joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d1c4
Capabilities:
Get process image filename

Disassembly:
push 0
mov eax, 0x483424
call fcn.0044baf5
mov ebx, ecx
push dword [ebp + 8]
xor edi, edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp + 8], esi
mov dword [ebp - 4], edi
test esi, esi
je 0x40d220
push 0x104
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040c7ef
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x40d215
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0040d22a
mov edi, eax
test esi, esi
je 0x40d220
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.0044bacf
ret 8

Function at 0x40d2e5
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x48346a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4a6074]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
push eax
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x40d33a
xor eax, eax
jmp 0x40d417
xor ecx, ecx
lea eax, [esi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044b636
pop ecx
mov edi, eax
push edi
push esi
call ebx
test eax, eax
je 0x40d333
push 0x208
xor ebx, ebx
lea eax, [ebp]
push ebx
push eax
call fcn.0044cd20
add esp, 0xc
jmp 0x40d40b
mov word [edi + 4], ax
lea eax, [ebp]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40d408
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401de7
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
add ebx, 4
push eax
mov ecx, ebx
call fcn.00413175
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebx]
je 0x40d3c7
push dword [esi + 0x10]
lea ecx, [ebp - 0x10]
call fcn.004066fb
test eax, eax
jns 0x40d3ee
lea eax, [ebp - 0x10]
push ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, ebx
call fcn.004133e1
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.00413444
mov esi, dword [ebp - 0x20]
push edi
lea ecx, [esi + 0x14]
call fcn.00401dbd
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401aec
xor ebx, ebx
add edi, 8
xor eax, eax
cmp word [edi], bx
jne 0x40d375
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0044b0c6
add ebp, 0x20c
leave
ret
Function at 0x40d43a
Capabilities:
Acquire debug privileges
Enumerate gui resources
Terminate process

Disassembly:
push 0x10
mov eax, 0x48349a
call fcn.0044baf5
mov edi, edx
mov esi, ecx
test esi, esi
jne 0x40d453
xor eax, eax
inc eax
jmp 0x40d4cf
push esi
push 0x40d4d5
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x18]
call fcn.0040cfc2
and dword [ebp - 4], 0
xor edx, edx
inc edx
mov ecx, str.SeDebugPrivilege
call fcn.0040d03b
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40d49c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [eax - 0x57]
neg edi
sbb edi, edi
inc edi
jmp 0x40d4c5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
test eax, eax
je 0x40d4b3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp + 8]
push esi
call edi
neg eax
push esi
sbb edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.0040cfea
mov eax, edi
call fcn.0044bacf
ret
Function at 0x40d55e
Capabilities:
Enumerate processes

Disassembly:
push 0x284
mov eax, 0x4834c5
call fcn.0044bb29
test ecx, ecx
jne 0x40d578
xor eax, eax
jmp 0x40d6fd
push ecx
lea ecx, [ebp - 0x5c]
xor esi, esi
call fcn.00406658
push esi
mov dword [ebp - 4], esi
push 2
mov dword [ebp - 0x28c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
or edi, 0xffffffff
cmp ebx, edi
je 0x40d6f3
lea eax, [ebp - 0x28c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ecx, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov byte [ebp - 4], 1
jmp 0x40d6da
lea eax, [ebp - 0x268]
push eax
push 0x493618
call fcn.00413caf
push dword [ebp - 0x284]
push 0x493628
call fcn.00413caf
lea eax, [ebp - 0x268]
push eax
call fcn.0045631c
add esp, 0x14
lea ecx, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00406852
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmovae edx, dword [ebp - 0x2c]
mov dword [ebp - 0x290], eax
test eax, eax
je 0x40d647
dec eax
mov ecx, edi
cmp eax, edi
push 0x5c
cmovb ecx, eax
lea eax, [edx + ecx*2]
pop ecx
jmp 0x40d63c
cmp eax, edx
je 0x40d647
sub eax, 2
cmp word [eax], cx
jne 0x40d635
sub eax, edx
sar eax, 1
jmp 0x40d649
mov eax, edi
mov ecx, dword [ebp - 0x290]
lea edx, [eax + 1]
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp ecx, edx
jb 0x40d70b
mov eax, ecx
sub eax, edx
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x44]
lea eax, [eax + edx*2]
push eax
call fcn.00406852
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041166c
lea ecx, [ebp - 0x44]
call fcn.00408f65
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x18], 8
cmovae ecx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x4c]
jne 0x40d6cc
push edx
push eax
push ecx
call fcn.0041386d
add esp, 0xc
test eax, eax
je 0x40d703
lea eax, [ebp - 0x28c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40d5cd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.00408f65
mov edi, esi
lea ecx, [ebp - 0x5c]
call fcn.00408f65
mov eax, edi
call fcn.0044bae4
ret
mov esi, dword [ebp - 0x284]
jmp 0x40d6e2
call fcn.00411e74
int3
Function at 0x40d79e
Capabilities:
Get file version info

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0x10], edx
mov ebp, ecx
xor ebx, ebx
push eax
push ebp
mov dword [esp + 0x14], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x40d80b
push esi
push edi
call fcn.0044b636
pop ecx
mov esi, eax
push esi
push edi
push ebx
push ebp
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40d803
lea eax, [esi + 6]
push eax
call fcn.0045631c
mov edx, dword [esp + 0x18]
mov bl, 1
pop ecx
lea ecx, [eax*2 + 0xb]
and ecx, 0xfffffffc
mov eax, dword [ecx + esi + 0xc]
mov dword [edx], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [ecx + esi + 8]
mov dword [eax], ecx
push esi
call fcn.0044b876
pop ecx
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
pop ecx
ret

Function at 0x40deff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xa4
mov eax, 0x48355c
call fcn.0044bb29
mov dword [ebp - 0xb0], ecx
xor esi, esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xa4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406f0a
test al, al
je 0x40dfe7
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40dfe7
push dword [ebp - 0xa0]
push dword [0x4a7a98]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xac], eax
test eax, eax
je 0x40dfe7
push 3
push dword [ebp + 0xc]
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
call fcn.00411a06
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
push dword [ebp - 0x9c]
call fcn.00402ed1
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x9c], eax
je 0x40dfbf
push dword [ebp - 0x9c]
call fcn.00459dde
pop ecx
push dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xb0]
push dword [ebp - 0xac]
push ebx
call fcn.0040e006
mov ecx, dword [ebp - 0xa8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00401aec
cmp dword [ebp - 0xa4], 0
je 0x40dffc
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
call fcn.0044bae4
ret 8
Function at 0x40e0f7
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x468]
sub esp, 0x468
push 0xffffffffffffffff
push 0x48359c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4a6074]
xor eax, ebp
mov dword [ebp + 0x464], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x5c
pop eax
mov word [ebp + 0x458], ax
xor eax, eax
mov dword [ebp + 0x45c], eax
mov dword [ebp + 0x460], eax
mov dword [ebp - 4], eax
call fcn.00401830
push eax
lea ecx, [ebp - 0x10]
call fcn.00401666
mov byte [ebp - 4], 1
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov ebx, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
je 0x40e194
mov esi, dword [edi]
push 0x104
call fcn.00401c03
push 0x494930
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00403c3d
jmp 0x40e19a
push edi
call fcn.00405119
mov esi, dword [ebp - 0x10]
lea ecx, [ebp]
push esi
call fcn.00413bc4
test eax, eax
je 0x40e2b5
mov ecx, dword [ebp + 0x460]
test ecx, ecx
push 0x2e
pop esi
mov edx, dword [ebp]
je 0x40e1ec
mov eax, edx
shr eax, 4
and eax, 1
je 0x40e1ee
cmp word [ebp + 0x2c], si
jne 0x40e1ee
cmp word [ebp + 0x2e], 0
je 0x40e26a
cmp word [ebp + 0x2e], si
jne 0x40e1ee
cmp word [ebp + 0x30], 0
je 0x40e26a
jmp 0x40e1ee
xor eax, eax
test eax, eax
je 0x40e212
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp]
call fcn.00413af2
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040e0f7
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
jmp 0x40e25c
test ecx, ecx
je 0x40e21b
and edx, 1
jmp 0x40e21d
xor edx, edx
test edx, edx
je 0x40e245
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp]
call fcn.00413af2
push 0x80
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00401aec
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp]
call fcn.00413af2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401aec
mov ecx, dword [ebp + 0x460]
cmp dword [ebp + 0x45c], 0
je 0x40e297
test ecx, ecx
je 0x40e297
lea eax, [ebp]
push eax
push dword [ebp + 0x45c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, eax
mov dword [ebp + 0x460], ecx
test ecx, ecx
jne 0x40e1b9
lea ecx, [ebp]
call fcn.00413c81
mov esi, dword [ebp - 0x10]
test ebx, ebx
je 0x40e2b5
mov ecx, dword [edi]
call fcn.0040e06a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi - 0x10]
call fcn.00401aec
lea ecx, [ebp]
call fcn.00413c81
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x464]
xor ecx, ebp
call fcn.0044b0c6
add ebp, 0x468
leave
ret
Function at 0x40f81e
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
push 0x2c
mov eax, 0x48384a
call fcn.0044baf5
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
inc ebx
push esi
mov edx, ebx
mov ecx, edi
call fcn.0041ee90
pop ecx
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.00403c5d
mov dword [ebp - 4], esi
call fcn.0040328e
lea eax, [ebp - 0x10]
push eax
call fcn.0040209f
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40f887
mov ecx, dword [edi + 8]
mov dword [ecx], ebx
mov dword [ecx + 4], 0x7ff7a501
mov ecx, dword [ebp - 0x10]
add dword [edi + 8], 8
add ecx, 0xfffffff0
call fcn.00401aec
mov eax, ebx
jmp 0x40f93e
push esi
lea ecx, [ebp - 0x10]
call fcn.00413ac8
push 0x14
pop eax
mov word [ebp - 0x28], ax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], esi
movlpd qword [ebp - 0x26], xmm0
mov dword [ebp - 0x1e], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x40f920
call fcn.00401830
push eax
lea ecx, [ebp - 0x14]
call fcn.00401666
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push 0x493a18
push eax
call fcn.00409b06
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
mov eax, esp
push ecx
mov dword [eax], 0x493174
mov eax, esp
mov dword [eax], esi
call fcn.00413962
pop ecx
pop ecx
sub eax, 3
je 0x40f96c
sub eax, 1
je 0x40f944
sub eax, 1
jne 0x40f918
xor ebx, ebx
inc ebx
lea ecx, [esi - 0x10]
call fcn.00401aec
mov eax, dword [edi + 8]
mov dword [eax], ebx
mov dword [eax + 4], 0x7ff7a501
add dword [edi + 8], 8
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401aec
xor eax, eax
inc eax
call fcn.0044bacf
ret
push edi
call fcn.0040f81e
mov edx, dword [edi + 8]
pop ecx
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx + 4], 0x7ff7a501
mov dword [edx], ecx
lea ecx, [esi - 0x10]
add dword [edi + 8], 8
call fcn.00401aec
jmp 0x40f930
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x419dd5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x18
mov eax, 0x48407b
call fcn.0044baf5
mov eax, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [eax + 8], 2
lea ecx, [eax + 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], ecx
mov dword [ecx], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x24]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406f0a
test al, al
je 0x419e98
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x419e98
push dword [ebp - 0x20]
push dword [0x4a7a98]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp - 0x14]
push eax
call fcn.0044c7a0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
add esp, 0xc
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x24], 0
je 0x419e90
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
call fcn.0044bacf
ret 8
push 0x80004005
call fcn.00401d06
int3
Function at 0x422610
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x4a6074]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x180
push 8
push 0
push eax
mov dword [esp + 0x20], eax
call ebx
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x422658
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044b0c6
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
lea esi, [edi + 0x70]
mov dword [edi], 0
mov byte [edi + 4], 8
mov byte [esi + 0x34], 0x21
mov byte [edi + 5], 1
mov byte [esi + 0x36], 0
mov dword [edi + 0xc], esi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x24], 1
mov dword [edi + 0x34], 0
mov word [edi + 0x28], 0x100
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x38], 0
mov byte [edi + 6], 0
mov dword [edi + 0x44], 0
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
push 0
mov dword [esi], ebx
mov dword [esi + 0x9c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x493e78
mov dword [esp + 0x24], fcn.00422610
call fcn.0046769c
mov edx, eax
add esp, 4
xor edx, 0x10
mov ebx, 0x10
movzx ecx, byte [esp + ebx + 0x13]
mov eax, edx
shl eax, 5
dec ebx
add ecx, eax
mov eax, edx
shr eax, 2
add ecx, eax
xor edx, ecx
cmp ebx, 1
jae 0x422703
mov dword [esi + 0x30], edx
lea eax, [esi + 0x68]
mov dword [esi + 0x78], eax
mov edx, 0x422360
mov dword [esi + 0x7c], eax
mov ecx, edi
mov byte [esi + 0x37], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 0x7ff7a500
mov dword [esi + 0x80], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0xa0], 0x493e00
mov byte [esi + 0x35], 5
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 8], 0x180
mov dword [esi + 0xc], 0
mov dword [esi + 0x8c], 0xc8
mov dword [esi + 0x90], 0xc8
mov dword [esi + 0x94], 0xc8
push 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
call fcn.00426b70
add esp, 4
test eax, eax
je 0x422867
mov ecx, edi
call fcn.004224d0
xor edi, edi
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044b0c6
mov esp, ebp
pop ebp
ret
Function at 0x428d60
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x428d7d.11
movzx eax, byte [eax + 0x428f0c]
jmp dword [eax*4 + 0x428ee4]
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0xc]
shl eax, 2
push 0
push eax
call fcn.0042b4b0
mov eax, dword [esi + 0x38]
mov ecx, edi
mov edx, dword [esi + 0x10]
shl eax, 2
push 0
push eax
call fcn.0042b4b0
mov eax, dword [esi + 0x2c]
mov ecx, edi
mov edx, dword [esi + 8]
shl eax, 3
push 0
push eax
call fcn.0042b4b0
mov eax, dword [esi + 0x34]
mov ecx, edi
mov edx, dword [esi + 0x14]
shl eax, 2
push 0
push eax
call fcn.0042b4b0
mov eax, dword [esi + 0x3c]
mov ecx, edi
mov edx, dword [esi + 0x18]
push 0
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.0042b4b0
mov eax, dword [esi + 0x28]
mov ecx, edi
mov edx, dword [esi + 0x1c]
shl eax, 3
push 0
push eax
call fcn.0042b4b0
push 0
push 0x50
mov edx, esi
mov ecx, edi
call fcn.0042b4b0
add esp, 0x38
pop edi
pop esi
ret
movzx eax, byte [esi + 6]
push 0
lea eax, [eax*4 + 0x10]
push eax
call fcn.0042b4b0
add esp, 8
pop edi
pop esi
ret
movzx eax, byte [esi + 6]
push 0
lea eax, [eax*8 + 0x10]
push eax
call fcn.0042b4b0
add esp, 8
pop edi
pop esi
ret
pop edi
pop esi
jmp 0x42a680
mov edx, dword [esi + 0x10]
cmp edx, 0x493e08
je 0x428e6b
mov cl, byte [esi + 7]
mov eax, 1
shl eax, cl
mov ecx, edi
push 0
lea eax, [eax + eax*2]
shl eax, 3
push eax
call fcn.0042b4b0
add esp, 8
mov eax, dword [esi + 0x1c]
mov ecx, edi
mov edx, dword [esi + 0xc]
shl eax, 3
push 0
push eax
call fcn.0042b4b0
push 0
push 0x20
mov edx, esi
mov ecx, edi
call fcn.0042b4b0
add esp, 0x10
pop edi
pop esi
ret
mov edx, dword [esi + 0x1c]
mov ecx, esi
call fcn.0042a6b0
mov ecx, esi
call fcn.00422310
push 0
push 0x70
mov edx, esi
mov ecx, edi
call fcn.0042b4b0
add esp, 8
pop edi
pop esi
ret
mov eax, dword [esi + 0x10]
add eax, 0x18
push 0
push eax
call fcn.0042b4b0
add esp, 8
pop edi
pop esi
ret
mov eax, dword [edi + 0xc]
dec dword [eax + 0x1c]
mov eax, dword [esi + 0xc]
add eax, 0x11
push 0
push eax
call fcn.0042b4b0
add esp, 8
pop edi
pop esi
ret
push edi
mov edi, ecx
lea ecx, [edx + 0x10]
cmp dword [edx + 8], ecx
je 0x42a69d
mov eax, dword [ecx]
push esi
mov esi, dword [edx + 0x14]
mov dword [esi + 0x10], eax
mov ecx, dword [ecx]
mov eax, dword [edx + 0x14]
pop esi
mov dword [ecx + 0x14], eax
push 0
push 0x18
mov ecx, edi
call fcn.0042b4b0
add esp, 8
pop edi
ret
Function at 0x429f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, edx
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
movzx eax, byte [ecx]
test byte [eax + 0x4946a1], 8
je 0x429f81
movzx eax, byte [ecx + 1]
inc ecx
test byte [eax + 0x4946a1], 8
jne 0x429f73
mov al, byte [ecx]
cmp al, 0x2d
jne 0x429f91
inc ecx
mov dword [ebp - 0x14], 1
jmp 0x429f99
cmp al, 0x2b
jne 0x429f96
inc ecx
mov dword [ebp - 0x14], esi
cmp byte [ecx], 0x30
jne 0x42a08d
mov al, byte [ecx + 1]
cmp al, 0x78
je 0x429fb1
cmp al, 0x58
jne 0x42a08d
add ecx, 2
lea edx, [ebp - 0x10]
mov dword [ebp - 8], ecx
xorps xmm1, xmm1
lea ecx, [ebp - 8]
call fcn.00429ee0
mov edx, dword [ebp - 8]
cmp byte [edx], 0x2e
jne 0x429fe2
inc edx
movaps xmm1, xmm0
mov dword [ebp - 8], edx
lea edx, [ebp - 0xc]
call fcn.00429ee0
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 0x10], 0
jne 0x429ff0
test esi, esi
je 0x42a08d
neg esi
mov dword [edi], edx
mov al, byte [edx]
shl esi, 2
cmp al, 0x70
je 0x42a001
cmp al, 0x50
jne 0x42a05c
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x42a015
inc edx
mov dword [ebp - 0x10], 1
jmp 0x42a01d
cmp al, 0x2b
jne 0x42a01a
inc edx
mov dword [ebp - 0x10], ecx
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x4946a1], 2
je 0x42a05e
nop
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x4946a1], 2
jne 0x42a030
mov eax, ecx
neg eax
cmp dword [ebp - 0x10], 0
cmove eax, ecx
add esi, eax
mov dword [edi], edx
cmp dword [ebp - 0x14], 0
je 0x42a06b
xorps xmm0, xmmword [0x4986a0]
push esi
sub esp, 8
movsd qword [esp], xmm0
call fcn.004653d2
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x42a9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [ebp + 8]
shr edi, 5
inc edi
cmp esi, edi
jb 0x42a9eb
nop dword [eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x42a9d0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x447340
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, edx
mov dword [esp + 0x10], ecx
mov esi, dword [edi]
test esi, esi
je 0x4473ab
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call ebp
mov ecx, dword [esp + 0x18]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x44739e
test ecx, ecx
je 0x4473ab
test esi, esi
je 0x4473ab
mov ecx, dword [esp + 0x10]
jmp 0x447361
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4473c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, edx
mov dword [esp + 0x10], ecx
mov esi, dword [edi]
test esi, esi
je 0x44742b
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
push 0
mov edx, 0x400000
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
cmp esi, edx
push eax
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call ebp
mov ecx, dword [esp + 0x18]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x44741e
test ecx, ecx
je 0x44742b
test esi, esi
je 0x44742b
mov ecx, dword [esp + 0x10]
jmp 0x4473e1
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret