joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce80
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
call fcn.004447f0
test al, al
je 0x40d07e
call dword [sym.imp.USER32.dll_GetInputState]
mov esi, eax
call fcn.0043bda0
test al, al
je 0x40d079
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0x7e054845
mov dword [esp + 8], 0xaaa01ea2
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40cf06
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d090
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40cee0
mov dword [esp + 4], 0x620bdd9d
mov dword [esp + 8], 0x5003a68f
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40cf56
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d110
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40cf30
test esi, esi
je 0x40d006
mov dword [esp + 4], 0x717e7f9f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x40cfb6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d190
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x40cf90
mov dword [esp + 4], 0x9b09b3d9
mov dword [esp + 8], 0x41547886
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x40d006
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d210
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x40cfe0
mov dword [esp + 4], 0x3e3f3839
mov dword [esp + 8], 0x22233c3d
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40d066
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0040d290
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40d040
call fcn.0040e9c0
test al, al
je 0x40d079
call fcn.00411c70
call fcn.0040ffb0
call fcn.00445770
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov ebx, dword [ecx + 0x60]
mov dword [esp + 4], 0x362f2d
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 3
ja 0x40d5fb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 4]
push dword [esp + 0x14]
push eax
call fcn.0040e370
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 4], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 4
jb 0x40d5d0
mov dword [esp + 8], 0x2e24201e
mov word [esp + 0xc], 0x332a
mov dword [esp + 0xe], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0xa
ja 0x40d65b
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 8]
push dword [esp + 0x14]
push eax
call fcn.0040e300
add esp, 8
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 8], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0xb
jb 0x40d630
mov edi, dword [esp + 0x68]
mov dword [esp + 0x14], 0x625c28d7
mov dword [esp + 0x18], 0x665a3430
mov dword [esp + 0x1c], 0x55626c37
mov dword [esp + 0x20], 0x6e695261
mov dword [esp + 0x24], 0x3e717d62
mov dword [esp + 0x28], 0x7c2b111b
mov dword [esp + 0x2c], 0x7379777e
mov dword [esp + 0x30], 0x7a223474
mov dword [esp + 0x34], 0x4c4b4b71
mov dword [esp + 0x38], 0x4c414b47
mov dword [esp + 0x3c], 0x4b321d4e
mov dword [esp + 0x40], 0x6454141
mov dword [esp + 0x44], 0x6e5e6c70
mov dword [esp + 0x48], 0x6a5c2f05
mov dword [esp + 0x4c], 0x2701585f
mov byte [esp + 0x50], 0xc0
mov dword [esp + 0x51], 0
mov dword [esp + 0x54], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x40d726
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x14]
push dword [esp]
push eax
call fcn.0040e290
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x14], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x40d700
mov ecx, dword [esp + 0x6c]
add edi, ebx
movzx edx, byte [esp + 0x14]
mov eax, edi
test dl, dl
je 0x40d74b
lea ebx, [esp + 0x15]
mov eax, edi
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d740
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d76b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d760
mov ecx, dword [esp + 0x70]
mov byte [eax], 0
movzx edx, byte [esp + 8]
test dl, dl
je 0x40d78b
lea ebx, [esp + 9]
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ebx]
inc ebx
test dl, dl
jne 0x40d780
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d7ab
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d7a0
mov byte [eax], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x40d7cb
lea edx, [esp + 5]
nop
nop
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40d7c0
mov byte [eax], 0
sub eax, edi
add dword [esi + 0x60], eax
add esp, 0x58
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x40f870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x10c], 0xffffffff
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0x453bec]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0x40f951
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44ebe0]
Function at 0x4278e0
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
mov esi, dword [0x454f24]
mov dword [esp + 0x14], 0x41b2476b
mov dword [esp + 0x18], 0x4daf43d1
mov dword [esp + 0x1c], 0x49da4faf
mov dword [esp + 0x20], 0x75da4b8b
mov dword [esp + 0x24], 0x71ba77e4
mov dword [esp + 0x28], 0x7dee7393
mov dword [esp + 0x2c], 0x79517f9f
mov word [esp + 0x30], 0x7b78
mov dword [esp + 0x32], 0
mov word [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x23
ja 0x42797b
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042a140
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x24
jb 0x427950
lea edi, [esp + 0x64]
lea eax, [esp + 0x14]
push edi
push 0
push 0
push 0xe
push eax
push 0
call esi
mov ebx, dword [esp + 0x64]
test ebx, ebx
jns 0x42799e
mov eax, 0xffffffff
jmp 0x4279a1
lea eax, [ebx + ebx]
push eax
call fcn.0040c7b0
add esp, 4
mov esi, eax
mov ebp, dword [0x454f24]
mov dword [esp + 0x14], 0x9326917d
mov dword [esp + 0x18], 0x9f3d9d0b
mov dword [esp + 0x1c], 0x9b0e9939
mov dword [esp + 0x20], 0x87168545
mov dword [esp + 0x24], 0x834e8110
mov dword [esp + 0x28], 0x8f128d2d
mov dword [esp + 0x2c], 0x8b678929
mov word [esp + 0x30], 0x7574
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x427a3b
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042a1c0
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x427a10
push edi
push ebx
push esi
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebp
mov eax, dword [esp + 0x64]
mov ecx, eax
add ecx, 9
jns 0x427a5b
mov eax, 0xffffffff
jmp 0x427a62
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c7b0
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0x7f0e7904
mov dword [esp + 0x18], 0x63057d1d
mov dword [esp + 0x1c], 0x6707610f
mov dword [esp + 0x20], 0x6b0f650f
mov dword [esp + 0x24], 0x6f6e69ff
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x13
ja 0x427adb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042a250
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x14
jb 0x427ab0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x427b01
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427af0
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x427b31
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x427b20
mov ebx, dword [esp + 0x84]
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00449460
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x450954]
Function at 0x437de0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x437f3d
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x437e41
jmp 0x437f37
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040c8e0
mov ebp, eax
cmp ebp, 0
setne al
jmp 0x437e61
xor ebx, ebx
test al, 1
jne 0x437e6c
jmp 0x437f2b
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0x87
mov byte [esp + 0x19], 0xbd
mov byte [esp + 0x1a], 0xbf
mov byte [esp + 0x1b], 0xa7
mov byte [esp + 0x1c], 0xba
mov byte [esp + 0x1d], 0xa6
mov byte [esp + 0x1e], 0xb3
mov byte [esp + 0x1f], 0xad
mov byte [esp + 0x20], 0xbc
mov byte [esp + 0x21], 0x63
mov byte [esp + 0x22], 0xa2
mov byte [esp + 0x23], 0xa7
mov byte [esp + 0x24], 0xa0
mov byte [esp + 0x25], 0x5d
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x13
jne 0x437ebf
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x13
jae 0x437f09
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043bc90
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x437ed4
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d520
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x437f2b
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
xor edi, edi
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec edi
cmp byte [eax], 0
lea eax, [eax + 1]
jne 0x446ca0
mov dword [esp + 4], 0x968a9461
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x446cf6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00446e90
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x446cd0
cmp edi, 0xffffffff
je 0x446d16
mov ebx, edi
not ebx
mov ecx, dword [esp + 4]
mov edx, ecx
not edx
test bl, 1
jne 0x446d1a
cmp edi, 0xfffffffe
jne 0x446d46
jmp 0x446d93
mov eax, ebp
jmp 0x446d93
movsx eax, byte [esi]
xor eax, ebp
mov ebx, eax
not ebx
and ebx, ecx
mov ebp, eax
and ebp, edx
imul ebp, ebx
mov ebx, eax
and ebx, ecx
or eax, ecx
imul eax, ebx
mov ebx, 0xfffffffe
sub ebx, edi
inc esi
add eax, ebp
mov ebp, eax
cmp edi, 0xfffffffe
je 0x446d93
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movsx edi, byte [esi]
xor edi, eax
mov eax, edi
not eax
and eax, ecx
mov ebp, edi
and ebp, edx
imul ebp, eax
mov eax, edi
and eax, ecx
or edi, ecx
imul edi, eax
add edi, ebp
movsx eax, byte [esi + 1]
xor eax, edi
mov edi, eax
not edi
and edi, ecx
mov ebp, eax
and ebp, edx
imul ebp, edi
mov edi, eax
and edi, ecx
or eax, ecx
imul eax, edi
add eax, ebp
add esi, 2
add ebx, 0xfffffffe
jne 0x446d50
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6ed90b83
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7d524023
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x45b5a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b7d68
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.00455de0
test eax, eax
je 0x45b6a8
lea ecx, [esp + 0xc]
call fcn.00433870
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00455de0
mov ecx, eax
call fcn.00453500
test eax, eax
je 0x45b68f
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x45b68f
push eax
push 0x42
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x45b68f
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00433a70
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x45b671
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp 0x45b68f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0xa6ec30]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0xa3fae0
call fcn.00433a70
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x45e4e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b7ff8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x45e519
inc eax
mov dword [esi + 0x10], eax
jmp 0x45e62c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x45e52d
mov eax, 0xffffffc7
jmp 0x45e62e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x45e53e
cmp dword [esi + 8], eax
jne 0x45e52d
cmp dword [esi + 8], eax
jne 0x45e557
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x45e557
mov eax, 0xffffffc7
jmp 0x45e62e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x45e56b
push eax
mov ecx, ebx
call fcn.0045dd10
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00433870
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x45e59c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00433890
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0045d480
test eax, eax
mov dword [esp + 0x38], eax
je 0x45e5cf
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xa3fb10
call fcn.00433a70
mov eax, dword [esp + 0x38]
jmp 0x45e62e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0045e340
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x45e613
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0045e360
mov esi, eax
test esi, esi
jne 0x45e643
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0045e340
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x45e5e5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xa3fb10
call fcn.00433a70
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xa3fb10
call fcn.00433a70
mov eax, esi
jmp 0x45e62e

Function at 0x462fe0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x463040
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x463040
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x463040
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x463040
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x463080
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ecx
ret
Function at 0x403070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x4030ce
mov eax, esi
je 0x40309a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0xb], 0
js 0x4030e8
mov word [esi], 0
mov byte [esi + 0xb], 0
cmp esi, edi
je 0x4030b8
cmp byte [esi + 0xb], 0
movzx eax, byte [edi + 0xb]
js 0x4030f8
test al, al
jns 0x4030d8
mov ecx, esi
push dword [edi + 4]
push dword [edi]
call fcn.004106c0
cmp byte [edi + 0xb], 0
jns 0x4030c8
push dword [edi]
call fcn.00411ae0
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
cmp dword [esi + 4], 0
je 0x40309a
mov eax, dword [esi]
jmp 0x403084
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [edi]
movsd qword [esi], xmm0
jmp 0x4030b8
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
jmp 0x40309a
mov edx, edi
test al, al
jns 0x403103
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov ecx, esi
push eax
push edx
call fcn.004105f0
jmp 0x4030b8
Function at 0x408d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x40f9f0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x408da1
movzx edi, byte [ebp + 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [0x451b2c]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x2c]
push esi
call fcn.00410fa0
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x457ef8
call fcn.004115d0
mov esi, eax
mov edi, dword [ebp - 0x2c]
cmp edi, 0x457e08
je 0x408df4
xor eax, eax
dec eax
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x408df4
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, ebx
call dword [0x451b2c]
mov ecx, edi
call ebx
xor eax, eax
dec eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov ecx, dword [esi]
mov dl, byte [ebp + 0x18]
xor dl, 1
movzx edx, dl
mov edi, dword [ecx + edx*4 + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, edi
call dword [0x451b2c]
mov ecx, esi
lea eax, [ebp - 0x2c]
push eax
call edi
movzx eax, byte [ebp - 0x21]
mov edx, eax
test al, al
jns 0x408e2f
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
test edx, edx
je 0x408ec8
test al, al
lea eax, [ebp - 0x2c]
cmovns ecx, eax
mov dword [ebp - 0x30], ecx
jmp 0x408ea5
movzx edi, al
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [0x451b2c]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push edi
call esi
xor ecx, ecx
cmp eax, 0xffffffff
je 0x408e77
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
jmp 0x408e83
mov dword [ebp - 0x20], 0
movzx eax, byte [ebp - 0x21]
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x2c]
mov esi, eax
test al, al
jns 0x408e98
mov esi, dword [ebp - 0x28]
mov edx, ecx
add edx, esi
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, edx
je 0x408ec8
cmp dword [ebp - 0x20], 0
je 0x408e7c
mov eax, dword [ebp - 0x30]
mov al, byte [eax]
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x408e47
lea edx, [ecx + 1]
mov esi, dword [ebp - 0x20]
mov dword [esi + 0x18], edx
mov byte [ecx], al
jmp 0x408e83
shr al, 7
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
mov dword [edx], esi
test al, al
je 0x408ee0
push ecx
call fcn.00411ae0
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x408d97