joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403820
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0040f550
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4038f9
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4038c5
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40389e
cmp word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], 4
jb 0x4038f9
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040ac62
add esp, 0x120
ret
cmp eax, 2
jae 0x4038a8
cmp eax, 1
jne 0x4038f9
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040ac62
add esp, 0x120
ret
cmp eax, 6
jne 0x4038f9
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4038ef
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040ac62
add esp, 0x120
ret
cmp eax, 1
jne 0x4038f9
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ac62
add esp, 0x120
ret

Function at 0x403920
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push connect
push eax
or edi, 0xffffffff
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403954
or eax, eax
or edx, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x40396d
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x10
ret

Function at 0x403ab0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x206
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call fcn.0040f550
add esp, 0xc
cmp dword [reloc.crypt32.dll_CertGetStoreProperty], 3
jne 0x403b11
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc40
lea edx, [esp + 4]
push 0x104
push edx
call fcn.0040aca1
add esp, 0xc
jmp 0x403b20
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea ecx, [esp + 4]
push ecx
push 0x41dc44
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
call fcn.0040ac62
add esp, 0x20c
ret
Function at 0x4056a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x9b0
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebp
mov ebp, dword [esp + 0x9b8]
push esi
push edi
push 0x7fe
lea eax, [esp + 0x1b6]
push 0
push eax
mov edi, ecx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], 0
call fcn.0040f550
add esp, 0xc
test edi, edi
lea esi, [esp + 0x1b0]
je 0x4056ee
mov esi, edi
lea ecx, [esp + 0x20]
push ecx
push 0x101
mov word [esi], 0
mov dword [esp + 0x14], 0
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40575e
push 0x41de54
push 0x3ff
push esi
call fcn.0040ad4a
push 0x41de74
push 0x3ff
push esi
call fcn.0040aca1
push 0x41de78
push 0x3ff
push esi
call fcn.0040aca1
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.0040ac62
add esp, 0x9b0
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebx], eax
je 0x405711
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4057f6
push ebp
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
push 4
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
jne 0x4057f6
push 0x41de54
push 0x3ff
push esi
call fcn.0040ad4a
push 0x41de74
push 0x3ff
push esi
call fcn.0040aca1
push 0x41de78
push 0x3ff
push esi
call fcn.0040aca1
mov eax, dword [ebx]
add esp, 0x24
test eax, eax
je 0x4057dc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], edi
mov ecx, dword [esp + 0x9b4]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040ac62
add esp, 0x9b0
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [esp + 0x9c4]
push eax
mov dword [esp + 0x18], edx
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebx]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x405839
push 0x41deb8
jmp 0x40579f
mov edi, 1
jmp 0x4057dc

Function at 0x405840
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
xor eax, eax
cmp dword [ecx], eax
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov dword [esp + 0xc], eax
je 0x4058c4
cmp edi, eax
jle 0x40586f
lea ebx, [ebx]
mov dl, byte [eax + ebp]
not dl
mov byte [eax + ebp], dl
add eax, 1
cmp eax, edi
jl 0x405860
lea ebx, [edi + 7]
push ebx
call fcn.0040baf9
mov esi, eax
lea eax, [edi + 5]
mov word [esi], ax
mov ecx, dword [0x423130]
push edi
mov dword [esi + 2], ecx
mov dl, byte [0x423134]
lea eax, [esi + 7]
push ebp
push eax
mov byte [esi + 6], dl
call fcn.00410700
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
add esp, 0x10
push 0
push ebx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4058c8
cmp eax, ebx
jne 0x4058c8
mov dword [esp + 0xc], 1
jmp 0x4058c8
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4058d5
push esi
call fcn.0040b8fe
add esp, 4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x408920
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x408965
cmp byte [esi + 1], 0
je 0x40896d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x408982
cmp byte [esi + 1], 0
je 0x408974
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40898b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x40893e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40898b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, reloc.crypt32.dll_CertDeleteCRLFromStore
cmp ebp, edi
mov dword [esp + 0xc], edi
jae 0x40899f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0040b29f
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4089bd
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
cmp edi, eax
mov dword [esp + 0x18], 0xffffffff
jbe 0x408ad3
jmp 0x4089e0
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
cmp eax, edi
mov dword [esp + 0x14], edi
ja 0x4089f1
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
cmp ebp, 0x404
mov dword [esp + 0x20], eax
jbe 0x408a0a
mov ebp, 0x404
cmp byte [esi], 0
je 0x408a2f
cmp byte [esi + 1], 0
je 0x408ad3
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x408a32
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x408a5a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408a54
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x408a80
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x408a6b
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.00410700
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x408ad3
lea eax, [ebp - 3]
test eax, eax
jl 0x408abe
sub eax, 1
cmp byte [eax + ebx], 0x50
jne 0x408aae
cmp byte [eax + ebx + 1], 0x4b
jne 0x408aae
cmp byte [eax + ebx + 2], 5
jne 0x408aae
cmp byte [eax + ebx + 3], 6
je 0x408ab4
test eax, eax
jge 0x408a90
jmp 0x408abe
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x408ad3
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x4089d4
push ebx
call fcn.0040b870
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x4099f0
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push edi
jne 0x409aa3
cmp dword [esi + 4], 0xffffffff
jne 0x409aa3
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x409a20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409a20
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + reloc.crypt32.dll_CertDeleteCRLFromStore]
cmp ax, 0x5c
je 0x409a59
cmp ax, 0x2f
je 0x409a59
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x409a46
mov eax, dword [0x41dc40]
mov dword [edi], eax
push 0x20
call fcn.0040baf9
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0x10], 0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.00408af0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
ret 8
mov eax, 0x1000000
pop edi
ret 8

Function at 0x40a790
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor esi, esi
push 0x206
lea eax, [esp + 0x12]
push esi
push eax
mov word [esp + 0x18], si
call fcn.0040f550
add esp, 0xc
cmp edi, esi
je 0x40a876
mov eax, 0x41ddcc
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a7d3
sub eax, edx
sar eax, 1
je 0x40a7fd
push 0x41dcc4
lea ecx, [esp + 8]
push 0x41ddcc
push ecx
call fcn.0040aeee
add esp, 0xc
jmp 0x40a838
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41ff94
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0040aca1
push 0x41dcc4
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0040aeee
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40a85b
push eax
push 1
push 0x200
push edi
call fcn.0040b7e3
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
Function at 0x40a890
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov word [esp + 0x18], di
call fcn.0040f550
add esp, 0xc
cmp esi, edi
mov dword [esp + 4], edi
je 0x40a993
mov eax, 0x41dccc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a8d3
sub eax, edx
sar eax, 1
je 0x40a993
cmp dword [reloc.crypt32.dll_CertGetStoreProperty], 3
jne 0x40a91a
push 0x104
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc40
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040aca1
add esp, 0xc
jmp 0x40a92a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41dccc
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0040aca1
push 0x41dcbc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040aeee
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40a993
push eax
push 1
push 0x200
push esi
call fcn.0040b5bf
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret

Function at 0x40a9b0
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x12]
push edi
push eax
mov word [esp + 0x18], di
call fcn.0040f550
add esp, 0xc
cmp esi, edi
mov dword [esp + 4], edi
je 0x40aa7d
mov eax, 0x41ff94
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a9f3
sub eax, edx
sar eax, 1
je 0x40aa7d
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41ff94
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040aca1
push 0x41dcbc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0040aeee
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40aa7d
push eax
push 1
push 0x200
push esi
call fcn.0040b5bf
mov edx, dword [esp + 0x14]
push edx
call fcn.0040b64d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040ac62
add esp, 0x214
ret
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x40ad90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
arpl word [ebx + 0x8458bec], cx
sub eax, 0xffffff92
je 0x40adab
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xf6002725
xor eax, ebp
pop ebp
ret
arpl word [ebp + 0x14], ax
mov ecx, dword [ebp + 0x10]
and byte [ebp - 0x75], dl
push eax
push ecx
push edx
call 0x40adbc
add esp, 0xc
pop ebp
jno 0x40adb4
nop
nop
nop
nop
nop
push ebx
mov dl, byte [eax - 0x6f6f1070]
nop
nop
sbb al, 0x8b
sub eax, 0x8b10458b
dec ebp
add dword [ebx + 0x100a10f8], 0xc12cc7ff
sub al, 0xc1
Function at 0x441480
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4414ae
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4414cc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004413ea
jmp 0x4414cc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4414cc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004413ea
test edi, edi
mov eax, edi
jne 0x4414b6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x460778]
test ecx, ecx
je 0x44157f
jmp 0x44147f
ret 8

Function at 0x408969
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub ebx, 0xe406a19
call fcn.00408999
push 0x60ac62ff
pop ebx
xor dword [esi], edx
inc esi
cmp esi, edi
jne fcn.00408969
sub ecx, 0x5eaea01d
ret
Function at 0x401000
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403238
push 0x401f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401087
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x401087
push edi
call fcn.00401a60
add esp, 4
mov ebx, eax
push 0
lea edx, [ebp - 0x20]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4010a1
push ebx
call fcn.00401a80
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edi
mov dword [ebp - 0x1c], 1
jmp 0x4010c4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401190
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x4030e4
mov dword [esp + 0x14], edi
call fcn.004015b0
push eax
call fcn.00401680
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
mov ebx, eax
call fcn.00401a80
push 0x4030f4
call fcn.004015b0
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
mov esi, eax
push esi
push ebx
call ebp
push esi
mov ebx, eax
call fcn.00401a80
add esp, 4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call ebx
mov esi, eax
cmp esi, edi
je 0x401262
cmp dword [esp + 0x10], 3
jne 0x40125b
push 0x403110
call fcn.004015b0
push eax
call fcn.00401680
add esp, 8
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
mov ebx, eax
call fcn.00401a80
push 0x403120
call fcn.004015b0
add esp, 8
mov edi, eax
push edi
push ebx
call ebp
push edi
mov ebx, eax
call fcn.00401a80
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x1c]
add esp, 4
push ecx
push edx
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call ebx
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401290
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
xor ebp, ebp
push edi
xor eax, eax
xor ebx, ebx
push 0x400
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebp
xor edi, edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.00401a60
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x4013f3
push 0x400
call fcn.00401a60
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebp
je 0x4013d0
push eax
push esi
call fcn.00401190
add esp, 8
test eax, eax
je 0x4013c3
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.00401000
mov ebx, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x4013c3
mov ecx, dword [esp + 0x10]
mov eax, ebx
cmp ebx, ebp
je 0x4013c3
cmp ecx, ebp
je 0x4013c3
xor byte [eax], 0xcc
dec ecx
inc eax
cmp ecx, ebp
jne 0x401336
call fcn.00401a50
push 0x400
mov dword [esp + 0x18], eax
mov ebp, edx
call fcn.00401a60
push 0x403130
mov edi, eax
call fcn.004015b0
mov esi, eax
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
call fcn.00401a80
push 0x10
lea edx, [esp + 0x48]
push edi
push edx
call fcn.00401720
add esp, 0x24
test eax, eax
je 0x4013bd
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.00401860
add esp, 0x14
test eax, eax
je 0x4013bd
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.004010e0
add esp, 0xc
mov esi, dword [esp + 0x24]
xor ebp, ebp
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00401a80
add esp, 4
push esi
call fcn.00401a80
add esp, 4
cmp ebx, ebp
je 0x4013e6
push ebx
call fcn.00401a80
add esp, 4
cmp edi, ebp
je 0x4013f3
push edi
call fcn.00401a80
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x401404
push eax
call fcn.00401a80
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401720
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x401748
lea eax, [esi + 1]
pop esi
pop ebx
add esp, 0x10
ret
push ebp
push edi
push 0x40313c
call fcn.004015b0
push eax
call fcn.00401680
add esp, 8
push 0xf0000000
push 1
mov ebp, eax
push ebp
push esi
lea edi, [ebx + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x401826
mov ecx, dword [edi]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x8004
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x401826
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
push esi
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x401826
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
lea esi, [ebx + 8]
push esi
push 1
push edx
push 0x6602
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x401824
mov edx, dword [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x13
push edx
mov dword [esp + 0x28], 0x28
call edi
mov ecx, dword [esi]
push 0
lea eax, [esp + 0x14]
push eax
push 4
push ecx
mov dword [esp + 0x20], 1
call edi
mov eax, dword [esi]
push 0
lea edx, [esp + 0x14]
push edx
push 3
push eax
mov dword [esp + 0x20], 1
call edi
mov dword [ebx], 1
mov dword [esp + 0x1c], 1
xor esi, esi
cmp ebp, esi
je 0x401833
push ebp
call fcn.00401a80
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop ebp
cmp eax, esi
je 0x401844
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x401855
push eax
call fcn.00401a80
add esp, 4
mov eax, dword [esp + 0x14]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401960
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
xor edi, edi
push 0x403194
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
call fcn.004015b0
push eax
call fcn.00401680
mov ebp, eax
push 0x4031c8
mov dword [esp + 0x24], ebp
call fcn.004015b0
push eax
call fcn.00401680
add esp, 0x10
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x20019
push edi
push ebp
push 0x80000002
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401a1d
push 0x1002
mov dword [esp + 0x14], 0x800
call fcn.00401a60
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x401a1d
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push ebp
push edi
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a14
xor al, al
mov esi, ebp
cmp word [ebp], di
je 0x401a10
mov dl, byte [esi]
xor al, dl
and al, 0x1f
movzx edx, dl
movzx ecx, al
xor edi, edx
add esi, 2
rol edi, cl
cmp word [esi], 0
jne 0x4019f7
mov esi, dword [esp + 0x14]
push ebp
call fcn.00401a80
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401a2c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00401a80
mov eax, dword [esp + 0x1c]
push eax
call fcn.00401a80
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret