joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x4a615f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004a5f34
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
test eax, eax
je 0x4a60ae
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4a60ae
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.00405130
test eax, eax
je 0x4a60b7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4a6143
mov dword [ebp - 0xc], eax
mov edi, 1
inc ebx
and ebx, 0x800000ff
jns 0x4a60d8
dec ebx
or ebx, 0xffffff00
inc ebx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
movzx edx, al
add esi, edx
and esi, 0x800000ff
jns 0x4a60f4
dec esi
or esi, 0xffffff00
inc esi
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi]
mov ecx, dword [ebp - 4]
mov byte [ecx + ebx], dl
mov edx, dword [ebp - 4]
mov byte [edx + esi], al
mov eax, dword [ebp - 8]
call fcn.00405700
lea eax, [eax + edi - 1]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + esi]
add edx, ecx
and edx, 0xff
mov ecx, dword [ebp - 4]
xor al, byte [ecx + edx]
pop edx
mov byte [edx], al
inc edi
dec dword [ebp - 0xc]
jne 0x4a60c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6166
lea eax, [ebp - 4]
mov edx, dword [0x4a594c]
call fcn.00407170
ret

Function at 0x4a61d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405c28
mov eax, dword [ebp - 8]
call fcn.00405c28
mov eax, dword [ebp + 8]
call fcn.00405c28
xor eax, eax
push ebp
push 0x4a6270
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp + 8]
call fcn.0040c1f8
mov eax, dword [ebp + 8]
call fcn.00405ccc
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405ccc
push eax
mov ecx, dword [0x4b5b4c]
mov dl, 1
mov eax, dword [0x41a054]
call fcn.0041eae0
mov ebx, eax
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.0041e8e8
mov eax, ebx
call fcn.00403d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6277
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405c38
lea eax, [ebp + 8]
call fcn.00405c30
ret
Function at 0x4a6280
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405c28
xor eax, eax
push ebp
push 0x4a6471
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404f14
mov esi, 1
push 0
push 0
push 0
push 0
push 0x4a6484
call sub.wininet.dll_InternetOpenW
mov edi, eax
test edi, edi
je 0x4a639b
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ccc
push eax
push edi
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a6395
lea eax, [ebp - 0x411]
xor ecx, ecx
mov edx, 0x401
call fcn.00403600
lea eax, [ebp - 0x10]
push eax
push 0x401
lea eax, [ebp - 0x411]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x10], 0
je 0x4a6386
mov edx, dword [ebp - 0x10]
add edx, esi
mov eax, ebx
xor ecx, ecx
call fcn.0040576c
mov eax, ebx
call fcn.00405700
lea eax, [eax + esi - 1]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00403600
mov eax, ebx
call fcn.00405700
lea eax, [eax + esi - 1]
mov edx, eax
lea eax, [ebp - 0x411]
mov ecx, dword [ebp - 0x10]
call fcn.004031d0
add esi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jne 0x4a6314
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebx]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x4a63b2
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
mov eax, ebx
xor ecx, ecx
call fcn.0040576c
cmp byte [ebp - 5], 0
je 0x4a644b
movzx eax, byte [0x4a64a4]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x420]
mov edx, dword [ebx]
call fcn.00405e2c
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov edx, 0x4a64b4
call fcn.00412288
mov edx, dword [ebp - 0x41c]
mov eax, ebx
mov ecx, 0
call fcn.00405e54
movzx eax, byte [0x4a64a4]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx]
call fcn.00405e2c
mov eax, dword [ebp - 0x428]
mov ecx, 0x4a64c4
mov edx, 0x4a64d4
call fcn.00412288
mov edx, dword [ebp - 0x424]
mov eax, ebx
mov ecx, 0
call fcn.00405e54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6478
lea eax, [ebp - 0x428]
mov edx, 4
call fcn.00405c38
lea eax, [ebp - 4]
call fcn.00405c30
ret
Function at 0x4a90e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4a90e8
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a92ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x419c58]
call fcn.0041e16c
mov dword [ebp - 0x10], eax
push dword [0x4b88a0]
push 0x4a9308
push dword [0x4b88a4]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004061c8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.00405e54
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004a6060
mov eax, dword [ebp - 8]
test eax, eax
je 0x4a9168
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4a9168
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00405130
test eax, eax
je 0x4a9171
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x4a91c3
mov esi, 1
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00405e2c
push dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + esi - 1]
call fcn.0040b9c4
push dword [ebp - 0x20]
push 0x4a9318
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004061c8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.00405e54
inc esi
dec ebx
jne 0x4a917c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4a91e2
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4a91e2
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00405130
test eax, eax
je 0x4a91eb
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
lea eax, [ebp - 0xc]
xor ecx, ecx
call fcn.0040576c
push 0x4a9328
push dword [ebp - 0xc]
push 0x4a9344
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405478
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00405e2c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x2c]
mov ecx, 0x4a9354
mov edx, dword [0x4b8898]
call fcn.004060e4
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00405e54
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 4]
call fcn.00405e2c
mov eax, dword [ebp - 0x30]
xor edx, edx
call fcn.0040c1f8
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 4]
call fcn.00405e2c
mov eax, dword [ebp - 0x34]
call fcn.00405ccc
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.00405e2c
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 4]
call fcn.00405e2c
mov eax, dword [ebp - 0x3c]
mov edx, 6
call fcn.0040c1f8
mov eax, dword [ebp - 0x10]
call fcn.00403d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a92f3
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00405c38
lea eax, [ebp - 0x28]
call fcn.00404f14
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00405c38
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f38
ret
Function at 0x4a9444
Capabilities:
Create process on windows
Create thread
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x60], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9658
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a9674
lea eax, [ebp - 0x60]
push eax
mov ecx, 0x4a9690
mov edx, 0x4a96a4
mov eax, ebx
call fcn.004a6644
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, dword [0x4b8898]
call fcn.004060e4
mov eax, dword [ebp - 0x5c]
call fcn.0040c0c0
test al, al
je 0x4a951e
push 0x4a9674
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x4a9690
mov edx, 0x4a96a4
mov eax, ebx
call fcn.004a6644
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov edx, dword [0x4b8898]
call fcn.004060e4
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x6c]
mov ecx, 0x4a96bc
mov edx, dword [0x4b8898]
call fcn.004060e4
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x70], edi
mov eax, dword [ebp - 0x70]
call fcn.00405ccc
push eax
mov dword [ebp - 0x74], esi
mov eax, dword [ebp - 0x74]
call fcn.00405ccc
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov eax, ebx
call fcn.004a90e0
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403600
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403600
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4b88b0]
call fcn.00405ccc
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4a95ec
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x7c]
call fcn.0040bbd0
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 0x4a96d4
call fcn.004060e4
mov edx, dword [ebp - 0x78]
mov eax, dword [0x4b8888]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x84]
call fcn.0040bbd0
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
mov edx, 0x4a96d4
call fcn.004060e4
mov eax, dword [ebp - 0x80]
call fcn.00405ccc
push eax
push 1
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov ebx, eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4a95fa
mov edx, 0x4a96e8
mov eax, ebx
call fcn.004a9058
jmp 0x4a962d
mov eax, dword [0x4b20dc]
mov eax, dword [eax]
call fcn.00470ee8
mov eax, 4
call fcn.00403018
mov dword [eax], ebx
lea edx, [ebp - 4]
push edx
push 0
push eax
push 0x4a9380
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a965f
lea eax, [ebp - 0x84]
mov edx, 4
call fcn.00405c38
lea eax, [ebp - 0x6c]
mov edx, 5
call fcn.00405c38
ret
Function at 0x4a9708
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4a9710
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x4b8884
xor eax, eax
push ebp
push 0x4a9906
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push dword [0x4b8898]
push 0x4a9920
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 8]
push 0x4a9938
lea eax, [ebp - 4]
mov edx, 4
call fcn.004061c8
mov eax, dword [ebp - 4]
call fcn.00405ccc
push eax
push dword [0x4b8898]
push 0x4a9950
push dword [0x4b88b4]
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x10]
push 0x4a997c
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.004061c8
mov eax, dword [ebp - 0xc]
call fcn.00405ccc
push eax
call sub.kernel32.dll_CopyFileW
push dword [0x4b8898]
push 0x4a9950
push dword [0x4b88b4]
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x18]
push 0x4a997c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004061c8
mov eax, dword [ebp - 0x14]
mov edx, 6
call fcn.0040c1f8
xor edx, edx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jl 0x4a985f
lea eax, [ebp - 0x20]
mov ecx, 0x4a9994
mov edx, dword [0x4b8898]
call fcn.004060e4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.00405e8c
mov eax, dword [ebp - 0x1c]
push eax
push dword [0x4b8894]
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, dword [esi]
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x2c]
push 0x4a997c
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004061c8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00405e8c
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebx + 0x3ac]
call fcn.00480004
jmp 0x4a98c6
mov eax, dword [ebx + 0x3b0]
call fcn.00450c94
mov eax, dword [ebx + 0x3b4]
call fcn.00450c94
mov eax, dword [ebx + 0x394]
call fcn.00450c9c
mov eax, dword [ebx + 0x3d0]
call fcn.00450c9c
mov eax, dword [ebx + 0x3d4]
call fcn.00450c9c
mov byte [0x4b887c], 1
mov eax, dword [ebx + 0x3c0]
call fcn.00450c9c
mov eax, dword [esi]
call fcn.00403d18
mov byte [0x4b887e], 0
mov edx, 0x4a99c4
mov eax, dword [ebx + 0x3b8]
call fcn.004506a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a990d
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405c38
lea eax, [ebp - 0x24]
call fcn.00405834
lea eax, [ebp - 0x20]
call fcn.00405c30
lea eax, [ebp - 0x1c]
call fcn.00405834
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00405c38
ret
Function at 0x4a99d0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4a99d8
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9b9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [0x4b20dc]
mov eax, dword [eax]
call fcn.00472100
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040c4fc
lea ecx, [ebp - 0x10]
mov edx, 0x4a9bb8
mov eax, dword [ebp - 4]
call fcn.0040c3ec
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004a5824
mov eax, dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4a9bd0
mov edx, 0x4a9be4
mov eax, ebx
call fcn.004a6644
mov edx, dword [ebp - 0x14]
pop eax
call fcn.004063b4
je 0x4a9a69
mov edx, 0x4a9bfc
mov eax, ebx
call fcn.004a9058
mov eax, dword [0x4b20dc]
mov eax, dword [eax]
call fcn.00471a2c
jmp 0x4a9b82
mov dl, 1
mov eax, dword [0x419c58]
call fcn.0041e16c
mov ebx, eax
mov edx, 0x4a9c28
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x4a9c40
call fcn.004060e4
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4a9c58
push dword [ebp - 4]
push 0x4a9c78
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004061c8
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4a9c98
lea ecx, [ebp - 0x24]
mov edx, 0x4a9bb8
mov eax, dword [ebp - 4]
call fcn.0040c3ec
push dword [ebp - 0x24]
push 0x4a9cb4
push dword [ebp - 4]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004061c8
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x4a9cc4
call fcn.004060e4
mov edx, dword [ebp - 0x28]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4a9ce0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x2c]
mov ecx, 0x4a9cfc
mov edx, dword [0x4b8898]
call fcn.004060e4
mov eax, dword [ebp - 0x2c]
xor edx, edx
call fcn.0040c1f8
lea eax, [ebp - 0x30]
mov ecx, 0x4a9cfc
mov edx, dword [0x4b8898]
call fcn.004060e4
mov edx, dword [ebp - 0x30]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x7c]
push 0
lea eax, [ebp - 0x34]
mov ecx, 0x4a9cfc
mov edx, dword [0x4b8898]
call fcn.004060e4
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4b20dc]
mov eax, dword [eax]
call fcn.00471a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9ba4
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00405c38
ret
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [eax - 0x18], dl
mov ebx, 0x55000001
add dword [eax], eax
invalid
push ebp

Function at 0x401096
Capabilities:
Query or enumerate registry value

Disassembly:
outsd dx, dword [esi]
jb 0x401097
je 0x4010e1
and byte gs:[ebx + 0x65], ch
jb 0x4010ed
insb byte es:[edi], dx
and byte [ecx + ebp*2 + 0x62], ch
jb 0x4010e8
jb 0x401102
and byte [ecx + 0x73], ch
and byte [ecx + 0x6e], ch
jbe 0x4010f2
popal
insb byte es:[edi], dx
imul esp, dword [ecx], 0x6f727245
jb 0x401109
jb 0x40110b
outsd dx, dword [esi]
add dword [eax], eax
add byte [ebx - 0x7af0ff08], al
mov eax, 0xc7000000
test dword [eax - 0x39000000], edi
test eax, esi
inc dword [ebx]
add dword [eax], eax
add byte [ebp - 0x10f7b], cl
call dword [eax - 0x73]
test esp, edi
invalid
invalid
adc byte [eax], al
Function at 0x41985f
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, ecx
shr ebx, 0x10
and ecx, 0xffff
cmp edi, 1
je 0x419a7f
test esi, esi
mov eax, 1
je 0x419a41
cmp edi, 0xf
jbe 0x419a4e
cmp edi, 0x15af
jbe 0x419968
sub edi, 0x15b0
mov edx, 0x15b
movzx eax, byte [esi]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 1]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 2]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 3]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 4]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 5]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 6]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 7]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 8]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 9]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xa]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xb]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xc]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xd]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xe]
add ecx, eax
add ebx, ecx
movzx eax, byte [esi + 0xf]
add esi, 0x10
add ecx, eax
add ebx, ecx
dec edx
jne 0x4198af
mov eax, 0x80078071
mul ecx
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
mul ebx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebx, edx
cmp edi, 0x15af
ja 0x4198a4
test edi, edi
je 0x419a3a
jmp 0x4199fa
movzx eax, byte [esi]
sub edi, 0x10
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 8]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 9]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 0xa]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 0xb]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 0xc]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 0xd]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 0xe]
add ebx, ecx
add ecx, eax
movzx eax, byte [esi + 0xf]
add ebx, ecx
add ecx, eax
add ebx, ecx
add esi, 0x10
cmp edi, 0xf
ja 0x419975
dec edi
cmp edi, 0xffffffff
je 0x419a17
movzx eax, byte [esi]
inc esi
add ecx, eax
add ebx, ecx
dec edi
cmp edi, 0xffffffff
jne 0x419a09
mov esi, 0x80078071
mov eax, esi
mul ecx
mov eax, esi
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
mov eax, ebx
shl eax, 0x10
or eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esi]
inc esi
add ecx, eax
add ebx, ecx
dec edi
cmp edi, 0xffffffff
jne 0x419a46
cmp ecx, 0xfff0
jbe 0x419a62
sub ecx, 0xfff1
mov eax, ebx
mov edx, 0x80078071
mul edx
mov eax, ebx
shr edx, 0xf
imul edx, edx, 0xfff1
sub eax, edx
shl eax, 0x10
or eax, ecx
jmp 0x419a41
movzx eax, byte [esi]
add ecx, eax
cmp ecx, 0xfff0
jbe 0x419a92
sub ecx, 0xfff1
add ebx, ecx
cmp ebx, 0xfff0
jbe 0x419a3a
sub ebx, 0xfff1
mov eax, ebx
jmp 0x419a3c
Function at 0x67d390
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x67d3a3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x67d39f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x67d3d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x67d40f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x67d405
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x67d411
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x67d3f5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x68e2cd
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x68e2e0
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x68e2dc
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x68e30d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x68e34c
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x68e342
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x68e34e
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x68e332
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret