joyce8/EMBER2024-capa huggingface dataset:
Function at 0x688697d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.068868f9
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x6886aec
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x6886aec
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x6886aa1
jg 0x68869d9
test eax, eax
je 0x6886a97
push 1
push 0x1000
call fcn.06878cf2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x68869fc
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x6886a8e
push 0x8000
push ebx
call fcn.0688682a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x6886a25
jg 0x6886a20
cmp ecx, 0x1000
jb 0x6886a25
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.06878ad6
add esp, 0x10
cmp eax, 0xffffffff
je 0x6886a6a
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x6886a20
jl 0x6886a51
test ecx, ecx
jne 0x6886a12
push dword [ebp - 0xc]
push ebx
call fcn.0688682a
push esi
call fcn.06875a42
add esp, 0xc
xor ebx, ebx
jmp 0x6886afa
cmp byte [edi + 0x24], 0
je 0x6886a81
cmp dword [edi + 0x20], 5
jne 0x6886a81
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x6886a8c
mov ebx, dword [edi + 0x18]
jmp 0x6886a8e
xor ebx, ebx
push esi
call fcn.06875a42
pop ecx
jmp 0x6886afa
test ecx, ecx
jg 0x6886a63
jl 0x6886aa1
test eax, eax
jae 0x6886a63
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.06878f95
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x6886ac1
cmp byte [edi + 0x1c], 0
je 0x6886a63
jmp 0x6886af2
push ebx
call fcn.068825cb
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x6886a63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x6886afa
cmp byte [edi + 0x1c], 0
je 0x6886af7
mov ebx, dword [edi + 0x18]
jmp 0x6886afa
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.06878f95
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6887fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6887ffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6887ffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404940
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44be40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x466014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x467070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041a930
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x466a88
push eax
call fcn.0041a930
mov esi, dword [0x467080]
xor ebx, ebx
mov edi, dword [0x467084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46a280], bl
mov eax, ebx
mov ecx, 0x467070
cmovae ecx, dword [0x467070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46a390], al
inc ebx
cmp ebx, 0x100
jl 0x4049c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46a280]
movzx eax, byte [esi + 0x46a390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404a14
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46a280]
mov byte [esi + 0x46a280], al
inc esi
mov byte [edi + 0x46a280], dl
cmp esi, 0x100
jl 0x4049f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404590
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404a69
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a5f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404aab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404aa1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abf
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004394da
int3
Function at 0x404ad0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.0041a7f0
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x404b23
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x404bce
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x404b61
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x404c45
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x404bf8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x404bfd
mov ecx, eax
sar eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x404c14
sar eax, 4
and eax, 0x3f
jmp 0x404c1a
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
test edx, edx
je 0x404c3f
and ecx, 0xf
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404c50
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x466014]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], esi
mov eax, dword [eax]
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
push edi
test eax, eax
jne 0x404cab
push eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
push 0x45b19b
mov byte [esi], al
call fcn.0041a930
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
mov ecx, eax
xor edi, edi
and ecx, 3
jne 0x404cc5
cmp byte [eax + edx - 1], 0x3d
je 0x404cc5
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
jmp 0x404ce7
mov dword [esp + 0x18], 1
cmp ecx, 2
ja 0x404cdf
cmp byte [eax + edx - 2], 0x3d
jne 0x404cdf
mov dword [esp + 0x20], edi
jmp 0x404ce7
mov dword [esp + 0x20], 1
sub eax, dword [esp + 0x18]
and eax, 0xfffffffc
mov dword [esp + 0x40], edi
mov ecx, eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
shr ecx, 2
push 0
mov dword [esp + 0x48], 0xf
mov byte [esp + 0x34], 0
lea eax, [eax + ecx*2]
add eax, ecx
lea ecx, [esp + 0x34]
add eax, dword [esp + 0x1c]
push eax
call fcn.0041a7f0
cmp dword [esp + 0x44], 0x10
lea eax, [esp + 0x30]
mov edx, dword [esp + 0x14]
cmovae eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
test edx, edx
je 0x404db5
mov esi, dword [esp + 0x2c]
lea eax, [edx - 1]
shr eax, 2
add esi, 2
inc eax
mov dword [esp + 0x28], eax
nop dword [eax]
movzx eax, byte [esi - 2]
lea esi, [esi + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax*4 + 0x45bf30]
movzx eax, byte [esi - 5]
shl ecx, 6
or ecx, dword [eax*4 + 0x45bf30]
movzx eax, byte [esi - 4]
shl ecx, 6
or ecx, dword [eax*4 + 0x45bf30]
movzx eax, byte [esi - 3]
shl ecx, 6
or ecx, dword [eax*4 + 0x45bf30]
mov eax, ecx
sar eax, 0x10
mov byte [edx + edi], al
mov eax, ecx
sar eax, 8
mov byte [edx + edi + 1], al
mov eax, edx
mov byte [eax + edi + 2], cl
add edi, 3
sub dword [esp + 0x28], 1
jne 0x404d50
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x18], 0
je 0x404e12
mov eax, dword [esp + 0x2c]
add eax, edx
mov dword [esp + 0x24], eax
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
mov edx, dword [eax*4 + 0x45bf30]
shl edx, 6
or edx, dword [ecx*4 + 0x45bf30]
mov ecx, dword [esp + 0x1c]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
cmp dword [esp + 0x20], 0
mov byte [ecx + edi], al
je 0x404e12
mov eax, dword [esp + 0x24]
sar edx, 8
movzx eax, byte [eax + 2]
mov eax, dword [eax*4 + 0x45bf30]
shl eax, 6
sar eax, 8
or al, dl
mov byte [ecx + edi + 1], al
movups xmm0, xmmword [esp + 0x30]
mov ecx, dword [esp + 0x5c]
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [esp + 0x3c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
Function at 0x404ec0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x466014]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0x67452301
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.0041a460
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push 0x10
push eax
push esi
call fcn.00436ac0
lea eax, [esp + 0x1c]
add esp, 0xc
lea ebx, [esi + 0x10]
cmp edi, eax
je 0x404f8b
mov eax, dword [edi]
test eax, eax
je 0x404f6d
mov ecx, dword [edi + 8]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x404f63
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404fce
mov eax, edx
push ecx
push eax
call fcn.0041fed9
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x404fbc
mov ecx, dword [esp + 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x404fb2
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404fce
push ecx
push esi
call fcn.0041fed9
add esp, 8
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
call fcn.004394da
int3
Function at 0x406010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c070
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x414], esi
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00436960
add esp, 0xc
mov dword [ebp - 0x414], 0x400
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x418]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4060c1
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4060e7
sub ecx, edx
lea eax, [ebp - 0x410]
push ecx
push eax
mov ecx, esi
call fcn.0041a930
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40612f
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406125
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40618d
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x406171
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406167
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40618d
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
call fcn.004394da
int3
Function at 0x4061a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 8]
push ecx
push 0xf003f
lea eax, [ebp + 8]
mov dword [ebp - 8], connect
cmovae eax, dword [ebp + 8]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406207
cmp dword [ebp + 0x4c], 0x10
lea edx, [ebp + 0x38]
mov eax, dword [ebp + 0x48]
lea ecx, [ebp + 0x20]
cmovae edx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
cmovae ecx, dword [ebp + 0x20]
inc eax
push eax
push edx
push 2
push 0
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x406244
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40623a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062d6
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x406286
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40627c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062d6
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x4062c8
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4062be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4062d6
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
call fcn.004394da
int3
Function at 0x407700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c248
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x466014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov edx, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
push 1
push 0x45bd74
call fcn.0041bce0
add esp, 8
xor edx, edx
test al, al
mov ecx, 5
cmove ecx, edx
mov edx, str.runas
push ecx
mov ecx, 0x45b19b
cmovne ecx, edx
push ecx
lea ecx, [ebp + 8]
call fcn.0041a930
cmp dword [ebp + 0x4c], 0x10
lea edx, [ebp + 0x38]
push 0
cmovae edx, dword [ebp + 0x38]
lea ecx, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 8]
push 0
cmovae ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0x10
push edx
cmovae eax, dword [ebp + 8]
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
mov dword [0x46a494], esi
cmp edx, 0x10
jb 0x4077d6
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4077cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40786c
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x407818
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40780e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40786c
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x40785a
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407850
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40786c
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004394da
int3
Function at 0x4079e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c248
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x466014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
mov dword [0x46a380], 0
call esi
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x46a578]
cmp eax, dword [ecx + 4]
jle 0x407ab1
push 0x46a578
call fcn.0041f987
add esp, 4
cmp dword [0x46a578], 0xffffffff
jne 0x407ab1
push 0x4526a0
mov dword [0x46a540], 0
mov dword [0x46a544], 0xf
mov byte [0x46a530], 0
mov dword [0x46a558], 0
mov dword [0x46a55c], 0xf
mov byte [0x46a548], 0
mov dword [0x46a570], 0
mov dword [0x46a574], 0xf
mov byte [0x46a560], 0
call fcn.0041fec4
push 0x46a578
call fcn.0041f93d
add esp, 8
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x46a530
push eax
call fcn.0041a930
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
mov ecx, 0x46a548
push eax
call fcn.0041a930
cmp dword [ebp + 0x4c], 0x10
lea eax, [ebp + 0x38]
push dword [ebp + 0x48]
cmovae eax, dword [ebp + 0x38]
mov ecx, 0x46a560
push eax
call fcn.0041a930
push 0
push 0
push 0x46a530
push 0x407880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call esi
mov edx, dword [ebp + 0x1c]
mov esi, dword [0x46a380]
cmp edx, 0x10
jb 0x407b55
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407b4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407beb
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x407b97
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407b8d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407beb
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x407bd9
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407bcf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407beb
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004394da
int3
Function at 0x407f30
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c3a0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x466014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004071c0
cmp dword [eax + 0x14], 0x10
jb 0x407f73
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x407fae
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407fa4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408168
push edx
push ecx
call fcn.0041fed9
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x34], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x4669c8
call fcn.0041a110
lea ecx, [ebp - 0x64]
call fcn.00405ec0
add esp, 0x18
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
sub esp, 0x18
mov ecx, esp
push 0x466d40
call fcn.0041a110
lea ecx, [ebp - 0x30]
call fcn.00405ec0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.0041ab90
add esp, 4
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041aa90
sub esp, 0x14
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x467028
call fcn.0041a110
mov ecx, esi
call fcn.00405ec0
mov ecx, esp
mov byte [ebp - 4], 5
push 1
push str.0123456789
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.0041a930
mov byte [ebp - 4], 3
call fcn.00407700
mov edx, dword [ebp - 0x38]
add esp, 0x48
cmp edx, 0x10
jb 0x408096
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40808c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40816d
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
cmp edx, 0x10
jb 0x4080dc
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4080d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40816d
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp edx, 0x10
jb 0x40811e
mov ecx, dword [ebp - 0x64]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408114
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40816d
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x40814e
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408144
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408172
push edx
push ecx
call fcn.0041fed9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f862
mov esp, ebp
pop ebp
ret
call fcn.004394da
call fcn.004394da
call fcn.004394da
int3