joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4689e0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
call fcn.00440660
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
add esp, 4
push 0
push eax
call esi
mov ecx, dword [0x4d0a5c]
push 0
push ecx
call esi
mov edx, dword [0x4d0a90]
push 0
push edx
call esi
mov eax, dword [0x4d0bec]
push 0
push eax
call esi
mov ecx, dword [0x4d0acc]
push 0
push ecx
call esi
mov edx, dword [0x4d0a88]
push 0
push edx
call esi
call fcn.0046fc20
mov eax, dword [0x4d0bec]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x14b
push eax
call ebx
mov ecx, dword [0x4d0acc]
push 0x4d0950
push 0x100
push 0xd
push ecx
call ebx
mov edx, dword [0x4d0a88]
push 0x4d0bfc
push 0x100
push 0xd
push edx
call ebx
mov edi, dword [esp + 0x14]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x468c00
push edi
push str.DIALOG_CREATE_BROWSE
mov dword [0x4d0a8c], 1
call fcn.00464540
add esp, 0x10
mov ebp, eax
mov dword [0x4d0a8c], 0
push 0x3f1
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push edi
mov dword [0x4d0bec], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x4d0bec]
push 0
push 0
push 0xb
push eax
call ebx
mov ecx, dword [0x4d0bec]
push ecx
push edi
call fcn.00468120
add esp, 8
test ebp, ebp
je 0x468b98
push 0x4683e0
push 0x4d0ad0
call fcn.00470a50
add esp, 8
cmp eax, reloc.WSOCK32.dll_getsockname
je 0x468b37
mov edx, dword [0x4d0bec]
push 0
push eax
push 0x14e
push edx
call ebx
mov eax, dword [0x4d0bec]
push eax
push 0x103f1
push 0x111
push edi
call ebx
push 0x5c
push 0x4d0ad0
call fcn.0047c8d0
add esp, 8
test eax, eax
je 0x468b4d
mov byte [eax], 0
push 0x4d0ad0
call fcn.004734b0
add esp, 4
test eax, eax
je 0x468b98
push closesocket
push 0x4d668c
push 0x4d0ad0
call sub.Storm.dll_Ordinal_501
push 0x104
push 0x4d0ad0
call fcn.0041e1f0
add esp, 8
push closesocket
push 0x4b3aa0
push 0x4d0ad0
call sub.Storm.dll_Ordinal_503
mov ecx, dword [0x4d0bec]
push 0
push 1
push 0xb
push ecx
call ebx
mov edx, dword [esp + 0x18]
push 1
push edx
call esi
mov eax, dword [0x4d0a5c]
push 1
push eax
call esi
mov ecx, dword [0x4d0a90]
push 1
push ecx
call esi
mov edx, dword [0x4d0a88]
push 1
push edx
call esi
mov eax, dword [0x4d0acc]
push 1
push eax
call esi
mov ecx, dword [0x4d0bec]
push 1
push ecx
call esi
mov edx, dword [0x4d0bec]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x46bb90
Capabilities:
Create process on windows
Delete file
Hide graphical window

Disassembly:
sub esp, 0x344
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [esp + 0x354]
push 1
push 0
push 0
push esi
push str.open
push 0
call sub.Storm.dll_Ordinal_346
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push eax
call edi
cmp eax, 0x20
ja 0x46bc99
push 0x495e90
push str.battle.htm
call fcn.0047cced
add esp, 8
test eax, eax
je 0x46bbf0
push eax
call fcn.0047cc3f
add esp, 4
lea eax, [esp + 0x48]
push eax
push 0
push str.battle.htm
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
ja 0x46bc8e
push 1
push 0
lea ecx, [esp + 0x50]
push esi
push ecx
push str.open
push 0
call sub.Storm.dll_Ordinal_346
push eax
call edi
cmp eax, 0x20
ja 0x46bc8e
push 0
call sub.Storm.dll_Ordinal_346
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 9
push 0
call sub.Storm.dll_Ordinal_346
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edx, [esp + 0x14c]
push 0x200
push edx
push 0x4b5
call fcn.00464430
lea eax, [esp + 0x14]
push 0x40
push eax
push 0x4b6
call fcn.00464430
mov eax, dword [esp + 0x368]
add esp, 0x18
lea ecx, [esp + 8]
lea edx, [esp + 0x14c]
push 0x30
push ecx
push edx
push eax
call fcn.00469b90
push str.battle.htm
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
add esp, 0x344
ret
Function at 0x470840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10
push ebx
push ebp
lea eax, [esp + 8]
push esi
xor ebx, ebx
push eax
push ebx
push ebx
push pe_nt_image_headers32
push str.Recent_Maps
push 0x49dc0c
mov ebp, 5
mov dword [esp + 0x24], ebx
call fcn.004eba00
test eax, eax
je 0x470a40
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x470a40
push ebx
push 0x23e
push str.C:war2bneBattle.netgluMap.cpp
push eax
call sub.Storm.dll_Ordinal_401
mov ecx, dword [esp + 0xc]
mov esi, eax
push ebx
push ecx
push esi
push pe_nt_image_headers32
push str.Recent_Maps
push 0x49dc0c
mov dword [esp + 0x2c], esi
call fcn.004eba00
test eax, eax
jne 0x4708ce
push ebx
push 0x245
push str.C:war2bneBattle.netgluMap.cpp
push esi
call sub.Storm.dll_Ordinal_403
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp esi, ebx
je 0x470a40
mov eax, dword [esp + 0xc]
push edi
cmp eax, ebx
mov dword [esp + 0x14], eax
mov edi, esi
jle 0x470a2e
jmp 0x4708ef
mov ebp, dword [esp + 0x1c]
cmp byte [edi], bl
je 0x470a2e
mov edx, ebp
dec ebp
test edx, edx
mov dword [esp + 0x1c], ebp
je 0x470a2e
push edi
call sub.Storm.dll_Ordinal_506
mov ecx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x14]
inc ebp
push eax
push ecx
push edi
call fcn.00477d90
add esp, 0xc
test eax, eax
jbe 0x470a1a
push edi
call fcn.004734b0
add esp, 4
test eax, eax
jne 0x470947
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x470a1a
mov esi, dword [0x4d1a60]
cmp esi, ebx
jle 0x47097b
lea edx, [esi + 0x269]
push edi
push edx
call fcn.0047c900
add esp, 8
test eax, eax
je 0x470977
cmp esi, ebx
jne 0x47096e
mov esi, 0x4d1a5c
mov esi, dword [esi + 4]
cmp esi, ebx
jg 0x470951
jmp 0x47097b
cmp esi, ebx
jne 0x4709ab
push 0x5c
push edi
call fcn.0047c8d0
add esp, 8
cmp eax, ebx
je 0x47099b
mov byte [eax], bl
inc eax
push eax
push edi
push 0x14
call fcn.00470590
add esp, 0xc
jmp 0x470a16
mov eax, edi
push eax
push edi
push 0x14
call fcn.00470590
add esp, 0xc
jmp 0x470a16
mov edx, dword [esi]
cmp edx, ebx
je 0x4709d4
mov ecx, dword [esi + 4]
cmp ecx, ebx
jg 0x4709bc
not ecx
jmp 0x4709c3
mov eax, esi
sub eax, dword [edx + 4]
add ecx, eax
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
mov dword [esi], ebx
mov dword [esi + 4], ebx
cmp dword [esi], ebx
je 0x4709f2
push 0xffffffffffffffff
mov ecx, esi
call fcn.00471d50
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov eax, dword [0x4d1a5c]
mov dword [esi], eax
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
mov dword [0x4d1a5c], esi
mov al, byte [esi + 0x268]
or al, 0x10
mov byte [esi + 0x268], al
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edi, ebp
sub eax, ebp
cmp eax, ebx
mov dword [esp + 0x14], eax
jg 0x4708eb
push ebx
push 0x281
push str.C:war2bneBattle.netgluMap.cpp
push esi
call sub.Storm.dll_Ordinal_403
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x475270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
push 0x3b7
lea eax, [esp + 0x14]
push str.C:war2bneBattle.net_net_chat_cmds.cpp
push eax
push 0
push str.SetupDatGenladder.lst
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0
call fcn.00462d30
mov ecx, dword [esp + 0x24]
mov ebp, eax
add esp, 0x14
mov edi, ebp
lea esi, [ebp + 1]
lea edx, [ecx + ebp]
cmp esi, edx
jae 0x475311
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp byte [esi], 0xd
jne 0x4752f3
inc edi
lea eax, [esp + 0x18]
push edi
push 0x4d6790
push str._sLadder_s
push 0x104
push eax
mov byte [esi - 1], 0
call fcn.00489aa0
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x475309
cmp byte [esi], 0xa
jne 0x4752fb
lea edi, [esi + 1]
mov edx, dword [esp + 0x10]
inc esi
lea eax, [edx + ebp]
cmp esi, eax
jb 0x4752c0
jmp 0x475311
mov dword [esp + 0x14], 0
push 0
push 0x3cd
push str.C:war2bneBattle.net_net_chat_cmds.cpp
push ebp
call sub.Storm.dll_Ordinal_403
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x476630
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov al, byte [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
cmp al, 1
jne 0x476670
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp bl, byte [0x4c0a98]
jne 0x476668
mov edx, dword [0x4c0a9c]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x1f4
jae 0x476668
push ebx
call fcn.00456d60
add esp, 4
pop ebx
ret
mov byte [0x4c0a98], bl
jmp 0x476680
test al, al
jne 0x476685
mov byte [0x4c0a98], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c0a9c], eax
mov dl, byte [esp + 8]
lea eax, [esp + 0xc]
push 3
push eax
mov byte [esp + 0x14], 0xf
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], bl
call fcn.00477be0
add esp, 8
pop ebx
ret

Function at 0x476e20
Capabilities:
Enumerate gui resources

Disassembly:
mov al, byte [0x4d3c1c]
test al, al
jne 0x476e44
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x476e45
mov eax, dword [esp + 4]
push 0
push 0
push 0
push eax
call fcn.00476c00
add esp, 0x10
ret
push 3
call fcn.00478ba0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
mov byte [0x4d3c1c], 1
call fcn.00476c00
add esp, 0x14
call fcn.00420480
cmp ax, 3
jne 0x476e84
push 0xd
call fcn.00420990
add esp, 4
jmp fcn.0046f680
Function at 0x47a8c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ecx, 8
xor eax, eax
mov edi, 0x4d4374
xor dl, dl
rep stosd dword es:[edi], eax
mov ecx, 0x10
mov edi, 0x4d4330
rep stosd dword es:[edi], eax
mov al, byte [0x4b497e]
xor ebp, ebp
test al, al
mov byte [0x4d4371], dl
mov dword [0x4d4328], ebp
mov ecx, 1
je 0x47a912
mov dl, 2
mov byte [0x4d4374], cl
mov byte [0x4d4375], 2
mov byte [0x4d4371], dl
cmp dl, cl
mov byte [0x4d432c], cl
mov byte [0x4d4370], cl
ja 0x47a929
mov byte [0x4d4370], 0
mov eax, dword [0x4d4370]
and eax, 0xff
mov dl, byte [eax + 0x4d4374]
mov byte [esp + 0x10], dl
mov eax, dword [esp + 0x10]
and eax, 0xff
dec eax
je 0x47a9dd
dec eax
je 0x47a957
mov edx, ecx
jmp 0x47aa68
xor esi, esi
xor edx, edx
mov edi, dword [edx + 0x4abb04]
mov ebx, dword [edx + 0x4acb58]
xor esi, edi
mov eax, esi
shr eax, 0x1d
lea ecx, [esi*8]
or eax, ecx
xor eax, ebx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
mov eax, dword [edx + 0x4abbe8]
xor ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
mov esi, eax
mov eax, edx
sub edx, 4
cmp eax, 0xffffffc4
jne 0x47a95b
call fcn.00479950
mov ecx, esi
lea edx, [esi*8]
shr ecx, 0x1d
or ecx, edx
mov edi, dword [0x4ace78]
xor eax, ecx
mov ebp, dword [0x4d4328]
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
xor ecx, edi
mov edx, ecx
shr edx, 0x1d
shl ecx, 3
or edx, ecx
jmp 0x47aa68
mov eax, dword [0x4ae220]
mov ecx, dword [0x4aec44]
xor esi, esi
mov edx, eax
dec eax
test edx, edx
je 0x47aa66
lea edx, [ecx + 0x27]
lea edi, [eax + 1]
mov bl, 7
test byte [edx - 9], bl
jne 0x47aa5d
xor ecx, ecx
mov cl, byte [edx]
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
xor ecx, ecx
mov cl, byte [edx - 1]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
movsx eax, word [edx - 0xf]
xor ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
movsx ecx, word [edx - 0xd]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
xor eax, eax
mov ax, word [edx - 5]
xor ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
xor eax, esi
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
mov esi, ecx
add edx, 0x98
dec edi
jne 0x47a9f9
mov edx, esi
xor esi, esi
mov edi, dword [0x4ad5c0]
mov si, word [0x4acbdc]
xor eax, eax
mov ecx, esi
imul ecx, ebp
lea edi, [edi + ecx*2]
lea ecx, [esi + esi]
sar ecx, 1
mov ebx, ecx
dec ecx
test ebx, ebx
je 0x47aaa8
inc ecx
xor ebx, ebx
mov bx, word [edi]
add edi, 2
and bh, 0x5f
xor eax, ebx
mov ebx, eax
shr ebx, 0x1d
shl eax, 3
or eax, ebx
dec ecx
jne 0x47aa8e
inc ebp
cmp ebp, esi
mov dword [0x4d4328], ebp
jb 0x47aabd
mov dword [0x4d4328], 0
mov esi, dword [0x4d3924]
mov ebp, dword [0x4d3920]
mov ebx, dword [0x4a70a4]
mov ecx, 8
xor esi, ebp
sub ecx, ebx
shl esi, cl
mov ecx, dword [0x4d432c]
pop edi
and ecx, 0xff
xor esi, eax
lea eax, [ecx*4 + 0x4d4330]
xor edx, esi
pop esi
mov ecx, edx
pop ebp
shr ecx, 0x10
xor ecx, edx
mov dl, byte [esp + 4]
mov word [eax], cx
mov byte [eax + 2], dl
pop ebx
pop ecx
ret
Function at 0x47ab60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov al, byte [0x4d432c]
inc al
cmp al, 0x10
mov byte [0x4d432c], al
jb 0x47ab78
mov byte [0x4d432c], 0
mov al, byte [0x4d4370]
mov cl, byte [0x4d4371]
inc al
cmp al, cl
mov byte [0x4d4370], al
jb 0x47ab95
mov byte [0x4d4370], 0
mov eax, dword [0x4d4370]
push ebx
and eax, 0xff
push ebp
push esi
push edi
mov cl, byte [eax + 0x4d4374]
mov byte [esp + 0x10], cl
mov eax, dword [esp + 0x10]
and eax, 0xff
dec eax
je 0x47ac53
dec eax
je 0x47abd3
mov ebp, dword [0x4d432c]
mov edx, ebp
and edx, 0xff
jmp 0x47ace4
xor esi, esi
xor edx, edx
mov edi, dword [edx + 0x4abb04]
mov ebx, dword [edx + 0x4acb58]
xor esi, edi
mov eax, esi
shr eax, 0x1d
lea ecx, [esi*8]
or eax, ecx
xor eax, ebx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
mov eax, dword [edx + 0x4abbe8]
xor ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
mov esi, eax
mov eax, edx
sub edx, 4
cmp eax, 0xffffffc4
jne 0x47abd7
call fcn.00479950
mov ecx, esi
lea edx, [esi*8]
shr ecx, 0x1d
or ecx, edx
mov edi, dword [0x4ace78]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
xor ecx, edi
mov edx, ecx
shr edx, 0x1d
shl ecx, 3
or edx, ecx
jmp 0x47acde
mov eax, dword [0x4ae220]
mov edx, dword [0x4aec44]
xor esi, esi
mov ecx, eax
dec eax
test ecx, ecx
je 0x47acdc
add edx, 0x27
lea edi, [eax + 1]
mov bl, 7
test byte [edx - 9], bl
jne 0x47acd3
xor ecx, ecx
mov cl, byte [edx]
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
xor ecx, ecx
mov cl, byte [edx - 1]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
movsx eax, word [edx - 0xf]
xor ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
movsx ecx, word [edx - 0xd]
xor eax, ecx
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
xor eax, eax
mov ax, word [edx - 5]
xor ecx, eax
mov eax, ecx
shr eax, 0x1d
shl ecx, 3
or eax, ecx
xor eax, esi
mov ecx, eax
shr ecx, 0x1d
shl eax, 3
or ecx, eax
mov esi, ecx
add edx, 0x98
dec edi
jne 0x47ac6f
mov edx, esi
mov ebp, dword [0x4d432c]
xor esi, esi
mov edi, dword [0x4ad5c0]
mov si, word [0x4acbdc]
xor eax, eax
mov ecx, esi
imul ecx, dword [0x4d4328]
lea edi, [edi + ecx*2]
lea ecx, [esi + esi]
sar ecx, 1
mov ebx, ecx
dec ecx
test ebx, ebx
je 0x47ad28
inc ecx
xor ebx, ebx
mov bx, word [edi]
add edi, 2
and bh, 0x5f
xor eax, ebx
mov ebx, eax
shr ebx, 0x1d
shl eax, 3
or eax, ebx
dec ecx
jne 0x47ad0e
mov ecx, dword [0x4d4328]
inc ecx
cmp ecx, esi
mov dword [0x4d4328], ecx
jb 0x47ad43
mov dword [0x4d4328], 0
mov esi, dword [0x4d3924]
mov ecx, dword [0x4d3920]
mov ebx, dword [0x4a70a4]
xor esi, ecx
mov ecx, 8
and ebp, 0xff
sub ecx, ebx
pop edi
shl esi, cl
xor esi, eax
lea eax, [ebp*4 + 0x4d4330]
xor edx, esi
pop esi
mov ecx, edx
pop ebp
shr ecx, 0x10
xor ecx, edx
mov dl, byte [esp + 4]
mov word [eax], cx
mov byte [eax + 2], dl
pop ebx
pop ecx
ret
Function at 0x47ba00
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
lea ecx, [eax + eax*2]
shl ecx, 3
sub ecx, eax
lea eax, [ecx*4 + 0x4d43b8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x488890
Capabilities:
Enumerate pe sections

Disassembly:
movzx ax, byte [esp + 8]
mov ecx, dword [esp + 4]
cmp ax, word [ecx]
jb 0x4888a4
mov byte [esp + 8], 0
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
and edx, 0xff
lea eax, [ecx + edx*8 + 6]
movzx dx, byte [ecx + edx*8 + 6]
mov word [esi], dx
mov esi, dword [esp + 0x18]
movzx dx, byte [eax + 1]
mov word [esi], dx
mov esi, dword [esp + 0x1c]
mov dx, word [ecx + 2]
mov word [esi], dx
mov esi, dword [esp + 0x20]
mov dx, word [ecx + 4]
mov word [esi], dx
mov edx, dword [esp + 0x10]
movzx si, byte [eax + 3]
mov word [edx + 2], si
movzx si, byte [eax + 2]
mov eax, dword [eax + 4]
test eax, 0x80000000
je 0x488909
and eax, 0x7fffffff
add esi, 0x100
add eax, ecx
mov word [edx], si
mov dword [edx + 4], eax
pop esi
ret

Function at 0x488ac0
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4d5498]
jne 0x488ad8
push 1
call fcn.0048b6f0
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x488ae0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push esi
push eax
push ecx
push 0x200
push 0x4d5298
call fcn.0048cd17
add esp, 0x10
mov byte [0x4d5497], 0
call fcn.0048bef0
push 0x4d5298
push 0x4965a0
call fcn.0048bc20
add esp, 8
push 0x4a49f0
call fcn.0048bc20
push 1
call fcn.0048b7d0
add esp, 8
push 1
call sub.Storm.dll_Ordinal_468
push 3
call sub.Storm.dll_Ordinal_119
call sub.Storm.dll_Ordinal_102
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
cmp eax, dword [0x4d5498]
jne 0x488b57
call fcn.0048c290
push 0x10
push str.ERROR
push 0x4d5298
call fcn.0048b4f0
add esp, 0xc
call esi
mov ecx, dword [0x4d5498]
pop esi
cmp eax, ecx
jne 0x488b82
push 1
call fcn.0048b6f0
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x488f70
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 1
call fcn.00409d50
add esp, 4
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_GetTickCount
movsx esi, word [esp + 0x10]
movsx edi, word [esp + 0x18]
mov ebp, eax
xor ecx, ecx
mov bl, byte [ecx + 0x4d58a8]
xor edx, edx
mov dl, byte [ecx + 0x4d60ac]
mov eax, ebx
and eax, 0xff
sub edx, eax
mov eax, esi
imul eax, edx
cdq
idiv edi
add al, bl
mov byte [ecx + 0x4d54a8], al
inc ecx
cmp ecx, 0x400
jb 0x488f9a
push 0x100
push 0
push 0x4d54a8
call fcn.0048a720
add esp, 0xc
call sub.KERNEL32.dll_GetTickCount
mov ecx, eax
sub ecx, ebp
cmp ecx, 0x10
jae 0x489001
mov edx, ebp
sub edx, eax
add edx, 0x10
push edx
call fcn.004604f0
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
sub eax, ebp
cmp ecx, edx
jae 0x48901f
lea esi, [eax + ecx]
cmp esi, edx
jbe 0x48901f
mov dword [esp + 0x10], edx
jmp 0x488f87
add ecx, eax
cmp ecx, edx
mov dword [esp + 0x10], ecx
jbe 0x488f87
push 1
call fcn.00409d50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x489040
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x100
mov edi, 0x4d54a8
push 0x100
push eax
push 0x4d54a8
rep stosd dword es:[edi], eax
mov byte [0x4aa388], 0
call fcn.0048a720
push 0x1df
push 0x27f
push 0
push 0
call fcn.004efde4
call fcn.004051d0
mov ecx, 0x100
xor eax, eax
mov edi, 0x4d58a8
push 1
rep stosd dword es:[edi], eax
call fcn.00409d50
add esp, 0x20
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_GetTickCount
movsx esi, word [esp + 0x10]
movsx edi, word [esp + 0x18]
mov ebp, eax
xor ecx, ecx
mov bl, byte [ecx + 0x4d58a8]
xor edx, edx
mov dl, byte [ecx + 0x4d60ac]
mov eax, ebx
and eax, 0xff
sub edx, eax
mov eax, esi
imul eax, edx
cdq
idiv edi
add al, bl
mov byte [ecx + 0x4d54a8], al
inc ecx
cmp ecx, 0x400
jb 0x4890b5
push 0x100
push 0
push 0x4d54a8
call fcn.0048a720
add esp, 0xc
call sub.KERNEL32.dll_GetTickCount
mov ecx, eax
sub ecx, ebp
cmp ecx, 0x10
jae 0x48911c
mov edx, ebp
sub edx, eax
add edx, 0x10
push edx
call fcn.004604f0
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
sub eax, ebp
cmp ecx, edx
jae 0x48913a
lea esi, [eax + ecx]
cmp esi, edx
jbe 0x48913a
mov dword [esp + 0x10], edx
jmp 0x4890a2
add ecx, eax
cmp ecx, edx
mov dword [esp + 0x10], ecx
jbe 0x4890a2
push 1
call fcn.00409d50
add esp, 4
cmp word [0x4d6530], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x489173
push 0
call fcn.00489870
add esp, 4
mov word [0x4d6530], 0
pop ecx
ret

Function at 0x489180
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ecx
cmp word [0x4d6530], 0
mov byte [0x4aa388], 1
jne 0x4891a5
push 1
call fcn.00489870
add esp, 4
mov word [0x4d6530], 1
push ebx
push ebp
push esi
push edi
mov ecx, 0x100
xor eax, eax
mov edi, 0x4d60ac
mov esi, 0x4d54a8
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x4d58a8
rep movsd dword es:[edi], dword [esi]
push 1
call fcn.00409d50
add esp, 4
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_GetTickCount
movsx esi, word [esp + 0x10]
movsx edi, word [esp + 0x18]
mov ebp, eax
xor ecx, ecx
mov bl, byte [ecx + 0x4d58a8]
xor edx, edx
mov dl, byte [ecx + 0x4d60ac]
mov eax, ebx
and eax, 0xff
sub edx, eax
mov eax, esi
imul eax, edx
cdq
idiv edi
add al, bl
mov byte [ecx + 0x4d54a8], al
inc ecx
cmp ecx, 0x400
jb 0x4891ed
push 0x100
push 0
push 0x4d54a8
call fcn.0048a720
add esp, 0xc
call sub.KERNEL32.dll_GetTickCount
mov ecx, eax
sub ecx, ebp
cmp ecx, 0x10
jae 0x489254
mov edx, ebp
sub edx, eax
add edx, 0x10
push edx
call fcn.004604f0
add esp, 4
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
sub eax, ebp
cmp ecx, edx
jae 0x489272
lea esi, [eax + ecx]
cmp esi, edx
jbe 0x489272
mov dword [esp + 0x10], edx
jmp 0x4891da
add ecx, eax
cmp ecx, edx
mov dword [esp + 0x10], ecx
jbe 0x4891da
push 1
call fcn.00409d50
call fcn.004051d0
push 0x100
push 0
push 0x4d5ca8
call fcn.0048a720
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret