joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406af0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b769
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
mov eax, dword [0x41100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
mov edx, str..utmp
mov ecx, eax
call fcn.00408720
push 0
lea ecx, [esi + 4]
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
mov edx, str..utmp
mov ecx, eax
call fcn.00408720
xor eax, eax
mov dword [ebp - 0x68], 0x44
push str..exe
lea edx, [esi + 8]
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x36], ax
mov dword [ebp - 0x34], eax
call fcn.00406f00
add esp, 4
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, eax
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407820
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov ebx, eax
push esi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [ebp - 4]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
call esi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp - 8]
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4078a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b949
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x41100c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.mfc120u.dll_Ordinal_10353]
push 0
mov ecx, edi
call dword [sym.imp.mfc120u.dll_Ordinal_2708]
mov ecx, dword [edi + 0x20]
call fcn.00407820
push 0x411798
mov edx, str.Updating__
lea ecx, [ebp - 0x10]
call fcn.00408490
add esp, 4
mov dword [ebp - 4], 0
mov ecx, edi
push dword [eax]
call dword [sym.imp.mfc120u.dll_Ordinal_13997]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
push 0x640001
push 0
push 0x401
push dword [edi + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 5
push 0x402
push dword [edi + 0xdc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push edi
push 0x407970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x407e00
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40ba77
mov eax, dword fs:[0]
push eax
sub esp, 0x150
push esi
mov eax, dword [0x41100c]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov esi, ecx
push 0x40c9f4
mov ecx, 0x4117a0
call dword [sym.imp.mfc120u.dll_Ordinal_1521]
push str._download
mov edx, 0x411794
lea ecx, [esp + 0x14]
call fcn.00406f00
add esp, 4
push 0
mov dword [esp + 0x164], 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
sub esp, 0x18
mov byte [esp + 0x178], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x4117a4
mov byte [ecx], 0
call fcn.00404990
lea eax, [esp + 0x24]
mov byte [esp + 0x178], 2
push eax
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_280]
mov byte [esp + 0x180], 1
call fcn.00408080
test al, al
je 0x407ee5
lea eax, [esp + 0xc]
mov ecx, 0x4117a0
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
push 0
push 0x66
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_462]
mov byte [esp + 0x160], 3
lea ecx, [esp + 0xe0]
mov dword [esp + 0x1c], vtable.CxUpdateDlg.0
call dword [sym.imp.mfc120u.dll_Ordinal_999]
mov dword [esp + 0xe0], 0x40d53c
mov byte [esp + 0x160], 4
call dword [sym.imp.mfc120u.dll_Ordinal_2204]
push 0x89
push 0xe
push 0x89
call dword [sym.imp.mfc120u.dll_Ordinal_2173]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esp + 0xdc], eax
mov byte [esp + 0xd8], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x160], 5
call dword [sym.imp.mfc120u.dll_Ordinal_4049]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x188]
lea ecx, [esp + 0xe0]
mov byte [esp + 0x160], 6
call dword [sym.imp.mfc120u.dll_Ordinal_1441]
lea ecx, [esp + 0xcc]
mov byte [esp + 0x160], 8
call dword [sym.imp.mfc120u.dll_Ordinal_1110]
mov byte [esp + 0x160], 7
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc0], vtable.CBrush.0
call fcn.00408590
lea ecx, [esp + 0x1c]
mov byte [esp + 0x160], 1
call dword [sym.imp.mfc120u.dll_Ordinal_1108]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4089a0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2218
call fcn.0040ac20
mov eax, dword [0x41100c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2210]
mov dword [ebp - 0x2214], ecx
push eax
push 0x1000
lea eax, [ebp - 0x220c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x4089e8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a185
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2210]
push ebx
push esi
shr eax, 2
xor esi, esi
push edi
test eax, eax
jle 0x408a6d
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp + esi*4 - 0x220c]
push 0
push 0x410
call ebx
mov edi, eax
lea eax, [ebp - 0x2218]
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0x208
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x120c]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push dword [ebp - 0x2214]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR120.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x408a80
mov eax, dword [ebp - 0x2210]
inc esi
shr eax, 2
cmp esi, eax
jl 0x408a00
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a185
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + esi*4 - 0x220c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a185
mov esp, ebp
pop ebp
ret
Function at 0x408d00
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40bc10
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x41100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40d2c8
mov edx, 0x411790
lea ecx, [ebp - 0x220]
call fcn.00406f00
add esp, 4
mov dword [ebp - 4], 0
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408d87
push str._data
mov edx, 0x411790
lea ecx, [ebp - 0x21c]
call fcn.00406f00
add esp, 4
push eax
mov ecx, 0x411794
mov byte [ebp - 4], 1
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
jmp 0x408e27
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 5
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
push 0x411794
call dword [sym.imp.mfc120u.dll_Ordinal_4772]
add esp, 8
mov ecx, 0x411794
push 0x40d2c4
push 0x40d344
call dword [sym.imp.mfc120u.dll_Ordinal_12634]
mov eax, dword [0x411794]
cmp dword [eax - 0xc], 0
jne 0x408dff
push 0x411790
mov ecx, 0x411794
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
jmp 0x408e37
push 0x411798
mov edx, 0x40d2c4
lea ecx, [ebp - 0x21c]
call fcn.00408490
add esp, 4
push eax
mov ecx, 0x411794
mov byte [ebp - 4], 2
call dword [sym.imp.mfc120u.dll_Ordinal_1684]
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
push str._update.utmp
mov edx, 0x411794
lea ecx, [ebp - 0x21c]
call fcn.00406f00
add esp, 4
push eax
mov ecx, 0x41179c
mov byte [ebp - 4], 3
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a185
mov esp, ebp
pop ebp
ret
Function at 0x4096c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40bd19
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x41100c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
push 0x40d9f4
mov edx, 0x411794
lea ecx, [esp + 0xc]
call fcn.00406f00
add esp, 4
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
push eax
push 0
mov ecx, 0x4117a0
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
push eax
call dword [sym.imp.ZLibWrap.dll_ZWZipExtract]
add esp, 8
test eax, eax
je 0x409754
push 0
mov ecx, 0x411790
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
push eax
push 0
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
push eax
mov ecx, esi
call fcn.004097a0
push 0
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc120u.dll_Ordinal_5019]
mov edx, 0x40d29c
mov ecx, eax
call fcn.00408720
push dword [0x4117a0]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x411790
call fcn.00406af0
lea ecx, [esp + 8]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405490
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6554d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0
mov eax, 8
imul ecx, eax, 0x1f
mov edx, dword [ecx + 0x65e360]
mov dword [0x598f24], edx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x598f44]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 0x38], 0
je 0x405576
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x30]
jle 0x405576
mov edx, dword [ebp - 0x28]
add edx, 0xa
cmp edx, dword [ebp - 0x18]
jl 0x405576
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
add eax, 0xa
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
cmp eax, ecx
jl 0x405576
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x30]
add edx, 5
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x20]
jl 0x405576
push 0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [0x598f44]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [ebp - 0x40], 1
cmp dword [ebp - 0x40], 0
jne 0x4055c5
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x18]
jle 0x4055c5
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
add edx, 5
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x20]
jl 0x4055c5
push 0
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [0x598f44]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x656280]
push ecx
mov edx, dword [0x598f44]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x598f44]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x598f20], 0
call fcn.00406ae0
mov dword [0x656290], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret

Function at 0x405750
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x598f44]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00479150
push eax
call fcn.00407150
add esp, 4
pop ebp
ret
Function at 0x4270d0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6554d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x7efc
mov dword [ebp - 0x4c], 0
push 0x30
push 0x59cf40
push 0x6586e0
call fcn.0050e9d0
add esp, 0xc
push 0x38
push str.80_
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004271f0
add esp, 0x10
mov dword [ebp - 0x44], 0
jmp 0x42712b
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x10
jge 0x4271e2
mov eax, dword [ebp - 0x54]
and eax, 1
mov ecx, dword [ebp - 0x4c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x4c], edx
imul eax, dword [ebp - 0x44], 0x30
add eax, 0x6583e0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0
jmp 0x427163
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0x30
jge 0x4271d5
mov edx, dword [ebp - 0x48]
movsx eax, byte [edx + 0x59ce90]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x1c
jl 0x4271a1
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x38
jl 0x42719f
mov eax, dword [ebp - 0x40]
sub eax, 0x1c
cdq
mov ecx, 0x1c
idiv ecx
add edx, 0x1c
mov dword [ebp - 0x40], edx
jmp 0x4271be
mov edx, dword [ebp - 0x40]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0x1c
jl 0x4271be
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 0x1c
idiv ecx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov cl, byte [ebp + eax - 0x3c]
mov byte [edx], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
jmp 0x42715a
mov eax, dword [ebp - 0x54]
shr eax, 1
mov dword [ebp - 0x54], eax
jmp 0x427122
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret
Function at 0x439480
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
push str.TMPDIR
call fcn.0051fd23
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4394de
mov eax, dword [ebp - 8]
push eax
call fcn.00513540
add esp, 4
cmp eax, 0x20
jge 0x4394de
mov ecx, dword [ebp - 8]
push ecx
call fcn.0045a1d0
add esp, 4
test eax, eax
je 0x4394de
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 8]
mov dword [eax + 0x5aaa50], ecx
mov dword [ebp - 4], 0
jmp 0x4394e5
mov dword [ebp - 4], 1
jmp 0x4394f0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jae 0x439581
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x5aaa50]
push ecx
call fcn.0045a1d0
add esp, 4
test eax, eax
je 0x43957c
mov dword [ebp - 0x14], 0x3f
push str.vileDXXXXXX
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x5aaa50]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004599a0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00534eb0
add esp, 4
test eax, eax
je 0x439574
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x439574
mov edx, dword [ebp + 8]
push edx
call fcn.00534ed0
add esp, 4
test eax, eax
jne 0x439567
mov dword [ebp - 0x10], 1
jmp 0x43956e
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43957c
jmp 0x439581
jmp 0x4394e7
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x43ba30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ebp + 0xc], 0
je 0x43bac2
cmp dword [ebp + 0xc], 0
je 0x43bab3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub edx, dword [ecx]
cmp edx, 0x7fffffff
jbe 0x43ba6b
mov dword [ebp - 4], SysReAllocString
jmp 0x43ba76
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [0x656150]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
push eax
call fcn.00524b10
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x43baa4
jmp 0x43bab3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
jmp 0x43ba4c
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x43bac2
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x46ea70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ecx + 0x65e742]
test edx, edx
jne 0x46ea95
call fcn.0046ea20
cmp dword [ebp + 8], 0
jne 0x46eaa5
mov eax, 1
jmp 0x46eb52
mov ax, word [ebp + 8]
mov word [ebp - 4], ax
mov dword [ebp - 0xc], 0
jmp 0x46eabf
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 2
jae 0x46eae3
movzx edx, word [ebp - 4]
and edx, 0xff
xor edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov ax, word [ebp - 4]
shr ax, 8
mov word [ebp - 4], ax
jmp 0x46eab6
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
movsx eax, byte [edx*4 + 0x65e742]
test eax, eax
je 0x46eb35
mov ecx, dword [ebp - 8]
movzx edx, word [ecx*4 + 0x65e740]
cmp edx, dword [ebp + 8]
jne 0x46eb0d
mov eax, dword [ebp - 8]
jmp 0x46eb52
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
jne 0x46eb23
or eax, 0xffffffff
jmp 0x46eb52
cmp dword [ebp - 8], 0x100
jl 0x46eb33
mov dword [ebp - 8], 2
jmp 0x46eae9
mov edx, dword [ebp - 8]
mov ax, word [ebp + 8]
mov word [edx*4 + 0x65e740], ax
mov ecx, dword [ebp - 8]
mov byte [ecx*4 + 0x65e742], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x46f620
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6554d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
push 0x659d38
push 0x5ad1b8
call fcn.00442e20
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jne 0x46f754
push 0x659d38
lea eax, [ebp - 0x104]
push eax
call fcn.00513440
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00486270
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jne 0x46f747
call fcn.004864a0
test eax, eax
jne 0x46f726
mov ecx, 8
imul edx, ecx, 0x35
cmp dword [edx + 0x65e360], 0
je 0x46f717
mov eax, dword [ebp - 0x10c]
push eax
push 0
push fcn.004706b0
call fcn.00528ec0
add esp, 0xc
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x46f715
push str._Cant_create_Win32_write_pipe_
call fcn.0041dc70
add esp, 4
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.00513c70
add esp, 4
mov edx, dword [ebp - 0x110]
push edx
call fcn.00486320
add esp, 4
mov dword [ebp - 0x108], 0
jmp 0x46f726
mov eax, dword [ebp - 0x10c]
push eax
call fcn.004706b0
add esp, 4
cmp dword [ebp - 0x108], 1
jne 0x46f745
mov ecx, dword [ebp - 0x110]
mov dword [0x656150], ecx
mov dword [0x65dbe0], 0
jmp 0x46f754
push str._Couldnt_open_pipe_or_command_
call fcn.0041dc70
add esp, 4
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050ce40
mov esp, ebp
pop ebp
ret
Function at 0x470600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
call fcn.0044b2a0
add esp, 4
movsx ecx, word [0x65dce6]
imul edx, ecx, 0x14
mov eax, dword [edx + 0x65dd04]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x470676
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x470640
mov dword [ebp - 0xc], 0x100
jmp 0x470653
movsx edx, word [0x65dce6]
imul eax, edx, 0x14
mov ecx, dword [eax + 0x65dd08]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call fcn.00529670
add esp, 0x10
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x470629
mov ecx, dword [ebp - 8]
push ecx
call fcn.00514650
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00513c70
add esp, 4
mov eax, 8
imul ecx, eax, 0x35
cmp dword [ecx + 0x65e360], 0
jne 0x4706a4
call fcn.00486350
mov esp, ebp
pop ebp
ret

Function at 0x4706b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
call fcn.0046b690
mov dword [ebp - 0xc], eax
mov ecx, dword [0x65e6fc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x47070b
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00529670
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
push 0xa
call fcn.00526700
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
jmp 0x4706cf
mov eax, dword [ebp - 8]
push eax
call fcn.00514650
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.00513c70
add esp, 4
mov edx, 8
imul eax, edx, 0x35
cmp dword [eax + 0x65e360], 0
jne 0x470739
call fcn.00486350
mov esp, ebp
pop ebp
ret