joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x633c2b
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x71de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x84c], eax
call fcn.0041cf30
lea eax, [ebp - 0x84c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x854]
lea ebx, [edi + 0xc]
push eax
mov ecx, ebx
call fcn.0041cd00
mov eax, dword [ebp - 0x854]
cmp dword [eax + 0x14], 0
jne 0x423b9c
imul eax, dword [ebp - 0x84c], 0x41c
sub esp, 0x41c
mov ecx, esp
add eax, dword [edi + 0x5d44]
push eax
call fcn.0041cea0
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp - 0x848]
lea ecx, [ebp - 0x848]
call dword [eax]
push 0
push 3
lea eax, [ebp - 0x848]
mov ecx, edi
push eax
call fcn.00420b60
mov esi, eax
mov edx, 0x800
mov ecx, 1
cmp esi, edx
jle 0x423b5c
mov ebx, ecx
nop word [eax + eax]
mov eax, dword [edi + 0x7c38]
xor byte [eax + edx], cl
inc ecx
cmp ecx, 0x80
cmove ecx, ebx
add edx, ecx
cmp edx, esi
jl 0x423b40
lea ebx, [edi + 0xc]
push esi
push dword [edi + 0x7c38]
call fcn.0041f3e0
add esp, 8
lea ecx, [ebp - 0x854]
mov esi, eax
lea eax, [ebp - 0x84c]
push eax
push ecx
mov ecx, ebx
call fcn.0041cd00
mov edx, dword [ebp - 0x854]
mov ecx, edi
mov dword [edx + 0x14], esi
mov dword [edi + 0x7c38], 0
call fcn.004260f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e0710
mov esp, ebp
pop ebp
ret 4
Function at 0x45c1a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63513f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x71de04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00428eb0
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0xc]
call fcn.00428eb0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.00428eb0
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x24]
call fcn.0045b770
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x30]
call fcn.0045b770
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x3c]
call fcn.0045b770
lea eax, [esi + 0x48]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x48]
call fcn.0045b690
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x467830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push 0x6b3c6d
mov esi, ecx
call fcn.0046e210
mov eax, dword [esi + 0x3c]
mov ecx, esi
push 0x6b3c6d
mov eax, dword [eax]
mov dword [esi + 0xca98], eax
call fcn.0046e6c0
mov eax, dword [esi + 0x24]
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0xcfa4], eax
mov dword [esi + 0x21cc], 1
pop esi
jmp fcn.0047a250
Function at 0x474c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov byte [ebp - 1], 0
call fcn.005ee093
add esp, 4
test eax, eax
jne 0x474ca9
nop dword [eax]
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.005ef913
mov ecx, dword [esi + 8]
add esp, 0x10
mov eax, dword [esi + 4]
inc ecx
cmp eax, ecx
jge 0x474c7c
nop dword [eax]
add eax, 0x100
cmp eax, ecx
jl 0x474c70
mov dword [esi + 4], eax
push dword [esi + 4]
push dword [esi]
call fcn.005ee0be
push 1
lea ecx, [ebp - 1]
mov dword [esi], eax
push ecx
mov ecx, dword [esi + 8]
add ecx, eax
push ecx
call fcn.004a02f4
inc dword [esi + 8]
push edi
call fcn.005ee093
add esp, 0x18
test eax, eax
je 0x474c50
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x474cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov byte [ebp - 1], 0
call fcn.005ee093
add esp, 4
test eax, eax
jne 0x474d39
nop dword [eax]
push edi
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.005ef913
mov ecx, dword [esi + 8]
add esp, 0x10
mov eax, dword [esi + 4]
inc ecx
cmp eax, ecx
jge 0x474d0c
nop dword [eax]
add eax, 0xea60
cmp eax, ecx
jl 0x474d00
mov dword [esi + 4], eax
push dword [esi + 4]
push dword [esi]
call fcn.005ee0be
push 1
lea ecx, [ebp - 1]
mov dword [esi], eax
push ecx
mov ecx, dword [esi + 8]
add ecx, eax
push ecx
call fcn.004a02f4
inc dword [esi + 8]
push edi
call fcn.005ee093
add esp, 0x18
test eax, eax
je 0x474ce0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x479a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636128
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x71de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov esi, dword [edi + 0xf570]
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
je 0x479c7f
cmp dword [edi + 0xf574], 1
jne 0x479c7f
mov eax, dword [edi + 0xf764]
lea ecx, [esi + esi*2]
mov eax, dword [eax + 0x30]
lea eax, [eax + ecx*8]
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x479aff
push 0xffffffffffffffff
push 0
push eax
call fcn.00415600
cmp dword [edi + 0xf66c], 0
jne 0x479b8e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x662604
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.005ef4e8
mov eax, dword [ebp - 0x2c]
add esp, 0xc
test eax, eax
je 0x479c2d
push eax
push dword [edi + 0x119c]
push 1
push dword [edi + 0x1194]
call fcn.005efbfb
push dword [ebp - 0x2c]
call fcn.005ef6c7
add esp, 0x14
mov ecx, edi
push 1
push dword [edi + 0xf158]
call fcn.0047bd90
cmp dword [edi + 0xd514], 8
lea eax, [edi + 0xd500]
jb 0x479b73
mov eax, dword [eax]
push 0x40
push eax
push 0x66274c
push dword [edi + 0xd374]
call dword [0x646924]
mov ecx, edi
call fcn.00479a20
cmp dword [edi + 0xf66c], 1
jne 0x479c86
mov eax, dword [edi + 0xf764]
mov eax, dword [eax + 0x3c]
cmp dword [eax + esi*4], 0
je 0x479c7b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x66260c
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.005ef4e8
add esp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x479c56
push dword [edi + 0x1198]
push 0
push dword [edi + 0x1194]
call fcn.004a0318
add esp, 0xc
mov dword [edi + 0x119c], 0
lea ecx, [edi + 0x1194]
push dword [ebp - 0x2c]
call fcn.00474cc0
push dword [ebp - 0x2c]
call fcn.005ef6c7
add esp, 4
mov ecx, edi
push 1
push dword [edi + 0xf158]
call fcn.0047bd90
mov ecx, edi
call fcn.00479a20
mov ecx, edi
call fcn.00471a40
jmp 0x479c86
cmp dword [edi + 0xd514], 8
lea eax, [edi + 0xd500]
jb 0x479c3e
mov eax, dword [eax]
push 0x10
push eax
push 0x662760
push dword [edi + 0xd374]
call dword [0x646924]
xor esi, esi
jmp 0x479c8b
cmp dword [edi + 0xd514], 8
lea eax, [edi + 0xd500]
jb 0x479c67
mov eax, dword [eax]
push 0x10
push eax
push 0x662778
push dword [edi + 0xd374]
call dword [0x646924]
xor esi, esi
jmp 0x479c8b
mov ecx, edi
call fcn.00479a20
mov esi, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x479ca0
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00415820
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e0710
mov esp, ebp
pop ebp
ret
Function at 0x483ef0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x483fdb
cmp eax, 0x271
jne 0x483f2b
push 0
call fcn.005f0472
push eax
call fcn.005f04d5
add esp, 8
call fcn.005f04b4
push eax
mov ecx, esi
call fcn.00484150
xor edx, edx
nop dword [eax]
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x70a878]
xor ecx, dword [esi + edx*4 + 0x634]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0xe3
jl 0x483f30
cmp edx, 0x26f
jge 0x483fa1
nop dword [eax]
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x70a878]
xor ecx, dword [esi + edx*4 - 0x38c]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0x26f
jl 0x483f70
mov ecx, dword [esi]
xor ecx, dword [esi + 0x9bc]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x70a878]
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi + 0x9bc], eax
mov dword [esi + 0x9c0], 0
mov eax, dword [esi + 0x9c0]
mov edx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov ecx, edx
and ecx, 0xffffdf8c
shl ecx, 0xf
xor edx, ecx
mov ecx, edx
shr ecx, 0x12
xor edx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
pop esi
cmp ecx, edx
jae 0x484022
xor edx, edx
div ecx
mov eax, edx
pop ebp
ret 4
Function at 0x49d480
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63706c
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x71de04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
mov dword [esi], vtable.CMemAllocator.0
mov dword [eax], vtable.CMemAllocator.1.0
call fcn.0049dc50
mov ecx, esi
call fcn.0049ef30
mov eax, dword [esi + 0x30]
mov byte [ebp - 4], 1
test eax, eax
je 0x49d4da
push eax
call dword [0x64626c]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x49d4e7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [esi + 0x10]
push eax
call dword [0x646260]
lea ecx, [esi + 4]
call fcn.0049cd80
test byte [ebp + 8], 1
je 0x49d50a
push 0x64
push esi
call fcn.005e15bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a4520
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
movaps xmm5, xmmword [ecx]
movaps xmm6, xmm1
movaps xmm1, xmmword [ecx + 0x20]
movaps xmm3, xmm5
movaps xmm4, xmmword [ecx + 0x30]
movaps xmmword [ebp - 0x90], xmm1
xorps xmm1, xmm1
movaps xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [ecx + 0x10]
shufps xmm3, xmm5, 0xee
movaps xmm2, xmm0
cmpeqps xmm1, xmm3
push esi
push edi
mov edi, edx
shufps xmm2, xmm0, 0xee
movaps xmmword [ebp - 0x70], xmm0
movaps xmm0, xmmword [0x646e80]
andps xmm0, xmm1
movaps xmmword [ebp - 0x80], xmm4
andnps xmm1, xmm3
movss xmm7, dword [ecx + 0x38]
orps xmm0, xmm1
mov ecx, dword [ecx + 0x44]
movaps xmmword [ebp - 0x50], xmm5
mov dword [ebp - 4], ecx
movaps xmmword [ebp - 0x30], xmm3
movaps xmmword [ebp - 0x20], xmm2
divps xmm4, xmm0
movaps xmmword [ebp - 0x40], xmm4
test cl, 4
je 0x4a45bd
mulps xmm5, xmm6
mulps xmm3, xmm6
movaps xmmword [ebp - 0x50], xmm5
movaps xmmword [ebp - 0x30], xmm3
jmp 0x4a45c4
mulps xmm4, xmm6
movaps xmmword [ebp - 0x40], xmm4
test cl, 8
jne 0x4a45d1
mulps xmm2, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x20], xmm2
ucomiss xmm7, dword [0x6489e0]
lahf
test ah, 0x44
jnp 0x4a4628
push ecx
movss dword [esp], xmm7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004438f0
movss xmm0, dword [ebp - 8]
xorps xmm6, xmm6
movaps xmm3, xmmword [ebp - 0x30]
movaps xmm2, xmm0
movss xmm0, dword [ebp - 0xc]
subps xmm6, xmm2
movaps xmm4, xmmword [ebp - 0x40]
movaps xmm1, xmm0
movaps xmm5, xmmword [ebp - 0x50]
movaps xmm7, xmm1
mov ecx, dword [ebp - 4]
add esp, 0xc
unpcklps xmm7, xmm2
movaps xmm2, xmmword [ebp - 0x20]
unpcklps xmm6, xmm1
jmp 0x4a4636
movaps xmm7, xmmword [0x646de0]
movaps xmm6, xmmword [0x646df0]
and ecx, 3
mov esi, 0x71c980
mov dword [ebp - 4], ecx
xor edx, edx
lea ecx, [edi + 0xc]
mov edi, dword [ebp - 4]
nop dword [eax]
movaps xmm1, xmmword [esi]
mov eax, edx
subps xmm1, xmm4
xor eax, edi
shl eax, 4
inc edx
add eax, 0x71c980
add esi, 0x10
mulps xmm1, xmm2
movaps xmm0, xmm1
shufps xmm0, xmm1, 0
mulps xmm0, xmm7
shufps xmm1, xmm1, 0x55
mulps xmm1, xmm6
addps xmm0, xmmword [ebp - 0x70]
addps xmm0, xmm1
shufps xmm0, xmmword [ebp - 0x80], 0xb4
movups xmmword [ecx - 0xc], xmm0
movaps xmm0, xmmword [ebp - 0x90]
movups xmmword [ecx], xmm0
movaps xmm0, xmmword [eax]
mulps xmm0, xmm3
addps xmm0, xmm5
movss dword [ecx + 0x10], xmm0
shufps xmm0, xmm0, 0x55
movss dword [ecx + 0x14], xmm0
add ecx, 0x24
cmp edx, 4
jb 0x4a4650
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x5f9cdc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005f9b5b
Function at 0x61c840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x61c84c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.0061c860

Function at 0x61fd20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x61fd45
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x61fd5d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x61fd8c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x61fdce
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x61fea2
sub edx, 0x10000
js 0x61fea2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x61fdb4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x61fdb4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x61fe25
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x61fe22
add edx, 8
jne 0x61fe09
jmp 0x61fe93
add edx, 4
test eax, 0xffff
jne 0x61fe32
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x61fe93
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x61fe66
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x61fdb4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x61fea2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x61fdb4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x61feb3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x475aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0
call fcn.0040b810
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
call fcn.0040b810
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp + 0xc]
ja 0x405bff
mov edx, 5
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx]
mov ecx, dword [edx + 4]
mov edx, dword [eax + 0x10]
call edx
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0xe]
test eax, eax
jne 0x405b41
mov eax, 0x80008001
jmp 0x405c04
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x24]
jbe 0x405b4f
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax]
mov ecx, dword [ecx + 4]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0
jmp 0x405b7f
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x18]
jae 0x405bfa
mov eax, dword [ebp - 0x20]
mov cl, byte [ebp + eax - 0xc]
mov byte [ebp - 0xd], cl
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
je 0x405ba5
cmp dword [ebp - 0x2c], 1
je 0x405bc3
jmp 0x405bd7
movzx eax, byte [ebp - 0xd]
sar eax, 1
mov byte [ebp - 0xf], al
movzx ecx, byte [ebp - 0xf]
movzx edx, byte [ebp - 0xd]
xor ecx, edx
and ecx, 1
je 0x405bbf
jmp 0x405bc1
jmp 0x405b76
jmp 0x405bd7
movzx eax, byte [ebp - 0xd]
and eax, 1
je 0x405bce
jmp 0x405bd7
mov dword [ebp - 0x14], 0
jmp 0x405b76
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [ecx], dl
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 5
jne 0x405bf5
xor eax, eax
jmp 0x405c04
jmp 0x405b76
jmp 0x405ae8
mov eax, 0x80008002
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041de32
mov esp, ebp
pop ebp
ret 8
Function at 0x40ae10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x38]
call eax
movzx ecx, al
test ecx, ecx
jne 0x40ae42
mov eax, 0xfffffffe
jmp 0x40aeb9
cmp dword [ebp + 8], 0
je 0x40ae4e
cmp dword [ebp + 0xc], 0
jne 0x40ae52
xor eax, eax
jmp 0x40aeb9
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x40ae7e
cmp dword [ebp - 0xc], 0
jbe 0x40ae7e
push 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov ecx, dword [ebp - 4]
add ecx, 0x38
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40aeb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40aeb6
mov dword [ebp - 8], 0xfffffffe
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x40aec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x38]
call eax
movzx ecx, al
test ecx, ecx
jne 0x40aee1
xor eax, eax
jmp 0x40af57
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40af54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40af4d
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40af4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
je 0x40af4b
mov dword [ebp - 8], 0
jmp 0x40af54
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x40b550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040b520
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
call fcn.0043dfaf
add esp, 0x18
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
call fcn.00402470
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x40b8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.0040b860
add esp, 8
mov dword [ebp + 8], eax
xor ecx, ecx
mov word [ebp - 4], cx
jmp 0x40b8eb
mov dx, word [ebp - 4]
add dx, 1
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
cmp eax, 0x100
jge 0x40b949
movzx ecx, word [ebp - 4]
mov dword [ebp - 0xc], ecx
xor edx, edx
mov word [ebp - 8], dx
jmp 0x40b911
mov ax, word [ebp - 8]
add ax, 1
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
cmp ecx, 8
jge 0x40b939
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x40b92f
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x40b937
mov ecx, dword [ebp - 0xc]
shr ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40b905
movzx edx, word [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [edx*4 + 0x4783f0], eax
jmp 0x40b8df
mov esp, ebp
pop ebp
ret
Function at 0x413b70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x475aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push ebx
push esi
lea esi, [ebp - 0x118]
mov dword [ebp - 0x120], ecx
push esi
push eax
push 0
push edx
push dword [ecx]
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x118], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x110]
test esi, esi
jne 0x413c00
xor esi, esi
test eax, eax
je 0x413bf4
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x110], eax
push edi
test esi, esi
jne 0x413cc1
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [ebp - 0x128]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x100
push ecx
lea ecx, [ebp - 0x104]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x413c87
nop dword [eax]
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x110]
call fcn.00413b70
mov esi, eax
test esi, esi
jne 0x413cbb
lea eax, [ebp - 0x128]
mov dword [ebp - 0x114], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x110]
call edi
test eax, eax
je 0x413c40
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x413c9e
push eax
call ebx
mov dword [ebp - 0x110], 0
push dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x10c], 0
call fcn.0040e2a0
mov esi, eax
mov eax, dword [ebp - 0x110]
pop edi
test eax, eax
je 0x413cc9
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041de32
mov esp, ebp
pop ebp
ret 4