joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474d3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49b93f
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push esi
push edi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
call fcn.00474d03
pop ecx
mov ebx, eax
push edi
lea eax, [esp + 0x28]
push eax
call fcn.00469282
push dword [ebp + 0x14]
and dword [esp + 0x10c], 0
push ebx
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0047467e
add esp, 0x10
test eax, eax
jne 0x474df2
xor ebx, ebx
or dword [esp + 0x108], 0xffffffff
lea esi, [esp + 0x24]
call fcn.0046941b
mov eax, ebx
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.0047d444
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
push 0x7e
push eax
mov word [esp + 0x7c], ax
lea eax, [esp + 0x7e]
push eax
call fcn.0047f8f0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, dword [0x4c4858]
inc dword [0x4c4858]
call fcn.0045d2b9
push eax
movzx eax, word [esp + 0x24]
push esi
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push eax
push str._04d__02d__02d__02d:_02d:_02d__d__08x
lea eax, [esp + 0x98]
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x2c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x5c]
call fcn.0046a800
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x10c], 1
call fcn.00403040
cmp dword [eax + 0x18], 8
pop ecx
jb 0x474e8f
mov eax, dword [eax + 4]
jmp 0x474e92
add eax, 4
lea ecx, [esp + 0x74]
push ecx
mov esi, eax
mov edi, str.Softwareprojonepodlp_rptcachependings_
call fcn.0045e911
lea esi, [esp + 0x3c]
mov ebx, eax
call fcn.00405980
lea ecx, [esp + 0x58]
mov byte [esp + 0x108], 0
call fcn.00403df0
test ebx, ebx
je 0x474ed2
mov ecx, str.GlobalD36B0A68_AE78_4fa2_BD9C_05FD95224F52
call fcn.004078a0
jmp 0x474db9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x78]
push eax
push edi
push str.CachedReport_write_register_failed:__s._s__d
call fcn.004751a6
add esp, 0x10
jmp 0x474db9
Function at 0x4754a8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4be0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4a18c8
lea esi, [ebp - 0x20]
call fcn.0045e820
pop ecx
pop ecx
test ebx, ebx
je 0x475519
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 8], 8
mov ecx, dword [ebp - 0x1c]
lea eax, [eax + eax + 2]
jae 0x4754ee
lea ecx, [ebp - 0x1c]
push edi
push eax
push ebx
push 1
push ecx
mov edi, str.Softwareprojonepodlp_volatilelastError_
push edi
call fcn.0045ebef
mov eax, dword [ebp - 0x1c]
add esp, 0x14
cmp dword [ebp - 8], 8
jae 0x47550e
lea eax, [ebp - 0x1c]
push eax
mov esi, ebx
call fcn.0045e911
pop edi
jmp 0x475536
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x475525
lea eax, [ebp - 0x1c]
push eax
push str.Softwareprojonepodlp_volatilelastError_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea esi, [ebp - 0x20]
call fcn.00405980
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d444
leave
ret 4

Function at 0x476078
Capabilities:
Create process on windows

Disassembly:
push 0x2c
mov eax, 0x495e13
call fcn.0047e89a
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov edi, ecx
xor esi, esi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0xf
call fcn.004048e0
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
mov edx, ebx
push dword [ebp - 0x30]
mov dword [ebp - 4], esi
push edi
call fcn.00475acc
mov edi, eax
add esp, 0x10
cmp edi, esi
jne 0x4760f3
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4760da
lea eax, [ebp - 0x28]
push 1
push esi
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4760f3
push 2
pop edi
lea ecx, [ebp - 0x2c]
call fcn.00403df0
mov eax, edi
call fcn.0047e91d
ret
Function at 0x4771fd
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x130
mov eax, dword [0x4be0a0]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
and dword [ebp - 0xc4], 0
push esi
push edi
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x78]
push 0x3f
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x3f]
push 0
push eax
mov byte [ebp - 0x40], 0
call fcn.0047f8f0
mov esi, 0x4adc3c
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x40]
mov dl, al
xor dl, 0x36
xor al, 0x5c
mov byte [ebp + ecx - 0x9c], dl
mov byte [ebp + ecx], al
inc ecx
cmp ecx, 0x40
jb 0x47724d
lea eax, [ebp - 0x5c]
call fcn.0047ce3d
lea eax, [ebp - 0x9c]
push 0x40
push eax
lea esi, [ebp - 0x5c]
call fcn.0047ce68
push dword [ebp + 0x7c]
push dword [ebp - 0xc0]
call fcn.0047ce68
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.0047cf00
lea eax, [ebp - 0xb8]
call fcn.0047ce3d
lea eax, [ebp]
push 0x40
push eax
lea esi, [ebp - 0xb8]
call fcn.0047ce68
lea eax, [ebp + 0x54]
push 0x14
push eax
call fcn.0047ce68
lea eax, [ebp + 0x40]
push eax
mov ecx, esi
call fcn.0047cf00
mov esi, dword [ebp - 0xbc]
add esp, 0x28
push 0x14
lea eax, [ebp + 0x40]
push eax
call fcn.0045f33f
mov ecx, dword [ebp + 0x68]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047d444
add ebp, 0x6c
leave
ret

Function at 0x47784c
Capabilities:
Get session user name
Print debug messages
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x898]
sub esp, 0x918
mov eax, dword [0x4be0a0]
xor eax, ebp
mov dword [ebp + 0x894], eax
push edi
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call fcn.0047f8f0
xor eax, eax
push 0xfe
push eax
mov word [ebp + 0x794], ax
lea eax, [ebp + 0x796]
push eax
call fcn.0047f8f0
add esp, 0x18
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x794]
push eax
mov dword [ebp - 0x70], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x4778ca
mov eax, dword [edi]
jmp 0x4778cc
mov eax, edi
push eax
lea eax, [ebp + 0x794]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
movzx eax, word [ebp - 0x80]
push eax
push str._04d_02d_02d__02d_02d_02d__s__s
lea eax, [ebp - 0x6c]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x2c
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x6c]
push eax
push 1
push 0x4c3b70
push str.Software
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [esi + 0x18], 8
jb 0x47793b
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0xd3d
call fcn.0047df5b
int3
Function at 0x47812f
Capabilities:
Delete registry value

Disassembly:
push 0x34
mov eax, 0x499fea
call fcn.0047e831
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
mov edi, 0x4c3b70
push edi
xor ebx, ebx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push str.Software
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x40]
push eax
call fcn.004117e0
push ebx
mov dword [ebp - 4], ebx
call esi
lea edi, [ebp - 0x40]
mov esi, eax
call fcn.00477b34
test eax, eax
jne 0x478195
mov esi, edi
call fcn.00403e20
xor eax, eax
call fcn.0047e909
ret
lea eax, [ebp - 0x40]
push eax
call fcn.00478094
pop ecx
cmp dword [0x4c457c], ebx
jne 0x4781b3
lea esi, [ebp - 0x40]
call fcn.00403e20
mov eax, ebx
jmp 0x47818f
mov eax, dword [0x4c4578]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4c4560]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4c4578]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4c4560]
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call fcn.004787eb
test al, al
jne 0x478202
call fcn.00463da9
add eax, 0x1c
push eax
lea eax, [ebp - 0x28]
push eax
push 0x4c4528
call fcn.00416530
call fcn.0047859b
jmp 0x4781c5
xor ebx, ebx
inc ebx
jmp 0x4781a7

Function at 0x4796c1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00479553
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
pop esi
leave
ret
Function at 0x47a79e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x47a7b8
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x47a7b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47a8e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4be0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.0047aaa7
mov bl, al
mov al, dl
call fcn.0047aaa7
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.0047aaa7
mov bl, al
mov al, byte [esi - 4]
call fcn.0047aaa7
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.0047aaa7
mov bl, al
mov al, byte [esi]
call fcn.0047aaa7
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.0047aaa7
mov bl, al
mov al, byte [esi - 0xc]
call fcn.0047aaa7
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x47a909
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d444
leave
ret 4
Function at 0x47a996
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4be0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.0047ab23
push ebx
mov dl, al
call fcn.0047aafc
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.0047aab7
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.0047aad5
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.0047aab7
push ebx
mov byte [ebp - 0x15], al
call fcn.0047aad5
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.0047aafc
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.0047ab23
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.0047aafc
mov bl, al
mov al, byte [edi + 4]
call fcn.0047ab23
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.0047aad5
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.0047aab7
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.0047aad5
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.0047aab7
xor bl, al
mov al, dl
call fcn.0047ab23
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.0047aafc
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x47a9c2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d444
leave
ret 4
Function at 0x47b1ad
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x495e13
call fcn.0047e89a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x30], ebx
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x47b1cb
sub eax, ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.004048e0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jbe 0x47b2c7
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x4a7230]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x47b207
cmp al, 0xff
je 0x47b1f3
cmp al, 0xff
je 0x47b2c7
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x4a7230]
inc esi
mov byte [ebp - 0x31], cl
cmp esi, dword [ebp - 0x30]
jae 0x47b227
cmp cl, 0xff
je 0x47b20f
cmp cl, 0xff
je 0x47b2c7
shl al, 2
sar cl, 4
and cl, 3
or cl, al
movzx eax, cl
push eax
lea eax, [ebp - 0x2c]
push eax
xor eax, eax
inc eax
call fcn.0045f759
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x47b2c7
movsx eax, al
mov bl, byte [eax + 0x4a7230]
cmp esi, dword [ebp - 0x30]
jae 0x47b266
cmp bl, 0xff
je 0x47b24b
cmp bl, 0xff
je 0x47b2c7
mov al, byte [ebp - 0x31]
mov cl, bl
shl al, 4
sar cl, 2
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea eax, [ebp - 0x2c]
push eax
xor eax, eax
inc eax
call fcn.0045f759
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x47b2c7
movsx eax, al
mov al, byte [eax + 0x4a7230]
cmp esi, dword [ebp - 0x30]
jae 0x47b2a5
cmp al, 0xff
je 0x47b28b
cmp al, 0xff
je 0x47b2c7
shl bl, 6
or bl, al
movzx eax, bl
push eax
lea eax, [ebp - 0x2c]
push eax
xor eax, eax
inc eax
call fcn.0045f759
cmp esi, dword [ebp - 0x30]
jb 0x47b1f3
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.00403dc0
lea ecx, [ebp - 0x2c]
call fcn.00403df0
mov eax, dword [ebp - 0x38]
call fcn.0047e91d
ret

Function at 0x47ce3d
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x47cfc0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x47cfcf
push 0x40
pop esi
cmp edx, esi
jae 0x47d04a
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x47d010
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x4a70e8]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x47d07b
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 8]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
pop edi
add ecx, edx
pop esi
mov dword [eax + 0x6c], ecx
pop ebx
leave
ret
Function at 0x47d444
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4be0a0]
jne 0x47d44e
repz ret
jmp fcn.0047e93b

Function at 0x484885
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047f236
and dword [ebp - 4], 0
cmp dword [0x4c2a34], 0
mov ebx, eax
jne 0x484936
push 0x49f0f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4849e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4849e7
push eax
call fcn.0047f1c4
mov dword [esp], 0x49f0d4
push edi
mov dword [0x4c2a34], eax
call esi
push eax
call fcn.0047f1c4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c2a38], eax
call esi
push eax
call fcn.0047f1c4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c2a3c], eax
call esi
push eax
call fcn.0047f1c4
pop ecx
mov dword [0x4c2a44], eax
test eax, eax
je 0x484936
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047f1c4
pop ecx
mov dword [0x4c2a40], eax
mov eax, dword [0x4c2a40]
cmp eax, ebx
je 0x48498e
cmp dword [0x4c2a44], ebx
je 0x48498e
push eax
call fcn.0047f23f
push dword [0x4c2a44]
mov esi, eax
call fcn.0047f23f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x48498e
test edi, edi
je 0x48498e
call esi
test eax, eax
je 0x484985
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x484985
test byte [ebp - 0xc], 1
jne 0x48498e
or dword [ebp + 0x10], 0x200000
jmp 0x4849c7
mov eax, dword [0x4c2a38]
cmp eax, ebx
je 0x4849c7
push eax
call fcn.0047f23f
pop ecx
test eax, eax
je 0x4849c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4849c7
mov eax, dword [0x4c2a3c]
cmp eax, ebx
je 0x4849c7
push eax
call fcn.0047f23f
pop ecx
test eax, eax
je 0x4849c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c2a34]
call fcn.0047f23f
pop ecx
test eax, eax
je 0x4849e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4849e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4019a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4047f4], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047f8], 0x30
mov dword [0x4047fc], 2
mov dword [0x404804], 0
mov dword [0x404808], 0
mov dword [0x404800], 0x401ec0
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x404104], ebx
mov dword [0x40480c], ebx
jmp 0x401a08
mov dword [0x404818], 0xf
mov dword [0x404820], 0x404769
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404810], eax
mov dword [0x404824], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x404814], eax
push 0x4047f8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.fomy
push 0x404769
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x4047ec], eax
xor eax, eax
jmp 0x401a96
push eax
push dword [0x4047ec]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x4047ec]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x404828
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x401adc
push 0x404828
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x404828
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x401aaf
mov eax, dword [0x404830]
call fcn.00401348
ret
Function at 0x405ef7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1274], 0
push esi
jne 0x405f2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f08
mov dword [ecx*4 + 0x7a1270], eax
inc ecx
cmp ecx, 0x100
jl 0x405f03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1270]
xor eax, esi
inc ecx
dec edx
jne 0x405f41
pop edi
not eax
pop esi
ret 0xc

Function at 0x401118
Capabilities:
Query environment variable

Disassembly:
enter 0x34, 0
mov edx, 0x403154
sub dword [ebp - 0x20], esi
push edx
push dword [edx + 0xd4]
push dword [edx + 0x60]
call fcn.00401a38
pop edx
push edx
lea edi, [edx - 0x154]
push edi
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
jne 0x401135
pop edx
push edx
call sub.KERNEL32.dll_GetEnvironmentStringsA
pop edx
add esp, 0x34
pop ebp
ret 0x10

Function at 0x40188c
Capabilities:
Query environment variable

Disassembly:
enter 0x60, 0
mov ebx, 0x4031b0
and dword [ebx - 0x78], 0x49
call sub.KERNEL32.dll_GetEnvironmentStringsA
push ebx
push dword [ebx + 0x9c]
push dword [ebx + 0xb4]
push edi
call fcn.004012a0
pop ebx
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
add esp, 0x60
pop ebp
ret 0xc