joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fec4
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push dword [esp + 0x10]
xor esi, esi
call fcn.004065cd
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x40ff16
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, dword [esp + 0x10]
mov edi, eax
add esi, 8
mov eax, esi
call fcn.00407d98
mov esi, dword [esi]
push edi
push esi
push ebx
call fcn.00407256
add esp, 0xc
mov esi, eax
test esi, esi
pop edi
je 0x40ff0f
mov eax, dword [esp + 0xc]
call fcn.0040fe99
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x410393
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [0x423d00], edi
mov esi, 0x400
jne 0x4103d9
call fcn.004102fa
xor ecx, ecx
push 0xc
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esp], 0x3000
push edi
push eax
mov dword [0x423d00], eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edx, dword [0x423d00]
xor eax, eax
mov ecx, edx
cmp dword [ecx], edi
je 0x4103f2
inc eax
add ecx, 0xc
cmp eax, esi
jl 0x4103e3
or eax, 0xffffffff
cmp eax, edi
jl 0x410432
mov esi, eax
lea ecx, [ebp - 4]
imul esi, esi, 0xc
push ecx
push 4
push eax
push 0x41031c
push edi
push edi
add esi, edx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, edi
je 0x410432
mov ecx, dword [ebp + 8]
mov dword [esi], eax
mov ecx, dword [ecx + 4]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
xor eax, eax
inc eax
jmp 0x410434
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x410498
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 8]
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
test ebx, ebx
mov word [ebp - 0xe], ax
je 0x410502
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4104e5
xor ebx, ebx
inc ebx
jmp 0x4104fe
call fcn.00410516
mov ebx, eax
test ebx, ebx
jne 0x4104fe
mov edi, dword [esi]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, esi
call dword [edi + 0x18]
mov eax, ebx
jmp 0x410510
mov eax, dword [esi]
push 0xffff
mov ecx, esi
call dword [eax + 0x18]
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x4109ff
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
lea eax, [esi + 0x3f4]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea eax, [esi + 0x3d0]
push eax
push 0x41c5a0
push edi
call fcn.00413651
add esp, 0xc
lea ebx, [esi + 0x3fc]
push ebx
push str.EnableDHCP
push edi
call fcn.00413651
add esp, 0xc
lea eax, [esi + 0x2c0]
push eax
push str.DhcpIPAddress
push str.IPAddress
push dword [ebx]
push edi
call fcn.004109ab
lea eax, [esi + 0x340]
push eax
push str.DhcpSubnetMask
push str.SubnetMask
push dword [ebx]
push edi
call fcn.004109ab
lea eax, [esi + 0x280]
push eax
push str.DhcpDefaultGateway
push str.DefaultGateway
push dword [ebx]
push edi
call fcn.004109ab
lea eax, [esi + 0x300]
push eax
push str.DhcpNameServer
push str.NameServer
push dword [ebx]
push edi
call fcn.004109ab
lea eax, [esi + 0x380]
push eax
push str.DhcpServer
push edi
push 0x3f
pop eax
call fcn.00413678
add esp, 0xc
push str.LeaseObtainedTime
lea ebx, [esi + 0x3d4]
push edi
call fcn.004109d1
push str.LeaseTerminatesTime
lea ebx, [esi + 0x3dc]
push edi
call fcn.004109d1
push 0x41c65c
lea ebx, [esi + 0x3e4]
push edi
call fcn.004109d1
push 0x41c660
lea ebx, [esi + 0x3ec]
push edi
call fcn.004109d1
pop ebx
ret

Function at 0x4113b9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
mov eax, esi
call fcn.00411382
test eax, eax
jne 0x4113e2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x41145a
push ebx
push edi
call fcn.00411362
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor ebx, ebx
test eax, eax
je 0x41140e
push str.LookupPrivilegeValueA
push dword [esi]
call edi
cmp eax, ebx
je 0x41140e
lea ecx, [ebp - 0x14]
push ecx
push str.SeDebugPrivilege
push ebx
call eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], eax
call fcn.00411362
test eax, eax
je 0x411445
push str.AdjustTokenPrivileges
push dword [esi]
call edi
cmp eax, ebx
je 0x411445
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push dword [ebp - 8]
call eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret
Function at 0x411a10
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push str.DevicePhysicalMemory
lea eax, [ebp - 8]
push eax
call dword [esi + 4]
and dword [ebp - 0x1c], 0
lea eax, [ebp - 8]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x14], 0x40
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea edi, [esi + 0x10]
push edi
call dword [esi + 8]
test eax, eax
jne 0x411a7f
mov ecx, esi
call fcn.00411a84
test eax, eax
jne 0x411a65
mov eax, esi
call fcn.00411ae4
push 0x1000
push eax
push 0
push 4
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
jmp 0x411a81
xor eax, eax
pop edi
leave
ret

Function at 0x411ae4
Capabilities:
Read file via mapping

Disassembly:
push esi
push edi
push 0xa0000
xor edi, edi
push edi
push edi
push 4
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push 0x67
pop edx
lea ecx, [eax + 0xc00]
mov esi, 0x1000
cmp dword [ecx], edx
je 0x411b19
add edx, esi
inc edi
add ecx, esi
cmp edx, 0xa0067
jb 0x411b08
push eax
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, edi
pop edi
shl eax, 0xc
pop esi
ret

Function at 0x411b28
Capabilities:
Read file via mapping

Disassembly:
mov ecx, dword [edi + 0x14]
push esi
mov esi, eax
shr eax, 0x16
mov eax, dword [ecx + eax*4]
test al, 1
jne 0x411b3c
xor eax, eax
pop esi
ret
test al, al
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
js 0x411b82
push 0x1000
and eax, 0xfffff000
push eax
push 0
push 4
push dword [edi + 0x10]
call ebp
shr esi, 0xc
and esi, 0x3ff
mov ebx, dword [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
test bl, 1
jne 0x411b78
xor eax, eax
jmp 0x411b9e
and ebx, 0xfffff000
mov esi, ebx
jmp 0x411b8f
and esi, 0x3ff000
and eax, 0xfffff000
add esi, eax
push 0x1000
push esi
push 0
push 4
push dword [edi + 0x10]
call ebp
pop ebp
pop ebx
pop esi
ret

Function at 0x411c13
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea ecx, [eax + 4]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ecx
cmp eax, ecx
jmp 0x411c90
mov eax, dword [ebp - 8]
push 0x1000
and eax, 0xfffff000
push eax
mov eax, dword [ebp + 8]
push 0
push 4
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x411c95
mov eax, dword [ebp - 8]
push 4
and eax, 0xfff
mov ecx, 0x1000
pop edx
sub edx, ebx
sub ecx, eax
cmp edx, ecx
mov dword [ebp - 4], edx
jb 0x411c69
mov dword [ebp - 4], ecx
push dword [ebp - 4]
add eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
add ebx, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jb 0x411c27
pop edi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4129c9
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push ebp
xor ebp, ebp
cmp dword [esi], ebp
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
jne 0x412a3e
push str.iphlpapi.dll
call ebx
cmp eax, ebp
mov dword [esi], eax
je 0x412a3e
push str.GetTcpTable
push eax
call edi
push str.GetUdpTable
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.SetTcpEntry
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.AllocateAndGetTcpExTableFromStack
push dword [esi]
mov dword [esi + 0x24], eax
call edi
push str.AllocateAndGetUdpExTableFromStack
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.GetExtendedTcpTable
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GetExtendedUdpTable
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
cmp dword [esi + 4], ebp
jne 0x412aa0
push str.ntdll.dll
mov dword [esi + 8], ebp
call ebx
cmp eax, ebp
mov dword [esi + 4], eax
je 0x412aa0
push str.NtQuerySystemInformation
push eax
call edi
push str.RtlInitUnicodeString
push dword [esi + 4]
mov dword [esi + 0x38], eax
call edi
push str.ZwOpenSection
push dword [esi + 4]
mov dword [esi + 0x3c], eax
call edi
push str.ZwOpenFile
push dword [esi + 4]
mov dword [esi + 0x40], eax
call edi
cmp dword [esi + 0x38], ebp
mov dword [esi + 0x44], eax
je 0x412aa0
cmp dword [esi + 0x3c], ebp
je 0x412aa0
cmp dword [esi + 0x40], ebp
je 0x412aa0
cmp eax, ebp
je 0x412aa0
mov dword [esi + 8], 1
pop edi
pop ebp
pop ebx
ret
Function at 0x41355e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10000
call fcn.00419b10
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
push esi
mov byte [ebp - 0x10000], al
je 0x4135b5
push 0xffff
push eax
lea eax, [ebp - 0xffff]
push eax
call sub.msvcrt.dll_memset
push dword [edi]
lea ebx, [ebp - 0x10000]
push dword [ebp + 0x14]
call fcn.004072ed
add esp, 0x14
push dword [ebp + 0x18]
mov eax, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
mov esi, eax
jmp 0x413600
mov esi, 0xffff
push esi
push eax
lea eax, [ebp - 0xffff]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x10000]
push esi
push eax
push 0x41a57f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea ebx, [ebp - 0x10000]
neg esi
call fcn.00407366
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x413606
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x413624
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00413512
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [esi], eax
pop ebp
ret

Function at 0x41388e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00419b10
push ebx
xor ebx, ebx
cmp dword [edi + 4], ebx
push esi
mov dword [ebp - 0xc], ebx
jbe 0x4138b0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0xc], eax
push 0x1001
lea eax, [ebp - 0x100f]
push ebx
push eax
mov byte [ebp - 0x1010], bl
call sub.msvcrt.dll_memset
push dword [ebp + 8]
call sub.msvcrt.dll_strlen
cdq
and edx, 0xfff
add eax, edx
mov esi, eax
sar esi, 0xc
add esp, 0x10
mov dword [ebp - 4], ebx
cmp esi, ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
jle 0x413944
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x1000
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x1010]
push eax
push 0
push 0xc2
push dword [edi]
mov byte [ebp - 0x10], 0
call ebx
cmp dword [edi + 4], 0
jbe 0x413935
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp eax, dword [edi + 4]
jae 0x413944
inc dword [ebp - 4]
add dword [ebp - 8], 0x1000
cmp dword [ebp - 4], esi
jl 0x4138f4
shl esi, 0xc
add esi, dword [ebp + 8]
push esi
push 0
push 0xc2
push dword [edi]
call ebx
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x41408b
Capabilities:
Create raw socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x101c
call fcn.00419b10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebx + 0x118], 0
lea edi, [ebx + 0x11c]
push 0xe
mov dword [esp + 0x14], edi
pop ecx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x34]
xor edi, edi
inc edi
cmp ecx, edi
mov dword [esp + 0xc], ebx
jne 0x41419b
push 0
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor esi, esi
cmp eax, 0xffffffff
mov dword [ebx + 4], eax
je 0x414183
push esi
mov word [esp + 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x414183
push edi
push 0x433
push dword [ebx + 0x110]
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x414183
push 4
lea eax, [ebx + 0x270]
push eax
push 0x1002
push 0xffff
push dword [ebx + 4]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push esi
push esi
lea eax, [esp + 0x14]
push eax
push 0x1000
lea eax, [esp + 0x38]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x98000001
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebx + 0x118], edi
cmp dword [ebx + 0x118], esi
jne 0x41428c
mov esi, ebx
call fcn.00413f99
jmp 0x41428c
cmp ecx, 2
jne 0x41421f
push dword [eax + 0x10]
mov esi, ebx
call fcn.00414050
test eax, eax
je 0x41420d
mov eax, dword [ebx + 0x154]
xor esi, esi
push esi
push edi
push str.ip_proto__tcp_or_udp_or_icmp
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [0x4305cc]
add esp, 0x14
test eax, eax
jl 0x41420d
mov eax, dword [ebx + 0x154]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [0x4305d0]
test eax, eax
pop ecx
pop ecx
jl 0x414201
push esi
push esi
push 0x434
push dword [ebx + 0x110]
mov dword [ebx + 0x118], edi
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [esp + 0x10]
push eax
call dword [0x4305d4]
pop ecx
cmp dword [ebx + 0x118], 0
jne 0x41428c
mov eax, ebx
call fcn.00414034
jmp 0x41428c
cmp ecx, 3
jne 0x414269
call fcn.0041106b
mov eax, dword [esp + 0x10]
push 0
push dword [eax]
mov ebx, 0x41f440
call fcn.004110ff
cmp dword [eax], 0
jle 0x414288
mov eax, dword [eax + 0x180]
mov edi, dword [esp + 0xc]
mov dword [edi + 0x25c], eax
call fcn.004147ea
test eax, eax
je 0x414288
mov eax, edi
mov dword [eax + 0x118], 1
mov ebx, eax
jmp 0x41428c
cmp ecx, 4
jne 0x41428c
push dword [eax + 0x10]
mov edi, ebx
call fcn.00414735
test eax, eax
je 0x41428c
mov dword [ebx + 0x118], 1
jmp 0x41428c
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x118]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x414bdc
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
call fcn.00414c47
push esi
push 0x41cd14
push 1
push ebx
push 0x41cd04
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [esi + 0x10], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x414c3c
mov ecx, dword [eax]
lea edi, [esi + 4]
push edi
push eax
call dword [ecx + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [edi]
cmp eax, ebx
je 0x414c3c
mov ecx, dword [eax]
lea edi, [esi + 8]
push edi
push eax
call dword [ecx + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [edi]
cmp eax, ebx
je 0x414c3c
mov ecx, dword [eax]
lea edi, [esi + 0xc]
push edi
push eax
call dword [ecx + 0x50]
cmp dword [edi], ebx
je 0x414c3c
inc ebx
jmp 0x414c41
call fcn.00414c47
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x415260
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
je 0x41526a
or eax, 0xffffffff
ret
cmp dword [esi + 4], 0
jne 0x4152b3
call sub.msvcrt.dll__errno
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x4152ae
push dword [esi + 0x40]
mov dword [esi + 0x3c], 1
call sub.msvcrt.dll_ferror
test eax, eax
pop ecx
je 0x415266
or dword [esi + 0x38], 0xffffffff
jmp 0x415266
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x4152c1
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
inc ebx
cmp edi, 2
jae 0x415331
test edi, edi
je 0x4152de
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call sub.msvcrt.dll__errno
and dword [eax], 0
push dword [esi + 0x40]
mov ecx, edi
mov eax, 0x4000
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call sub.msvcrt.dll_fread
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x415319
push dword [esi + 0x40]
call sub.msvcrt.dll_ferror
test eax, eax
pop ecx
je 0x415319
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov ecx, dword [esi + 0x44]
mov dword [esi], ecx
jae 0x415331
mov dword [esi + 0x58], eax
jmp 0x4153ea
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4153e7
cmp byte [eax + 1], 0x8b
jne 0x4153e7
add dword [esi + 4], 0xfffffffe
add eax, 2
mov dword [esi], eax
call fcn.00415260
mov edi, eax
call fcn.00415260
cmp edi, 8
mov ebx, eax
jne 0x4153de
test bl, 0xe0
jne 0x4153de
push 6
pop edi
call fcn.00415260
dec edi
jne 0x41536a
test bl, 4
je 0x415399
call fcn.00415260
mov edi, eax
call fcn.00415260
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x415399
call fcn.00415260
cmp eax, 0xffffffff
jne 0x415388
test bl, 8
je 0x4153ac
call fcn.00415260
test eax, eax
je 0x4153ac
cmp eax, 0xffffffff
jne 0x41539e
test bl, 0x10
je 0x4153bf
call fcn.00415260
test eax, eax
je 0x4153bf
cmp eax, 0xffffffff
jne 0x4153b1
test bl, 2
je 0x4153cf
push 2
pop edi
call fcn.00415260
dec edi
jne 0x4153c7
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
jmp 0x4153ea
mov dword [esi + 0x38], 0xfffffffd
jmp 0x4153ea
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x415708
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x41f04c]
test eax, eax
je 0x415808
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x41f04c], 0
xor eax, eax
movzx edx, byte [eax + 0x41c028]
push 0x1f
pop ecx
sub ecx, edx
xor edx, edx
inc edx
shl edx, cl
or esi, edx
inc eax
cmp eax, 0xe
jb 0x415728
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x415752
shr eax, 1
xor eax, esi
jmp 0x415754
shr eax, 1
dec edx
jne 0x415748
mov dword [ecx*4 + 0x421228], eax
inc ecx
cmp ecx, 0x100
jl 0x415743
mov edi, 0x422228
mov ecx, 0xff00
mov eax, dword [edi - 0x1000]
mov esi, eax
and esi, ecx
mov ebx, eax
shl ebx, 0x10
add esi, ebx
mov edx, eax
shr edx, 8
shl esi, 8
mov ebx, edx
and ebx, ecx
add esi, ebx
mov ebx, eax
shr ebx, 0x18
add esi, ebx
mov dword [edi], esi
lea esi, [edi + 0x400]
mov dword [esp + 0x10], 3
and eax, 0xff
mov eax, dword [eax*4 + 0x421228]
xor eax, edx
mov ebx, eax
and ebx, ecx
mov ebp, eax
shl ebp, 0x10
add ebx, ebp
mov edx, eax
shr edx, 8
shl ebx, 8
mov ebp, edx
and ebp, ecx
add ebx, ebp
mov ebp, eax
shr ebp, 0x18
add ebx, ebp
mov dword [esi - 0x1000], eax
mov dword [esi], ebx
add esi, 0x400
dec dword [esp + 0x10]
jne 0x4157a7
add edi, 4
cmp edi, 0x422628
jl 0x415771
pop edi
pop esi
pop ebp
mov dword [0x41f048], 0
pop ebx
pop ecx
ret
mov eax, dword [0x41f048]
test eax, eax
jne 0x415808
pop ecx
ret
Function at 0x4170b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x417142
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x417102
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x417124
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x417201
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x41716a
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x417175
xor eax, eax
jmp 0x4171c2
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x417193
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.004179d4
pop ecx
jmp 0x4171a6
cmp ecx, 2
jne 0x4171ac
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00415813
add esp, 0xc
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4171ed
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x417201
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4170c0
pop edi
pop ebx
leave
ret