joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466ba5
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x1fc
mov eax, dword [0x530e50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00466b81
mov edi, eax
pop ecx
test edi, edi
je 0x466d47
push ebx
push 3
call fcn.0046734b
pop ecx
cmp eax, 1
je 0x466cef
push 3
call fcn.0046734b
pop ecx
test eax, eax
jne 0x466bf9
cmp dword [0x531f50], 1
je 0x466cef
cmp esi, 0xfc
je 0x466d46
push str.Runtime_Error__n_nProgram:
push 0x314
push 0x531f58
call fcn.0046bf5e
add esp, 0xc
xor ebx, ebx
test eax, eax
jne 0x466d55
push 0x104
push 0x531f8a
push ebx
mov word [0x532192], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x2fb
test eax, eax
jne 0x466c61
push str._program_name_unknown_
push esi
push 0x531f8a
call fcn.0046bf5e
add esp, 0xc
or eax, eax
jne 0x466d55
push 0x531f8a
call fcn.0046e0f7
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x466ca7
push 0x531f8a
call fcn.0046e0f7
lea ecx, [eax*2 + 0x531f14]
mov eax, ecx
sub eax, 0x531f8a
push 3
sar eax, 1
push 0x4735a8
sub esi, eax
push esi
push ecx
call fcn.0046e110
add esp, 0x14
test eax, eax
jne 0x466d55
push 0x4735b0
push 0x314
mov esi, 0x531f58
push esi
call fcn.0046e08b
add esp, 0xc
or eax, eax
jne 0x466d55
push edi
push 0x314
push esi
call fcn.0046e08b
add esp, 0xc
or eax, eax
jne 0x466d55
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push esi
call fcn.0046e1ce
add esp, 0xc
jmp 0x466d46
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
pop esi
or esi, esi
je 0x466d46
cmp esi, 0xffffffff
je 0x466d46
xor ebx, ebx
mov ecx, ebx
mov al, byte [edi + ecx*2]
mov byte [ebp + ecx - 0x1f8], al
cmp word [edi + ecx*2], bx
je 0x466d1f
inc ecx
cmp ecx, 0x1f4
jb 0x466d06
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 5], bl
call fcn.0046e000
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00463541
leave
ret
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00468015
int3

Function at 0x467465
Capabilities:
Query environment variable

Disassembly:
push ebp
push esp
pop ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
pop edi
or edi, edi
je 0x4674bd
push ebx
xor ebx, ebx
push esi
push edi
pop esi
cmp word [edi], bx
je 0x467491
add esi, 2
cmp word [esi], bx
jne 0x467481
add esi, 2
cmp word [esi], bx
jne 0x467481
sub esi, edi
add esi, 2
push esi
call fcn.0046ae67
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x4674b2
push esi
push edi
push eax
call fcn.00463550
mov ebx, dword [ebp - 4]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x46e1ce
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x530e50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
sub edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0046755f
mov dword [ebp - 0x14], eax
cmp dword [0x532d78], edi
jne 0x46e2bf
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x46e24c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46e39f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
pop esi
or esi, esi
je 0x46e39f
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46e39f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x532d78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x532d7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x532d80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x532d88], eax
test eax, eax
je 0x46e2bc
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x532d84], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46e2e4
mov eax, dword [ebp - 0x1c]
or eax, eax
je 0x46e2d7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x46e2f9
push 4
pop eax
jmp 0x46e3a1
cmp dword [ebp - 0x14], edi
je 0x46e2f9
push dword [0x532d78]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46e2de
mov eax, dword [0x532d84]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x46e357
cmp dword [0x532d88], esi
je 0x46e357
push eax
call ebx
push dword [0x532d88]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46e357
test eax, eax
je 0x46e357
call ecx
test eax, eax
je 0x46e34c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46e34c
test byte [ebp - 8], 1
jne 0x46e357
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x46e387
mov eax, dword [0x532d7c]
cmp eax, esi
je 0x46e384
push eax
call ebx
test eax, eax
je 0x46e384
call eax
mov edi, eax
test edi, edi
je 0x46e384
mov eax, dword [0x532d80]
cmp eax, esi
je 0x46e384
push eax
call ebx
or eax, eax
je 0x46e384
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x532d78]
call ebx
test eax, eax
je 0x46e39f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x46e3a1
sub eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00463541
leave
ret
Function at 0x470530
Capabilities:
Clear file content

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.0046d5ab
push edx
pop ecx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x4705b8
push 2
push esi
push esi
push edi
call fcn.0046d5ab
push eax
pop ecx
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4705b8
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x47064f
jg 0x470592
or esi, esi
je 0x47064f
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x4705c4
call fcn.00468074
mov dword [eax], 0xc
call fcn.00468074
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.0047070e
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jl 0x4705ec
jg 0x4705e5
cmp esi, 0x1000
jb 0x4705ec
mov eax, 0x1000
jmp 0x4705ee
mov eax, esi
push eax
push dword [ebp - 0xc]
push edi
call fcn.0046c9b8
add esp, 0xc
cmp eax, 0xffffffff
je 0x470615
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x470630
jg 0x4705d7
or esi, esi
je 0x470630
jmp 0x4705d7
call fcn.00468040
cmp dword [eax], 5
jne 0x47062a
call fcn.00468074
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.0047070e
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4706b5
or eax, eax
jg 0x4706c1
jl 0x470659
or esi, esi
jae 0x4706c1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0046d5ab
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4705b8
push edi
call fcn.0047013a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
push eax
pop ebx
mov eax, edx
mov ecx, ebx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x4706c1
call fcn.00468074
mov dword [eax], 0xd
call fcn.00468040
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x4705b8
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.0046d5ab
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4705b8
sub eax, eax
jmp 0x4705bf
Function at 0x406fa0
Capabilities:
Resolve dns

Disassembly:
jne 0x406f75
mov ecx, ebx
mov edi, eax
mov dword [ecx - 0x16653e75], eax
add dh, bl
movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 0x15
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx]
rcl dword [edx + ebp - 0x50fff4fc], 0x5d
ret 0x31
push ebp
push ds
in al, dx
mov ecx, dword [ebp - 0x12]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + edx*2]
mov esi, dword [ebp + 0x60]
and eax, 0xffffffb3
loope 0x406f0b
xchg esi, eax
add byte [eax], al
add byte [eax], al
je 0x406f76
iretd
add byte [ebx - 0x3fd3cbbb], cl
mov eax, dword [ebp + 0x34]
sub al, 0xc0
jne 0x406f82
mov eax, 0x42
mov ebp, dword [0x8b515744]
dec ebp
mov eax, dword [0x5256ba51]
call 0x406fa0
adc dword [esi + eax*2 - 0x3ba2baa1], 0x3e
pop ebp
rcl byte [eax - 0x74aaede1], cl
in al, dx
xlatb
in al, dx
and al, 0x53
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
sal bl, cl
stosb byte es:[edi], al
mov dword [ebp - 0xc], esi
add byte [0x401840be], 0
mov al, byte [esi]
cmp al, 0x30
jl 0x40707d
cmp al, 0x39
jg 0x40707d
inc esp
xor al, 0xf4
inc eax
pop es
push esi
xor al, 0x15
sbb al, 0xc1
inc eax
add byte [ebx - 0x7c017430], cl
leave
push dword [ebx]
rol byte [ebx - 0x51a7f73c], 0xf7
ror dword [ecx + 0x3b], 1
sbb byte [edi], cl
test dword [eax + eax - 0xa9a181], ecx
adc eax, sym.imp.WSOCK32.dll_inet_addr
mov dword [eax + edi*8 - 0x13], ecx
inc ebp
clc
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov edi, eax
call 0x8b4cc59a
inc edi
or al, 5
inc ecx
or al, 0x39
xchg edx, eax
je 0x4070c6
mov dword [eax], esi
cmp al, 0xa0
push ebp
sbb al, 0x6a
ficomp word [ecx]
call 0x53f7160
mov esi, edx
xor ebp, ecx
mov esi, edi
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x3e]
mov ecx, dword [ebp + 0xc]
mov ebp, eax
cld
rol byte [esi], cl
aaa
push ecx
or al, 0x8b
add al, 0x17
mov ecx, dword [edx + 0x14]
push edx
mov dword [edx], eax
in al, 0x1b
push esi
in al, 0x5b
sub al, 0xe8
jne 0x407056
call 0xb9406dd0
inc eax
les ecx, [eax*4 - 0x74bc9125]
inc ebp
hlt
invalid
dec edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
out dx, al
inc ebp
or al, 0x75
sbb cl, byte [ebx + 0x408ad835]
add bh, bh
salc
pushfd
mov edx, 0xd6ff2f74
pop edi
pop esi
and al, byte [eax + 0x5b005cfc]
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
mov dword [0x8b0890c3], eax
jo 0x407055
in al, dx
push esp
add al, byte [eax]
add byte [ebx + 0x56530c4d], cl
or al, 0x53
push esi
cmpsd dword [esi], dword es:[edi]
test byte [ebx + 0x4cd8b01], 0x89
inc ebp
cmp ecx, dword [ebx - 0x76a8efbb]
jne 0x4070db
mov al, byte [eax]
mov dword [ebp + 0x2f], esi
test al, al
mov dword [0xf07589e0], ecx
mov edi, ecx
fmul dword [ecx - 0x7bf04a90]
stosb byte es:[edi], al
rol byte [eax], 0xb4
mov ebx, dword [ebp + 0x14]
sbb dword [0x458be774], esp
hlt
Function at 0x402cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f108
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x672114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x634], edi
lea eax, [edi + 8]
mov dword [edi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x638], edi
jb 0x402d2a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [edi + 0x34], 7
mov dword [edi + 0x30], ecx
cmp dword [edi + 0x34], 8
jb 0x402d47
mov eax, dword [edi + 0x20]
jmp 0x402d4a
lea eax, [edi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x402d64
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x402d7e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 3
call fcn.004f8bf2
push eax
call fcn.004f8dd2
push 0x20c
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004f0ae0
add esp, 0x14
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x402e31
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x630]
push eax
call fcn.004f0ae0
add esp, 0xc
lea eax, [ebp - 0x630]
push 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x402e22
test eax, eax
je 0x402e22
add eax, eax
cmp eax, 0x412
jae 0x402e1d
xor ecx, ecx
mov word [ebp + eax - 0x630], cx
lea eax, [ebp - 0x630]
jmp 0x402e28
call fcn.004746b5
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x20]
call fcn.00402600
mov eax, dword [edi + 0x30]
test eax, eax
je 0x402e5d
cmp dword [edi + 0x34], 8
jb 0x402e43
mov ecx, dword [edi + 0x20]
jmp 0x402e46
lea ecx, [edi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x402e5d
push 1
push 0x656b9c
lea ecx, [edi + 0x20]
call fcn.00404240
cmp dword [edi + 0x30], 0
jne 0x402e72
push 3
push 0x656ba0
lea ecx, [edi + 0x20]
call fcn.00402650
mov dword [edi + 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474193
mov esp, ebp
pop ebp
ret
Function at 0x407300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f656
mov eax, dword fs:[0]
push eax
sub esp, 0x400
mov eax, dword [0x672114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402160
mov al, byte [0x674ab0]
test al, al
jne 0x407444
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f0ae0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40743f
lea eax, [ebp - 0x218]
push eax
call fcn.004fb6f3
lea eax, [ebp - 0x218]
push str.config_systemprofile
push eax
call fcn.004efe95
add esp, 0xc
test eax, eax
jne 0x4073b0
lea eax, [ebp - 0x218]
push str.cocuments_and_settingslocalService
push eax
call fcn.004efe95
add esp, 8
test eax, eax
je 0x40743f
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x404], 0
mov ecx, 0x74
mov dword [ebp - 4], 0
mov esi, str.sLsVcqffkweNKp3V24c0m2eV5eKvlsYLnJ5j3XVvq5xr3JUgPeYnU0rmQwtpxJ2XtPNIxDPAYC46kSZN1ETzKRw9qgzQUEshJ0oaGTqrOm1Zee38cGuttmEunUF5QiyR5ffdkiajbV3aOrIAEBvP45NkCnL2GlZeBFYP17rg5sEEazOUfEKXS1bax0gkmNuGAIxq13kGIMzk3eAzezXY9ZlLIVaSkhr5lRdBbEXPkqgcMKIj7MkxVA5stRKXXBQDYhWArjClrlhnBtu0UUQiioyteFio9tfM7vrVtJXaO702MLcYJRZSGkf5CMULw904a0rDizQNiy6EjHaI2QLq3dsvZ44tm32GIqNqgdQeYkEUgW3MsbLnW1CjKOvfJavFw6dgThPgEb8QqvvHdpx6gXL8Zd7KtuvFn5HJPdJ4tJnY7DqGwxftsn5Jcgkq74DpkrLlU9T0lGIi1k1
lea edi, [ebp - 0x3e8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x400]
call fcn.004057d0
lea eax, [ebp - 0x400]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x40c]
call fcn.00408170
mov eax, dword [ebp - 0x3ec]
cmp eax, 0x10
jb 0x40742d
inc eax
lea ecx, [ebp - 0x400]
push eax
push dword [ebp - 0x400]
call fcn.00408010
lea ecx, [ebp - 0x40c]
mov byte [0x674ab0], 1
call fcn.00405a70
mov al, byte [0x674ab0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474193
mov esp, ebp
pop ebp
ret
Function at 0x40fe10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x674ac0], ecx
inc eax
cmp eax, 0x100
jb 0x40fe12
cmp eax, 0x800
jae 0x40fee3
nop
mov edx, dword [eax*4 + 0x6746c0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x674ac0]
mov dword [eax*4 + 0x674ac0], edx
inc eax
cmp eax, 0x800
jb 0x40fec0
mov dword [0x676ac0], 0x40b1f0
call fcn.004102e0
mov ecx, dword [0x676ac0]
test eax, eax
mov edx, 0x40b290
cmove ecx, edx
mov dword [0x676ac0], ecx
ret
Function at 0x411210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x411230
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp + 0xc], edx
add esi, ebx
mov dword [ebp - 4], esi
cmp esi, edx
jae 0x411262
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x41125f
inc esi
cmp esi, edx
jb 0x411250
mov dword [ebp - 4], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x411387
cmp ecx, 3
jbe 0x41127c
xor eax, eax
jmp 0x4112ba
dec ecx
shl eax, cl
and eax, 7
je 0x4112ba
movzx ecx, byte [eax + 0x55c004]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x55bffc], 0
mov cl, byte [edx + 4]
je 0x4112a4
test cl, cl
je 0x4112a4
cmp cl, 0xff
jne 0x4112b7
mov edx, dword [ebp + 0xc]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x411244
mov edx, dword [ebp + 0xc]
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x4112dc
cmp cl, 0xff
je 0x4112dc
mov esi, dword [ebp + 8]
and eax, 3
add eax, eax
or eax, 1
inc ebx
jmp 0x411244
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
nop dword [eax]
cmp dword [ebp + 0x18], 0
je 0x41130d
lea edx, [edi + ebx]
add edx, esi
jmp 0x411313
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x411351
movzx edi, byte [eax + 0x55c004]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x41133d
cmp cl, 0xff
jne 0x411351
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x411300
mov esi, dword [ebp - 4]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp + 0xc]
shr ecx, 8
add ebx, 5
mov byte [esi + 2], cl
mov esi, dword [ebp + 8]
jmp 0x411244
pop edi
pop esi
cmp ecx, 3
jbe 0x41139c
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412cb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ff4e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x672114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00412560
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
call fcn.00412560
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.00412560
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call fcn.00412560
mov dword [esi + 0x20], vtable.VectorParameter_class_MapParameter_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____.0
mov eax, esi
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], vtable.VectorParameter_class_MapParameter_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____.0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], vtable.VectorParameter_struct_SInstallItem__.0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], vtable.VectorParameter_class_MapParameter_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____.0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f6c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543d56
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x672114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov ecx, 0x3c
mov dword [ebp - 4], 0
mov esi, str.30TrlFfhMifHE8n72W88jkLqgkmtANOo9QF7rqQGA6zR5iDWJkuc0ttPr7Vn7bBhj1z8sNPQjsVHbNyM5S7VYIwDMYSOSlYAxyRhLxtFfI9So9r4xScbomERoaEnZvgf0nXakpoxZr2yUygV903QlJJYYMhwsj7vwTYmjm8zJvP8Mo2SPs6QghDhSoRsG8nboHTgZS9xzeySIxbyQEpDuZ2WJDmMtAJKmBD7GP7yvRfQArz7u
mov dword [ebp - 0x108], 0xf
lea edi, [ebp - 0x104]
mov dword [ebp - 0x10c], 0
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x11c], 0
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x104], 0
jne 0x42f751
xor ecx, ecx
jmp 0x42f769
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42f760
sub ecx, edx
push ecx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x11c]
call fcn.00407f10
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x128]
call fcn.00408170
mov eax, dword [ebp - 0x108]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x42f7b4
inc eax
lea ecx, [ebp - 0x11c]
push eax
push dword [ebp - 0x11c]
call fcn.00408010
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0x34], eax
call fcn.0047f1b9
lea eax, [ebx + 0x30]
mov dword [ebx], 1
push eax
push 0
push ebx
push 0x427da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x2c], eax
call fcn.0047b103
mov esi, dword [ebp - 0x128]
test esi, esi
je 0x42f83a
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x124]
push esi
call fcn.004056a0
mov ecx, dword [ebp - 0x120]
mov eax, 0x2aaaaaab
sub ecx, esi
add esp, 0x10
imul ecx
lea ecx, [ebp - 0x128]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.00408070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474193
mov esp, ebp
pop ebp
ret