joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40d8b7
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40d8bd
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40d818
cmp al, 0x61
jb 0x40d810
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40d803
cmp edx, dword [esp + 0x14]
je 0x40d828
dec ecx
jne 0x40d7f8
xor eax, eax
jmp 0x40d8b7
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40d8b7
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40d8b7
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40d868
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40d877
jmp 0x40d85f
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x40d8bd
test eax, eax
je 0x40d8b7
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40d8b2
cmp al, 0x61
jb 0x40d8aa
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40d89d
call 0x40d7cc
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40d90a
mov al, cl
cmp al, 0x61
jb 0x40d8e5
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40d90a
mov al, cl
cmp al, 0x61
jb 0x40d8fd
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40d8d6
cmp edx, dword [esp + 0x18]
je 0x40d91a
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40d8cf
xor eax, eax
jmp 0x40d91d
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x40d8bd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40d8b7
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40d8bd
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40d818
cmp al, 0x61
jb 0x40d810
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40d803
cmp edx, dword [esp + 0x14]
je 0x40d828
dec ecx
jne 0x40d7f8
xor eax, eax
jmp 0x40d8b7
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40d8b7
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40d8b7
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40d868
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40d877
jmp 0x40d85f
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x40d8bd
test eax, eax
je 0x40d8b7
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40d8b2
cmp al, 0x61
jb 0x40d8aa
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40d89d
call 0x40d7cc
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40d90a
mov al, cl
cmp al, 0x61
jb 0x40d8e5
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40d90a
mov al, cl
cmp al, 0x61
jb 0x40d8fd
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40d8d6
cmp edx, dword [esp + 0x18]
je 0x40d91a
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40d8cf
xor eax, eax
jmp 0x40d91d
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x410f7e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x411031
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x4128d3
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4128dd
add dword [esp], 5
retf

Function at 0x412a90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ax, 0x53
mov fs, eax
push 0x33
call 0x412aa0
add dword [esp], 5
retf

Function at 0x412b50
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x412b5a
add dword [esp], 5
retf
Function at 0x412d6b
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x412d97
add dword [esp], 5
retf

Function at 0x416098
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
cmp dword [ebp - 4], esp
je 0x4160d9
push 0
push 0x4018be5
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp - 4], esp
push 4
push 0
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
nop
cmp dword [ebp - 4], esp
je 0x416111
push 0x2c
push 0x4018be5
push 6
call fcn.0041779f
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x416699
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x4166eb
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4166e3
push 0x4f
push 0x4028046
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x416724
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416721
push 0x7d
push 0x4028046
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x416738
mov eax, 0
jmp 0x4167a0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416769
push 0x10b
push 0x4028046
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416798
push 0x12f
push 0x4028046
push 6
call fcn.0041779f
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x4167a0
mov esp, ebp
pop ebp
ret 8

Function at 0x4168da
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x416919
mov dword [ebp - 4], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
nop
cmp dword [ebp - 4], esp
je 0x416916
push 0x46
push 0x401007e
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x41694f
push 0xa5
push 0x401007e
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416983
push 0xa5
push 0x401007e
push 6
call fcn.0041779f
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x416997
mov esp, ebp
pop ebp
ret 8
Function at 0x417d00
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x417f90
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x418011
je 0x418002
cmp eax, 0x80000101
ja 0x417ffb
je 0x418002
cmp eax, 0x80000004
je 0x417fdc
cmp eax, 0x80000005
jne 0x418026
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x418073
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x418073
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call dword [0x269a51c]
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x418073
cmp eax, 0x80000201
jne 0x418026
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x418073
cmp eax, 0x80000401
je 0x41805e
cmp eax, 0x80000501
je 0x418046
cmp eax, 0x80000601
je 0x41802e
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call sub.MSVCRT.dll__ftol
mov dword [esp + 0xc], eax
jmp 0x41806f
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call sub.MSVCRT.dll__ftol
mov dword [esp + 0xc], eax
jmp 0x41806f
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.0041ac80
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call dword [0x269a51c]
add esp, 8
test esi, esi
je 0x41814c
test eax, eax
je 0x41814c
inc eax
push edi
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4180ee
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x418142
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x418137
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x418170
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x418202
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4181f4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4181ec
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4181b5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x418210
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x418290
push edi
call dword [0x269a51c]
add esp, 4
test eax, eax
jbe 0x418290
test esi, esi
je 0x41824e
cmp esi, 0xffffffff
je 0x41824e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x4182d2
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x41827c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x418290
jmp 0x41828b
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x418290
mov ebp, 1
test esi, esi
je 0x4182d2
cmp esi, 0xffffffff
je 0x4182d2
test ebp, ebp
jne 0x418309
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x4182df
call edi
test eax, eax
je 0x4182d2
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x418309
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x4182ba
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x4182d2
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x418309
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x4182ec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x269a51c]
inc eax
push eax
call fcn.00417a80
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret

Function at 0x418370
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x4185e0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4185ed
xor eax, eax
pop esi
ret
push esi
call dword [0x269a51c]
add esp, 4
test eax, eax
jne 0x4185fd
pop esi
ret
cmp eax, 1
jne 0x41860b
cmp byte [esi], 0x5c
jne 0x41860b
xor eax, eax
pop esi
ret
push esi
call fcn.00418390
add esp, 4
test eax, eax
je 0x41861f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x418950
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.0041ac80
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x269a51c]
add esp, 8
test ebx, ebx
je 0x418a94
test eax, eax
je 0x418a94
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4189c2
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x418a81
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x418a4a
cmp eax, 0xea
jne 0x418a6d
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x418a15
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x418a58
cmp eax, 2
jne 0x418a6d
push esi
call dword [0x269a51c]
push eax
push esi
call fcn.0041aed0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x418abd
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x418ac9
mov esi, dword [esp + 0x40]
test esi, esi
je 0x418ac9
push esi
call dword [0x269a51c]
push eax
push esi
call fcn.0041aed0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x419d50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x419d91.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x419d91.2
jmp dword [eax*4 + 0x419e1c]
mov word [esp + 0x48], di
jmp 0x419dca
mov word [esp + 0x48], 2
jmp 0x419dca
mov word [esp + 0x48], 3
jmp 0x419dca
mov word [esp + 0x48], 4
jmp 0x419dca
mov word [esp + 0x48], 7
jmp 0x419dca
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x419e14
cmp dword [esp + 0x70], edi
je 0x419e00
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x41a700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x41a721
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x41a77b
inc edi
cmp edi, esi
jl 0x41a715
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x41a7b0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x41a76a
cmp byte [eax], bl
je 0x41a785
cmp byte [eax + 1], bl
je 0x41a78e
cmp byte [eax + 2], bl
je 0x41a798
cmp byte [eax + 3], bl
je 0x41a7a4
add eax, 4
cmp eax, edi
jb 0x41a741
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x41bc00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x41bc0c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x41bc9f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x41bc69
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.0041bcb0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x41bc3e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x41bcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x41bdcd
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x41bd22
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x41bd4e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.0041bcb0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x41bd8f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x41bd11
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x41cd90
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x269a6e4]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x269a674]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x41cda3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x41cde4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x269a71c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x41ce16
mov bl, byte [esp + ecx + 0x4c]
jmp 0x41ce1a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x41ce0b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x41ce38
mov bl, byte [esp + ecx + 0x4c]
jmp 0x41ce3c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x41ce2d
xor ecx, ecx
mov eax, 0x269a684
xor ebx, ebx
mov bl, byte [ecx + 0x269a72c]
cmp byte [esp + ebx + 0x14], 0
je 0x41ce67
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x269a744]
cmp byte [esp + ebx + 0x14], 0
je 0x41ce7e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x269a6e4
jl 0x41ce4e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x41cdd7
lea edx, [esp + 0x84]
push edx
call fcn.0041cec0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret