joyce8/EMBER2024-capa huggingface dataset:
Function at 0x74af10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x75f9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x74b002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0074edff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x74b002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007466e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0074f20b
push 0x10
call fcn.0074f1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x74afc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0073b1c0
jmp 0x74afc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0074ab80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x74aff0
mov ecx, edi
call fcn.0073b2c0
push edi
call fcn.0074f1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x74b021
inc ebx
cmp ebx, 0x20
jb 0x74af3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x74c250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x760808
push 0x750288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x74c329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x74c329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0074f1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x74c329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x74c329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x74c32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0074c351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x74cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x74cd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x74cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x74cd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x74cd94
push eax
push esi
call fcn.0074f20b
add esp, 8
pop esi
ret 0x10

Function at 0x74cda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x74ce22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x74ce15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x765320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0074edff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x74cdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x74ce30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x74cec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x74ceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x765320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0074edff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x74ceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x74ce6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x74d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x74d131
push esi
call fcn.00750145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0073f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x74d131
push 0
push ebp
call fcn.0073f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0073f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x74d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0073f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x74d121
push 0x765918
push edi
call fcn.0074e3f0
push eax
push ebx
push esi
call fcn.0074cf60
push 0x7658f8
push edi
call fcn.0074e3f0
push eax
push ebx
push esi
call fcn.0074cf60
push 0x7658d8
push edi
call fcn.0074e3f0
push eax
push ebx
push esi
call fcn.0074cf60
push 0x7658c0
push edi
call fcn.0074e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0074cf60
push 0x7658a0
push edi
call fcn.0074e3f0
push eax
push ebx
push esi
call fcn.0074cf60
push 0x765888
push edi
call fcn.0074e3f0
push eax
push ebx
push esi
call fcn.0074cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x74e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0074e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0074e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0074e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0074e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x74ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x74ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x76087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x74ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x74ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x452482
Capabilities:
Check for software breakpoints

Disassembly:
push eax
call 0x452488
pop ebx
sub ebx, 0x1a2
mov ecx, 0x152e6
sub ebx, ecx
mov esi, ebx
sub ebx, 0x3c000
mov edi, ebx
sub ebx, 0x1000
push edi
push ecx
push esi
call fcn.00452337
add esp, 0xc
mov ebp, dword [ebx + 0xc0]
lea ebp, [ebx + ebp]
dec ebp
mov cl, byte [ebp]
cmp cl, 0xcc
je 0x4524ba
sub ebp, 9
mov edx, ebx
sub edx, dword [ebx + 0x74]
add dword [ebp], edx
add ebp, 6
add dword [ebp], edx
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, ebx
add esi, dword [edx + 0x10c]
mov edi, dword [edx + 0x104]
mov ecx, 0x1eb7a
call fcn.00452458
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x452544
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x45253f
pushal
test eax, 0x80000000
je 0x452529
and eax, 0x7fffffff
jmp 0x45252d
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x452514
add esi, 0x14
jmp 0x4524fa
pop edx
mov ebp, ebx
sub ebp, dword [edx + 0x34]
mov esi, dword [edx + 0xa0]
add esi, ebx
cmp esi, ebx
je 0x45258e
push edx
mov eax, dword [esi + 4]
or eax, eax
je 0x45258d
mov ecx, dword [esi]
add ecx, ebx
add esi, 8
sub eax, 8
shr eax, 1
mov edx, esi
lea edi, [eax + esi]
lea esi, [eax + edi]
xor eax, eax
add al, byte [edx]
adc ah, byte [edi]
test ah, 0x30
je 0x452585
push eax
and ah, 0xf
add dword [ecx + eax], ebp
pop eax
inc edx
inc edi
cmp edi, esi
jb 0x452574
jmp 0x452557
pop edx
pop eax
cmp eax, 0xd0dec0de
je 0x45259b
add ebx, dword [edx + 0x28]
jmp ebx
ret 0xc
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x4068ad
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406883
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x40687e
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068da
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068bb
not eax
pop ebp
ret 0xc

Function at 0x1cd81b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1cd81ba
pushal
call 0x1cd81c0
pop ebp
sub ebp, 0x10
sub ebp, 0x18d81b0
jmp 0x1cd81d6
mov eax, 0x18d81b0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5dd
mov edx, 0xe27958a5
xor byte [eax], dl
inc eax
dec ecx
jne 0x1cd81ed
jmp 0x1cd8200
push 0xa5992c2e
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and al, 0x64
pop ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
push 0xa5a5a11d
movsd dword es:[edi], dword [esi]
pop ds
lea esp, [ebp + 0x4752a5a5]
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
and al, 0xa9
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmpsb byte [esi], byte es:[edi]
pushal
sub cl, al
sbb dword [ecx + 0x2c], 0xc12881a1
sbb dword [ecx + 0x2c], 0xd5cd81a1
invalid
Function at 0x4a47b0
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], 0x6ed5
lea esp, [esp + 4]
je 0x4a16ba
sal si, cl
rcl esi, 0x16
btc esi, 0x19
sbb si, 0xabf0
mov esi, edx
bsr dx, cx
cmp cx, bx
mov edx, eax
clc
xor ebx, ebx
jmp 0x4a308c
sub al, 0x5a
sub ebx, edi
shr edi, 0x1a
neg al
test esp, ecx
add ebx, esp
xor al, 0xa7
sal di, 8
rcr al, 2
shld di, si, cl
mov edi, ebx
ror al, 3
pushal
cmc
xor al, 0x41
mov al, 0x2e
cmp dl, bh
jmp 0x4a431e
cmc
stc
shr eax, 0x10
jmp 0x4a26bc
call fcn.004a458e
pushal
repne scasb al, byte es:[edi]
mov byte [esp + 4], 0x21
mov byte [esp + 4], cl
lea esp, [esp + 0x40]
jne 0x4a3df0
movsx eax, cl
mov byte [edi - 1], 0
bswap ax
pushal
lea eax, [ebp*8 + 0x693c1122]
mov dword [esp + 0x1c], ebx
not eax
push eax
lea eax, [0x4a4d32]
pushfd
pushfd
mov dword [esp + 0x24], 0x48c0f2
pushal
mov dword [esp + 0x40], eax
pushfd
pushfd
push dword [esp + 0x48]
ret 0x4c
pop es
sub al, 6
push 0x6981d340
mov bl, 0xd3
stosb byte es:[edi], al
call fcn.0048ba0d
pushfd
lea esp, [esp + 0x30]
ja 0x4a2461
xchg dword [esi - 0x6000024], esp
stc
sub ebx, edi
sub al, 0xd5
add ebx, esp
sal di, cl
inc di
bt esp, eax
dec al
mov edi, ebx
xor al, cl
dec al
mov al, dl
rol al, cl
mov al, 0x2e
push 0xb0ceabee
repne scasb al, byte es:[edi]
push dword [esp]
call fcn.004a3e13
rcr byte [ebp - 0xb], 1
aad 0x8e
inc ecx
repne scasb al, byte es:[edi]
insd dword es:[edi], dx
sub ch, bl
xchg ebx, eax
inc esp
mov eax, dword [0xe5d55be5]
popfd
push ss
je 0x4a47b6
sbb al, 0xa5
call 0xee5eb880
jg 0x4a4867
and byte [ecx - 0x2e24c74b], al
jg 0x4a47a0
js 0x6a34b80f
in eax, 0x56
leave
and al, al
push 0x13020af5
call fcn.004a7539
jno 0x4a4867
lea esp, [esp + 0x10]
ja 0x4a2461
jb 0x48b19f
sar al, 5
sub ebx, edi
and di, si
add ebx, esp
bts di, 2
btr di, si
mov edi, ebx
clc
call fcn.004a5de8
push 0x1302147a
call fcn.004a664c
sub byte [esi*4 - 0x18e618], cl
call 0x4a2f7d
invalid
je 0x4a4891
out 0x9d, al
push edx
or bh, byte [ebx - 0x5914d18b]
stc
pushal
dec ecx
cmp ch, dl
dec esi
pop ebx
pushfd
mov edi, 0x2a6fb43c
cmpsd dword [esi], dword es:[edi]
mov eax, dword es:[0x78078d14]
in al, dx
popal
fcom dword [eax + ebp*2 - 0x12]
int1
add byte [ebx], dl
call fcn.004a8d97
cdq
pop esi
add byte [ecx - 0x2bc70aa2], bl
cmc
cmp ah, dl
push ecx
pushfd
bt bx, 5
mov dword [esp], ebx
cmc
or eax, eax
jmp 0x4a54ea
pushfd
jmp 0x46645a
Function at 0x405f75
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 4]
test edx, edx
jbe 0x405fa2
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x41c4c0]
xor eax, esi
inc ecx
dec edx
jne 0x405f83
pop edi
pop esi
ret 4
Function at 0x40bfff
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x415e1b
call fcn.004133c0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4175a0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4175c8
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040dcf9
push dword [esi + 8]
mov ecx, ebx
call fcn.0040dcf9
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040dcf9
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040dcf9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x411fba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jae 0x411fd1
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x411ff8
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x411ff8
inc esi
jmp 0x411fe9
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x4120e8
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x41202d
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x41205a
cmp cl, 0xff
je 0x41205a
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x411fdc
dec ecx
shl edx, cl
and edx, 7
je 0x412013
movzx ecx, byte [edx + 0x4179e0]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x4179d8], 0
mov cl, byte [edi + 4]
je 0x412055
test cl, cl
je 0x412055
cmp cl, 0xff
jne 0x412013
mov dword [ebp - 4], eax
jmp 0x412022
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x412083
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x41208a
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x4120be
movzx edi, byte [edx + 0x4179e0]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x4120a9
cmp al, 0xff
jne 0x4120bb
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x412075
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x411fdc
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret
Function at 0x4046f0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406910
test esi, esi
jne 0x404726
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406a78
jmp 0x404744
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404634
mov edi, eax
test esi, esi
je 0x404744
cmp dword [ebx], 0
je 0x404744
dec esi
jmp 0x40472d
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405670
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405a5c
mov byte [esp], al
cmp byte [esp], 0
jne 0x4057f9
test edi, edi
je 0x4057f9
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405730
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x40570b
cmp edi, 0xffffffff
je 0x4056cf
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4056cf
mov byte [esp], 0
jmp 0x4057f9
mov ebx, dword [esi]
cmp ebx, 1
jg 0x40570b
test ebx, ebx
jne 0x405704
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.00402580
test eax, eax
jne 0x405704
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4057f9
pause
dec ebp
test ebp, ebp
jg 0x4056b4
cmp edi, 0xffffffff
je 0x405730
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40572e
mov byte [esp], 0
jmp 0x4057f9
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40567e
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.00402580
cmp ebx, eax
jne 0x405730
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040586c
mov edx, eax
mov ebx, dword [0x4c78c8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405797
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405795
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405797
xor edi, edi
cmp byte [esp], 0
je 0x4057c0
mov ebx, dword [esi]
test bl, 1
jne 0x4057d9
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.00402580
cmp ebx, eax
jne 0x40579d
mov byte [esp + 1], 1
jmp 0x4057d9
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.00402580
cmp ebx, eax
jne 0x4057c0
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x40574a
cmp byte [esp], 0
je 0x4057f9
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406574
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c7050], 0
je 0x4065d5
cmp word [0x4c732c], 0xd7b2
jne 0x40659d
cmp dword [0x4c7334], 0
jbe 0x40659d
mov eax, 0x4c7328
call dword [0x4c7344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406600
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4c4028], 0
jne 0x4065f1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4067cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4c402c], 0
je 0x4067f7
mov edx, edi
mov eax, esi
call dword [0x4c402c]
mov ebx, eax
jmp 0x406808
mov eax, 8
call fcn.00404368
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4c7051], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406794
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40683d
mov edx, 8
mov eax, ebx
call fcn.00404384
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc