joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4300b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f440
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00455aba
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004532c7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x438020
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
xor eax, eax
xor esi, esi
test edi, edi
je 0x438048
nop dword [eax]
lea edx, [eax + 1]
mov al, byte [eax + 0x4a6cd8]
xor byte [esi + ecx], al
inc esi
cmp edx, 0xe
sbb eax, eax
and eax, edx
cmp esi, edi
jb 0x438030
pop edi
pop esi
ret
Function at 0x44ad30
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484050
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov ecx, dword [esi + 8]
push 0xf003f
push 0
call fcn.0044c890
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov byte [ebp - 4], 1
test edi, edi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44ad9c
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x44ae4d
push 0x10000
push dword [esi + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
xor ebx, ebx
mov byte [ebp - 4], 2
test esi, esi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44add5
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x44ae63
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
neg eax
sbb ebx, ebx
neg ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44adfc
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x44ae79
jmp 0x44ae1d
test esi, esi
je 0x44ae2c
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x44ae32
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x44ae39
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
lea ecx, [ebp - 0x14]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
push eax
lea ecx, [ebp - 0x18]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
push eax
lea ecx, [ebp - 0x1c]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
int3
Function at 0x44aea0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484078
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0
call fcn.0041bfa0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov eax, ecx
not eax
cmp eax, 1
jb 0x44b05c
lea eax, [ecx + 1]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.004422b0
test al, al
je 0x44b066
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x44b070
mov edx, dword [ebp - 0x1c]
lea edi, [ebp + 0x24]
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x20]
mov dword [edx], eax
mov eax, dword [ebp + 0x1c]
mov dword [edx + 4], eax
cmp ebx, 0xffffffff
je 0x44af7b
nop dword [eax]
mov eax, dword [edi]
mov esi, ecx
cmp esi, dword [ebp - 0x14]
jb 0x44af65
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00443450
test al, al
je 0x44b066
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi]
add edi, 8
mov dword [edx + esi*8], ebx
inc ecx
mov dword [edx + esi*8 + 4], eax
mov dword [ebp - 0x18], ecx
mov ebx, dword [edi - 4]
cmp ebx, 0xffffffff
jne 0x44af40
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
push 0xf003f
push 0
mov ecx, dword [esi + 8]
mov dword [ebp - 0x20], edx
call fcn.0044c890
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
xor eax, eax
test edi, edi
setne al
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x44afbb
movzx ebx, bx
or ebx, 0x80070000
cmp dword [ebp + 0xc], 0
je 0x44b035
push 0xf01ff
push dword [esi + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x44aff1
movzx ebx, bx
or ebx, 0x80070000
cmp dword [ebp + 0xc], 0
je 0x44b02a
lea eax, [ebp - 0x30]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
neg eax
sbb eax, eax
neg eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x44b022
movzx ebx, bx
or ebx, 0x80070000
cmp dword [ebp + 0xc], 0
je 0x44b02a
xor ebx, ebx
test esi, esi
je 0x44b035
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x44b040
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x1c]
call fcn.00441fc0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070216
call fcn.00417140
push 0x8007000e
call fcn.00417140
push 0x80070057
call fcn.00417140
int3
Function at 0x44b080
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4ba070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20]
push ebx
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
push ecx
push eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
neg eax
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44b0cf
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x44b195
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0x1c], ebx
je 0x44b17d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
mov dword [ebp - 0x28], edi
call esi
mov ecx, dword [ebp + 0x10]
sub eax, edi
cmp eax, ecx
jae 0x44b168
mov eax, 0xcccccccd
mul ecx
mov edi, edx
shr edi, 3
cmp edi, 0x3e8
jae 0x44b116
mov eax, 0x3e8
jmp 0x44b125
mov eax, edi
cmp edi, 0x2710
jbe 0x44b125
mov eax, 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
neg eax
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44b151
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x44b1ab
cmp dword [ebp - 0x1c], ebx
je 0x44b17d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0x10]
jb 0x44b107
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045561a
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045561a
mov esp, ebp
pop ebp
ret 0xc
push eax
lea ecx, [ebp - 0x24]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
push eax
lea ecx, [ebp - 0x28]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
int3
Function at 0x44c480
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
mov bh, dl
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
test eax, eax
je 0x44c4af
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x44c4af
and eax, 0xfffffffe
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bh, bh
je 0x44c4d1
test bl, bl
je 0x44c4cc
push 4
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x44c4cc
pop esi
mov al, 1
pop ebx
ret
pop esi
xor al, al
pop ebx
ret
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
pop ebx
ret

Function at 0x44cb00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 8], eax
nop dword [eax + eax]
push 0
push 0x80
push 4
push dword [ebp + 0x14]
push 1
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, 0xffffffff
jne 0x44cb6e
cmp esi, 0x20
jne 0x44cb6e
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x44cb5e
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x3e8
jb 0x44cb20
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44cb80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x4a5ac8
mov esi, ecx
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x44cc35
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x44cc35
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44cc35
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x44cc35
sub esp, 8
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push 0x80
push 2
push 0
push 0x40000000
push dword [ebp + 0xc]
call fcn.0041ccd0
mov esi, dword [ebp - 8]
test eax, eax
js 0x44cc1f
push 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44cc1b
call fcn.004173b0
test eax, eax
js 0x44cc1f
mov bl, 1
jmp 0x44cc21
xor bl, bl
test esi, esi
je 0x44cc2c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f500
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486216
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x4ba070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x424], ecx
mov ebx, dword [ebp + 8]
mov ecx, 4
mov dword [ebp - 0x420], ebx
mov ebx, 0x100
mov eax, ebx
mov dword [ebp - 0x418], 0
mul ecx
test edx, edx
ja 0x44f79b
jb 0x44f568
cmp eax, 0xffffffff
ja 0x44f79b
cmp eax, 0x400
jbe 0x44f583
push eax
lea ecx, [ebp - 0x418]
call fcn.00427550
mov eax, dword [ebp - 0x418]
jmp 0x44f58f
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 0
push ecx
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x44f760
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jne 0x44f6a9
mov eax, ebx
shr eax, 1
add ebx, eax
cmp ebx, 0x3fffffff
jae 0x44f7a5
mov eax, dword [ebp - 0x418]
lea esi, [ebx*4]
test eax, eax
jne 0x44f600
cmp esi, 0x400
jbe 0x44f673
push esi
lea ecx, [ebp - 0x418]
call fcn.00427550
jmp 0x44f67f
lea ecx, [ebp - 0x414]
cmp esi, 0x400
jbe 0x44f649
cmp eax, ecx
lea ecx, [ebp - 0x418]
push esi
jne 0x44f642
call fcn.00427550
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push 0x400
push eax
mov edx, esi
call fcn.00416fc0
push eax
call fcn.00417180
add esp, 0xc
jmp 0x44f67f
call fcn.00427520
jmp 0x44f67f
cmp eax, ecx
je 0x44f673
push esi
push eax
mov edx, 0x400
lea ecx, [ebp - 0x414]
call fcn.00416fc0
push eax
call fcn.00417180
add esp, 0xc
lea ecx, [ebp - 0x418]
call fcn.00427510
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x41c]
push eax
push esi
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x44f760
mov edi, dword [ebp - 0x41c]
cmp edi, esi
je 0x44f5c3
shr edi, 2
xor esi, esi
test edi, edi
je 0x44f759
nop word [eax + eax]
mov eax, dword [ebp - 0x418]
cmp dword [eax + esi*4], 0
je 0x44f750
lea ecx, [ebp - 0x45c]
call fcn.0044efa0
push ecx
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 1
push eax
mov eax, dword [ebp - 0x418]
push dword [eax + esi*4]
call fcn.0044f250
test eax, eax
je 0x44f741
mov ecx, dword [ebp - 0x420]
mov ebx, dword [ecx + 4]
cmp ebx, dword [ecx + 8]
jb 0x44f71e
lea eax, [ebx + 1]
push eax
call fcn.0044f8f0
test al, al
je 0x44f7af
lea ecx, [ebx*8]
sub ecx, ebx
mov ebx, dword [ebp - 0x420]
mov eax, dword [ebx]
lea ecx, [eax + ecx*8]
lea eax, [ebp - 0x45c]
push eax
call fcn.0044f7c0
inc dword [ebx + 4]
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0
call fcn.0044ec40
inc esi
cmp esi, edi
jb 0x44f6c0
mov esi, 1
jmp 0x44f762
xor esi, esi
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x44f77b
lea ecx, [ebp - 0x418]
call fcn.00427510
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045561a
mov esp, ebp
pop ebp
ret 8
push 0x80070216
call fcn.00417140
push 0x80004005
call fcn.00417140
push 0x8007000e
call fcn.00417140
int3
Function at 0x44f7c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486343
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov al, byte [esi + 0xc]
mov byte [edi + 0xc], al
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x10], eax
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x18]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x20]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x28]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x28], eax
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0x2c]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x2c], eax
mov byte [ebp - 4], 7
mov ecx, dword [esi + 0x30]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x30], eax
mov byte [ebp - 4], 8
mov ecx, dword [esi + 0x34]
sub ecx, 0x10
call fcn.0041bab0
add eax, 0x10
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x450130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48642e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.00452a90
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x1c]
mov dword [ebx], vtable.logog::Node.0
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004512c0
mov ecx, edi
mov dword [esi], eax
call fcn.00452180
mov dword [edi], vtable.logog::LockableNodesType.0
mov byte [ebp - 4], 1
lea edi, [ebx + 0x30]
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x1c]
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004512c0
mov ecx, edi
mov dword [esi], eax
call fcn.00452180
mov dword [edi], vtable.logog::LockableNodesType.0
mov byte [ebp - 4], 2
call fcn.004500f0
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ecx, [eax + 0x1c]
lea eax, [ebp - 0x10]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.004513c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4508b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4864d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x30]
push eax
lea ecx, [ebp - 0x14]
call fcn.00452240
mov dword [ebp - 4], 0
lea ecx, [edi + 0x4c]
mov esi, dword [edi + 0x4c]
push dword [esi + 4]
call fcn.00451020
mov eax, dword [edi + 0x4c]
lea ecx, [ebp - 0x14]
mov dword [eax + 4], esi
mov eax, dword [edi + 0x4c]
mov dword [eax], esi
mov eax, dword [edi + 0x4c]
mov dword [eax + 8], esi
mov dword [edi + 0x50], 0
call fcn.004522b0
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.00452240
mov dword [ebp - 4], 1
lea ecx, [edi + 0x4c]
mov esi, dword [edi + 0x4c]
push dword [esi + 4]
call fcn.00451020
mov eax, dword [edi + 0x4c]
lea ecx, [ebp - 0x14]
mov dword [eax + 4], esi
mov eax, dword [edi + 0x4c]
mov dword [eax], esi
mov eax, dword [edi + 0x4c]
mov dword [eax + 8], esi
mov dword [edi + 0x50], 0
call fcn.004522b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473278
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004730ee

Function at 0x4754c2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047513f
Function at 0x404923
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437e13
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404a46
push ecx
lea ecx, [esi + 0x18]
call fcn.00424143
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404a5d
push ecx
lea ecx, [esi + 0x24]
call fcn.00424053
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x480863
Capabilities:
Encode data using xor

Disassembly:
dec edi
pop esp
test byte [ecx + 0x70], cl
dec ecx
add edx, ebp
or eax, dword [ebp + 0x4b90f6bc]
salc
lodsd eax, dword [esi]
ror eax, cl
add ebp, dword [edx]
xchg edi, eax
fincstp
cmc
xor eax, 0xcf77f425
add dword [edx + 0x25], 0xb25ee54
loop 0x48089f
mov bh, 0xe6
call 0xe75da7ea
imul edi, dword [eax - 0x375ca849], 0x55c968f3
enter 0x68f3, 0xffffffffffffffc9
push ebp
aaa
sub dword [eax + eax - 0x30], eax
daa
rcr ecx, 0xb
xor ah, byte [edx + 0x6a]
xor al, 0x57
jo 0x48084a
shl byte [ecx - 0xc], 1
cmpsb byte [esi], byte es:[edi]
jmp 0x480818
and esi, ecx
xchg byte [edx - 0x5a6ba106], ch
jmp fcn.00480863
Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xb2c1e9

Function at 0x496fb3
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca4a3
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970d6
push ecx
lea ecx, [esi + 0x18]
call fcn.004b67d3
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970ed
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66e3
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret