joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461dc8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
test dword [eax + 4], 6
je 0x403a34
mov ecx, dword [edx + 4]
mov dword [edx + 4], 0x21b1a34
push ebx
push esi
push edi
push ebp
mov ebp, dword [edx + 8]
add ecx, 5
call fcn.004036ec
call ecx
pop ebp
pop edi
pop esi
pop ebx
mov eax, 1
ret
call fcn.0054cb84
inc ebx
jle 0x461dd6
aaa
jg 0x461e45
call 0x6d944457
call 0x6d944457
push ss
inc esp
push ebx
loope 0x461dd0
invalid
sbb eax, 0xb7a11fc5
add ebx, edi
invalid
or dword [edx], ecx
jns 0x461dce
cmp bh, byte [eax + 0x1148f03]
scasd eax, dword es:[edi]
xchg ebx, eax
jecxz 0x461e19
movsd dword es:[edi], dword [esi]
or eax, 0x7f483135
push esi
cmp eax, esp
inc dword [esi + 0x12283fc]
stc
test eax, 0xaf11c20
dec eax
or eax, 0x1f2b41e7
sub ebx, dword [edi]
pop esi
fmul dword [edi]
or ah, byte [edi - 0x1a8cc274]
or ah, byte [edi - 0x1a8cc274]
push 0x14
xor eax, 0xf865217c
lodsb al, byte [esi]
pushfd
fdivr dword [0x90d50610]
jp 0x461e62
sub cl, dh
pop esp
jbe 0x461f05
mov dl, byte [ecx - 0x30428416]
mov ebp, 0xe317468e
leave
stc
loope 0x461ece
mov dh, 0x2b
fucomi st(4)
xchg dword [eax], ecx
or byte [edi + ebp + 0x25], 0xe4
sbb dl, dl
or al, 0x50
mov edi, 0x54d2bd7a
mul byte [ebp - 0x5c]
stosd dword es:[edi], eax
dec ebx
mov ebp, 0xda414c13
push 0xe05ec1de
xchg byte [edi], ch
push edx
ret 0xf620
aam 0xc4
cmp dword [edi + 0x6c2aa5f0], 0xb
mov edi, 0xfc0bd98c
sbb dword [ebx], esp
add al, al
loopne 0x461ee3
jp 0x461e6c
mov byte [esi - 0x35], dh
jbe 0x461eb1
loopne 0x461e72
mov esp, 0xcbf87ea7
call fcn.0054cb84
scasb al, byte es:[edi]
inc edx
int 0xbc
jmp 0x403a04
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x220ffee
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00404148
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.00404418
mov ebx, eax
cmp ebx, 1
jl 0x461fad
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
call fcn.00404330
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004094c4
mov eax, dword [ebp - 0xc]
mov edx, 0x2210004
call fcn.00404760
dec eax
test eax, eax
jl 0x461fa8
cmp eax, 1
jg 0x461fa8
mov ecx, esi
shl ax, cl
or di, ax
inc esi
cmp esi, 8
jl 0x461fa8
lea eax, [ebp - 0x14]
mov edx, edi
and dl, 0xff
call fcn.00404330
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [ebp - 8]
call fcn.00404464
movzx eax, di
shr eax, 8
mov edi, eax
sub esi, 8
dec ebx
test ebx, ebx
jne 0x461f41
test esi, esi
jle 0x461fd3
test di, di
jbe 0x461fd3
lea eax, [ebp - 0x18]
mov edx, edi
and dl, 0xff
call fcn.00404330
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [ebp - 8]
call fcn.00404464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x220fff5
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040416c
ret
Function at 0x462740
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x462800
xor ebx, ebx
lea esi, [ebp - 0x114]
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
call fcn.00405410
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x46276a
xor edx, edx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x462800
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc edx
and dl, 0xff
mov esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x114]
mov cl, byte [ebp - 0xd]
add cl, al
and cl, 0xff
mov byte [ebp - 0xd], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov cl, byte [ebp + ecx - 0x114]
mov byte [ebp + esi - 0x114], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x114], al
add al, byte [ebp + esi - 0x114]
and al, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x114]
mov eax, dword [ebp - 8]
mov byte [eax + ebx], cl
inc ebx
dec dword [ebp - 0x14]
jne 0x46279c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46280c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x4628c4
xor esi, esi
lea ecx, [ebp - 0x110]
mov eax, esi
cdq
idiv edi
mov al, byte [ebx + edx]
mov byte [ecx], al
inc esi
inc ecx
cmp esi, 0x100
jne 0x462839
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4628c4
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc edx
and dl, 0xff
xor eax, eax
mov al, dl
mov al, byte [ebp + eax - 0x110]
lea ecx, [eax + ecx]
and cl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [ebp + ebx - 0x110]
mov edi, edx
and edi, 0xff
mov byte [ebp + edi - 0x110], bl
xor ebx, ebx
mov bl, cl
mov byte [ebp + ebx - 0x110], al
xor ebx, ebx
mov bl, dl
add al, byte [ebp + ebx - 0x110]
and al, 0xff
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + esi]
and eax, 0xff
xor bl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], bl
inc esi
dec dword [ebp - 0x10]
jne 0x46285f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4aa7dc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x22c61e0]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x22589b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a29ac
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004a3bd4
mov eax, dword [esi]
call fcn.004914bc
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x4aa84e
mov eax, dword [esi]
call fcn.004914bc
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.004914c8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x4aa872
mov eax, dword [esi]
call fcn.004914c8
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004914b0
cmp eax, dword [ebp - 0x18]
jle 0x4aa888
mov eax, dword [esi]
call fcn.004914b0
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004914a4
cmp eax, dword [ebp - 0xc]
jle 0x4aa89e
mov eax, dword [esi]
call fcn.004914a4
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004a9164
push eax
call fcn.00407810
call fcn.00406d28
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x4aa965
mov eax, ebx
call fcn.00404418
cmp eax, 0x64
jge 0x4aa965
cmp dword [0x22c3fd0], 0
je 0x4aa965
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00407860
cmp dword [ebp - 8], 0
je 0x4aa965
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00407860
cmp dword [ebp - 8], 0
je 0x4aa928
mov bl, 2
jmp 0x4aa943
lea edx, [ebp - 0x20]
mov eax, dword [0x22ce834]
call fcn.004ada74
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x4aa941
xor ebx, ebx
jmp 0x4aa943
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x22c40d8]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.004a9164
push eax
call dword [0x22c3fd0]
mov eax, dword [0x22c6010]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.004a6898
push 4
mov eax, dword [ebp - 4]
call fcn.004a9164
push eax
call fcn.00407858
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x22589bc
call fcn.00406d28
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4ccf78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x227b037
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4cd029
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4cd012
test esi, esi
jbe 0x4cd029
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a518
test eax, eax
jne 0x4cd004
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4cd029
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4ccfe1
jmp 0x4cd029
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4cd029
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x227b03e
ret
Function at 0x4cda58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x227bc07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404868
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4cda93
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4cdaac
lea eax, [ebp - 0x10]
mov edx, dword [0x22c5ff8]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.004048c8
jmp 0x4cdabf
lea eax, [ebp - 0x10]
mov edx, dword [0x22c5ff8]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004048c8
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4cdacb
adc edx, 0
mov edx, dword [edx*4 + 0x22c4608]
call fcn.00404ac8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404aac
push eax
call fcn.00406a50
mov esi, eax
cmp esi, 0xffffffff
je 0x4cdbd9
mov eax, 0x40
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406e80
test eax, eax
je 0x4cdbcc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4cdbcc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ef8
mov eax, edi
call fcn.00402744
mov eax, 0x18
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406e80
test eax, eax
je 0x4cdbcc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4cdbcc
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4cdbcc
cmp dx, 0x150
ja 0x4cdbcc
mov eax, edi
call fcn.00402744
mov eax, 0xe0
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406e80
test eax, eax
je 0x4cdbcc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4cdbcc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004048a4
mov eax, edi
call fcn.00402744
push esi
call fcn.00406a08
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404bd4
jne 0x4cdbf1
inc ebx
cmp ebx, 0x19
jne 0x4cda85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x227bc0e
lea eax, [ebp - 0x10]
call fcn.00404868
ret
Function at 0x1000336e
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x100
lea eax, [ebp - 0x39c]
push esi
push dword [edi]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push esi
lea eax, [ebp - 0x39c]
push dword [edi]
push eax
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x18
lea eax, [ebp - 0x39c]
push 0x100032f7
push eax
call dword [0x10006f08]
xor ebx, ebx
mov dword [0x10006f90], eax
cmp eax, ebx
je 0x10003585
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 1
push ebx
push 2
call fcn.1000318a
push ebx
push ebx
push 4
call fcn.1000318a
add esp, 0x18
lea eax, [ebp - 0x198]
mov dword [ebp - 0x198], 0x94
push eax
call dword [0x10006ec8]
cmp dword [ebp - 0x188], 2
jne 0x10003566
cmp dword [ebp - 0x194], 6
jae 0x10003419
call sym.MainDll.dll_MainThread
jmp 0x10003566
lea eax, [ebp - 0x104]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push 0x1000660c
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x104]
push str.Recte4
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x104]
push str..exe
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x29c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x29c]
push str.Rundll32.exe
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x104]
push eax
call dword [0x10006eb0]
cmp eax, 0xffffffff
jne 0x100034cb
call dword [0x10006e98]
cmp eax, 2
jne 0x100034cb
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [0x10006eec]
pop ecx
pop ecx
lea eax, [ebp - 0x4a0]
push esi
push eax
xor edi, edi
push dword [0x10006e60]
mov dword [ebp + 0xc], ebx
call dword [0x10006e8c]
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x8a0]
push str._s___s__MainThread
push eax
call dword [0x10006eec]
add esp, 0x10
push 0x3e8
call dword [0x10006ea0]
lea eax, [ebp + 0xc]
push eax
push edi
call dword [0x10006ecc]
cmp dword [ebp + 0xc], 0x103
je 0x10003547
push edi
call dword [0x10006e9c]
push 0xbb8
call dword [0x10006ea0]
lea eax, [ebp - 0x8a0]
push eax
call fcn.10001fbd
pop ecx
mov edi, eax
mov eax, dword [0x10006f8c]
cmp eax, 3
je 0x10003556
cmp eax, 1
jne 0x10003507
push 0xffffffffffffffff
push edi
call dword [0x10006eac]
push edi
call dword [0x10006e9c]
push 0x64
call dword [0x10006ea0]
mov eax, dword [0x10006f8c]
cmp eax, 3
je 0x10003585
cmp eax, 1
je 0x10003585
cmp dword [0x10006f94], ebx
je 0x10003566
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100036ba
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push esi
mov esi, 0x144
push edi
push esi
lea eax, [ebp - 0x198]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x29c]
mov byte [ebp - 0x198], 0xc8
push str.Recte4
push str.SYSTEMCurrentControlSetServices_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x197]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x197]
push 0
push eax
push 1
lea eax, [ebp - 0x29c]
push str.Group
push eax
push 0x80000002
call fcn.10004822
push 0x10
lea eax, [ebp - 0x14]
pop edi
push edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x2c
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x48]
call dword [0x10006f84]
lea eax, [ebp - 0x10]
push 4
push eax
lea eax, [ebp - 0x174]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x170]
push 0x32
push eax
call fcn.100035ea
add esp, 0x18
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x9c
push eax
call dword [0x10006ec8]
lea eax, [ebp - 0xa0]
push eax
call fcn.1000358c
pop ecx
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
push 0x14
pop ecx
call fcn.10004d40
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c], eax
call fcn.100031d2
mov dword [ebp - 0x88], eax
call fcn.1000366a
test eax, eax
setne al
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x7c]
push 0x14
push eax
call fcn.10003629
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x10006514
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x198]
push esi
push eax
mov ecx, edi
call fcn.10001863
pop edi
pop esi
leave
ret
Function at 0x590ac8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
add esp, 0xfffffff8
push 0
call sub.kernel32.dll_GetModuleHandleW
mov ecx, eax
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ebx, dword [eax + 0x34]
add ebx, dword [eax + 0x28]
mov eax, 0x590a9c
sub eax, 5
mov dword [esp], eax
mov eax, dword [esp]
sub eax, ebx
mov dword [esp], eax
lea eax, [esp + 4]
push eax
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x590b4b
mov eax, 0x59fe7d
mov edx, eax
mov eax, esp
mov ecx, 4
call fcn.004058a0
mov edx, ebx
mov eax, 0x59fe7c
mov ecx, 6
call fcn.004058a0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
pop ebx
ret

Function at 0x590cb4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov esi, edx
mov edi, ebx
sub esi, edi
sub esi, 5
push esp
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [ebx], 0xe9
inc edi
mov dword [edi], esi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x659a6d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663168
cmp edx, dword [eax]
je 0x659a8f
add eax, 8
inc ecx
cmp eax, 0x6631f8
jl 0x659a80
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663168]
jne 0x659bbd
mov eax, dword [0xa68a90]
cmp eax, 1
je 0x659b97
test eax, eax
jne 0x659ac0
cmp dword [0x663094], 1
je 0x659b97
cmp edx, 0xfc
je 0x659bbd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659af7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a450
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a8e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659b3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a8e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eeac
push edi
call fcn.0065c7b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a450
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a460
lea eax, [ebp - 0xa0]
push 0x65ee8c
push eax
call fcn.0065a460
push dword [esi + 0x66316c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a460
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c724
add esp, 0x2c
pop edi
jmp 0x659bbd
lea eax, [ebp + 8]
lea esi, [esi + 0x66316c]
push 0
push eax
push dword [esi]
call fcn.0065a8e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xe84960
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xec8c00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xee2014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0xee30bc
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00e97f20
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0xee2a8c
push eax
call fcn.00e97f20
mov esi, dword [0xee30cc]
xor ebx, ebx
mov edi, dword [0xee30d0]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0xee6360], bl
mov eax, ebx
mov ecx, 0xee30bc
cmovae ecx, dword [0xee30bc]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0xee6470], al
inc ebx
cmp ebx, 0x100
jl 0xe849e0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0xee6360]
movzx eax, byte [esi + 0xee6470]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0xe84a34
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0xee6360]
mov byte [esi + 0xee6360], al
inc esi
mov byte [edi + 0xee6360], dl
cmp esi, 0x100
jl 0xe84a10
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00e84650
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0xe84a89
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xe84a7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xe84adf
push edx
push ecx
call fcn.00e9d4c4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0xe84acb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xe84ac1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xe84adf
push edx
push ecx
call fcn.00e9d4c4
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00eb6aca
int3