joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x53bd4d23
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5e516560
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617
Function at 0x4053e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x4053f7
inc edx
jmp 0x4053ec
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x402390

Function at 0x414dc9
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], esi
or edi, ebx
sub ebx, 0xeeeb068b
add eax, 4
sub ecx, 1
and ecx, edi
push edi
mov edi, dword [esp]
add esp, 4
cmp eax, edx
jne fcn.00414dc9
or ecx, ecx
sub ecx, ebx
sub edi, edi
ret
Function at 0x401fe8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x40202a
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00402040
lea eax, [ebx + 1]
cmp eax, 2
jb 0x402023
mov dword [esi], ebx
call fcn.00426310
push eax
push dword [ebp + 4]
push esi
push ebx
call fcn.00429a50
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40ab00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x40ab24
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.004a9705
add esp, 0x14
jmp 0x40ab51
test esi, esi
jle 0x40ab4a
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x40ab4c
inc edi
mov eax, ebx
cmp edi, esi
jl 0x40ab2d
jmp 0x40ab4c
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x40ab60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x4df19c]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x40ac20
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x40aba7
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.004a9705
add esp, 0x10
cmp eax, edi
je 0x40ac20
jmp 0x40ac2a
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x40ac2a
mov edi, eax
cmp eax, 3
je 0x40ac08
cmp edi, 1
ja 0x40ac2a
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.004a9705
add esp, 0x10
cmp eax, ebx
jne 0x40ac2a
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x40abb2
jmp 0x40ac1d
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.004a9705
add esp, 0x10
cmp eax, edi
jne 0x40ac2a
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
jmp 0x40ac2d
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40ac80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x40aca4
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.004a9705
add esp, 0x14
jmp 0x40acd2
test esi, esi
jle 0x40accb
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x40accd
inc edi
mov eax, ebx
cmp edi, esi
jl 0x40acad
jmp 0x40accd
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x40ace0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x4df19c]
movzx ebx, word [ebp + 8]
xor eax, ebp
cmp bx, 0xffff
mov dword [ebp - 0x10], eax
je 0x40ada5
mov word [ebp - 0x1a], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x40ad2b
xor esi, esi
lea eax, [ebp - 0x1a]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.004a9705
add esp, 0x10
cmp eax, esi
je 0x40ada5
jmp 0x40adb0
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x40adb0
mov ebx, eax
cmp eax, 3
je 0x40ad8c
cmp ebx, 1
ja 0x40adb0
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a9705
add esp, 0x10
cmp eax, esi
jne 0x40adb0
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x40ad36
jmp 0x40ada1
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004a9705
add esp, 0x10
cmp eax, ebx
jne 0x40adb0
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
jmp 0x40adb3
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004956a1
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x410820
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x41e4a0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
push dword [edi + 4]
push ecx
push 0x4c1566
push eax
call fcn.0040d974
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x16]
lea ecx, [eax + 1]
add eax, 4
and eax, 0xfffffffc
mov dword [esi + 4], ecx
call fcn.00495a30
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.0040ae50
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00420925
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.0040da88
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.00495a30
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00408826
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00418d00
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41093f
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00401220
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x410b00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x41e4c0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
xor ecx, ecx
mov dword [eax - 1], 0x25
inc ecx
push dword [edi + 4]
push ecx
push 0x4c1566
push eax
call fcn.0040d974
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.0040ae50
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00420925
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.0040da88
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.00495a30
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00408826
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00418d00
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x410c17
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00401220
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x411820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x41e520
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
push dword [edi + 4]
push ecx
push 0x4c1566
push eax
call fcn.0040d974
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x16]
lea ecx, [eax + 1]
add eax, 4
and eax, 0xfffffffc
mov dword [esi + 4], ecx
call fcn.00495a30
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.0040ae50
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00420925
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.0040da88
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.00495a30
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00408826
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00419370
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x411941
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00419600
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x411b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x41e540
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
xor ecx, ecx
mov dword [eax - 1], 0x25
inc ecx
push dword [edi + 4]
push ecx
push 0x4c1566
push eax
call fcn.0040d974
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.0040ae50
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00420925
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.0040da88
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.00495a30
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00408826
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00419370
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x411c29
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00419600
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41a744
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x41a769
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41a764
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x41a769
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, edi
call fcn.0041de84
mov ebx, eax
test esi, esi
je 0x41a796
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41a783
movzx eax, word [eax]
jmp 0x41a78a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x41a796
test bl, bl
jne 0x41a79c
jmp 0x41a7e0
xor esi, esi
test bl, bl
jne 0x41a7d1
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41a7ab
movzx eax, word [eax]
jmp 0x41a7b0
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
movzx eax, ax
mov edx, dword [ecx]
push eax
push 8
call dword [edx + 0xc]
test al, al
jne 0x41a752
mov ecx, edi
call fcn.0041de84
mov ebx, eax
test esi, esi
jne 0x41a7e9
jmp 0x41a7da
mov ecx, edi
call fcn.0041de84
mov ebx, eax
test bl, bl
jne 0x41a808
jmp 0x41a80e
mov ecx, edi
call fcn.0041de84
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41a7f6
movzx eax, word [eax]
jmp 0x41a7fd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x41a80e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4218b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
cmp dword [0x4e1680], 0
jne 0x421946
push 0x1c
call fcn.004955e6
add esp, 4
mov esi, eax
push 0xc
call fcn.004955e6
add esp, 4
mov dword [esi], eax
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [esi + 0x10]
mov dword [0x4e1680], esi
mov dword [esi + 8], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x42193b
cmp word [eax], 0
je 0x42193b
xor ebx, ebx
nop dword [eax]
cmp word [eax + ebx*2 + 2], 0
lea ebx, [ebx + 1]
jne 0x421930
mov ecx, esi
push ebx
push eax
call fcn.00421950
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x421950
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov edx, dword [0x4df19c]
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor edx, ebp
mov dword [esi + 0x30], edx
lea edx, [esi + 0x20]
push 3
push ecx
push eax
push edx
call fcn.0042d960
add esp, 0x10
cmp dword [esi + 0x24], 0
je 0x421abd
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x2c]
mov dword [esi + 8], edi
mov dword [esi + 0x2c], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
test eax, eax
js 0x421ad1
je 0x421a6c
mov edi, dword [esi + 4]
lea ebx, [esi + 0x10]
lea eax, [edi + eax*4]
mov dword [esi + 0xc], eax
nop dword [eax + eax]
mov eax, dword [edi]
xor ecx, ecx
test eax, eax
je 0x4219fb
cmp word [eax], 0
je 0x4219fb
xor ecx, ecx
cmp word [eax + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x4219f0
push ecx
push eax
push ebx
call fcn.00429240
add esp, 0xc
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x28]
jae 0x421a40
mov ecx, dword [esi + 0x18]
mov dword [eax + 8], ecx
movsd xmm0, qword [esi + 0x10]
movsd qword [eax], xmm0
add dword [esi + 0x24], 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
jmp 0x421a60
lea ecx, [esi + 0x20]
push ebx
call fcn.004235b0
cmp byte [esi + 0x1b], 0
jns 0x421a60
push dword [esi + 0x10]
call fcn.00495666
add esp, 4
nop word [eax + eax]
add edi, 4
cmp edi, dword [esi + 0xc]
jne 0x4219e0
mov ecx, dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.00421720
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esi + 0x20]
test edi, edi
je 0x421abd
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x421aaf
nop
cmp byte [eax - 1], 0
lea ebx, [eax - 0xc]
jns 0x421aa4
push dword [eax - 0xc]
call fcn.00495666
add esp, 4
cmp edi, ebx
mov eax, ebx
jne 0x421a90
mov eax, dword [esi + 0x20]
jmp 0x421ab1
mov eax, edi
mov dword [esi + 0x24], edi
push eax
call fcn.00495666
add esp, 4
mov ecx, dword [esi + 0x30]
xor ecx, ebp
call fcn.004956a1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
int3