401c0c
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00402a94
jmp 0x40218d
mov edx, dword [eax]
test dl, 2
je 0x40212b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402126
mov dword [0x4055b0], 0xb
jmp 0x40215d
or dword [eax], 1
jmp 0x402154
mov eax, edi
cmp dword [eax + 4], 0
je 0x40213e
cmp dword [eax], 0
je 0x40213e
cmp dword [eax + 8], 0xc
jge 0x40214a
mov dword [0x4055b0], 0xb
jmp 0x40215d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.0040191c
mov edx, ebx
mov eax, esi
call fcn.00401b84
mov eax, dword [0x4055b0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40218d
cmp byte [0x405035], 0
je 0x402185
push 0x4055b4
call sub.KERNEL32.DLL_GetSystemDirectoryA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4026e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402778
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402758
xor eax, eax
push ebp
push 0x402751
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402794
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402758
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40400c], ax
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareEnterbrainRGSS3RTP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401ca0
add esp, 0xc
push 0x40c1f0
mov eax, dword [ebp + 8]
push eax
call fcn.00401c60
add esp, 8
test eax, eax
je 0x4010bb
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
je 0x40108c
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401ca0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401c46
add esp, 4
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
jne 0x4010bb
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401c46
add esp, 4
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax*2 - 2], cx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x401d67
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401d71
repz ret
jmp fcn.0040279d

Function at 0x407e4d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403850
and dword [ebp - 4], 0
cmp dword [0x410990], 0
mov ebx, eax
jne 0x407efe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407faf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407faf
push eax
call fcn.004037de
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x410990], eax
call esi
push eax
call fcn.004037de
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x410994], eax
call esi
push eax
call fcn.004037de
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x410998], eax
call esi
push eax
call fcn.004037de
pop ecx
mov dword [0x4109a0], eax
test eax, eax
je 0x407efe
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004037de
pop ecx
mov dword [0x41099c], eax
mov eax, dword [0x41099c]
cmp eax, ebx
je 0x407f56
cmp dword [0x4109a0], ebx
je 0x407f56
push eax
call fcn.00403859
push dword [0x4109a0]
mov esi, eax
call fcn.00403859
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407f56
test edi, edi
je 0x407f56
call esi
test eax, eax
je 0x407f4d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407f4d
test byte [ebp - 0xc], 1
jne 0x407f56
or dword [ebp + 0x10], 0x200000
jmp 0x407f8f
mov eax, dword [0x410994]
cmp eax, ebx
je 0x407f8f
push eax
call fcn.00403859
pop ecx
test eax, eax
je 0x407f8f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407f8f
mov eax, dword [0x410998]
cmp eax, ebx
je 0x407f8f
push eax
call fcn.00403859
pop ecx
test eax, eax
je 0x407f8f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x410990]
call fcn.00403859
pop ecx
test eax, eax
je 0x407faf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407fb1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401380
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4013db
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4013a0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x4013bc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00403c20
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4013fd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40146f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40146f
test esi, esi
je 0x40146f
cmp word [esi + 0x24], 2
jbe 0x401469
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401469
cmp dword [esi + 0x18], 0
je 0x401469
test ebp, ebp
je 0x401425
cmp ebp, eax
jne 0x401469
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00403c20
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40144a
cmp edx, dword [esi + 0x18]
jne 0x401469
cmp dword [esp + 0x14], eax
je 0x40147c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402c50
add esp, 8
test eax, eax
je 0x40147c
mov esi, dword [esi]
cmp esi, ebx
jne 0x401403
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x401770
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x81d608]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x40191d
cmp dword [0x81d60c], 0
jne 0x401909
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00403bf0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x4017c0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4017d0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401805
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403bf0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401864
sub edx, esi
sar edx, 1
je 0x40191d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401880
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40191d
xor eax, eax
push ebx
test edx, edx
je 0x4018b8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x4018b8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x4018a1
xor eax, eax
test edx, edx
je 0x4018d2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4018d2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4018c0
xor eax, eax
test edx, edx
je 0x4018ef
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4018ef
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4018e0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x81d608]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x401d50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x81e18c]
sub esp, 0x11c
test eax, eax
jne 0x401e4e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00403bf0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x401da0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x401db0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x401de5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00401380
pop edi
pop esi
pop ebx
test eax, eax
je 0x401e49
mov eax, dword [eax + 0x18]
test eax, eax
je 0x401e49
mov dword [0x81e18c], eax
add esp, 0x11c
ret
mov eax, dword [0x81e18c]
add esp, 0x11c
ret
Function at 0x402810
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40285b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40284b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x402831
jmp 0x402850
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4028ab
mov edi, edx
lea ecx, [edi + 2]
jmp 0x402870
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402870
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40288c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00403c20
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4028cd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402940
mov esi, dword [ebx]
cmp esi, ebx
je 0x402940
test esi, esi
je 0x402940
cmp word [esi + 0x24], 2
jbe 0x40293a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40293a
cmp dword [esi + 0x18], 0
je 0x40293a
test ebp, ebp
je 0x4028f5
cmp ebp, eax
jne 0x40293a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00403c20
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40291a
cmp eax, dword [esi + 0x18]
jne 0x40293a
cmp dword [esp + 0x10], 0
je 0x40294d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402c50
add esp, 8
test eax, eax
je 0x40294d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4028d3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x4029a0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x81d748
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402ac9
cmp dword fs:[0xc0], eax
je 0x4029cb
mov dword [0x81d744], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x81d62c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x81d630], eax
movzx edx, word [esi + 0xac]
mov dword [0x81d634], edx
mov eax, dword [esi + 0xb0]
mov dword [0x81d638], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x402a2b
push 0x7f
push eax
push 0x81d63c
call fcn.00403c20
mov edx, dword [0x81d634]
add esp, 0xc
jmp 0x402a33
xor eax, eax
mov word [0x81d63c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x81d73c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x81d73e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x81d740], ax
mov ecx, eax
mov byte [0x81d742], 0
cmp byte [0x7ffe0268], 0
je 0x402a7a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x81d742], bl
cmp ebx, 1
pop ebx
jne 0x402a94
and ecx, 0xffef
mov word [0x81d740], cx
test edx, edx
jne 0x402ac9
call fcn.004029a0
cmp dword [0x81d62c], 6
ja 0x402ac9
jb 0x402ab1
cmp dword [0x81d630], 4
jae 0x402ac9
call fcn.004029a0
cmp dword [0x81d62c], 0xa
jae 0x402ac9
mov dword [0x81d634], 1
ret
Function at 0x403730
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403758
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403766
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40377f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40378d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x4037a6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4037b4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4037cd
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4037db
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403822
add dword [esp], 5
retf
Function at 0x41ae72
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x4675d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x24
call fcn.00628ef0
mov eax, dword [0x70d514]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x717bc0], ecx
inc eax
cmp eax, 0x100
jb 0x4675f0
cmp eax, 0x800
jae 0x4676c3
nop dword [eax]
nop dword [eax + eax]
mov edx, dword [eax*4 + 0x7177c0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x717bc0]
mov dword [eax*4 + 0x717bc0], edx
inc eax
cmp eax, 0x800
jb 0x4676a0
lea ecx, [esp + 0xc]
mov dword [0x714870], 0x4687b0
call fcn.004688b0
test eax, eax
je 0x46777f
mov edi, dword [esp + 0x1c]
xor ecx, ecx
mov esi, edi
mov eax, 0x70e338
shr esi, 8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
nop
mov ebx, dword [esp + 0x10]
cmp dword [eax - 8], ebx
jne 0x46771a
mov ebx, dword [esp + 0x14]
cmp dword [eax - 4], ebx
mov ebx, dword [esp + 0x18]
jne 0x46771a
cmp dword [eax], ebx
je 0x467738
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x467700
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00628dca
mov esp, ebp
pop ebp
ret
sub ecx, 0
je 0x467766
sub ecx, 1
je 0x467755
sub ecx, 1
jne 0x46777f
cmp esi, 6
jb 0x46777f
jne 0x467775
cmp edi, 0xf
jb 0x46777f
jmp 0x467775
cmp esi, 5
jb 0x46777f
jne 0x467775
cmp edi, 6
jb 0x46777f
cmp edi, 0xa
jmp 0x467773
cmp esi, 6
jb 0x46777f
jne 0x467775
cmp edi, 0x100c
je 0x46777f
mov dword [0x714870], 0x468850
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00628dca
mov esp, ebp
pop ebp
ret

Function at 0x467850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.00628ef0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x4678bf
mov dword [edi], 0
mov edx, 0x400000
nop dword [eax]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x4678c8
test ecx, ecx
je 0x4678bf
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x467880
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4678e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x46793f
mov ebx, dword [ebp + 0xc]
mov ecx, 0x400000
mov dword [edi], 0
nop dword [eax]
push 0
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x467946
test ecx, ecx
je 0x46793f
mov ecx, 0x400000
test esi, esi
jne 0x467900
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x46a570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628ef0
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x46a599
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea ebx, [edx - 4]
mov dword [ebp - 4], 0xffffffff
add ebx, ecx
mov dword [ebp - 0x10], ebx
nop dword [eax]
lea edx, [edi + ecx]
cmp edx, ebx
jae 0x46a5c4
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x46a5c4
inc edx
cmp edx, ebx
jb 0x46a5b7
mov edi, edx
sub edi, ecx
mov ecx, edi
sub ecx, dword [ebp - 4]
cmp edx, ebx
jae 0x46a6c5
cmp ecx, 3
jbe 0x46a5fe
xor esi, esi
mov al, byte [edx + 4]
mov dword [ebp - 4], edi
test al, al
je 0x46a639
cmp al, 0xff
je 0x46a639
mov ecx, dword [ebp - 8]
and esi, 3
add esi, esi
mov eax, 1
or esi, 1
add edi, eax
jmp 0x46a5b0
dec ecx
shl esi, cl
and esi, 7
je 0x46a5dc
cmp byte [esi + 0x6949b8], 0
je 0x46a625
movzx eax, byte [esi + 0x6949c0]
mov ecx, edx
sub ecx, eax
mov al, byte [ecx + 4]
test al, al
je 0x46a625
cmp al, 0xff
jne 0x46a5dc
mov ecx, dword [ebp - 8]
and esi, 3
add esi, esi
mov dword [ebp - 4], edi
or esi, 1
inc edi
jmp 0x46a5b0
movzx ecx, byte [edx + 3]
movzx eax, al
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 1]
shl eax, 8
or eax, ecx
sub eax, edi
lea ebx, [eax - 5]
test esi, esi
je 0x46a694
movzx eax, byte [esi + 0x6949c0]
mov ecx, 0x18
shl eax, 3
sub ecx, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x46a680
cmp al, 0xff
jne 0x46a694
mov ecx, 0x20
mov eax, 1
sub ecx, dword [ebp - 0xc]
shl eax, cl
dec eax
xor eax, ebx
jmp 0x46a657
mov ecx, dword [ebp - 8]
mov eax, ebx
shr eax, 0x18
and al, 1
mov byte [edx + 1], bl
neg al
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x10]
shr eax, 8
mov byte [edx + 2], al
mov eax, 5
add edi, eax
jmp 0x46a5b0
pop ebx
cmp ecx, 3
jbe 0x46a6da
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
dec ecx
shl esi, cl
and esi, 7
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret