joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68f29c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x68f406
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7a8c7c]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x7a8c7c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004913a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004515c4
xor edx, edx
push ebp
push 0x68f3e9
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x68f359
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406ef0
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.0068d404
push eax
mov eax, dword [0x7a87cc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x68f34f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404d20
jmp 0x68f3f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x68f395
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004511a4
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0068f12c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x68f371
push 0
mov edx, 0x68f0c4
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00450d5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68f3f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00451610
mov eax, dword [0x7a8c7c]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.004913a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68f40d
lea eax, [ebp - 0x10]
call fcn.00406ef0
ret
Function at 0x69f7b8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x69f83e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.0040863c
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x69f854
mov edx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 0x28]
call fcn.0040577c
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69f845
lea eax, [ebp - 0x28]
call fcn.004052bc
lea eax, [ebp - 4]
call fcn.004052bc
ret
Function at 0x6a4104
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a42e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov eax, dword [eax + 0x22c]
call fcn.004575f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
call fcn.00480048
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x31c]
mov eax, dword [ebp - 0x1c]
call fcn.0045ab1c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x31c]
mov eax, dword [ebp - 0x1c]
call fcn.0045aaac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
dec eax
test eax, eax
jl 0x6a42d2
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov dl, 1
mov eax, dword [0x4274cc]
call fcn.0042e00c
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x4274cc]
call fcn.0042e00c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6a42bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x22c]
call fcn.004574a0
mov ebx, eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.00456e9c
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00457084
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x48]
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0x31c]
sub eax, dword [esi + 0x34]
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6a42f8]
call fcn.00402ff4
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x30]
add eax, 0x1e
imul dword [ebp - 8]
add eax, 0xa
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0045733c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x168]
call fcn.0042bbb0
mov edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.006a4324
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0047fabc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a42c6
lea eax, [ebp - 0x10]
call fcn.0040ffa4
lea eax, [ebp - 0xc]
call fcn.0040ffa4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a42ef
lea eax, [ebp - 0x24]
call fcn.004052bc
ret
Function at 0x6a7f24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x20]
mov ebx, eax
mov dl, 1
mov eax, dword [0x4274cc]
call fcn.0042e00c
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x6a8083
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 7
mov eax, dword [ebp - 0x1c]
call fcn.0042f724
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec ebx
test ebx, ebx
jl 0x6a8054
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0042e744
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
call fcn.0042e744
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x6a8048
inc eax
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x10]
add esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
xor ebx, ebx
mov bl, byte [esi + 3]
xor eax, eax
mov al, byte [esi + 2]
imul ebx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6a8094]
call fcn.00402ff4
mov edx, ebx
xor dl, 0xff
add al, dl
mov byte [edi + 2], al
xor eax, eax
mov al, byte [esi + 1]
imul ebx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6a8094]
call fcn.00402ff4
mov edx, ebx
xor dl, 0xff
add al, dl
mov byte [edi + 1], al
xor eax, eax
mov al, byte [esi]
imul ebx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6a8094]
call fcn.00402ff4
xor bl, 0xff
add al, bl
mov byte [edi], al
add dword [ebp - 0x18], 4
dec dword [ebp - 0x24]
jne 0x6a7fcc
inc dword [ebp - 8]
dec dword [ebp - 0x20]
jne 0x6a7f99
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 7
call fcn.0042f724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a808a
mov eax, dword [ebp - 0x1c]
call fcn.004044a8
ret
Function at 0x6ab130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x6ab1b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.0040863c
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x6ab1cc
mov edx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 0x28]
call fcn.0040577c
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ab1bd
lea eax, [ebp - 0x28]
call fcn.004052bc
lea eax, [ebp - 4]
call fcn.004052bc
ret

Function at 0x6ac418
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x6ac49e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.0040863c
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x6ac4b4
mov edx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 0x28]
call fcn.0040577c
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ac4a5
lea eax, [ebp - 0x28]
call fcn.004052bc
lea eax, [ebp - 4]
call fcn.004052bc
ret
Function at 0x6afc0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x20]
mov ebx, eax
mov dl, 1
mov eax, dword [0x4274cc]
call fcn.0042e00c
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x6afd6b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 7
mov eax, dword [ebp - 0x1c]
call fcn.0042f724
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec ebx
test ebx, ebx
jl 0x6afd3c
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0042e744
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
call fcn.0042e744
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x6afd30
inc eax
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x10]
add esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
xor ebx, ebx
mov bl, byte [esi + 3]
xor eax, eax
mov al, byte [esi + 2]
imul ebx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6afd7c]
call fcn.00402ff4
mov edx, ebx
xor dl, 0xff
add al, dl
mov byte [edi + 2], al
xor eax, eax
mov al, byte [esi + 1]
imul ebx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6afd7c]
call fcn.00402ff4
mov edx, ebx
xor dl, 0xff
add al, dl
mov byte [edi + 1], al
xor eax, eax
mov al, byte [esi]
imul ebx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fdiv dword [0x6afd7c]
call fcn.00402ff4
xor bl, 0xff
add al, bl
mov byte [edi], al
add dword [ebp - 0x18], 4
dec dword [ebp - 0x24]
jne 0x6afcb4
inc dword [ebp - 8]
dec dword [ebp - 0x20]
jne 0x6afc81
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 7
call fcn.0042f724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6afd72
mov eax, dword [ebp - 0x1c]
call fcn.004044a8
ret
Function at 0x6b4208
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x6b428e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.0040863c
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x6b42a4
mov edx, dword [ebp - 4]
call fcn.004055c8
mov eax, dword [ebp - 0x28]
call fcn.0040577c
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b4295
lea eax, [ebp - 0x28]
call fcn.004052bc
lea eax, [ebp - 4]
call fcn.004052bc
ret
Function at 0x6f3138
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040576c
xor eax, eax
push ebp
push 0x6f31a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a8d8
mov eax, dword [ebp - 8]
call fcn.0040577c
mov ebx, eax
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x6f3188
push ebx
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x6f318c
mov bl, 1
jmp 0x6f318e
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f31b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052e0
ret
Function at 0x401100
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0
push 0
mov ebx, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x401125
mov edi, 0x40dc50
call fcn.00401060
pop edi
xor eax, eax
pop ebx
pop ebp
ret
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x401157
mov edi, 0x40dc70
call fcn.00401060
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
xor eax, eax
pop ebx
pop ebp
ret
push ebx
push 0x40dddc
push 1
push 0
push 0x40c2b8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x401186
mov edi, 0x40dc9c
call fcn.00401060
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
xor eax, eax
pop ebx
pop ebp
ret
push esi
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x4011e8
mov edx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax]
push edx
push 0
push 0
push 0x80
push 0
push 0
push 0
push esi
push eax
mov eax, dword [ecx + 0xc]
call eax
push esi
test eax, eax
jns 0x4011e2
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, str.ConnectServer
call fcn.00401060
mov ebx, dword [ebx]
mov ecx, dword [ebx]
mov edx, dword [ecx + 8]
push ebx
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push ecx
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x401234
mov edi, 0x40dcdc
call fcn.00401060
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x401846
Capabilities:
Terminate process

Disassembly:
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401807
jmp 0x40180e
call 0x4645c95
add bl, byte [eax - 0x3d]
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401818
add dword [esp + 4], 2
pop eax
ret
jmp 0x40181f
call 0x24449b7b
add eax, ebx
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401828
pop eax
add dword [esp], 3
ret
jmp 0x40182f
call 0x24449b8b
add al, 0xc3
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401838
pop eax
add dword [esp], 4
ret
jmp 0x40183f
call 0x4645cc6
add eax, 0xd3bc358
cmp ecx, dword [0x40f004]
jne 0x401850
add dword [esp + 4], 5
pop eax
ret
repz ret
Function at 0x404ba7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x404bce
call fcn.00402062
mov dword [eax], esi
call fcn.0040204f
push 0x16
pop esi
mov dword [eax], esi
call fcn.004036da
mov eax, esi
jmp 0x404c23
test dword [ebp + 0xc], 0xfffffff9
jne 0x404bb4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404bfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402075
pop ecx
call fcn.0040204f
mov eax, dword [eax]
jmp 0x404c23
test al, 0x10
jne 0x404c21
test al, 1
je 0x404c21
test byte [ebp + 0xc], 2
je 0x404c21
call fcn.00402062
mov dword [eax], 5
call fcn.0040204f
mov dword [eax], 0xd
jmp 0x404bf2
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4062db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040566b
and dword [ebp - 0x14], 0
cmp dword [0x410b18], 0
mov dword [ebp - 0x18], eax
jne 0x40638e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406436
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406436
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x410b18], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x410b1c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x410b20], eax
call edi
push eax
call esi
mov dword [0x410b28], eax
test eax, eax
je 0x40638e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x410b24], eax
mov eax, dword [0x410b24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4063e7
cmp dword [0x410b28], ecx
je 0x4063e7
push eax
call esi
push dword [0x410b28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4063e7
test ebx, ebx
je 0x4063e7
call edi
test eax, eax
je 0x4063de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4063de
test byte [ebp - 8], 1
jne 0x4063e7
or dword [ebp + 0x10], 0x200000
jmp 0x40641a
mov eax, dword [0x410b1c]
cmp eax, dword [ebp - 0x18]
je 0x40641a
push eax
call esi
test eax, eax
je 0x40641a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40641a
mov eax, dword [0x410b20]
cmp eax, dword [ebp - 0x18]
je 0x40641a
push eax
call esi
test eax, eax
je 0x40641a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x410b18]
call esi
test eax, eax
je 0x406436
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406438
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401846
leave
ret
Function at 0x405700
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448c00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x462014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x4630d0
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00419190
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x462a88
push eax
call fcn.00419190
mov esi, dword [0x4630e0]
xor ebx, ebx
mov edi, dword [0x4630e4]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x4663d0], bl
mov eax, ebx
mov ecx, 0x4630d0
cmovae ecx, dword [0x4630d0]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x4664e0], al
inc ebx
cmp ebx, 0x100
jl 0x405780
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x4663d0]
movzx eax, byte [esi + 0x4664e0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4057d4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x4663d0]
mov byte [esi + 0x4663d0], al
inc esi
mov byte [edi + 0x4663d0], dl
cmp esi, 0x100
jl 0x4057b0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405350
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405829
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40581f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40587f
push edx
push ecx
call fcn.0041e368
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x40586b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405861
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40587f
push edx
push ecx
call fcn.0041e368
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00437937
int3
Function at 0x406ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x462014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push eax
push 0
call dword [0x4500a0]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x406e9b
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x406e9b
push 0x44
lea eax, [ebp - 0x14c]
push 0
push eax
call fcn.00434df0
add esp, 0xc
lea eax, [ebp - 0x160]
xorps xmm0, xmm0
movups xmmword [ebp - 0x160], xmm0
push eax
lea eax, [ebp - 0x14c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [0x450048]
test eax, eax
je 0x406e9b
push 4
push 0x1000
push 4
push 0
call dword [0x450090]
mov ebx, eax
push ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebx], 0x10007
push dword [ebp - 0x15c]
call dword [0x450034]
test eax, eax
je 0x406e9b
push 0
push 4
lea eax, [ebp - 0x150]
push eax
push 0x458dcc
push dword [ebp - 0x160]
call dword [0x4500a4]
mov eax, dword [edi + 0x34]
cmp dword [ebp - 0x150], eax
jne 0x406dbc
push 0x458dd0
push 0x458de8
call dword [0x450078]
push eax
call dword [0x450038]
push dword [ebp - 0x150]
push dword [ebp - 0x160]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [ebp - 0x160]
call dword [0x45003c]
mov dword [ebp - 0x168], eax
test eax, eax
je 0x406e9b
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [ebp - 0x160]
call dword [0x45009c]
xor eax, eax
cmp ax, word [edi + 6]
jae 0x406e55
mov ecx, 0xa0
xor ebx, ebx
mov dword [ebp - 0x164], ecx
nop dword [eax]
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + esi + 0x68]
mov eax, dword [ecx + esi + 0x6c]
add eax, esi
push eax
mov eax, dword [ecx + esi + 0x64]
add eax, dword [ebp - 0x168]
push eax
push dword [ebp - 0x160]
call dword [0x45009c]
mov ecx, dword [ebp - 0x164]
inc ebx
movzx eax, word [edi + 6]
add ecx, 0x28
mov dword [ebp - 0x164], ecx
cmp ebx, eax
jl 0x406e10
mov ebx, dword [ebp - 0x16c]
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x160]
call dword [0x45009c]
mov eax, dword [edi + 0x28]
add eax, dword [ebp - 0x168]
push ebx
mov dword [ebx + 0xb0], eax
push dword [ebp - 0x15c]
call dword [0x450050]
push dword [ebp - 0x15c]
call dword [0x450080]
push 0x8000
push 0
push esi
call dword [0x450098]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dcf1
mov esp, ebp
pop ebp
ret