joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c721
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
movzx eax, word [esi + 0x2a8]
cmp word [esp + 0x10], ax
push edi
jb 0x40c773
movzx edi, word [esp + 0x14]
movzx eax, ax
add eax, dword [esi + 0x328]
cmp edi, eax
jge 0x40c773
push 0x10
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40c757
inc ebx
movzx eax, word [esi + 0x2a8]
push ebx
push 0
sub edi, eax
push edi
call fcn.0040a6b1
call fcn.0040c77c
xor eax, eax
inc eax
jmp 0x40c775
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x40d819
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x8dc], 1
push esi
push edi
je 0x40da55
mov eax, dword [ebx + 0x690]
xor edi, edi
cmp dword [eax + 0x490], edi
je 0x40da55
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x694]
call fcn.0040a92b
test eax, eax
je 0x40da55
mov esi, dword [ebp + 8]
call fcn.00403c8d
cmp eax, 1
mov dword [ebp - 4], eax
je 0x40d899
cmp eax, 2
je 0x40d899
cmp eax, 3
je 0x40d899
push 1
mov esi, ebx
call fcn.0040da96
push 0x455388
push dword [ebx + 0xbac]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x40da55
push 0x208
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call fcn.0043efa0
add esp, 0xc
push 0x45540c
lea edi, [ebp - 0x218]
call fcn.00406e27
mov eax, dword [ebx + 0x690]
add eax, 0x258
pop ecx
push eax
mov eax, dword [ebx + 0x694]
mov edi, 0x34c
add eax, edi
push eax
call fcn.00401fe8
mov eax, esi
call fcn.004040ca
push eax
mov eax, esi
call fcn.004040b3
lea ecx, [ebp - 0x218]
push ecx
push dword [esi + 0x3c]
mov ecx, dword [ebx + 0x690]
push dword [esi + 0x34]
add ecx, 0x258
push ecx
mov ecx, dword [ebx + 0x694]
add ecx, edi
push ecx
mov ecx, eax
call fcn.0040211e
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x694]
add eax, edi
call fcn.004020f7
cmp dword [ebp + 8], 0
je 0x40da37
mov eax, esi
call fcn.0040409c
cmp dword [ebp - 4], 2
jne 0x40d97d
push str.image_webp
push eax
call fcn.0043fbd2
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x218]
push eax
jne 0x40d96b
lea eax, [ebx + 0x8fc]
push eax
call fcn.00408949
jmp 0x40d976
lea edi, [ebx + 0x8fc]
call fcn.00408a40
push 0
jmp 0x40da30
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x218]
push eax
lea esi, [ebx + 0xbb4]
push esi
call fcn.004087e2
test eax, eax
jne 0x40da2e
mov eax, dword [ebp + 8]
test eax, eax
jbe 0x40da2e
mov ecx, dword [esi]
cmp byte [ecx], 0
je 0x40d9c8
cmp byte [ecx + 1], 0
jne 0x40d9c8
lea edi, [ebx + 0xbc0]
shr eax, 1
push ecx
call fcn.0040812a
jmp 0x40d9d6
push eax
push ecx
lea edi, [ebx + 0xbc0]
push edi
call fcn.00408255
mov esi, 0x45690c
xor eax, eax
jmp 0x40da0d
test ecx, ecx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
jle 0x40da0a
mov eax, edi
call fcn.0040811e
cmp word [eax + ecx*2 - 2], 0xd
je 0x40da0a
push 0x456910
push ecx
xor eax, eax
push edi
inc eax
call fcn.00408323
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
push esi
push edi
call fcn.004081e4
mov ecx, eax
test ecx, ecx
jge 0x40d9df
mov eax, edi
call fcn.0040811e
push eax
push dword [ebx + 0xbac]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 1
mov esi, ebx
call fcn.0040da96
lea eax, [ebp - 0x218]
push eax
call fcn.00406f43
test eax, eax
pop ecx
je 0x40da55
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40eb0e
Capabilities:
Delete file
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov esi, eax
call fcn.0040eae6
test eax, eax
je 0x40eb33
push 0
lea edi, [esi + 0xbac]
call fcn.0040674b
jmp 0x40eb9d
push 0x456a18
lea edi, [ebp - 0x208]
call fcn.00406e27
mov eax, dword [esi + 0x694]
pop ecx
push 1
push 1
push 2
mov ecx, edi
push ecx
push eax
call fcn.0040e486
test eax, eax
je 0x40eb9d
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40eb78
mov eax, edi
push eax
call fcn.00406b98
pop ecx
jmp 0x40eb7e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40eb90
push dword [esi + 0x208]
mov ecx, eax
call fcn.00406a4c
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
pop esi
leave
ret

Function at 0x40eed2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi + 0x694]
lea eax, [ebp - 4]
push eax
push edi
call fcn.0040a92b
test eax, eax
je 0x40ef0b
mov eax, dword [ebp - 4]
push 5
push 0
push 0
call fcn.00404085
push eax
push str.open
push dword [esi + 0x208]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, edi
call fcn.0040a1ac
pop edi
leave
ret
Function at 0x40ef6e
Capabilities:
Create directory
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [esi + 0x694]
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.0040a92b
test eax, eax
je 0x40f147
lea edi, [esi + 0x6b0]
xor ebx, ebx
cmp word [edi], bx
jne 0x40efbb
push 0x45540c
call fcn.00406e27
pop ecx
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov edi, 0x208
push edi
lea eax, [ebp - 0x426]
push ebx
push eax
mov word [ebp - 0x428], bx
call fcn.0043efa0
add esp, 0xc
push edi
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call fcn.0043efa0
mov ebx, dword [ebp - 8]
add esp, 0xc
mov eax, ebx
call fcn.004040e1
push eax
mov eax, 0x104
lea edi, [ebp - 0x428]
call fcn.00406da8
pop ecx
mov edx, edi
call fcn.0040ef15
lea eax, [esi + 0x6b0]
push eax
call fcn.0043f735
mov edi, eax
pop ecx
lea eax, [ebp - 0x428]
push eax
call fcn.0043f735
lea eax, [edi + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x40f057
lea eax, [ebp - 0x428]
push eax
lea eax, [esi + 0x6b0]
push eax
lea eax, [ebp - 0x218]
call fcn.004071cb
pop ecx
pop ecx
jmp 0x40f05f
and word [ebp - 0x218], 0
mov eax, dword [esi + 0x690]
add eax, 0x258
push eax
mov eax, dword [esi + 0x694]
mov edi, 0x34c
add eax, edi
push eax
call fcn.00401fe8
mov eax, ebx
call fcn.004040ca
push eax
mov eax, ebx
call fcn.004040b3
lea ecx, [ebp - 0x218]
push ecx
push dword [ebx + 0x3c]
mov ecx, dword [esi + 0x690]
push dword [ebx + 0x34]
add ecx, 0x258
push ecx
mov ecx, dword [esi + 0x694]
add ecx, edi
push ecx
mov ecx, eax
call fcn.0040211e
mov eax, dword [esi + 0x694]
add eax, edi
call fcn.004020f7
lea eax, [ebp - 0x218]
push eax
call fcn.00406f43
test eax, eax
pop ecx
je 0x40f147
lea ebx, [esi + 0x8bc]
mov edi, dword [ebx + 0x1c]
jmp 0x40f0fc
mov ecx, edi
mov eax, ebx
call fcn.004080a7
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004418c3
test eax, eax
pop ecx
pop ecx
je 0x40f102
dec edi
jns 0x40f0e0
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x40f115
lea eax, [ebp - 0x218]
push eax
mov eax, ebx
call fcn.00407f9a
xor eax, eax
cmp dword [ebp + 8], eax
je 0x40f12b
lea eax, [ebp - 0x218]
push eax
call fcn.00412233
pop ecx
jmp 0x40f147
push 5
push eax
push eax
lea eax, [ebp - 0x218]
push eax
push str.open
push dword [esi + 0x208]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 4]
call fcn.0040a1ac
pop edi
pop ebx
leave
ret 4
Function at 0x40f197
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp dword [esi + 0x8d8], edi
jle 0x40f1ce
lea ebx, [esi + 0x8bc]
mov ecx, edi
mov eax, ebx
call fcn.004080a7
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x8d8]
jl 0x40f1b5
add esi, 0x6b0
xor eax, eax
cmp word [esi], ax
je 0x40f253
push 0x208
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0043efa0
push esi
call fcn.0043f735
mov edi, str.Thumbs.db
push edi
mov ebx, eax
call fcn.0043f735
lea eax, [ebx + eax + 1]
add esp, 0x14
cmp eax, 0x104
jae 0x40f226
push edi
push esi
lea eax, [ebp - 0x20c]
call fcn.004071cb
pop ecx
pop ecx
jmp 0x40f22e
and word [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00406f43
test eax, eax
pop ecx
je 0x40f24c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f258
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebx + 0x274], esi
jne 0x40f453
push edi
push 0x208
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call fcn.0043efa0
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.00441893
cmp eax, esi
pop ecx
pop ecx
je 0x40f2bc
mov word [eax], si
lea eax, [ebp - 0x20c]
push str..cfg
push eax
call fcn.0043ed20
mov esi, dword [ebx + 0xc90]
pop ecx
pop ecx
push str._cfg
call fcn.0040850a
test eax, eax
jl 0x40f3bc
push edi
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [eax + 1]
mov eax, dword [ebx + 0xc90]
call fcn.004084fa
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0043f74b
test eax, eax
pop ecx
pop ecx
jne 0x40f3bc
and word [ebp - 0x418], ax
mov esi, 0x208
push esi
push eax
lea eax, [ebp - 0x416]
push eax
call fcn.0043efa0
and word [ebp - 0x624], 0
push esi
lea eax, [ebp - 0x622]
push 0
push eax
call fcn.0043efa0
add esp, 0x18
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [ebp - 0x418]
push eax
call fcn.0043f735
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043f735
lea eax, [esi + eax + 1]
cmp eax, edi
pop ecx
pop ecx
jae 0x40f39f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x624]
call fcn.004071cb
pop ecx
pop ecx
jmp 0x40f3a7
and word [ebp - 0x624], 0
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043ed4a
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
and word [ebp - 0xa38], 0
and word [ebp - 0x82e], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa40]
mov dword [ebp - 0xa40], 0x456e58
call fcn.00411e45
test edi, edi
je 0x40f404
mov eax, dword [ebx + 0x8f4]
mov ecx, dword [ebx + 0x690]
mov eax, dword [eax + 0xc]
mov dword [ecx + 0x494], eax
mov eax, dword [ebx + 0x690]
lea esi, [ebp - 0xa40]
call fcn.004038e1
mov edi, esi
mov esi, ebx
call fcn.00401b18
lea eax, [ebx + 0xbd8]
call fcn.00411b76
mov eax, edi
mov edi, dword [ebx + 0x694]
push eax
call fcn.0040a1d6
cmp dword [ebp + 0xc], 0
pop edi
jne 0x40f453
mov eax, dword [ebx + 0x690]
mov ecx, dword [ebx + 0x8f4]
mov eax, dword [eax + 0x494]
mov dword [ecx + 0xc], eax
pop esi
pop ebx
leave
ret 8

Function at 0x40f4d4
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x690]
xor dword [eax + 0x498], 1
call fcn.0040f48f
push 0
call fcn.0040caa3
mov eax, dword [esi + 0x690]
mov eax, dword [eax + 0x498]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [esi + 0xca4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040d43a
mov eax, dword [esi + 0x690]
cmp dword [eax + 0x498], 0
je 0x40f534
push 0x40b
lea eax, [esi + 0xc94]
call fcn.00401596
pop esi
ret
Function at 0x40f536
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
push 0xc
mov edi, eax
call fcn.004092ac
mov ecx, dword [edi + 0x208]
push 0x124
push 0x455368
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40f686
lea esi, [edi + 0x8e4]
call fcn.004019ce
push 0x9c80
push dword [edi + 0x694]
push edi
call fcn.0040ea40
xor eax, eax
cmp dword [edi + 0x8f0], eax
mov dword [ebp - 4], eax
jle 0x40f63b
test eax, eax
jl 0x40f5af
lea ecx, [edi + 0x8e4]
cmp eax, dword [ecx + 0xc]
jge 0x40f5af
mov ecx, dword [ecx]
mov eax, dword [ecx + eax*4]
jmp 0x40f5b1
xor eax, eax
mov dword [ebp - 8], eax
call fcn.004040ca
mov ebx, dword [edi + 0x690]
add ebx, 0x258
push ebx
mov dword [ebp - 0xc], eax
call fcn.0043f735
pop ecx
push dword [ebp - 0xc]
mov esi, eax
call fcn.0043f735
lea eax, [esi + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x40f5f8
push dword [ebp - 0xc]
lea eax, [ebp - 0x220]
push ebx
call fcn.004071cb
pop ecx
pop ecx
jmp 0x40f600
and word [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp - 0x220]
push eax
call fcn.00406f43
neg eax
sbb eax, eax
inc eax
pop ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 0x8f0]
mov dword [ebp - 4], eax
jl 0x40f599
mov esi, dword [edi + 0x694]
mov eax, esi
call fcn.0040aa91
cmp dword [esi + 0x33c], 0
je 0x40f658
call fcn.0040aa75
jmp 0x40f686
mov eax, esi
call fcn.0040a16b
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x40f686
lea eax, [ebp - 4]
push eax
mov edx, edi
mov eax, esi
call fcn.0040a8d0
test eax, eax
je 0x40f681
push edi
push dword [ebp - 4]
call fcn.0040a961
inc edi
cmp edi, ebx
jl 0x40f667
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411c0a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.0044fe10
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x411c69
call fcn.0043efa0
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.00407975
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x411caa
call fcn.0043efa0
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x455388
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.004079fe
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x411cb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x411cce
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00411bbd
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret

Function at 0x411cfb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411d34
mov ecx, dword [ebp - 4]
cmp ecx, 2
jb 0x411d30
shr ecx, 1
and word [esi + ecx*2], ax
leave
ret
and word [esi], 0
leave
ret

Function at 0x412053
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
mov ebx, dword [ebp + 8]
push edi
call fcn.00412024
xor edi, edi
cmp dword [0x483064], edi
je 0x412082
call fcn.0040713a
push edi
push 0x1c
push ebx
push edi
call dword [0x483064]
jmp 0x4120f0
push 0x206
lea eax, [ebp - 0x24a]
push edi
push eax
mov word [ebp - 0x24c], di
call fcn.0043efa0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00411ce1
add esp, 0x18
cmp eax, edi
jne 0x4120d9
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
mov eax, 0x104
lea esi, [ebp - 0x24c]
call fcn.00411cfb
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
lea eax, [ebp - 0x24c]
push eax
push ebx
call fcn.0043ed4a
xor eax, eax
cmp word [ebx], di
pop ecx
pop ecx
setne al
pop edi
pop ebx
leave
ret
Function at 0x412233
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xae4
push esi
push edi
xor esi, esi
push 0x286
lea eax, [ebp - 0x2e2]
push esi
push eax
mov word [ebp - 0x2e4], si
call fcn.0043efa0
push 0x7fe
lea eax, [ebp - 0xae2]
push esi
push eax
mov word [ebp - 0xae4], si
call fcn.0043efa0
add esp, 0x18
push 0x143
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push dword [ebp + 8]
lea eax, [ebp - 0x2e4]
push eax
push eax
push str.__s_rundll32.exe___s_shell32.dll_OpenAs_RunDLL__s
lea eax, [ebp - 0xae4]
push 0x3ff
push eax
call fcn.0043ec4f
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0043efa0
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xae4]
push eax
push esi
mov dword [ebp - 0x5c], 0x44
mov word [ebp - 0x2c], 5
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x412304
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor eax, eax
inc eax
jmp 0x412306
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x413035
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [esi + 0x12c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x130]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x110]
push ebx
mov ebx, dword [esi + 0x128]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1b4]
push edi
lea edi, [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0xc], ebx
call fcn.004179ad
test eax, eax
jne 0x4131da
push 2
pop eax
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], 0
jbe 0x4131e3
mov eax, dword [edi + 0xc]
cmp eax, 2
jb 0x4131f1
cmp dword [edi + 4], 0x10
jb 0x4130ce
movzx ecx, word [edi + 2]
mov eax, dword [edi + 8]
xor dword [edi + 4], 0x10
mov dword [edi], ecx
movzx edx, word [eax]
shl edx, 0x10
or edx, ecx
mov ecx, dword [edi + 0xc]
add ecx, 0xfffffffe
add eax, 2
mov dword [edi], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov eax, edx
shr eax, cl
and eax, 0x1f
lea eax, [esi + eax*4 + 0x134]
movzx ecx, byte [eax]
add dword [edi + 4], ecx
movzx eax, word [eax + 2]
cmp eax, 0x10
mov ecx, dword [edi + 4]
jae 0x41312f
and dword [ebp - 0x10], 0
test eax, eax
je 0x413129
mov ecx, dword [esi + eax*4 + 0x758]
mov edx, dword [ebp - 0x18]
mov word [edx + ecx*2], bx
mov ecx, eax
mov edx, 0x8000
shr edx, cl
mov dword [esi + eax*4 + 0x758], ebx
mov dword [ebp - 0x14], eax
lea eax, [esi + eax*2 + 0x7ea]
sub dword [ebp - 8], edx
inc word [eax]
inc ebx
jmp 0x4131d7
xor ebx, ebx
cmp eax, 0x10
setne bl
shr edx, cl
push 3
mov dword [ebp - 0x1c], edx
inc ebx
mov edx, dword [ebx*4 + 0x478844]
and edx, dword [ebp - 0x1c]
inc ebx
add ecx, ebx
xor ebx, ebx
cmp eax, 0x10
mov dword [edi + 4], ecx
pop ecx
jne 0x41315d
mov ebx, dword [ebp - 0x14]
push 2
pop ecx
cmp dword [ebp - 4], ebx
je 0x413169
xor eax, eax
mov dword [ebp - 4], ebx
jmp 0x41316c
mov eax, dword [ebp - 0x10]
test eax, eax
mov ebx, eax
jbe 0x413177
add eax, 0xfffffffe
shl eax, cl
lea edx, [eax + edx + 3]
mov dword [ebp - 0x10], edx
sub edx, ebx
mov ebx, dword [ebp - 0xc]
lea eax, [edx + ebx]
cmp eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
ja 0x4131e8
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4131d5
mov eax, dword [esi + ecx*4 + 0x758]
add eax, eax
mov ecx, dword [ebp - 0x18]
mov word [eax + ecx], bx
mov ecx, ebx
lea eax, [ebx + ebx]
inc ebx
cmp ebx, dword [ebp - 0x1c]
jne 0x41319e
mov eax, dword [ebp - 4]
mov dword [esi + eax*4 + 0x758], ecx
push 0xf
pop ecx
sub ecx, eax
mov eax, edx
shl eax, cl
sub dword [ebp - 8], eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*2 + 0x7ea]
add word [eax], dx
jmp 0x4131d7
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, dword [ebp + 8]
jb 0x41308c
xor eax, eax
inc eax
jmp 0x413215
mov dword [ebp - 8], 0xfffff
jmp 0x4131e3
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x12c], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x114], eax
mov eax, dword [ebp - 4]
push 2
mov dword [esi + 0x110], eax
mov dword [esi + 0x128], ebx
pop eax
mov ecx, dword [ebp - 8]
mov dword [esi + 0x130], ecx
jmp 0x413088
Function at 0x421916
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x421958
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
sub edx, ecx
push edi
mov eax, dword [edx + ecx]
mov edi, eax
and edi, 0xff00
add edi, 0xff
xor edi, eax
and eax, 0xff00ff00
and edi, 0xff00ff
sub eax, 0xffff01
xor edi, eax
mov dword [ecx], edi
add ecx, 4
dec esi
jne 0x42192a
pop edi
pop esi
ret

Function at 0x42211f
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jle 0x42215f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
push ebx
sub edx, eax
push esi
mov ecx, dword [edx + eax]
movzx esi, ch
mov ebx, esi
shl ebx, 0x10
or ebx, esi
mov esi, ecx
and esi, 0xffff00ff
add ebx, esi
xor ebx, ecx
and ebx, 0xff00ff
xor ebx, ecx
mov dword [eax], ebx
add eax, 4
dec edi
jne 0x422134
pop esi
pop ebx
pop edi
ret

Function at 0x42260d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 8]
lea ecx, [edi + eax*4]
cmp edi, ecx
jae 0x422656
push ebx
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [edi]
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 0xc
xor dl, bl
and dl, 0xf
mov ebx, eax
shr ebx, 0x10
xor dl, bl
mov byte [esi], dl
mov edx, eax
shr edx, 0x1c
xor dl, al
and dl, 0xf
add edi, 4
inc esi
xor dl, al
mov byte [esi], dl
inc esi
cmp edi, ecx
jb 0x422623
pop esi
pop ebx
pop edi
ret

Function at 0x422658
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 8]
lea ecx, [edi + eax*4]
cmp edi, ecx
jae 0x4226a9
push ebx
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [edi]
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 0xd
xor dl, bl
and dl, 7
mov ebx, eax
shr ebx, 0x10
xor dl, bl
mov byte [esi], dl
mov edx, eax
shr edx, 5
mov ebx, eax
shr ebx, 3
xor dl, bl
and dl, 0x1f
shr eax, 5
add edi, 4
inc esi
xor dl, al
mov byte [esi], dl
inc esi
cmp edi, ecx
jb 0x42266e
pop esi
pop ebx
pop edi
ret

Function at 0x43a6d4
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
je 0x43a6de
or eax, 0xffffffff
ret
cmp dword [esi + 4], 0
jne 0x43a727
call fcn.00442c8b
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call fcn.00442f6b
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x43a722
push dword [esi + 0x40]
mov dword [esi + 0x3c], 1
call fcn.004430d5
test eax, eax
pop ecx
je 0x43a6da
or dword [esi + 0x38], 0xffffffff
jmp 0x43a6da
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret