joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10ccd8c9
Capabilities:
Execute syscall

Disassembly:
not ecx
xor ecx, 0xa93c1913
rol al, 0xa1
bswap ecx
xor ebx, ecx
and word [esp + edx*2 - 0x499a3f51], ax
mov dword [esp + edx*2 - 0x499a3f56], 0x7cbc88b7
adc esi, ecx
shl word [esp + edx*2 - 0x499a3f54], 0x4d
movzx cx, byte [ebp + edx*2 - 0x499a3f56]
xchg word [esp + edx - 0x24cd1faa], ax
inc dword [esp + edx*2 - 0x499a3f53]
mov dl, byte [ebp + edx - 0x24cd1fa9]
xadd byte [esp + 5], ah
sub word [esp + 3], 0x8531
adc ebp, 2
or cl, dl
xadd dword [esp + 1], eax
movzx edx, byte [esp + eax*2 - 0x4aa13f4c]
not cl
dec dword [esp + eax*2 - 0x4aa13f4c]
adc dword [esp + edx - 0xc3], edx
mov word [ebp + edx*4 - 0x31c], cx
movsx ecx, dx
call fcn.10cc9363
mov edx, 0x4b73f0c
shr dx, 0x6d
jbe 0x1071b096
mov edx, 0xcb8ee7ae
lea ecx, [edx + edx*8 - 0x385b7cc7]
sub edi, 4
pop ecx
add ecx, 0x9eb99
jmp ecx

Function at 0x10cef56d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6187cf85
xchg ah, al
mov eax, dword [ebp + eax - 0x618785cf]
push 0x2abae6ba
lea esp, [esp + 4]
call eax
mov esi, 0xfb60496
mov ebp, dword [ebp + esi*4 - 0x3ed8125c]
and esi, 0xb021e983
jp 0x10c50b92
mov eax, 0xe725d28b
movsx ecx, ax
lea ecx, [eax + ecx*8 + 0x741079bd]
mov ecx, dword [esi + ecx - 0x5b34e0a0]
add esi, 4
call fcn.109b85ed
mov eax, dword [ebp + 4]
add ebp, 8
mov dword [ecx], eax
sub esi, 4
mov eax, 0xc57ad
mov dword [esp + eax*2 - 0x18af56], eax
mov ecx, dword [eax + esi - 0xc57ad]
call fcn.107756b6
mov edx, dword [esi]
add esi, 4
mov eax, 0xd69e17b2
xor al, 6
movzx ecx, ax
xor edx, ebx
xadd ecx, eax
lea edx, [edx + eax + 0x65b81adb]
rol edx, 1
lea edx, [eax + edx + 0x2b3e90f0]
rol edx, 1
sal eax, cl
sbb ecx, eax
xor edx, 0xd9977824
shl cx, 0x8e
seta cl
setbe cl
xor ebx, edx
add edi, edx
mov edx, eax
mov ecx, dword [ebp + eax*2 - 0x2f6800]
xor dl, byte [eax + ebp - 0x17b3fc]
and eax, 0xc8b487b4
ja 0x10cef559
mov dword [esi + ebp - 0x200082], eax
pop ebx
pop esi
mov edx, 0x6c14348f
pop edi
push edx
lea edi, [edi + edx - 0x6c143493]
mov eax, dword [edi + edx - 0x6c14348f]
shl dword [esp + edx - 0x6c14348f], 0x58
adc dl, dh
xor eax, ebx
shr dx, 0x2a
not eax
xor eax, 0x9301e3a8
ror eax, 1
movzx ecx, dl
lea eax, [ecx + eax + 0x49982276]
jmp fcn.1072a773
lea ebp, [ebp + eax - 0x1483fa]
mov byte [ecx + eax*2 - 0x290800], dl
jp 0x10c53a51
test ebx, ebx
mov dword [esp + 4], 0xd6285281
lea esp, [esp + 8]
je 0x10750d71
mov eax, 0x261b850d
mov eax, dword [ebp + ebx*4]
call fcn.10aabcdc

Function at 0x10cf439b
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
inc ebp
mov esi, ecx
dec edx
mov edx, dword [esp + ecx - 0x67bfbb0f]
dec esi
mov esi, dword [esp - 0x57819b9c]
dec esi
mov esp, dword [esp - 0x2bc0cdbe]
dec edx
lea eax, [ecx*8 - 0x4e541f78]
not ax
dec edx
mov dword [esp + ecx - 0x67bfbb07], eax
dec esi
mov ebx, dword [esp + ecx - 0x67bfbaf7]
inc ecx
mov edi, 0xd00a67ae
movzx edi, al
dec eax
mov ebp, dword [esp + edi*2 - 0x156]
dec esp
mov ebp, dword [esp + edi*8 - 0x5c8]
call fcn.109adcf8
Function at 0x4044b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x4044e4
mov esi, dword [esp + 8]
test esi, esi
je 0x4044e4
call fcn.00414890
jmp 0x4044f3
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov dword [edi + 4], eax
mov eax, 0x40000000
lea esi, [esp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
call fcn.004148f0
test al, al
je 0x404554
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [edi + 0x10], ecx
shrd ecx, eax, 5
mov dword [edi + 0x14], eax
shr eax, 5
mov edx, ecx
mov esi, eax
shld esi, edx, 4
shl edx, 4
add edx, ecx
adc esi, eax
mov dword [edi + 8], edx
mov dword [edi + 0xc], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42be2b
push eax
mov dword fs:[0], esp
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
mov dword [esi + 4], vtable.ICompressSetFinishMode.0
mov dword [esi + 8], vtable.ICompressGetInStreamProcessedSize2.0
mov dword [esi + 0xc], vtable.ICompressSetInStream2.0
mov dword [esi + 0x10], vtable.ISequentialInStream.0
mov dword [esi + 0x14], vtable.ICompressSetOutStreamSize.0
mov dword [esi + 0x18], vtable.ICompressSetBufSize.0
mov dword [esi + 0x1c], ebx
mov eax, 0x40000
mov dword [esi + 0x20], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x54], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x58], eax
push 0x403200
push 0x4031f0
mov dword [esp + 0x18], ebx
push 4
push 4
lea eax, [esi + 0xa0]
push eax
mov dword [esi], vtable.NCompress::NBcj2::CDecoder.0
mov dword [esi + 4], vtable.NCompress::NBcj2::CDecoder.1.0
mov dword [esi + 8], vtable.NCompress::NBcj2::CDecoder.2.0
mov dword [esi + 0xc], vtable.NCompress::NBcj2::CDecoder.3.0
mov dword [esi + 0x10], vtable.NCompress::NBcj2::CDecoder.4.0
mov dword [esi + 0x14], vtable.NCompress::NBcj2::CDecoder.5.0
mov dword [esi + 0x18], vtable.NCompress::NBcj2::CDecoder.6.0
call fcn.00425861
mov ecx, dword [esp + 8]
mov word [esi + 0xb0], bx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x411110
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c51b
push eax
mov dword fs:[0], esp
sub esp, 0x320
cmp byte [0x4395bd], 0
push ebp
push esi
push edi
mov esi, ecx
push 0x105
jne 0x41117d
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, eax
lea edi, [esp + 0x18]
lea eax, [esp + 0xc]
call fcn.0040f000
push eax
mov dword [esp + 0x338], 0
call fcn.0040e9d0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004259b6
add esp, 4
jmp 0x4111a6
lea eax, [esp + 0x124]
xor edx, edx
push eax
mov word [esp + 0x128], dx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x120]
push ecx
mov edi, esi
mov ebp, eax
call fcn.0040e940
mov ecx, dword [esp + 0x32c]
dec ebp
mov edx, 0x103
cmp edx, ebp
pop edi
sbb eax, eax
pop esi
inc eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x32c
ret

Function at 0x4111d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42c51b
push eax
mov dword fs:[0], esp
sub esp, 0x320
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
cmp byte [0x4395bd], 0
jne 0x411259
mov ecx, dword [ebp + 0x430a14]
lea eax, [esp + 0x1c]
push eax
push 0
push 0
or ecx, 0x8000
push ecx
push 0
mov byte [esp + 0x30], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov ebx, eax
lea edi, [esp + 0x1c]
lea eax, [esp + 0x10]
call fcn.0040f000
push eax
mov dword [esp + 0x33c], 0
call fcn.0040e9d0
mov dword [esp + 0x338], 0xffffffff
mov edx, dword [esp + 0x10]
push edx
call fcn.004259b6
add esp, 4
jmp 0x411292
mov edx, dword [ebp + 0x430a14]
xor eax, eax
lea ecx, [esp + 0x124]
push ecx
push eax
push eax
or edx, 0x8000
push edx
push eax
mov word [esp + 0x138], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
lea eax, [esp + 0x124]
push eax
mov edi, esi
call fcn.0040e940
test ebx, ebx
je 0x4112bd
add ebp, 4
cmp ebp, 0xc
jb 0x4111f3
xor al, al
mov ecx, dword [esp + 0x330]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x32c
ret
mov al, 1
jmp 0x4112a4

Function at 0x411340
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
cmp byte [0x4395bd], 0
jne 0x41137b
push esi
push eax
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call fcn.004259b6
add esp, 4
test esi, esi
pop esi
je 0x41138d
mov al, 1
add esp, 0xc
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41138d
mov al, 1
add esp, 0xc
ret
xor al, al
add esp, 0xc
ret

Function at 0x4113a0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc
cmp byte [0x4395bd], 0
jne 0x4113da
push esi
push eax
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call fcn.004259b6
add esp, 4
test esi, esi
pop esi
je 0x4113eb
mov al, 1
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4113eb
mov al, 1
add esp, 0xc
ret
xor al, al
add esp, 0xc
ret
Function at 0x411400
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
cmp byte [0x4395bd], 0
jne 0x41143c
push esi
push eax
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call fcn.004259b6
add esp, 4
test esi, esi
pop esi
je 0x41144f
mov al, 1
add esp, 0xc
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41144f
mov al, 1
add esp, 0xc
ret
xor al, al
add esp, 0xc
ret

Function at 0x411460
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c8f8
push eax
mov dword fs:[0], esp
sub esp, 0x48
cmp byte [0x4395bd], 0
push ebx
push esi
jne 0x4114be
push edi
lea esi, [esp + 0xc]
call fcn.0040ef80
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call fcn.004259b6
add esp, 4
test esi, esi
je 0x4114de
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x54
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4114de
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x54
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x411515
lea esi, [esp + 0x14]
call fcn.00411560
push edi
mov ecx, esi
mov dword [esp + 0x5c], 0
call fcn.00412dc0
test al, al
jne 0x411528
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004259b6
add esp, 4
xor al, al
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x54
ret
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
shr ebx, 4
push edx
and bl, 1
call fcn.004259b6
mov ecx, dword [esp + 0x54]
add esp, 4
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0x54
ret
Function at 0x411830
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 0xc
cmp byte [0x4395bd], 0
push esi
push ebx
jne 0x411863
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call fcn.004259b6
add esp, 4
mov eax, esi
jmp 0x41186e
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41188d
cmp eax, 0xffffffff
je 0x41188d
test al, 0x10
jne 0x41188d
test al, 1
je 0x41188d
push edi
mov edi, eax
and edi, 0xfffffffe
mov eax, ebx
call fcn.00411340
pop edi
test al, al
je 0x4118d4
cmp byte [0x4395bd], 0
push ebx
jne 0x4118c3
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call fcn.004259b6
add esp, 4
test esi, esi
je 0x4118d4
mov al, 1
pop esi
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4118d4
mov al, 1
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x411cf0
Capabilities:
Set current directory

Disassembly:
sub esp, 0xc
cmp byte [0x4395bd], 0
jne 0x411d29
push esi
push eax
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call fcn.004259b6
add esp, 4
test esi, esi
setne al
pop esi
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
add esp, 0xc
ret

Function at 0x411d40
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c51b
push eax
mov dword fs:[0], esp
sub esp, 0x320
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 4], 0
push edi
mov word [eax], cx
cmp byte [0x4395bd], cl
jne 0x411db9
lea edx, [esp + 0x18]
push edx
push 0x105
mov byte [esp + 0x20], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ebp, eax
lea edi, [esp + 0x18]
lea eax, [esp + 0xc]
call fcn.0040f000
push eax
mov dword [esp + 0x338], 0
call fcn.0040e9d0
mov eax, dword [esp + 0xc]
push eax
call fcn.004259b6
add esp, 4
jmp 0x411de7
lea edx, [esp + 0x120]
push edx
xor ecx, ecx
push 0x105
mov word [esp + 0x128], cx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebp, eax
lea eax, [esp + 0x120]
push eax
mov edi, esi
call fcn.0040e940
dec ebp
mov ecx, 0x103
cmp ecx, ebp
mov ecx, dword [esp + 0x32c]
pop edi
sbb eax, eax
pop esi
inc eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x32c
ret
Function at 0x411e90
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42c51b
push eax
mov dword fs:[0], esp
sub esp, 0x320
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 4], 0
push edi
mov word [eax], cx
cmp byte [0x4395bd], cl
jne 0x411f09
lea edx, [esp + 0x18]
push edx
push 0x105
mov byte [esp + 0x20], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebp, eax
lea edi, [esp + 0x18]
lea eax, [esp + 0xc]
call fcn.0040f000
push eax
mov dword [esp + 0x338], 0
call fcn.0040e9d0
mov eax, dword [esp + 0xc]
push eax
call fcn.004259b6
add esp, 4
jmp 0x411f37
lea edx, [esp + 0x120]
push edx
xor ecx, ecx
push 0x105
mov word [esp + 0x128], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, eax
lea eax, [esp + 0x120]
push eax
mov edi, esi
call fcn.0040e940
dec ebp
mov ecx, 0x103
cmp ecx, ebp
mov ecx, dword [esp + 0x32c]
pop edi
sbb eax, eax
pop esi
inc eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x32c
ret
Function at 0x412d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xc
cmp byte [0x4395bd], 0
jne 0x412da6
push esi
push eax
lea esi, [esp + 8]
call fcn.0040ef80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call fcn.004259b6
add esp, 4
mov eax, esi
pop esi
add esp, 0xc
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412db4
or eax, eax
add esp, 0xc
ret

Function at 0x413700
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x400000
jbe 0x413724
mov eax, 0x400000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [edx]
push edi
push eax
mov dword [esp + 0x28], 0
call ebx
mov ecx, dword [esp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x41375a
test ecx, ecx
je 0x413752
add edi, ecx
sub ebp, ecx
jne 0x413715
pop edi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop ebp
xor al, al
pop ebx
ret 8

Function at 0x413770
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x400000
jbe 0x413794
mov eax, 0x400000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [edx]
push edi
push eax
mov dword [esp + 0x28], 0
call ebx
mov ecx, dword [esp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x4137ca
test ecx, ecx
je 0x4137c2
add edi, ecx
sub ebp, ecx
jne 0x413785
pop edi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop ebp
xor al, al
pop ebx
ret 8

Function at 0x4148f0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x68
push edi
push str.GlobalMemoryStatusEx
xor edi, edi
push str.kernel32.dll
mov dword [esi], SysReAllocStringLen
mov dword [esi + 4], edi
mov dword [esp + 0x30], 0x40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x414957
lea ecx, [esp + 0x28]
push ecx
call eax
test eax, eax
je 0x414957
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
cmp ecx, edx
ja 0x414947
mov eax, dword [esp + 0x50]
jb 0x41494b
cmp eax, edi
jb 0x41494b
mov eax, edi
mov ecx, edx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov al, 1
pop edi
add esp, 0x68
ret
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jb 0x414978
mov eax, ecx
mov dword [esi + 4], edi
mov dword [esi], eax
mov al, 1
pop edi
add esp, 0x68
ret
Function at 0x4150e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x4150f0
mov eax, 0x400000
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esi + 0x14]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
test eax, eax
setne al
test ecx, ecx
je 0x415127
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
test al, al
je 0x415131
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x1c], 0
je 0x41514f
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx]
push eax
mov eax, dword [esi + 0x20]
push eax
call edx
pop esi
ret 0x10
test eax, eax
jne 0x41515c
mov eax, 0x80004005
pop esi
ret 0x10
jle 0x415168
and eax, 0xffff
or eax, 0x80070000
pop esi
ret 0x10

Function at 0x415170
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, 0x100000
cmp ecx, eax
jae 0x41517f
mov eax, ecx
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push edx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4151a9
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
push esi
test eax, eax
jne 0x4151bb
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x6d
jne 0x4151c1
xor eax, eax
pop esi
ret 0x10
call esi
test eax, eax
jne 0x4151d0
mov eax, 0x80004005
pop esi
ret 0x10
jle 0x4151dc
and eax, 0xffff
or eax, 0x80070000
pop esi
ret 0x10

Function at 0x415290
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 0x10]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4152b8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x4152d4
mov edx, dword [esp + 0xc]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret 8
call edi
test eax, eax
jne 0x4152e4
pop edi
mov eax, 0x80004005
pop esi
ret 8
jle 0x4152f0
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
ret 8
Function at 0x4169d0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
jne 0x416a05
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 4], eax
test eax, eax
jne 0x416a05
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x416a7d
mov eax, 1
pop edi
pop ecx
ret
cmp dword [esi + 8], 0
jne 0x416a1c
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x4169ef
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x416a35
call ebx
mov ecx, dword [esi + 8]
push ecx
call edi
test eax, eax
jne 0x416a41
call ebx
cmp dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
je 0x416a51
pop ebx
xor eax, eax
pop edi
pop ecx
ret
lea edx, [esp + 8]
push edx
push 0
push esi
push 0x416970
push 0
push 0
call fcn.00425bf6
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
jne 0x416a4b
call ebx
test eax, eax
jne 0x416a7c
mov eax, 1
pop ebx
pop edi
pop ecx
ret

Function at 0x41b950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c6f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
push edi
xor edi, edi
mov dword [esp + 0x20], edi
push eax
mov dword [esp + 0xc], edi
call fcn.0040e8d0
mov dword [esp + 0x20], edi
push 0x430da0
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 1
call fcn.0040e7d0
mov ecx, dword [esp + 0x30]
push ecx
mov edx, edi
push edx
mov eax, esi
mov dword [esp + 0x28], 1
call fcn.0040ee30
mov eax, dword [esp + 0xc]
push eax
call fcn.004259b6
mov ecx, dword [esp + 0x1c]
add esp, 4
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x41c930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [ecx]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0x41c94b
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x10
add dword [esp + 0x14], 5
push ebx
push ebp
mov ebp, dword [esp + 0x18]
lea ebx, [eax - 4]
add ebx, ebp
mov dword [esp + 0x10], ebx
nop
lea edx, [edi + ebp]
cmp edx, ebx
jae 0x41c974
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x41c974
inc edx
cmp edx, ebx
jb 0x41c967
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, ebp
sub edi, ebp
cmp edx, ebx
jae 0x41ca60
cmp ecx, 2
jbe 0x41c9cc
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x41ca51
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [esp + 0x1c]
lea ebp, [edi + ecx]
add edi, 5
cmp dword [esp + 0x24], 0
je 0x41c9f5
add eax, ebp
jmp 0x41c9f7
shr esi, cl
test esi, esi
je 0x41c98d
cmp esi, 4
ja 0x41c9ea
cmp esi, 3
je 0x41c9ea
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x41c98d
or esi, 8
shr esi, 1
inc edi
jmp 0x41c960
sub eax, ebp
test esi, esi
je 0x41ca2b
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x41ca25
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [esp + 0x24], 0
je 0x41ca23
add eax, ebp
jmp 0x41ca25
sub eax, ebp
mov ebx, dword [esp + 0x10]
xor esi, esi
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x41c960
mov ebp, dword [esp + 0x18]
or esi, 8
shr esi, 1
inc edi
jmp 0x41c960
pop ebp
pop ebx
cmp ecx, 2
jbe 0x41ca77
mov edx, dword [esp + 0x18]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ecx
ret 0x10