joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc850
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, 0x2fd
cdq
idiv dword [0x4dd090]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4cc87d
mov dword [ebp - 8], 1
mov edi, dword [ebp - 8]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0047eb20
mov eax, dword [ebp - 4]
call fcn.0047e5dc
cmp dword [ebp + 0xc], 2
jne 0x4cc9f9
mov dl, 1
mov eax, dword [esi + 0x48]
call fcn.0047eb20
mov eax, dword [esi + 0x48]
call fcn.0047e5dc
jmp 0x4cc9f9
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x4e03f0], eax
mov eax, dword [ebp + 0xc]
dec eax
je 0x4cc8cb
dec eax
je 0x4cc90a
jmp 0x4cc98a
mov eax, dword [esi + 0x48]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0x4c]
call fcn.0047e348
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047eb30
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jbe 0x4cc98a
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0x4c]
call fcn.0047e348
jmp 0x4cc98a
cmp edi, 0x7f
jge 0x4cc947
xor edx, edx
mov eax, dword [esi + 0x4c]
call fcn.0047dc90
mov eax, edi
add eax, eax
mov edx, 0xff
sub edx, eax
mov eax, dword [esi + 0x48]
call fcn.0047eb30
mov eax, dword [esi + 0x48]
cmp dword [eax + 0x84], 0
jbe 0x4cc98a
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0x4c]
call fcn.0047e348
jmp 0x4cc98a
xor edx, edx
mov eax, dword [esi + 0x4c]
call fcn.0047dc90
mov eax, edi
sub eax, 0x7f
mov edx, eax
add edx, edx
mov eax, 0xff
call fcn.00429b30
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0047eb30
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jbe 0x4cc98a
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0x4c]
call fcn.0047e348
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x14]
xor edx, edx
xor eax, eax
call fcn.00406a1c
push esi
push edi
lea edi, [esi + 0x60]
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [esi + 0x70]
add esi, 0x60
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push 0x4c43e0
mov eax, esi
call fcn.0041e364
mov edx, 1
mov eax, ebx
call fcn.00429b30
push eax
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [0x4e03f0]
cdq
xor eax, edx
sub eax, edx
cmp ebx, eax
jle 0x4cc9f6
cmp byte [0x4e03e8], 0
je 0x4cc9c7
add edi, dword [ebp - 8]
cmp edi, 0xff
jge 0x4cca0e
cmp byte [0x4e03e8], 0
je 0x4cc8b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4cd144
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
fild dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
fild dword [ebp - 0x30]
fdivp st(1)
fstp qword [ebp - 0x18]
wait
mov edx, ecx
sar edx, 1
jns 0x4cd173
adc edx, 0
mov dword [ebp - 8], edx
sar eax, 1
jns 0x4cd17d
adc eax, 0
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
idiv dword [0x4dd090]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cd199
mov dword [ebp - 4], 1
mov esi, dword [ebp - 4]
jmp 0x4cd23e
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x4e03f0], eax
mov dword [ebp - 0x2c], esi
fild dword [ebp - 0x2c]
fmul qword [ebp - 0x18]
call fcn.00402ca4
add eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x30], esi
fild dword [ebp - 0x30]
fmul qword [ebp - 0x18]
call fcn.00402ca4
mov edx, dword [ebp - 0xc]
sub edx, eax
mov ecx, dword [ebp - 8]
add ecx, esi
mov eax, dword [ebp - 8]
sub eax, esi
call fcn.00406a1c
push esi
push edi
add edi, 0x60
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
add edi, 0x70
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push edi
push 0x4c43a0
mov eax, edi
call fcn.0041e364
mov edx, 1
mov eax, ebx
call fcn.00429b30
push eax
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [0x4e03f0]
cdq
xor eax, edx
sub eax, edx
cmp ebx, eax
jle 0x4cd23b
cmp byte [0x4e03e8], 0
je 0x4cd20c
add esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
cmp esi, eax
jge 0x4cd255
cmp byte [0x4e03e8], 0
je 0x4cd1a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cf580
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409768
add esp, 0x108
pop ebx
ret

Function at 0x4cf668
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409768
add esp, 0x108
pop ebx
ret

Function at 0x4cfcbc
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cec
xor eax, eax
push ebp
push 0x4cfdfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4cfe14
mov dl, 1
mov eax, dword [0x434a38]
call fcn.004351a8
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, 0x4cfe34
call fcn.004048d4
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, esi
sub eax, 1
jb 0x4cfd25
je 0x4cfd34
sub eax, 2
je 0x4cfd38
jmp 0x4cfd43
lea eax, [ebp - 0xc]
mov edx, 0x4cfe40
call fcn.004048d4
jmp 0x4cfd43
xor esi, esi
jmp 0x4cfd43
xor esi, esi
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4cfe4c
xor edx, edx
mov eax, ebx
call fcn.0043523c
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4cfe60
xor edx, edx
mov eax, ebx
call fcn.0043523c
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00408cec
mov eax, dword [ebp - 0x14]
push eax
mov ecx, 0x4cfe78
xor edx, edx
mov eax, ebx
call fcn.0043523c
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.00408cec
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x4cfe90
xor edx, edx
mov eax, ebx
call fcn.0043523c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00408cec
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, 0x4cfeac
xor edx, edx
mov eax, ebx
call fcn.0043523c
mov eax, ebx
call fcn.00403a48
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfe02
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404860
lea eax, [ebp - 0xc]
call fcn.0040483c
lea eax, [ebp - 4]
call fcn.0040483c
ret
Function at 0x4d4e2c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4d4e34
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d508b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x420], 0
jl 0x4d5070
push 0x4d50a0
mov eax, dword [ebx + 0x3cc]
mov eax, dword [eax + 0x228]
call fcn.0047e278
mov ecx, 0xc8
mov edx, 0x64
call fcn.00422a6c
mov eax, dword [ebx + 0x3cc]
mov edx, dword [eax]
call dword [edx + 0x80]
lea eax, [ebp - 8]
call fcn.004cf5a8
push dword [ebp - 8]
push 0x4d50cc
lea eax, [ebp - 0xc]
imul edx, dword [ebx + 0x420], 0x69
mov ecx, dword [0x4e053c]
lea edx, [ecx + edx*8 + 0xc]
mov ecx, 5
call fcn.00404aac
push dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404bbc
imul esi, dword [ebx + 0x420], 0x69
mov eax, dword [0x4e053c]
mov eax, dword [eax + esi*8]
mov edx, dword [0x4e041c]
sub edx, dword [0x4e0418]
add eax, edx
cdq
push edx
push eax
mov eax, dword [0x4e053c]
mov eax, dword [eax + esi*8 + 8]
cdq
push edx
push eax
mov eax, dword [0x4e053c]
mov eax, dword [eax + esi*8 + 4]
cdq
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, dword [0x4dd4d0]
mov eax, dword [eax]
call fcn.0046bcc0
mov eax, dword [ebp - 0x10]
imul edx, dword [ebx + 0x420], 0x69
mov ecx, dword [0x4e053c]
cmp dword [ecx + edx*8 + 8], 0
setg cl
mov edx, dword [ebp - 4]
call fcn.004cf270
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00409484
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004089d8
mov eax, dword [ebp - 0x14]
mov edx, 0x4d50dc
call fcn.00404c48
jne 0x4d4f8a
push 0
lea eax, [ebp - 0x1c]
call fcn.004cf668
lea eax, [ebp - 0x1c]
mov edx, 0x4d50ec
call fcn.00404b04
mov eax, dword [ebp - 0x1c]
call fcn.00404cfc
push eax
mov eax, dword [ebp - 4]
call fcn.00404cfc
push eax
call sub.KERNEL32.DLL_CopyFileA
jmp 0x4d5011
mov dl, 1
mov eax, dword [0x420688]
call fcn.00424bb8
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00424db8
mov dl, 1
mov eax, dword [0x4209d4]
call fcn.004272a8
mov esi, eax
mov eax, ebx
call fcn.0042526c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
call fcn.00425284
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 0xc]
push eax
mov eax, esi
call fcn.00427870
xor ecx, ecx
xor edx, edx
call fcn.00422704
lea eax, [ebp - 0x20]
call fcn.004cf668
lea eax, [ebp - 0x20]
mov edx, 0x4d50ec
call fcn.00404b04
mov edx, dword [ebp - 0x20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
