joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401e2d
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401d74
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401e26
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401d60
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401e6a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401e4a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401e1f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401e1f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401e34
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401d7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]

Function at 0x402330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402385
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40237e
test esi, esi
je 0x40237e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402360
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4025a0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4025d8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4025ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4025da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4025c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x9f0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009f01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9f007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f006a
add dl, dl
jne 0x9f0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f00dc
xor eax, eax
add dl, dl
jne 0x9f0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f017d
add dl, dl
jne 0x9f00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9f00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9f0075
mov eax, 1
add dl, dl
jne 0x9f00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f00e1
sub eax, ebx
mov ebx, 1
jne 0x9f0128
mov ecx, 1
add dl, dl
jne 0x9f010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9f013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f0136
cmp eax, 0x7d00
jae 0x9f016d
cmp eax, 0x500
jb 0x9f0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f0075
cmp eax, 0x7f
ja 0x9f0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9f019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9f0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401d00
Capabilities:
Initialize winhttp library
Receive http response

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x12d0]
mov dword [esp + 0x2d4], eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1278], 0
mov dword [ebp - 0x127c], 0
mov dword [ebp - 0x1280], 0
mov dword [ebp - 0x12d4], 0
mov eax, 1
lea edx, [ebp - 0x12a4]
lea ecx, [ebp - 0x128c]
call fcn.0040f240
call fcn.00410d60
push eax
test eax, eax
jne 0x401ef2
mov eax, 1
lea edx, [ebp - 0x12cc]
lea ecx, [ebp - 0x12b4]
call fcn.0040f240
call fcn.00410d60
push eax
test eax, eax
jne 0x401eb1
push 0
push 0
push 0
push 1
push dword [ebp - 4]
call sub.Winhttp.dll_WinHttpOpen
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x12d4]
mov eax, dword [ebp - 8]
mov dx, 0
call fcn.0040d240
mov eax, dword [ebp - 0x12d4]
lea ecx, [ebp - 0x127c]
lea edx, [ebp - 0x1278]
call fcn.004018d0
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x1278]
call fcn.0040e070
push 0
push 0
mov eax, dword [ebp - 0x1280]
test eax, eax
jne 0x401deb
mov eax, 0x4523a0
push eax
push dword [ebp - 0x10]
call sub.Winhttp.dll_WinHttpConnect
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1280]
mov eax, dword [ebp - 0x127c]
call fcn.0040e070
mov ecx, dword [ebp - 0x1280]
test ecx, ecx
jne 0x401e17
mov ecx, 0x4523a0
mov edx, 0x446318
mov eax, dword [ebp - 0x14]
call fcn.004019b0
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
call sub.Winhttp.dll_WinHttpReceiveResponse
test al, al
je 0x401eed
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1270]
call fcn.004151f0
lea eax, [ebp - 0x1270]
mov edx, 1
call fcn.00413a70
call fcn.00410510
lea eax, [ebp - 0x1274]
push eax
push 0x1000
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x18]
call sub.Winhttp.dll_WinHttpReadData
test al, al
je 0x401eb1
mov eax, dword [ebp - 0x1274]
test eax, eax
jbe 0x401ea8
cmp eax, 0x1000
ja 0x401ea8
mov ecx, dword [ebp - 0x1274]
lea edx, [ebp - 0x101c]
lea eax, [ebp - 0x1270]
call fcn.00413d20
call fcn.00410510
cmp dword [ebp - 0x1274], 1
jae 0x401e5c
call fcn.0040f4c0
lea eax, [ebp - 0x1270]
call fcn.00415200
call fcn.00410510
push dword [ebp - 0x10]
call sub.Winhttp.dll_WinHttpCloseHandle
push dword [ebp - 0x14]
call sub.Winhttp.dll_WinHttpCloseHandle
push dword [ebp - 0x18]
call sub.Winhttp.dll_WinHttpCloseHandle
pop eax
test eax, eax
je 0x401ef2
cmp eax, 2
je 0x401ef2
call fcn.0040f5f0
pop eax
push 2
jmp 0x401eb1
call fcn.0040f4c0
lea eax, [ebp - 0x12d4]
call fcn.004063e0
lea eax, [ebp - 0x1278]
call fcn.004063e0
lea eax, [ebp - 0x127c]
call fcn.004063e0
lea eax, [ebp - 0x1280]
call fcn.0040cfe0
pop eax
test eax, eax
je 0x401f2d
call fcn.0040f5f0
leave
ret
Function at 0x402460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1034]
mov dword [esp + 0x38], eax
push eax
push ebx
push esi
push edi
mov esi, eax
mov ebx, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x1034], 0
mov eax, 1
lea edx, [ebp - 0x102c]
lea ecx, [ebp - 0x1014]
call fcn.0040f240
call fcn.00410d60
push eax
test eax, eax
jne 0x40257d
lea eax, [ebp - 4]
push eax
call fcn.00402440
or eax, 0x20019
push eax
push 0
mov eax, ebx
test ebx, ebx
jne 0x4024cb
mov eax, 0x4523a0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
lea ebx, [ebp - 0x1008]
push 0
push 0
push ebx
push 0
mov eax, edi
test edi, edi
jne 0x4024ea
mov eax, 0x4523a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 0x1008]
cmp eax, 1
je 0x40251d
cmp eax, 2
je 0x40251d
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x1038]
mov edx, 0
call fcn.0040af50
jmp 0x40257d
mov dword [ebp - 0x1008], 0x1000
push ebx
lea eax, [ebp - 0x1004]
push eax
push 0
push 0
mov eax, edi
test edi, edi
jne 0x40253e
mov eax, 0x4523a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push 1
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0x1004]
mov cx, 0
mov edx, 0xfff
call fcn.0040b910
mov edx, dword [ebp - 0x1034]
mov eax, dword [ebp - 0x1038]
call fcn.0040af50
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
call fcn.0040f4c0
lea eax, [ebp - 0x1034]
call fcn.004063e0
pop eax
test eax, eax
je 0x402597
call fcn.0040f5f0
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4025a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
lea eax, [ebp - 8]
mov esi, eax
push 0
push edx
push 0
call fcn.00402440
or eax, 0x2001b
push eax
push 0
push 0
push 0
mov eax, ebx
test ebx, ebx
jne 0x4025e0
mov eax, 0x4523a0
push eax
mov eax, edi
push eax
call sub.advapi32.dll_RegCreateKeyExA
push 0
push 0
mov eax, esi
push eax
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4025fe
mov eax, 0x4523a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 2
je 0x402628
cmp eax, 6
je 0x402628
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x40262f
cmp eax, 2
je 0x40262f
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
jmp 0x402669
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402639
mov eax, dword [eax - 4]
push eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x402646
mov eax, 0x4523a0
push eax
push dword [ebp - 8]
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x402658
mov eax, 0x4523a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402670
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 4]
lea eax, [ebp - 8]
mov esi, eax
push 0
push edx
push 0
call fcn.00402440
or eax, 0x2001b
push eax
push 0
push 0
push 0
mov eax, ebx
test ebx, ebx
jne 0x4026aa
mov eax, 0x4523a0
push eax
mov eax, edi
push eax
call sub.advapi32.dll_RegCreateKeyExA
push 0
push 0
mov eax, esi
push eax
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4026c8
mov eax, 0x4523a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 2
je 0x4026f2
cmp eax, 6
je 0x4026f2
mov eax, dword [ebp - 8]
cmp eax, 4
je 0x4026f9
cmp eax, 0xb
je 0x4026f9
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
jmp 0x402721
mov dword [ebp - 8], 4
push 4
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x402710
mov eax, 0x4523a0
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402730
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x15c]
push ebx
push esi
mov dword [ebp - 4], eax
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.0040af20
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov eax, 1
lea edx, [ebp - 0x150]
lea ecx, [ebp - 0x138]
call fcn.0040f240
call fcn.00410d60
push eax
test eax, eax
jne 0x40282c
push 0
push 2
call fcn.00415290
mov ebx, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.004152a0
test eax, eax
je 0x40282c
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 4]
call fcn.0040c460
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 4]
call fcn.0040af50
nop
cmp dword [ebp - 4], 0
je 0x40280e
push 1
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x108]
mov cx, 0
mov edx, 0x103
call fcn.0040b910
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x15c]
call fcn.0040c460
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 4]
call fcn.0040bda0
test eax, eax
jle 0x40281b
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004152d0
lea eax, [ebp - 0x12c]
push eax
push ebx
call fcn.004152b0
test eax, eax
jne 0x4027c8
call fcn.0040f4c0
lea eax, [ebp - 0x15c]
call fcn.004063e0
lea eax, [ebp - 0x158]
call fcn.004063e0
lea eax, [ebp - 4]
call fcn.004063e0
pop eax
test eax, eax
je 0x402859
call fcn.0040f5f0
pop esi
pop ebx
leave
ret
Function at 0x402a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.0040af20
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040f240
call fcn.00410d60
push eax
test eax, eax
jne 0x402b51
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004163e0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 8]
call fcn.00402730
mov eax, dword [ebp - 8]
test eax, eax
je 0x402a98
mov eax, dword [eax - 4]
add eax, 1
cmp eax, 1
jl 0x402b51
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0040c460
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.0040af50
mov eax, dword [ebp - 8]
call fcn.0040e250
mov edi, eax
mov ebx, 0
cmp edi, ebx
jb 0x402b51
sub ebx, 1
lea esi, [esi]
add ebx, 1
mov eax, dword [ebp - 8]
push dword [eax + ebx*4]
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x402b4d
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0x400
call fcn.0040bb70
push 0x400
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x402b11
mov eax, 0x4523a0
push eax
push 0
push esi
call fcn.004152c0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.0040c460
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0xc]
call fcn.0040af50
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040bda0
test eax, eax
jle 0x402b47
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
cmp edi, ebx
ja 0x402ad4
call fcn.0040f4c0
lea eax, [ebp - 0x38]
call fcn.004063e0
mov edx, 0x447260
lea eax, [ebp - 8]
call fcn.0040fec0
lea eax, [ebp - 0xc]
call fcn.004063e0
lea eax, [ebp - 4]
call fcn.004063e0
pop eax
test eax, eax
je 0x402b85
call fcn.0040f5f0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402e50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x58]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov al, byte [ebp + 8]
mov byte [ebp - 0x58], al
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.00415270
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.00415270
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, ebx
push eax
push 0
push 0x8000000
push 0
push 0
push 0
mov eax, esi
push eax
mov eax, edi
push eax
call sub.kernel32.dll_CreateProcessA
or eax, eax
setne al
mov bl, al
mov al, byte [ebp - 0x58]
test al, al
je 0x402eb7
push 0xffffffffffffffff
push dword [ebp - 0x54]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404b40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
mov eax, 0x404a00
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
leave
ret

Function at 0x4102b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4524d0], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x4524cc]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x4524d0], eax
cmp ecx, 0x26f
jl 0x4102c0
mov dword [0x443db0], 0x270
ret

Function at 0x410300
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x4510d0]
cmp eax, dword [0x443500]
je 0x410318
mov dword [0x443db0], 0x271
cmp dword [0x443db0], 0x270
jl 0x410437
cmp dword [0x443db0], 0x271
jne 0x41034f
mov eax, dword [0x4510d0]
call fcn.004102b0
mov eax, dword [0x4510d0]
not eax
mov dword [0x4510d0], eax
mov dword [0x443500], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x4524d4]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x4524d0]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x452b04]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x443dc0]
xor edx, eax
mov dword [ebx*4 + 0x4524d0], edx
cmp ebx, 0xe2
jl 0x410358
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x4524d4]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x4524d0]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x452144]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x443dc0]
xor edx, eax
mov dword [ebx*4 + 0x4524d0], edx
cmp ebx, 0x26e
jl 0x4103ac
mov eax, dword [0x452e8c]
and eax, 0x80000000
mov edx, dword [0x4524d0]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x452b00]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x443dc0]
xor eax, edx
mov dword [0x452e8c], eax
mov dword [0x443db0], 0
mov eax, dword [0x443db0]
mov eax, dword [eax*4 + 0x4524d0]
add dword [0x443db0], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x411ed0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x443230]
cmp ax, 0xcb
je 0x411fcc
cmp ax, 0xcc
je 0x411fcc
mov edx, dword [0x4530e0]
test edx, edx
je 0x411f02
mov eax, dword [0x452f80]
call edx
mov ebx, eax
jmp 0x411f07
mov ebx, 0x452f84
cmp word [0x452f70], 0
jle 0x411f2a
mov eax, 0x452f50
call fcn.00412140
mov eax, ebx
call fcn.00411ab0
mov eax, ebx
call fcn.00411b20
mov edi, dword [ebx]
jmp 0x411f4a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x411f45
mov edx, edi
mov eax, ebx
call fcn.00410f80
jmp 0x411f48
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x411f30
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x452f70], 0
jle 0x411fcc
mov edx, 0x452e90
mov eax, ebx
call fcn.004110b0
mov edi, eax
test edi, edi
je 0x411f9f
mov eax, dword [0x452f24]
mov dword [edi + 0xc], eax
cmp dword [0x452f24], 0
je 0x411f94
mov eax, dword [0x452f24]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x452f24], eax
sub word [0x452f70], 1
cmp word [0x452f70], 0
sete bl
mov eax, 0x452f50
call fcn.00412150
test bl, bl
je 0x411fcc
mov eax, 0x452f50
call fcn.00412130
pop edi
pop esi
pop ebx
ret
Function at 0x414200
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x452310], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.004143e0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x452310]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00405e40
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4432a0], eax
mov esi, dword [0x4432a0]
jmp 0x4143a0
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x414290
cmp byte [esi], 0
je 0x4143a9
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x414305
mov al, byte [esi]
cmp al, 1
jb 0x4142fb
sub al, 0x20
jbe 0x4142cc
sub al, 2
je 0x4142df
jmp 0x4142fb
mov al, byte [ebp - 0x10c]
test al, al
je 0x41430a
add dword [ebp - 0x110], 1
jmp 0x414302
cmp byte [esi + 1], 0x22
je 0x4142f6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x414302
add esi, 1
jmp 0x414302
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x4142bc
test dword [ebp - 0x114], 0xffffffff
je 0x414399
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.004143e0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x452310]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x414391
mov al, byte [esi]
cmp al, 1
jb 0x414387
sub al, 0x20
jbe 0x414358
sub al, 2
je 0x41436b
jmp 0x414387
mov al, byte [ebp - 0x10c]
test al, al
je 0x414396
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x41438e
cmp byte [esi + 1], 0x22
je 0x414382
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x41438e
add esi, 1
jmp 0x41438e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x414348
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x414293
mov ebx, dword [ebp - 0x114]
mov dword [0x452300], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x452310
call fcn.00411d30
mov eax, dword [0x452310]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4167f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x4167fc
mov eax, 0x4523a0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x416810
and eax, 0x10
jbe 0x416810
mov al, 1
jmp 0x416812
mov al, 0
leave
ret