joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f370
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x60c418]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40f394
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x40f3e2
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x60e96c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x40f410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x60c418]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40f440
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x60c418]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x40f47e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x40f47e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x40f480
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40f8a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x60c418]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x417370
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x417390
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x417390
mov eax, dword [eax + 0x44]
test eax, eax
je 0x417390
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4338d0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xa8
mov eax, dword [0x60e750]
mov dword [esp], 0x4020
mov dword [esp + 4], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x433957
push 0x9c
push eax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x9c
mov dword [esp + 0x10], 6
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x43394b
mov dword [0x60e750], 2
add esp, 0xa8
ret
mov dword [0x60e750], 1
jmp 0x43395c
cmp eax, 2
je 0x4339a8
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0xbc]
call dword [sym.imp.WSOCK32.DLL_getsockopt]
test eax, eax
jne 0x43398a
mov eax, dword [esp + 4]
cmp eax, dword [esp]
jg 0x4339a8
push 4
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0xbc]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
add esp, 0xa8
ret
Function at 0x441300
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push dword [esp + 0x108]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x441349
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x441349
lea eax, [esp]
push eax
call dword [0x60c428]
add esp, 4
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret
Function at 0x446190
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x446323
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x44630d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4461df
lea ebx, [eax + 0xe]
jmp 0x4461eb
cmp eax, 0x17
jne 0x44629a
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x44629a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x44629a
cmp eax, ebx
jb 0x44629a
push 0x20
call dword [0x60c41c]
mov esi, eax
add esp, 4
test esi, esi
je 0x446302
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x60c41c]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4462f1
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x446285
push eax
call dword [0x60c428]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4462d7
test ebp, ebp
jne 0x44628b
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x446296
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4461d2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4462b9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x446309
push ebp
call fcn.00446150
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x60c420]
push esi
call dword [0x60c420]
add esp, 8
jmp 0x4462a9
push esi
mov ebx, 8
call dword [0x60c420]
add esp, 4
jmp 0x4462a9
mov ebx, 8
jmp 0x4462a9
test ebp, ebp
jne 0x446319
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x446770
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.00446720
mov al, 1
ret
Function at 0x44c1cb
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x60e7ac
cmp dword [0x60e7a8], edi
jne 0x44c1fa
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x60e7a8], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x60e7a4]
test esi, esi
je 0x44c255
test edi, edi
jne 0x44c39c
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x44c22b
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x44c21c
jmp 0x44c247
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.0044c174
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x44c20b
test edi, edi
jne 0x44c39c
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x44c39c
mov esi, dword [0x60e7a4]
jmp 0x44c296
cmp dword [esi + 0xc], 0x3f
jl 0x44c337
mov esi, dword [esi]
test esi, esi
jne 0x44c28a
push 0x310
push 8
push dword [0x60dec8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x44c396
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 8], eax
test eax, eax
je 0x44c388
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x44c3af
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x44c383
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.0044c174
mov eax, dword [0x60e7a4]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x44c32f
mov dword [eax + 4], esi
mov dword [0x60e7a4], esi
jmp 0x44c39c
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.0044c174
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x44c39c
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x60dec8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x60e7ac
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0xac8850
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ab9ce0
jmp 0xac8808
lea edx, [eax + edx]
jmp 0xac882d
lea esp, [esp + 2]
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0xac87d5
pushfd
shl esi, 1
jmp 0xac8858
xchg bx, dx
mov ebp, dword [esp + 0x30]
cpuid
jmp 0xac885f
push si
mov word [esp], sp
jmp 0xac881e
jnp 0xac8837
xchg bx, dx
jmp 0xac883a
xchg dh, dl
mov ebx, dword [esp]
shr eax, 9
jl 0xac888e
jge 0xac888e
add eax, 0x41f9a0c3
jmp 0xac9bd8
lea esi, [esp + 4]
jmp 0xac8898
lea edx, [edx + esi]
mov cx, word [esp]
sete dl
dec cl
js 0xac891f
jns 0xac891f
add eax, 0x5771a123
jmp 0xac9b36
sub esp, 0xbc
mov edi, esp
call fcn.00ac88d1
jmp 0xac88e8
mov dx, word [esp]
bswap edx
lea edx, [ebp - 0xba]
mov eax, dword [eax - reloc.MSVFW32.dll_DrawDibDraw]
call 0xac9abd
lea edx, [esi + 0xa7]
not dx
bswap edx
mov edx, 0x29735c4b
jmp 0xac9b80
lea esp, [esp + 3]
jmp 0xac9b6a
push eax
ret
mov esp, edi
mov edx, 0x345fb719
pushfd
lea esp, [esp + 1]
mov dl, 0xc3
jmp 0xac9b48
jmp 0xac9b1f

Function at 0xac88b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push di
pop dword [esp]
lea esp, [esp + 2]
mov dword [esp + 8], esi
call fcn.00ac8850
pushfd
jmp 0xac887c

Function at 0xacaf78
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0xc53b
push dword [esp + 0xa]
jns 0xacaf9c
mov edx, esi
jmp 0xacaf9e
lea esp, [esp + 4]
add bl, 0xa1
pushal
xchg byte [esp + 0x10], al
jmp 0xacaf62
lea esp, [esp + 0x24]
dec bl
cmp edx, 0xba17bcf2
jmp 0xacafd8
mov edx, esi
jmp 0xacaf86
mov dx, bp
lea edx, reloc.MSVFW32.dll_DrawDibDraw
neg ah
rdtsc
xchg ah, al
jmp 0xacafe5
jl 0xacafa0
mov dx, bp
lea edx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0xacafc2

Function at 0xacb231
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xacb399
mov dword [esp + 0xc], ecx
push cx
pushfd
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp + 0xc], edx
call fcn.00acb236
mov ebp, dword [esp + 0x34]
mov esi, 0x9f00b512
inc eax
jl 0xacb3eb
jge 0xacb3d5
sub dword [ecx + reloc.MSVFW32.dll_DrawDibDraw], edi
sbb byte [ebx - 0x73], bh
and al, 0x19
mov word [esp + 4], bx
lea esp, [esp + 3]
jmp 0xacb3b0
mov bh, cl
jmp 0xacb3ed
mov bh, cl
lea esi, [esp + 8]
mov edi, 0x35192f35
bswap ebx
lea ebx, [esp + edx]
jmp 0xacb401
sub esp, 0xb8
mov edi, esp
dec edx
jbe 0xacb541
setp dl
setp dl
mov dx, di
lea ebx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0xacb47b

Function at 0xacb236
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
jmp 0xacb2ab
pop word [esp]
mov word [esp], si
lea esp, [esp + 2]
mov dword [esp + 8], esp
call fcn.00acb28c
std
jl 0xacb262
jne 0xacb1d6
inc eax
leave
push 0xf766228b
shl byte [esi + 0xf], 1
stosd dword es:[edi], eax
clc
jo 0xacb208
mov eax, dword [esp]
jmp 0xacb1dd
and al, 0xe9
jne 0xacb265
invalid
invalid
mov dword [esp + 8], esp
jmp 0xacb248
pop word [esp]
mov word [esp], si
lea esp, [esp + 2]
jmp 0xacb268
mov byte [esp], dh
mov dword [esp + 0xc], ebx
push ax
push word [esp]
jb 0xacb238
jae 0xacb27e
Function at 0xacb28c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0ab9ce0
jmp 0xacb364
push dword [esp + 1]
jl 0xacb31e
push dword [esp + 6]
jmp 0xacb2d6
mov byte [esp + 0x15], cl
jmp 0xacb32f
mov dword [esp + 0x10], ebp
pushal
pop dword [esp + 6]
jmp 0xacb2c0
push dword [esp + 6]
mov dword [esp + 0x10], ebp
pushal
pop dword [esp + 6]
mov byte [esp + 0x15], cl
push dword [esp + 3]
mov dword [esp + 0x2c], esi
call fcn.00acb2f7
lea esp, [esp + 0x28]
jmp 0xacb37a
pushal
push dword [esp + 0x14]
jp 0xacb380
jnp 0xacb3c6
fcom qword [ecx - 0x3f]
mov al, byte [0xd25e9553]
inc eax
daa
shl byte [edx - 0x2d], cl
pushfd
jmp 0xaca851
lea esp, [esp + 0x19]
mov word [esp + 4], bx
lea esp, [esp + 3]
jmp 0xacb3b0
lea esp, [esp + 0x19]

Function at 0xaed5f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
test eax, eax
push bx
lea esp, [esp + 2]
sub esp, 0x13
pop dword [esp + 0xe]
lea esp, [esp + 3]
jmp 0xaed5de

Function at 0xaed819
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
and eax, edx
jmp 0xaed853
mov word [esp], dx
lea esp, [esp + 4]
add esi, 4
jmp 0xaed801
lea edi, [edi - 4]
mov dword [edi], eax
pop edi
jmp 0xaed85d
mov edi, ebp
jmp 0xaed826
lea esp, [esp + 0x20]
dec dword [ebp - 8]
push edi
jmp 0xaed83c
jne 0xaed640
mov bl, al
pop ebx
jmp 0xaed50c

Function at 0xb39eea
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jbe 0xb39f1d
mov dword [esp], ecx
rdtsc
mov dword [esp + 4], esi
lea esp, [esp + 4]
jmp 0xb39f2a
jmp 0xb39f07
popal
jmp 0xb39f77

Function at 0xbf3fcf
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
call fcn.00bf3053
mov dword [esp], edi
jmp 0xbf407c
push si
pushal
lea esp, [esp + 0x46]
jmp 0xbf3fb9
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xbf304e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xbf400f
Function at 0x403d6c
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push ebp
push esi
lea eax, [ecx - 0x1f59]
xor edx, 0x22cf
push edi
mov edi, dword [esp + 0x1c]
lea esi, [ecx - 0x159]
mov dword [esp + 0xc], eax
xor ecx, 0x3d95
mov eax, dword [esp + 0x14]
add eax, 0x165
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
lea ebp, [edi - 0x1f5f]
mov dword [esp + 0x20], ebp
cmp esi, ecx
jg 0x403f9b
lea eax, [edi - 0x165]
push ebx
cmp esi, eax
jle 0x403ef7
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov edx, dword [0x79d454]
push 0x54
mov eax, dword [edx + 0x9c]
mov ecx, dword [edx + 0xb0]
xor ecx, dword [0x7bb390]
mov esi, dword [eax + ebp]
mov eax, 0xa1739
sub eax, ecx
add ebp, 4
add dword [0x7bb370], eax
pop eax
sub eax, dword [edi + 0x10]
add dword [edx + 0x104], eax
mov eax, dword [edi + 0xb0]
xor eax, dword [0x7bb328]
sub eax, 0x1d1912
xor dword [0x7bb370], eax
mov eax, dword [edi + 0xdc]
xor eax, 1
imul eax, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [0x79d454]
mov ecx, dword [0x7bb304]
mov ebx, dword [eax + 0x58]
mov eax, dword [0x7bb35c]
imul ebx, esi
mov edx, ebx
shr edx, 8
mov byte [ecx + eax], dl
inc dword [0x7bb304]
mov eax, dword [edi + 0xa4]
sub eax, dword [0x7bb2f4]
dec eax
add dword [edi + 0xa0], eax
mov eax, dword [0x79d454]
mov ecx, dword [eax + 0x5c]
mov eax, dword [edi + 0xb4]
mov byte [ecx + eax], bl
mov eax, dword [0x79d454]
inc dword [eax + 0x5c]
mov eax, dword [edi + 0x2c]
sub eax, 0xd
mov dword [edi + 0x8c], 0xd24ba
add dword [edi + 0xe8], eax
mov eax, dword [0x7bb31c]
add eax, 0xffef7f7c
imul eax, dword [edi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [0x79d454]
mov eax, dword [eax + 0x80]
xor eax, dword [0x7bb2c4]
xor eax, 0x170e1a
or dword [edi + 0xf8], eax
mov ecx, dword [0x79d454]
mov eax, dword [0x7bb2d4]
xor eax, 0xc
imul eax, dword [ecx + 0x64]
mov dword [ecx + 0x64], eax
cmp ebp, 0x1d4f0
jl 0x403dd0
mov dword [0x7bb3b0], 0x7bb2a8
jmp 0x403f96
or edx, esi
cmp esi, edx
je 0x403f9a
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x79d454]
mov edx, dword [0x7bb318]
imul edx, ecx
mov ebx, dword [ebp + 0xe0]
xor ebx, dword [ebp + 4]
mov ecx, dword [ebp + 0xa0]
xor ebx, esi
mov esi, dword [eax + 0xf0]
mov eax, dword [esp + 0x24]
and esi, 0x22cc
sub eax, dword [esp + 0x30]
or ecx, dword [esp + 0x20]
mov edi, dword [ebp + 0x98]
imul eax, eax, 0x1dfa
add edi, 0x221
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call fcn.004058a2
mov ecx, eax
mov eax, dword [ebp + 0x50]
xor eax, dword [0x7bb2ac]
push eax
mov eax, dword [ebp + 0x10c]
and eax, ecx
mov ecx, dword [0x79d454]
push 0x7bb2a8
push eax
mov eax, dword [ebp + 0xd4]
mov ecx, dword [ecx + 0x64]
and eax, 0x18f2
or ecx, dword [esp + 0x38]
push eax
push ecx
call fcn.00406c81
add esp, 0x30
mov ebp, dword [esp + 0x24]
pop ebx
pop edi
xor ebp, 0x15a3
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x404829
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x10]
xor edx, 0x32b
push ebp
push esi
lea ebp, [eax + 0x58d]
xor ebx, 0x46e
push edi
lea esi, [ecx - 0x8ad]
mov dword [esp + 0x24], ebp
lea edi, [eax + 0xa44]
mov dword [esp + 0x10], esi
add ecx, 0xffffe112
mov dword [esp + 0x14], edi
lea eax, [ebp + 0x658]
mov dword [esp + 0x1c], ebx
cmp ecx, eax
jg 0x4049d2
mov eax, edx
xor eax, 0x54a
cmp ebp, eax
je 0x404910
mov esi, dword [esp + 0x28]
lea eax, [ebx + 0x69e]
push eax
lea eax, [ebx + 0x6e6]
push eax
mov dword [esi + 0xb0], 0xa1739
mov eax, edx
push dword [0x79d454]
xor eax, 0xbf9
push eax
lea eax, [edi + 0x269]
push eax
lea eax, [edx + 0x269]
push eax
mov eax, dword [esp + 0x38]
add eax, 0x4c6
push eax
call fcn.0040527a
add esp, 0x1c
cmp dword [0x7bb384], 0x11ffb
jb 0x4048f7
mov eax, dword [esi + 0x98]
sub dword [esi + 0xdc], eax
jmp 0x4049d2
mov ecx, dword [0x79d454]
mov eax, 0xffffdc9a
sub eax, dword [esi + 0xc8]
add dword [ecx + 0x5c], eax
jmp 0x4049d2
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp + 0x90]
xor eax, dword [0x7bb3ac]
cmp esi, eax
jb 0x4049d2
mov edx, dword [ebp + 0x7c]
mov eax, esi
sub eax, ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
xor eax, dword [0x7bb358]
cmp edx, eax
jne 0x4049d2
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebp + 0x38]
and eax, dword [0x7bb34c]
imul eax, dword [ebp + 0x20]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0xfc]
mov edx, dword [esp + 0x10]
xor esi, 0x15a3
sub edx, dword [ebp + 0x10]
add esi, 0x1901
mov dword [ebp + 0x20], eax
mov ecx, dword [0x79d454]
mov eax, dword [esp + 0x14]
sub eax, dword [ebp + 4]
xor eax, dword [esp + 0x24]
sub edi, dword [ecx + 0x60]
mov ecx, dword [ecx + 0xb0]
and ecx, dword [ebp + 0x68]
push eax
imul eax, dword [esp + 0x28], 0x1641
xor ecx, 0x22cc
push ecx
push edx
push esi
push edi
push eax
push ebp
call fcn.004058a2
mov dword [esp + 0x40], eax
mov ecx, ebx
mov eax, dword [esp + 0x4c]
add esp, 0x1c
xor ecx, dword [0x7bb358]
add eax, 2
mov dword [esp + 0x30], eax
cmp eax, ecx
je 0x404949
mov ebx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
lea eax, [ebx + 0xbb2]
pop ebx
pop ecx
pop ecx
ret
Function at 0x404c66
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov ecx, dword [0x7bb5fc]
push ebx
movzx eax, byte [eax]
push ebp
push esi
mov esi, dword [0x7bb608]
mov eax, dword [edx + eax*4]
dec byte [0x7bb5c2]
mov dword [esp + 0x14], eax
mov eax, dword [0x7bb5c8]
or eax, 0xbd8
mov dword [esp + 0x1c], eax
mov eax, dword [0x7bb5f0]
push edi
movzx edi, byte [0x7bb5c0]
lea ebp, [eax + ecx]
inc eax
mov dword [0x7bb5f0], eax
inc ecx
mov eax, dword [0x7bb5cc]
mov dword [0x7bb5fc], ecx
mov ebx, dword [edx + esi*4]
mov edx, dword [esp + 0x20]
add ebx, ecx
dec esi
mov dword [0x7bb608], esi
mov al, byte [edi + eax*8]
and al, byte [0x7bb5d1]
sub al, byte [ebp + edx*2]
sub al, 0x66
mov byte [0x7bb5c1], al
mov cl, byte [edi + esi*4]
mov esi, dword [esp + 0x18]
movzx edx, al
movzx eax, byte [0x7bb5d1]
or cl, byte [eax + esi + 8]
sub cl, byte [esi + edx*2]
mov byte [esi + edx*2], cl
movzx eax, word [ebp]
mov ecx, dword [esp + 0x20]
dec ecx
mov edx, dword [ebx + eax*4]
mov eax, dword [esp + 0x24]
lea edi, [eax + ecx*4]
movzx eax, word [edi]
cmp edx, eax
jl 0x404d40
mov ecx, dword [0x7bb5ec]
mov esi, dword [0x7bb5fc]
xor ecx, 0x1aba
mov eax, ecx
lea edi, [edi - 4]
sub eax, edx
imul esi, eax
inc edx
mov dword [0x7bb5fc], esi
movzx eax, word [edi]
cmp edx, eax
jge 0x404d28
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, dword [eax + 0x27e4]
pop ebx
ret
Function at 0x404d4f
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
lea ebp, [edx - 0x171a]
add esi, 0xffffe0a1
mov dword [esp + 0xc], ebp
mov ebx, eax
mov dword [esp + 0x20], esi
add eax, 0xfffffaec
xor ebx, 0x3c5f
mov dword [esp + 0x28], eax
lea eax, [edx + 0x83f]
lea ecx, [esi + 0x2021]
cmp eax, ecx
jge 0x404ee7
mov eax, esi
xor eax, 0x22cf
cmp esi, eax
jg 0x404e19
mov ecx, dword [esp + 0x38]
cmp dword [ecx + 0xdc], 0xcbab
jae 0x404dbc
add dword [ecx + 0x5c], 0xf12
cmp dword [ecx + 0x80], 0xd798
ja 0x404dda
mov eax, dword [ecx + 0x104]
xor eax, dword [ecx + 0x10]
imul eax, dword [ecx + 0x4c]
mov dword [ecx + 0x4c], eax
jmp 0x404de6
mov eax, dword [ecx + 0xb8]
mov dword [ecx + 0xb4], eax
mov eax, dword [ecx + 0xc8]
mov ecx, dword [0x7bb2f4]
add eax, 0x585
mov dword [0x7bb3b8], eax
add ecx, 0x4f72c235
mov eax, dword [0x79d454]
mov dword [eax + 0x58], ecx
mov dword [0x7bb344], 0x408060
jmp 0x404ee7
mov edx, dword [0x79d454]
mov eax, ebp
mov ecx, dword [esp + 0x28]
push edi
sub eax, dword [edx + 0x10c]
mov edi, dword [edx + 0x7c]
or eax, ecx
mov dword [esp + 0x14], edi
cmp edi, eax
ja 0x404ee6
mov eax, dword [0x7bb388]
sub eax, dword [esp + 0x44]
add eax, ebx
mov dword [esp + 0x40], eax
mov eax, ebp
mov ebp, dword [esp + 0x3c]
mov ebp, dword [ebp + 0x50]
cmp ebp, dword [esp + 0x40]
jb 0x404ec9
mov edi, dword [esp + 0x44]
lea edx, [eax + 0x1dfa]
imul eax, esi, 0x1cd8
mov dword [esp + 0x20], edx
add eax, 0xffffec8c
mov dword [esp + 0x18], eax
mov eax, ecx
imul eax, ebx
add eax, esi
mov dword [esp + 0x1c], eax
push edx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [0x7bb388]
add ebp, 4
mov edx, dword [esp + 0x20]
sub esi, edi
add esi, ebx
mov dword [esp + 0x40], esi
cmp ebp, esi
jae 0x404e83
mov edx, dword [0x79d454]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc edi
sub ecx, dword [edx + 0x10c]
or ecx, dword [esp + 0x2c]
cmp edi, ecx
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x2c]
jbe 0x404e4e
pop edi
xor esi, 0x1b25
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret