joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421acc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004218b4
dec esi
jne 0x421aee
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x422c30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4f188c
cmp dword [edi], 0
jne 0x422cac
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4f1888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4e6548
mov ecx, 2
call fcn.00402b30
mov edx, 0x422c08
lea eax, [esi + 5]
call fcn.00422c28
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00422c28
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x422c81
mov dword [0x4f1888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x423f8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404e74
mov eax, dword [ebp - 8]
call fcn.00404e74
xor eax, eax
push ebp
push 0x424089
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x423fdd
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x423fdd
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00404f24
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00404e84
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x42406e
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404e84
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x42405e
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00405010
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00404e84
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push ebx
mov eax, dword [ebx]
call fcn.00404c84
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404ee4
jmp 0x424065
mov eax, ebx
call fcn.004049a8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424090
lea eax, [ebp - 8]
mov edx, 2
call fcn.004049cc
ret
Function at 0x424c34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e74
xor eax, eax
push ebp
push 0x424d1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c84
dec eax
jle 0x424c9d
mov edx, dword [ebp - 4]
mov eax, 0x424d34
call fcn.00404fc8
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c84
dec eax
cmp ebx, eax
jne 0x424c9d
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c84
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404ee4
mov eax, dword [ebp - 4]
call fcn.00404c84
mov ebx, eax
test ebx, ebx
jle 0x424cd4
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
call fcn.00404edc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 8]
dec ebx
jne 0x424cb2
mov eax, dword [ebp - 4]
call fcn.00404c84
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [ebp - 8], 0
jle 0x424d08
lea eax, [ebp - 4]
call fcn.00404edc
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424d25
lea eax, [ebp - 4]
call fcn.004049a8
ret

Function at 0x425060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edx, [ebp - 4]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405010
cmp dword [ebp - 4], 0
jle 0x42509d
mov eax, ebx
call fcn.00404edc
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebx]
call fcn.00404c84
mov esi, eax
test esi, esi
jle 0x4250d1
mov dword [ebp - 4], 1
mov eax, ebx
call fcn.00404edc
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov edi, dword [ebp - 4]
mov cl, byte [ecx + edi - 1]
xor cl, 0x62
mov byte [eax + edx - 1], cl
inc dword [ebp - 4]
dec esi
jne 0x4250b1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42611c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00402b30
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4261cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00404e74
xor eax, eax
push ebp
push 0x4263c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004260c0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004260c0
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x42623d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, 0x4263e0
mov dl, 1
mov eax, dword [0x425f88]
call fcn.0040d6f4
call fcn.00404324
jmp 0x426286
cmp dword [ebp - 4], 0x7fffffff
jbe 0x426286
mov eax, dword [0x4f002c]
cmp dword [eax], 2
je 0x426286
mov eax, dword [ebp - 4]
call fcn.00405fe8
lea edx, [ebp - 0x20]
call fcn.0042619c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, 0x426410
mov dl, 1
mov eax, dword [0x42603c]
call fcn.0040d6f4
call fcn.00404324
xor edx, edx
push ebp
push 0x426377
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x43
call fcn.00402858
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0x2d
lea eax, [ebx + 0x16]
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [ebx + 0x16]
mov byte [eax], 0x50
mov dword [eax + 1], 0x424448b
mov byte [eax + 5], 0xa3
lea edx, [ebx + 8]
mov dword [eax + 6], edx
mov byte [eax + 0xa], 0x58
mov byte [eax + 0xb], 0x83
mov word [eax + 0xc], 0x4c4
mov byte [eax + 0xe], 0x68
mov dword [eax + 0xf], ebx
mov byte [eax + 0x13], 0xe8
mov edx, fcn.0042617c
lea ecx, [ebx + 0x29]
sub edx, ecx
sub edx, 5
mov dword [eax + 0x14], edx
mov byte [eax + 0x18], 0xe8
lea edx, [ebx + 0x2e]
mov ecx, dword [ebp - 4]
sub ecx, edx
sub ecx, 5
mov dword [eax + 0x19], ecx
mov byte [eax + 0x1d], 0x68
mov dword [eax + 0x1e], ebx
mov byte [eax + 0x22], 0xe8
mov edx, fcn.0042615c
lea ecx, [ebx + 0x38]
sub edx, ecx
sub edx, 5
mov dword [eax + 0x23], edx
mov word [eax + 0x27], 0x25ff
lea edx, [ebx + 8]
mov dword [eax + 0x29], edx
lea eax, [ebx + 0x16]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
lea edx, [ebx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, 5
call fcn.00402b30
mov edx, ebx
mov eax, dword [0x4f18c4]
call fcn.0041a6fc
mov byte [ebx + 0x11], 0xe9
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
sub eax, 5
mov dword [ebx + 0x12], eax
push ebx
call fcn.0042615c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4263a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4263cc
lea eax, [ebp - 0x20]
call fcn.004049a8
lea eax, [ebp - 0xc]
call fcn.004049a8
ret
Function at 0x4269b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x426a25
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 7]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x2c]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404c18
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409628
push 2
lea edx, [ebp - 0x27]
push edx
push eax
call sub.gdi32.dll_TranslateCharsetInfo
mov ebx, dword [ebp - 0x27]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426a2c
lea eax, [ebp - 0x2c]
call fcn.004049a8
ret

Function at 0x426c58
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x426cc4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x2c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov esi, eax
test esi, esi
je 0x426cae
push 0
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0040ce80
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 8]
mov edx, 0x426cdc
mov eax, ebx
call fcn.00426df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426ccb
lea eax, [ebp - 0xc]
call fcn.004049a8
ret

Function at 0x426d8c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, edx
mov eax, ebx
call fcn.00404e84
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp + 4], eax
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 4
call fcn.00403340
cmp dword [esp + 4], 0
je 0x426dde
mov eax, dword [esp + 4]
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 8], cl
mov cl, byte [edx + 1]
mov byte [esp + 9], cl
mov cl, byte [edx + 2]
mov byte [esp + 0xa], cl
mov al, byte [edx + 3]
mov byte [esp + 0xb], al
mov eax, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop ebx
ret
Function at 0x427030
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4271a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x24], 0
jne 0x427185
push 0
mov eax, dword [ebx + 0x1c]
push eax
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x28], esi
inc esi
jne 0x42709a
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x10]
call fcn.0040ce80
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x4271b8
mov eax, ebx
call fcn.00426df0
mov word [ebx + 4], 2
mov edx, dword [ebx + 0x14]
mov eax, ebx
call fcn.00426d8c
mov dword [ebx + 8], eax
mov ax, word [ebx + 0x18]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 6], ax
push 0
push 0
push 0
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebx + 4]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x42711c
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x14]
call fcn.0040ce80
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x4271d8
mov eax, ebx
call fcn.00426df0
cmp dword [ebx + 0x28], 0xffffffff
setne al
mov byte [ebx + 0x24], al
lea eax, [ebp - 0x18]
push eax
xor eax, eax
mov al, byte [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
xor eax, eax
mov al, byte [ebx + 9]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebx + 0xa]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebx + 0xb]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
movzx eax, word [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x40]
mov ecx, 4
mov eax, 0x4271f8
call fcn.0040a8ac
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x1bc]
call fcn.004049fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4271a7
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004049cc
ret
Function at 0x42721c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4272b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp byte [ebx + 0x24], 0
je 0x42729b
push 0
mov eax, dword [ebp - 4]
push eax
push edx
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x42729b
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x42729b
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test edi, edi
je 0x42729b
push 0
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.0040ce80
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x4272cc
mov eax, ebx
call fcn.00426df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4272b8
lea eax, [ebp - 0x10]
call fcn.004049a8
ret

Function at 0x4273a8
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42745f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x4273ee
cmp byte [ebx + 0x24], 0
je 0x4273ee
lea eax, [ebp - 4]
push eax
push 0x4004667f
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x427449
cmp byte [ebx + 0x24], 0
je 0x427449
push 0
push esi
push edi
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x427449
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2733
je 0x427449
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test esi, esi
je 0x427449
push 0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040ce80
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x427478
mov eax, ebx
call fcn.00426df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427466
lea eax, [ebp - 0x10]
call fcn.004049a8
ret
Function at 0x427490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x42755b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004049a8
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.004273a8
mov ebx, eax
test ebx, ebx
jbe 0x42753d
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405010
mov eax, dword [ebp - 8]
call fcn.00404c84
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004273a8
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405010
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404c8c
mov eax, dword [ebp - 4]
lea eax, [esi + 0x1bc]
mov edx, dword [ebp - 8]
call fcn.00404c8c
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.004273a8
mov ebx, eax
push 1
call sub.kernel32.dll_Sleep
test ebx, ebx
ja 0x42753d
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x3e8
jbe 0x427516
test ebx, ebx
jne 0x4274b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427562
lea eax, [ebp - 8]
call fcn.004049a8
ret

Function at 0x42756c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.00427490
cmp dword [ebx], 0
jne 0x427592
push 1
call sub.kernel32.dll_Sleep
cmp dword [ebx], 0
jne 0x4275a3
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, dword [esi + 0x20]
jb 0x42757d
cmp dword [ebx], 0
jne 0x4275c5
push 0
xor eax, eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0xb
lea ecx, [esp + 4]
mov edx, 0x4275d4
mov eax, esi
call fcn.00426df0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x428e1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x428e46
cmp dword [ebx + 0x64], 0
jne 0x428e46
cmp dword [ebx + 0x6c], 0
jne 0x428e46
mov edi, esi
jmp 0x428ecd
cmp edi, 0xffffffff
jne 0x428e4e
dec edi
jmp 0x428ecd
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x428ecd
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00428110
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x428e9b
mov cx, word [esp]
sub cx, si
jmp 0x428e9d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x428e84
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x428ec3
mov cx, word [esp]
sub cx, si
jmp 0x428ec5
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x428eac
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x428f2a
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.00428bb8
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x428f15
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x428f2a
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x428e26
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42eae0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x42ec58
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.004095bc
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.004095bc
push dword [ebp - 0x14]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d44
mov eax, dword [ebp - 0xc]
call fcn.00404e84
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x42ec3d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x42eb95
cmp esi, 4
jne 0x42eb95
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x42ec3d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x42ec1f
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.004095bc
push dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.004095bc
push dword [ebp - 0x20]
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404d44
mov eax, dword [ebp - 0x18]
call fcn.00404e84
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ec5f
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004049cc
ret
Function at 0x42f058
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x42f060
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x42f27a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004028e8
mov edx, dword [0x40832c]
call fcn.00403c60
test al, al
jne 0x42f252
call fcn.004028e8
mov edx, dword [0x4082a0]
call fcn.00403c60
test al, al
je 0x42f0b8
call fcn.004028e8
mov edx, dword [eax + 4]
lea eax, [ebp - 0xc]
call fcn.00404a40
jmp 0x42f0c5
lea eax, [ebp - 0xc]
mov edx, 0x42f290
call fcn.00404a40
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x42f2b0
call fcn.0040a8ac
mov eax, dword [ebp - 8]
call fcn.00404e84
push eax
call sub.kernel32.dll_OutputDebugStringA
push 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00424098
lea eax, [ebp - 0x10]
call fcn.004049a8
call fcn.00402908
mov dword [ebp - 0x14], eax
mov edx, 0x20
mov eax, dword [ebp - 0x14]
call fcn.0042efb0
test al, al
je 0x42f175
mov eax, dword [ebp - 0x14]
mov esi, eax
mov ebx, eax
add ebx, 0x20
dec ebx
sub ebx, esi
jb 0x42f175
inc ebx
push dword [ebp - 0x10]
push 0x42f2e0
lea ecx, [ebp - 0x30]
xor eax, eax
mov al, byte [esi]
mov edx, 2
call fcn.00409594
push dword [ebp - 0x30]
push 0x42f2ec
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404d44
inc esi
dec ebx
jne 0x42f143
push 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x42f2f8
call fcn.00424098
call fcn.004245a8
call fcn.0042465c
test al, al
je 0x42f252
push 0x242014
push 0x42f308
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x42f328
call fcn.0040a8ac
mov eax, dword [ebp - 0x34]
call fcn.00404e84
push eax
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x42f252
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.00402cbc
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 4]
mov edx, 0x42f3a0
call fcn.00409e5c
call fcn.004244ec
lea eax, [ebp - 4]
push eax
push 0
mov ecx, 0x42f3b0
mov edx, 0x42f3b0
mov eax, 0x42f3d8
call fcn.00438240
test al, al
jne 0x42f252
push 0x242030
push 0x42f3f0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x42f404
call fcn.0040a8ac
mov eax, dword [ebp - 0x3c]
call fcn.00404e84
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f281
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.004049cc
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004049cc
ret