call fcn.00403a48
mov eax, esi
call fcn.00403a48
mov eax, dword [ebp - 4]
call fcn.00409380
cmp dword [0x4e0484], 1
jne 0x4d504a
push 0
lea eax, [ebp - 0x24]
call fcn.004cf668
lea eax, [ebp - 0x24]
mov edx, 0x4d50ec
call fcn.00404b04
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 2
call fcn.004cfcbc
jmp 0x4d5070
push 0
lea eax, [ebp - 0x28]
call fcn.004cf668
lea eax, [ebp - 0x28]
mov edx, 0x4d50ec
call fcn.00404b04
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, 1
call fcn.004cfcbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5092
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00404860
ret
Function at 0x4d609c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc9c
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404cec
xor eax, eax
push ebp
push 0x4d61a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20d]
mov edx, dword [ebp - 4]
call fcn.00409614
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004029d4
lea eax, [ebp - 0x30d]
mov edx, dword [ebp - 0xc]
call fcn.00409614
lea eax, [ebp - 0x354]
xor ecx, ecx
mov edx, 0x44
call fcn.004032d0
mov dword [ebp - 0x354], 0x44
mov dword [ebp - 0x328], 1
mov word [ebp - 0x324], bx
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x354]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x20d]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4d614c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4d6182
push 0xffffffffffffffff
mov eax, dword [ebp - 0x364]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x364]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 0x364]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x360]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d61a7
lea eax, [ebp - 0xc]
call fcn.0040483c
lea eax, [ebp - 4]
call fcn.0040483c
ret
Function at 0x1000b172
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000b181
pop dword [ebp - 0x44]
mov eax, 0x49284dcd
add eax, 0xc6d863b4
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb44fe934
add dword [ebp - 0x54], 0x9a025c17
mov dword [ebp - 0x50], 0xb07cfd6c
sub dword [ebp - 0x50], 0x7e49b127
mov dword [ebp - 0x4c], 0xc5ecf900
sub dword [ebp - 0x4c], 0x79a0b4d2
mov dword [ebp - 0x48], 0x51458869
sub dword [ebp - 0x48], 0x51458869
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x7d3bb154
sub dword [ebp - 0x54], 0x8c947fe
mov dword [ebp - 0x50], 0x99f63aef
add dword [ebp - 0x50], 0xa7762686
mov dword [ebp - 0x4c], 0xc6cc5747
add dword [ebp - 0x4c], 0x9ca31525
mov dword [ebp - 0x48], 0xc5d9598e
sub dword [ebp - 0x48], 0xc5d9598e
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad1a
push 0
call eax
mov ecx, 0xedb3631a
sub ecx, 0xedb318f4
xor ebx, ebx
add ebx, eax
mov edi, 0xe4c45f70
sub edi, 0xd4c21570
add edi, dword [ebp - 0x44]
mov edx, 0x8b214be2
add edx, 0x5b9bed2a
mov dword [ebp - 0x2c], 0x22c4db0
mov esi, dword [edi]
mov dword [ebp - 0x24], 0x6e7a4111
xor esi, edx
mov dword [ebx], esi
xor dword [ebp - 0x10], ecx
add ebx, 0xdbed0fb0
sub ebx, 0xdbed0fac
add edi, 0x5f6dd141
add edi, 0xa0922ec3
loop 0x1000b29b
add eax, 0x11b6b
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x593cb35c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x593cb36b
pop dword [ebp - 0x34]
mov eax, 0x593cb36b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3a51c873
add dword [ebp - 0x44], 0x14007cd8
mov dword [ebp - 0x40], 0x98f2359a
add dword [ebp - 0x40], 0x994116ab
mov dword [ebp - 0x3c], 0x437f4675
add dword [ebp - 0x3c], 0x8ccfdb9
mov dword [ebp - 0x38], 0x2a84216a
sub dword [ebp - 0x38], 0x2a84216a
lea eax, [ebp - 0x44]
push eax
mov eax, 0xc50445aa
add eax, 0x9436caba
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xbcd1c317
sub dword [ebp - 0x44], 0x485f59c1
mov dword [ebp - 0x40], 0x65363529
add dword [ebp - 0x40], 0xdc362c4c
mov dword [ebp - 0x3c], 0xe19c71ec
sub dword [ebp - 0x3c], 0x7e2d0580
mov dword [ebp - 0x38], 0x747c1d02
sub dword [ebp - 0x38], 0x747c1d02
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x4e318ca0
add eax, 0xb0983dc
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7d8
push 0
call eax
mov ecx, 0x56e8
xor edi, edi
add edi, eax
mov esi, 0xdda2fc2f
sub esi, 0x8464dc2f
add esi, dword [ebp - 0x34]
mov ebx, 0x1b20e86f
xor dword [ebp - 0x14], eax
mov edx, dword [esi]
sub dword [ebp - 4], 0x7bb3aaf7
xor edx, ebx
mov dword [edi], edx
xor dword [ebp - 0x2c], eax
add edi, 4
add esi, 4
loop 0x593cb47e
add eax, 0xd8e6d6d3
sub eax, 0xd8e58860
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4b6bafd6
add ecx, 0xdcf502a
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x593d249a
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov edi, ecx
call dword [sym.imp.vsansi.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [esi + 1]
push eax
push esi
mov ecx, edi
call fcn.593d1d54
push eax
push dword [esp + 0x14]
call dword [sym.imp.vsansi.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.593d1ef0
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x593d339b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.593d3384
and byte [esi + 0xc], 0
mov eax, 0x593b0000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x593d33f5
cmp dword [ebp - 0x18], 5
jb 0x593d340d
jmp 0x593d3409
cmp dword [ebp - 0xc], 1
jne 0x593d340d
cmp dword [ebp - 0x18], 4
ja 0x593d3409
jne 0x593d340d
cmp dword [ebp - 0x14], 0
jbe 0x593d340d
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x593d5070
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret

Function at 0x419ab4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x419ad1
xor eax, eax
jmp 0x419b58
movzx ecx, byte [esi]
and cl, 0xff
movzx ecx, cl
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea edx, [eax + 1]
movzx edx, byte [esi + edx]
and dl, 0xff
movzx edx, dl
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x419b14
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.004195cc
test al, al
jne 0x419b4f
xor eax, eax
jmp 0x419b58
mov edx, ebx
mov eax, edi
call fcn.0041957c
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4029cc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029fb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cd0
jmp 0x402a19
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402954
mov edi, eax
test ebx, ebx
je 0x402a19
cmp dword [esi], 0
je 0x402a19
dec ebx
jmp 0x402a02
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x405130
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]

Function at 0x405778
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4057a4
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40579f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x405789
and ecx, 0xfff
dec dword [edi]
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x405791
cmp edx, ebx
jne 0x4058df
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x405760
add eax, dword [eax + 4]
jmp 0x40574d
mov dword [ebp + 0xc], ebx
jmp 0x4057af
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4057c7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4057e5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405843
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40582a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405833
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40583d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40581f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4057a9
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40595c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00405100
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004050b5
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
invalid
movsd dword es:[edi], dword [esi]
aas
cld
invalid
invalid

Function at 0x405dec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00405100
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004050b5
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004050f0
lodsb al, byte [esi]
int3