joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e558
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
mov eax, esi
call fcn.0040496c
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x45e612
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
call sub.kernel32.dll_GetFileTime
fld qword [ebp + 0x18]
fcomp dword [0x45e61c]
fnstsw ax
sahf
je 0x45e5bc
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [ebp - 8]
call fcn.0045e504
fld qword [ebp + 8]
fcomp dword [0x45e61c]
fnstsw ax
sahf
je 0x45e5d8
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
call fcn.0045e504
fld qword [ebp + 0x10]
fcomp dword [0x45e61c]
fnstsw ax
sahf
je 0x45e5f4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
call fcn.0045e504
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
call sub.kernel32.dll_SetFileTime
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x45e65c
Capabilities:
Get file size

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
push 0
push 0x80
push 3
push 0
push 3
push 0
mov eax, ebx
call fcn.0040496c
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45e6b7
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize
mov edx, eax
mov eax, dword [esp + 8]
call fcn.0045e620
mov dword [esp], eax
mov dword [esp + 4], edx
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop ebx
ret

Function at 0x45f24c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x45f265
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x45f272
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x45f290
cld
pop edi
pop esi
xor ecx, ecx
mov cl, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f2b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
xor ecx, ecx
mov cl, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x45f2fb
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.00404710
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00404710
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f88c
Capabilities:
Read data from internet
Read file on windows
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax - 0x1009], 0
je 0x45f8dd
push 0
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x130]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x168]
push eax
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb eax, eax
inc eax
pop ebp
ret
mov eax, dword [ebp + 8]
add eax, 0xffffeff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1010]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x130]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1004]
mov eax, dword [eax + 0x164]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb eax, eax
inc eax
pop ebp
ret
Function at 0x461810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x461918
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 2
call fcn.00462e68
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2fc]
call fcn.0043ad10
mov edx, 0x46192c
mov eax, dword [ebx + 0x334]
call fcn.0043ad10
mov dl, 1
mov eax, dword [ebx + 0x334]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
xor edx, edx
mov eax, dword [ebx + 0x300]
call fcn.0043ac00
xor edx, edx
mov eax, dword [ebx + 0x304]
call fcn.0043ac00
xor edx, edx
mov eax, dword [ebx + 0x320]
mov ecx, dword [eax]
call dword [ecx + 0x64]
lea edx, [ebp - 8]
mov eax, 0x10
call fcn.00462e68
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x31c]
call fcn.0043ad10
mov dl, 1
mov eax, dword [ebx + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x31c]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov eax, ebx
call fcn.00457304
push 5
lea edx, [ebp - 0x10]
mov eax, dword [0x4671e8]
mov eax, dword [eax]
call fcn.0045b0c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408d84
lea eax, [ebp - 0xc]
mov edx, 0x461940
call fcn.00404774
mov eax, dword [ebp - 0xc]
call fcn.0040496c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46191f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004044d0
ret
Function at 0x464238
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x464240
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x464473
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x464285
xor edx, edx
mov eax, ebx
call fcn.00463484
xor eax, eax
mov dword [ebx + 0x238], eax
mov eax, dword [ebx + 0x198]
cmp byte [eax + 4], 0
je 0x46428b
mov eax, ebx
call fcn.004614cc
jmp 0x46428b
inc dword [ebx + 0x238]
mov eax, dword [ebx + 0x224]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebx + 0x238]
jle 0x4643a5
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x238]
mov eax, dword [ebx + 0x224]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x228]
call fcn.00404500
mov eax, dword [0x466f54]
cmp dword [eax], 0
je 0x464331
mov eax, dword [0x466f54]
mov eax, dword [eax]
mov eax, dword [eax + 0x330]
mov edx, dword [ebx + 0x228]
call fcn.0043ad10
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x238]
inc eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, dword [ebx + 0x224]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 9
call fcn.00462e84
mov edx, dword [ebp - 0xc]
mov eax, dword [0x466f54]
mov eax, dword [eax]
mov eax, dword [eax + 0x324]
call fcn.0043ad10
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x228]
call fcn.00404500
lea edx, [ebp - 0x20]
mov eax, dword [ebx + 0x228]
call fcn.0045d984
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x4671e8]
mov eax, dword [eax]
call fcn.0045b0c0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408d84
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x228]
pop ecx
call fcn.004047b8
mov edx, dword [ebx + 0x228]
mov eax, dword [ebx + 0x240]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebx + 0x44]
mov edx, dword [ebx + 0x228]
call fcn.00404500
mov eax, ebx
call fcn.0045f5dc
jmp 0x46444b
mov eax, dword [0x466f54]
cmp dword [eax], 0
je 0x464433
mov eax, dword [ebx + 0x240]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4643f7
inc esi
mov dword [ebp - 4], 0
push 0xa0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x240]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.0040496c
push eax
call sub.kernel32.dll_SetFileAttributesA
inc dword [ebp - 4]
dec esi
jne 0x4643cd
mov eax, dword [0x466f54]
mov eax, dword [eax]
call fcn.00461810
jmp 0x464420
mov eax, dword [0x466f54]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xc4]
mov eax, dword [0x4671e8]
mov eax, dword [eax]
call fcn.0045a844
mov eax, dword [0x466f54]
cmp dword [eax], 0
jne 0x464405
cmp byte [ebx + 0x21c], 0
jne 0x46444b
cmp word [ebx + 0x1aa], 0
je 0x46444b
mov edx, ebx
mov eax, dword [ebx + 0x1ac]
call dword [ebx + 0x1a8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46447a
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004044d0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004044d0
ret
Function at 0x4653c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x465198
call fcn.004064d4
mov ebx, dword [0x4672d8]
xor eax, eax
push ebp
push 0x465510
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4671e8]
mov eax, dword [eax]
call fcn.0045a968
mov ecx, ebx
mov eax, dword [0x4671e8]
mov eax, dword [eax]
mov edx, dword [0x4646f0]
call fcn.0045a980
mov eax, dword [ebx]
mov edx, 1
call fcn.0043a49c
mov eax, dword [ebx]
mov edx, 1
call fcn.0043a4c0
mov eax, dword [ebx]
or edx, 0xffffffff
call fcn.0043a474
mov eax, dword [ebx]
or edx, 0xffffffff
call fcn.0043a4c0
mov eax, dword [ebx]
call fcn.004649e8
push 0
mov eax, dword [ebx]
call fcn.004414bc
push eax
call sub.user32.dll_ShowWindow
push 0
push 0x465520
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x465477
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
push 0x1f4
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x46549c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0x2f8]
call fcn.0046357c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4654e9
mov eax, dword [0x4671e8]
mov eax, dword [eax]
call fcn.0045aa00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465517
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004044d0
ret
Function at 0x40a280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000c3ef
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x10016364]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
test eax, eax
mov dword [esp + 0x18], 1
je 0x40a2c0
push eax
call dword [0x1000d0a4]
cmp dword [esi + 0x58], 0
je 0x40a2d1
mov eax, dword [esi + 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esi + 0x10]
push eax
call dword [0x1000d094]
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.004065b0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x41d700
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, eax
push esi
push edi
test ebx, ebx
je 0x41d744
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x41d744
mov edi, dword [ebx + 0x3c]
mov eax, edi
cdq
mov esi, eax
mov ecx, edx
add esi, 0xf8
mov eax, ebp
cdq
adc ecx, 0
cmp edx, ecx
jb 0x41d744
ja 0x41d738
cmp eax, esi
jbe 0x41d744
cmp dword [edi + ebx], 0x4550
lea ecx, [edi + ebx]
je 0x41d74b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
movzx edx, word [ecx + 4]
mov esi, 0x14c
xor eax, eax
cmp dx, si
jne 0x41d76b
push ebp
mov eax, ecx
call fcn.0041d5c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, 0x8664
cmp dx, si
je 0x41d77f
mov esi, 0x200
cmp dx, si
jne 0x41d78a
push ebx
mov eax, ebp
call fcn.0041d640
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x421530
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x421e60
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x805c]
mov eax, 0x805c
call fcn.0042ef70
push 0xffffffffffffffff
push 0x1003da30
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1005469c]
xor eax, ebp
mov dword [ebp + 0x8058], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x8068]
mov ebx, dword [ebp + 0x8064]
xor edi, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10055d94]
mov dword [ebp - 4], edi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], edi
mov dword [ebp], 0x67452301
mov dword [ebp + 4], 0xefcdab89
mov dword [ebp + 8], 0x98badcfe
mov dword [ebp + 0xc], 0x10325476
cmp eax, edi
jne 0x421eec
call fcn.0040d8f0
mov dword [0x10055d94], eax
mov ecx, dword [eax + 0x11c]
cmp ecx, edi
je 0x421efb
mov eax, dword [eax + 0x40]
jmp 0x421efd
xor eax, eax
push edi
push edi
push edi
push ebx
cmp eax, edi
je 0x421f09
call eax
jmp 0x421f0f
call dword [0x1003f1a0]
cmp eax, 0xffffffff
jne 0x421f2c
push 0x100446f4
push edi
push 0x1ae
push 0x100446dc
call fcn.00420e40
add esp, 0x10
Function at 0x424f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003dcb0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1005469c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov eax, dword [ebx + 8]
xor edi, edi
lea ecx, [ebx + 0x10]
mov dword [ebx + 0xa0], edi
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], edi
call eax
add esp, 8
cmp eax, edi
jne 0x424fcc
push 0x10045274
push edi
push 0x9c
push 0x10044f24
call fcn.00420e40
add esp, 0x10
cmp dword [ebp + 8], edi
jne 0x424fd6
mov dword [ebx + 0x20], edi
jmp 0x424fdd
mov dword [ebx + 0x20], 1
lea ecx, [ebx + 0x24]
Function at 0x42a270
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x46f920
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a6f51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
push edi
mov edi, dword [0x4aa35c]
lea eax, [esi + 0x38]
push eax
mov ebx, ecx
call edi
mov edx, dword [ebx + 0x40]
lea eax, [ebx + 0x38]
lea ecx, [ebx + 0x44]
push eax
mov dword [ebx + 0x24], 5
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x40], 0
call edi
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], eax
call dword [0x4aa364]
mov dword [esp + 0x24], 0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x46f99a
lea edi, [eax + 0x10]
mov ecx, ebx
call fcn.0046d160
mov ebx, eax
test ebx, ebx
je 0x46f9fc
push ebx
mov dword [esp + 0x14], 0
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x30]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x34]
push edx
push eax
push ecx
call dword [0x4aa2e0]
test eax, eax
jne 0x46f9e7
call dword [0x4aa374]
cmp eax, 0x3e5
je 0x46f9e7
call fcn.0046eb30
call fcn.0046ebb0
mov eax, esi
call fcn.0046f330
mov ecx, ebx
call fcn.0046d0a0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x46f9fc
lea edi, [eax + 0x10]
call fcn.0046d250
mov ebx, eax
test ebx, ebx
jne 0x46f99e
mov edx, dword [esp + 0x14]
push edx
call dword [0x4aa360]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
test eax, eax
push ebx
push esi
push edi
mov ebx, ecx
je 0x476b24
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc], esp
push eax
call dword [0x4aa880]
lea eax, [ebp - 0x30]
push eax
call fcn.00477a30
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x476aac
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp 0x476ab2
add eax, 4
mov dword [ebp - 4], eax
xor edx, edx
xor eax, eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
dec esi
xor cl, cl
xor edx, eax
inc esi
and cl, 0x1f
movzx eax, byte [esi]
add cl, 5
test al, al
rol eax, cl
jne 0x476abe
xor eax, edx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], eax
call dword [0x4aa888]
lea esi, [ebx + 0x2c]
push esi
mov dword [ebp - 0xc], esi
call dword [0x4aa364]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x14]
push eax
lea edi, [ebx + 4]
call fcn.0041f340
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebx + 0xc]
add ebx, 8
test edi, edi
mov dword [ebp - 4], ecx
je 0x476b0f
cmp edi, ebx
je 0x476b15
call dword [0x4aaaf0]
mov ebx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 4]
jne 0x476b32
push esi
call dword [0x4aa360]
mov eax, 0x80000000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test edi, edi
jne 0x476b3c
call dword [0x4aaaf0]
cmp ebx, dword [edi + 4]
jne 0x476b47
call dword [0x4aaaf0]
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 0x8c]
mov esi, dword [eax + 0x88]
mov edi, dword [eax + 0x90]
mov ebx, dword [eax + 0x94]
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 4], edx
call dword [0x4aa360]
mov eax, dword [ebp - 4]
add eax, 0xffffffff
cmp eax, 3
ja case.default.0x476b7a
jmp dword [eax*4 + 0x476bdc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
push ebx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push ecx
push edx
push ebx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x476bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x4be3ec
call dword [0x4aa880]
lea eax, [ebp - 0x30]
push eax
call fcn.00477a30
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x476c3b
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
jmp 0x476c41
add eax, 4
mov dword [ebp - 0x10], eax
xor edx, edx
xor eax, eax
mov esi, dword [ebp - 0x10]
mov al, byte [esi]
dec esi
xor cl, cl
xor edx, eax
inc esi
and cl, 0x1f
movzx eax, byte [esi]
add cl, 5
test al, al
rol eax, cl
jne 0x476c4d
xor eax, edx
mov ebx, eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], ebx
call dword [0x4aa888]
mov edi, dword [ebp + 8]
push ebx
mov eax, edi
call fcn.00476a00
test eax, eax
je 0x476c93
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x98
call fcn.0045f884
add esp, 4
mov esi, eax
push 0x3f
lea edx, [esi + 4]
push 0x4be3ec
push edx
call dword [0x4aab08]
xor eax, eax
add esp, 0xc
add edi, 0x2c
push edi
mov dword [esi], ebx
mov dword [esi + 0x88], 0x49c330
mov dword [esi + 0x84], eax
mov dword [esi + 0x8c], 1
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [ebp - 0x14], edi
call dword [0x4aa364]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 4], 0
call fcn.0041ecd0
push edi
mov dword [eax], esi
call dword [0x4aa360]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e6ff
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp dword [ebp - 8], 2
jl 0x40e8bc
inc eax
cmp dword [ebp - 8], eax
push esi
push edi
mov dword [ebp - 4], eax
jle 0x40e8b7
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea esi, [eax + ecx*4]
push 0x4015ac
push dword [esi]
call edi
test eax, eax
je 0x40e8bf
push 0x4015a4
push dword [esi]
call edi
test eax, eax
je 0x40e8bf
push 0x40159c
push dword [esi]
call edi
test eax, eax
je 0x40e8bf
push 0x401594
push dword [esi]
call edi
test eax, eax
je 0x40e8bf
cmp dword [ebp - 4], 1
jne 0x40e79e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebx + 8], eax
jmp 0x40e8a8
push 0x40158c
push dword [esi]
call edi
test eax, eax
je 0x40e7b8
push 0x401584
push dword [esi]
call edi
test eax, eax
jne 0x40e7bc
mov byte [ebx + 3], 1
push 0x40157c
push dword [esi]
call edi
test eax, eax
je 0x40e7d6
push 0x401574
push dword [esi]
call edi
test eax, eax
jne 0x40e7da
mov byte [ebx + 1], 1
push 0x40156c
push dword [esi]
call edi
test eax, eax
je 0x40e7f4
push 0x401564
push dword [esi]
call edi
test eax, eax
jne 0x40e7fb
mov byte [ebx + 1], 1
mov byte [ebx], 1
push 0x40155c
push dword [esi]
call edi
test eax, eax
je 0x40e815
push 0x401554
push dword [esi]
call edi
test eax, eax
jne 0x40e819
mov byte [ebx + 2], 1
push 0x40154c
push dword [esi]
call edi
test eax, eax
je 0x40e833
push 0x401544
push dword [esi]
call edi
test eax, eax
jne 0x40e83a
mov dword [ebx + 4], 1
push 0x40153c
push dword [esi]
call edi
test eax, eax
je 0x40e854
push 0x401534
push dword [esi]
call edi
test eax, eax
jne 0x40e872
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebp - 8]
jge 0x40e872
mov ecx, dword [ebp - 0xc]
lea esi, [ecx + eax*4]
mov dword [ebx + 4], 2
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx + 0xc], eax
push 0x40152c
push dword [esi]
call edi
test eax, eax
je 0x40e88c
push 0x401524
push dword [esi]
call edi
test eax, eax
jne 0x40e8a8
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebp - 8]
jge 0x40e8a8
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 4], 3
mov dword [ebp - 4], eax
mov eax, dword [ecx + eax*4]
mov dword [ebx + 0xc], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x40e73d
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
push 0x401258
call fcn.00411619
pop ecx
xor eax, eax
jmp 0x40e8ba