joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e3db0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7491cd
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x765f4c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x7c], 0x8000
mov dword [ebp - 0x78], 0x769710
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x8000
lea ecx, [ebp - 0xa8]
call fcn.006b2eb0
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x74]
call fcn.006e28f0
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb8]
call fcn.006e1280
push eax
push 0x8000
push 0
lea ecx, [ebp - 0xa8]
call fcn.006b2f90
push eax
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.006e1280
push eax
mov ecx, dword [ebp + 0x10]
call fcn.006e1280
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.006985d0
push 0
lea ecx, [ebp - 0xa8]
call fcn.006b2f90
push eax
lea ecx, [ebp - 0x98]
call fcn.00694390
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.006e9ad0
add esp, 8
movzx eax, al
test eax, eax
je 0x6e3ef8
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.006e15a0
mov edx, dword [ebp - 0xb0]
or edx, 1
mov dword [ebp - 0xb0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.00694420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.006b2f30
mov eax, dword [ebp + 8]
jmp 0x6e3f57
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
call fcn.006e7550
mov ecx, dword [ebp - 0xb0]
or ecx, 1
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.00694420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.006b2f30
mov eax, dword [ebp + 8]
jmp 0x6e3f57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070231e
mov esp, ebp
pop ebp
ret
Function at 0x6e4640
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7493a1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x765f4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.006e1280
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x6e46f6
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.006b2eb0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.006b2f90
push eax
mov ecx, dword [ebp + 0xc]
call fcn.006e1280
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.006b2f90
push eax
mov ecx, dword [ebp + 8]
call fcn.00694390
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.006b2f30
mov eax, dword [ebp + 8]
jmp 0x6e4715
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.006a9750
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x6e4b60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7494a1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x765f4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x6e4c08
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.006b2eb0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.006b2f90
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.006b2f90
push eax
mov ecx, dword [ebp + 8]
call fcn.00694390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.006b2f30
mov eax, dword [ebp + 8]
jmp 0x6e4c23
mov ecx, dword [ebp + 8]
call fcn.006a8c30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x6e5680
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x749731
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x765f4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.006b2eb0
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.006b2f90
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.006b2f90
push eax
mov ecx, dword [ebp + 8]
call fcn.00694390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.006b2f30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x6f6af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74b650
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x765f4c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x769d48
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x769e28
call fcn.006ab8d0
mov byte [esp + 0x38], 1
call fcn.006f5cc4
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.006ab9a0
mov dword [esi], 0x769e4c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x6fec70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x74c6b0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x765f4c]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [0x765f4c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
mov ebx, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
jb 0x6fecbf
mov eax, dword [edi]
jmp 0x6fecc1
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x6fece1
push esi
push edi
push ebx
call fcn.006fcce0
add esp, 0xc
jmp 0x6fee15
test eax, 0x400
je 0x6fede3
cmp dword [edi + 0x14], 8
jb 0x6fecf6
mov edx, dword [edi]
jmp 0x6fecf8
mov edx, edi
xor eax, eax
mov word [esp + 0x20], ax
mov ebx, 7
mov eax, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6fed15
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.006b62c0
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 0
jae 0x6fed46
lea eax, [esp + 0x20]
push 0
push 0x2000000
push 3
push 0
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x48], 2
jb 0x6fed7a
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00701e16
add esp, 4
mov dword [esp + 0x34], ebx
xor edx, edx
or ebx, 0xffffffff
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, ebx
jne 0x6fedab
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
push eax
push edi
push esi
call fcn.006fcce0
add esp, 0xc
mov eax, esi
jmp 0x6fee17
push edi
call fcn.006faf70
add esp, 4
mov dword [esp + 0x48], ebx
push esi
test al, al
jne 0x6fedd1
mov edi, dword [esp + 0x18]
mov dword [edi], 9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x6fee17
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test esi, esi
je 0x6fedf9
mov dword [esi], 0
call fcn.00701010
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
test al, 0x10
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 3
jne 0x6fee11
mov dword [esp + 0x10], 2
mov ecx, dword [eax]
mov dword [ebx], ecx
mov eax, ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0070231e
add esp, 0x3c
ret
Function at 0x6fee40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x14], 8
jb 0x6fee51
mov eax, dword [edi]
jmp 0x6fee53
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6fee7a
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
push eax
push edi
push esi
call fcn.006fcce0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, dword [esp + 0x18]
test esi, esi
je 0x6fee90
mov dword [esi], 0
call fcn.00701010
mov dword [esi + 4], eax
test ebx, 0x400
je 0x6feec5
push edi
call fcn.006faf70
add esp, 4
test al, al
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
jne 0x6feeb9
mov dword [esp + 0x14], 9
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 3
test bl, 0x10
jne 0x6feede
mov dword [esp + 0x14], 2
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], edx
pop ebx
ret

Function at 0x70231e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x765f4c]
jne 0x702328
repz ret
jmp fcn.0070c6dc
Function at 0x71a62a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x765f4c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0070c0cc
and dword [ebp - 0x14], 0
cmp dword [0x782320], 0
mov dword [ebp - 0x18], eax
jne 0x71a6dd
push 0x76d358
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x71a785
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7697b8
push ebx
call edi
test eax, eax
je 0x71a785
mov esi, dword [0x7673a0]
push eax
call esi
push 0x76d348
push ebx
mov dword [0x782320], eax
call edi
push eax
call esi
push 0x76d334
push ebx
mov dword [0x782324], eax
call edi
push eax
call esi
push 0x76d318
push ebx
mov dword [0x782328], eax
call edi
push eax
call esi
mov dword [0x782330], eax
test eax, eax
je 0x71a6dd
push 0x76d300
push ebx
call edi
push eax
call esi
mov dword [0x78232c], eax
mov eax, dword [0x78232c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x7673a4]
cmp eax, ecx
je 0x71a736
cmp dword [0x782330], ecx
je 0x71a736
push eax
call esi
push dword [0x782330]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x71a736
test ebx, ebx
je 0x71a736
call edi
test eax, eax
je 0x71a72d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x71a72d
test byte [ebp - 8], 1
jne 0x71a736
or dword [ebp + 0x10], 0x200000
jmp 0x71a769
mov eax, dword [0x782324]
cmp eax, dword [ebp - 0x18]
je 0x71a769
push eax
call esi
test eax, eax
je 0x71a769
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x71a769
mov eax, dword [0x782328]
cmp eax, dword [ebp - 0x18]
je 0x71a769
push eax
call esi
test eax, eax
je 0x71a769
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x782320]
call esi
test eax, eax
je 0x71a785
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x71a787
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0070231e
leave
ret
Function at 0x727b78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x727bfd
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00702730
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x727bc0
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x727be2
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x727c58
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.007278c8
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x727c44
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x727c58
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x727b81
pop esi
pop ebx
leave
ret
Function at 0x6750c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x6750c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x6750c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6750c06a
add dl, dl
jne 0x6750c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6750c0dc
xor eax, eax
add dl, dl
jne 0x6750c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x6750c17d
add dl, dl
jne 0x6750c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6750c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6750c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6750c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x6750c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x6750c075
mov eax, 1
add dl, dl
jne 0x6750c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x6750c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6750c0e1
sub eax, ebx
mov ebx, 1
jne 0x6750c128
mov ecx, 1
add dl, dl
jne 0x6750c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6750c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6750c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6750c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x6750c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6750c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x6750c136
cmp eax, 0x7d00
jae 0x6750c16d
cmp eax, 0x500
jb 0x6750c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6750c075
cmp eax, 0x7f
ja 0x6750c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6750c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x6750c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x6750c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x405c80
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5503dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x134], 0
mov ebx, ecx
mov dword [ebp - 0x128], esi
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x12c], edi
jb 0x405cc9
mov eax, dword [esi]
jmp 0x405ccb
mov eax, esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
push eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407d60
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x124], ecx
test ecx, ecx
jne 0x405d29
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.00407990
mov ecx, dword [ebp - 8]
cmp ecx, 0x10
jb 0x405d16
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00408290
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c9018
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 0x10
jb 0x405d37
mov edi, dword [edi]
mov dword [ebp - 0x12c], edi
xor bh, bh
xor eax, eax
nop dword [eax + eax]
mov byte [ebp + eax - 0x120], al
inc eax
cmp eax, 0x100
jb 0x405d40
mov esi, dword [ebp - 0x12c]
xor edi, edi
mov word [ebp - 0x20], 0
nop dword [eax]
mov eax, edi
mov bl, byte [ebp + edi - 0x120]
xor edx, edx
div ecx
lea ecx, [ebp - 0x120]
movzx eax, byte [edx + esi]
add al, bl
add bh, al
movzx eax, bh
add ecx, eax
movzx eax, byte [ecx]
mov byte [ebp + edi - 0x120], al
inc edi
mov byte [ecx], bl
mov ecx, dword [ebp - 0x124]
cmp edi, 0x100
jb 0x405d60
mov esi, dword [ebp - 0x128]
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0x10
cmovae eax, dword [ebp - 0x1c]
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], eax
jb 0x405dc3
mov esi, dword [esi]
xor edi, edi
test ecx, ecx
je 0x405e3a
mov bl, byte [ebp - 0x1f]
mov dl, byte [ebp - 0x20]
nop
inc dl
mov byte [ebp - 0x20], dl
movzx eax, dl
lea edx, [ebp - 0x120]
add edx, eax
add bl, byte [edx]
mov byte [ebp - 0x1f], bl
mov cl, byte [edx]
movzx eax, bl
movzx eax, byte [ebp + eax - 0x120]
mov byte [edx], al
movzx eax, byte [ebp - 0x1f]
mov byte [ebp + eax - 0x120], cl
mov bl, byte [ebp - 0x1f]
mov dl, byte [ebp - 0x20]
movzx ecx, bl
movzx eax, dl
movzx ecx, byte [ebp + ecx - 0x120]
add cl, byte [ebp + eax - 0x120]
movzx eax, cl
mov ecx, dword [ebp - 0x128]
movzx eax, byte [ebp + eax - 0x120]
xor al, byte [esi + edi]
mov byte [ecx + edi], al
inc edi
cmp edi, dword [ebp - 0x124]
jb 0x405dd0
mov esi, dword [ebp - 0x130]
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00407990
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x405e60
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408290
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c9018
mov esp, ebp
pop ebp
ret
Function at 0x406ec0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x57b090], 0
je 0x406f0a
mov byte [0x57b090], 0
call fcn.00410ed0
push dword [ebp + 8]
push dword [0x57b094]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [0x57b094]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x57b098
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x57b094], 0
pop ebp
ret

Function at 0x40a090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5503dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10c], esi
call fcn.004debe0
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x108], 0
jne 0x40a0fc
xor ecx, ecx
jmp 0x40a10e
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a105
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00407d60
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004c9018
mov esp, ebp
pop ebp
ret
Function at 0x417bf0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x5503dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x78], esi
push 0x64
lea eax, [ebp - 0x74]
mov dword [ebp - 0x94], 0
push 0
push eax
call fcn.004debe0
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x78]
add esp, 0xc
mov byte [ebp - 0x8c], 0
mov dword [ebp - 0x8b], 0
mov byte [ebp - 0x87], 0
mov dword [ebp - 0x78], 0
push eax
push 0
call ebx
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
movq qword [ebp - 0x84], xmm0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x84]
push dword [ebp - 0x78]
call fcn.00412080
mov edi, dword [ebp - 0x84]
test edi, edi
je 0x417d0f
lea eax, [ebp - 0x78]
push eax
push edi
call ebx
test eax, eax
jne 0x417d0f
mov ebx, dword [ebp - 0x8c]
mov esi, edi
nop dword [eax]
lea ecx, [esi + 8]
call fcn.00417aa0
mov ecx, eax
cmp ecx, 1
je 0x417ce3
test ecx, ecx
jne 0x417d01
mov ax, word [esi + 0x198]
mov ebx, dword [esi + 0x194]
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x88], ax
test ecx, ecx
je 0x417d07
mov esi, dword [esi]
test esi, esi
jne 0x417cd0
mov esi, dword [ebp - 0x90]
jmp 0x417d15
mov ebx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp - 0x88]
push eax
mov eax, ebx
shr eax, 0x18
push eax
mov eax, ebx
shr ebx, 8
shr eax, 0x10
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [ebp - 0x8c]
push eax
push str._02X__02X__02X__02X__02X__02X
lea eax, [ebp - 0x74]
push 0x64
push eax
call fcn.00409410
mov dword [esi + 0x14], 0xf
add esp, 0x24
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x74], 0
jne 0x417d76
xor ecx, ecx
jmp 0x417d89
lea ecx, [ebp - 0x74]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417d80
sub ecx, edx
push ecx
lea eax, [ebp - 0x74]
mov ecx, esi
push eax
call fcn.00407d60
test edi, edi
je 0x417de0
mov eax, dword [ebp - 0x7c]
sub eax, edi
cmp eax, 0x1000
jb 0x417dd7
test byte [ebp - 0x84], 0x1f
je 0x417db3
call fcn.004e12d1
mov eax, dword [edi - 4]
cmp eax, edi
jb 0x417dbf
call fcn.004e12d1
sub edi, eax
cmp edi, 4
jae 0x417dcb
call fcn.004e12d1
cmp edi, 0x23
jbe 0x417dd5
call fcn.004e12d1
mov edi, eax
push edi
call fcn.00469456
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9018
mov esp, ebp
pop ebp
ret