joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003df60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x18
mov dword [ebp - 8], 0
jmp 0x1003df82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x18
jge 0x1003dfc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x3f850b1e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003dfbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003df79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003dfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf0
mov dword [ebp - 8], 0
jmp 0x1003e002
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x11
jge 0x1003e041
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x1051c42b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e03c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003dff9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc6
mov dword [ebp - 8], 0
jmp 0x1003e082
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x1003e0c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x288e10e7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e0bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e079
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x74
mov dword [ebp - 8], 0
jmp 0x1003e102
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jge 0x1003e141
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2273ea1d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e13c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e0f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xfd
mov dword [ebp - 8], 0
jmp 0x1003e182
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x1003e1c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x6be90bf8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e1bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e179
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa2
mov dword [ebp - 8], 0
jmp 0x1003e202
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x1003e241
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4f349485]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e23c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e1f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9f
mov dword [ebp - 8], 0
jmp 0x1003e282
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x1003e2c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3c8a13b2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e2bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e279
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x27
mov dword [ebp - 8], 0
jmp 0x1003e302
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x1003e341
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4fd82c96]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e33c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e2f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x39
mov dword [ebp - 8], 0
jmp 0x1003e382
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x1003e3c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7bb6f8e8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e3bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e379
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6b
mov dword [ebp - 8], 0
jmp 0x1003e402
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x1003e441
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x46cbf18e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e43c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e3f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd4
mov dword [ebp - 8], 0
jmp 0x1003e482
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1003e4c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x162539dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e4bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e479
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003e4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa0
mov dword [ebp - 8], 0
jmp 0x1003e502
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1003e541
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2efa48c0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003e53c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003e4f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10040b4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10077b3c]
jne 0x10040b56
repz ret
jmp fcn.100410ec

Function at 0x100426f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100427f8
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100427f8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x100427f8
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10041420
add esp, 0x10
cmp eax, 2
je 0x10042739
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1004272d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10041420
add esp, 0x10
cmp eax, 4
jne 0x1004272d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10042768
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10041420
add esp, 0x10
cmp eax, 2
jne 0x1004272d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x100427c3
cmp eax, 0x8664
jne 0x1004272d
push 0x108
push ebx
push edi
push esi
call fcn.10041420
add esp, 0x10
cmp eax, 0x108
jne 0x1004272d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10041420
add esp, 0x10
cmp eax, 0xf8
jne 0x1004272d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4012c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x80], 0
push 0x40
push 0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.00409620
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x80]
push edx
call fcn.00409620
add esp, 0xc
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x78], str.winsta0default
push 0x10
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00409620
add esp, 0xc
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x401342
xor eax, eax
jmp 0x401460
mov dword [ebp - 0x28], 4
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x13
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x401376
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401460
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0x30
push 0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x34]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4013a9
mov ecx, dword [ebp - 4]
or ecx, 0x400
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00409532
add esp, 4
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x80]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
push ecx
call fcn.00409ec1
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
mov esp, ebp
pop ebp
ret
Function at 0x4017f0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4283a3
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x430090]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40191d
push 0xf01ff
lea ecx, [ebp + 8]
call fcn.004071c0
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4018fa
mov dword [ebp - 0x38], 0
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4018aa
cmp dword [ebp - 0x34], 1
je 0x4018aa
lea ecx, [ebp - 0x38]
push ecx
push 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4018c1
mov dword [ebp - 0x14], 1
jmp 0x4018ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x430
jne 0x4018ee
mov dword [ebp - 0x44], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406900
mov eax, dword [ebp - 0x44]
jmp 0x401935
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401913
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x424
jne 0x401913
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406900
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00409b17
mov esp, ebp
pop ebp
ret
Function at 0x402040
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428527
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x430090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004067a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004072c0
sub eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00407220
movzx ecx, ax
cmp ecx, 0x5c
je 0x40209e
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.004071d0
lea ecx, [ebp - 0x24]
call fcn.00407300
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00406740
mov byte [ebp - 4], 2
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x28], 0
jmp 0x4020cc
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x14]
call fcn.004072c0
cmp dword [ebp - 0x28], eax
jge 0x40211f
mov eax, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407220
movzx ecx, ax
cmp ecx, 0x5c
je 0x402107
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.00407220
movzx eax, ax
push eax
lea ecx, [ebp - 0x10]
call fcn.004071d0
jmp 0x40211d
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00407350
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.004071d0
jmp 0x4020c3
mov dword [ebp - 0x2c], 0
jmp 0x402131
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x24]
call fcn.00407330
cmp dword [ebp - 0x2c], eax
jge 0x402164
push 0
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00407450
mov ecx, eax
call fcn.004071c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne cl
mov byte [ebp - 0x15], cl
jmp 0x402128
mov dl, byte [ebp - 0x15]
mov byte [ebp - 0x2d], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00406900
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004085f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00406900
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x403820
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x430090]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x88], ecx
push 0x40
push 0
mov eax, dword [ebp - 0x88]
add eax, 0x600
push eax
call fcn.00409620
add esp, 0xc
push 0x40
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x640
push ecx
call fcn.00409620
add esp, 0xc
push 8
push 0
mov edx, dword [ebp - 0x88]
add edx, 0x680
push edx
call fcn.00409620
add esp, 0xc
push 8
push 0
mov eax, dword [ebp - 0x88]
add eax, 0x688
push eax
call fcn.00409620
add esp, 0xc
push 0x41
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x690
push ecx
call fcn.00409620
add esp, 0xc
push 0x11
push 0
mov edx, dword [ebp - 0x88]
add edx, 0x6d1
push edx
call fcn.00409620
add esp, 0xc
push 9
push 0
mov eax, dword [ebp - 0x88]
add eax, 0x6e2
push eax
call fcn.00409620
add esp, 0xc
push 0x1000
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x6eb
push ecx
call fcn.00409620
add esp, 0xc
push 0x1000
push 0
mov edx, dword [ebp - 0x88]
add edx, 0x16eb
push edx
call fcn.00409620
add esp, 0xc
mov byte [ebp - 0x48], 0
push 0x3f
push 0
lea eax, [ebp - 0x47]
push eax
call fcn.00409620
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x88]
call fcn.00403c20
mov byte [ebp - 0x80], 0
push 0x37
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.00409620
add esp, 0xc
mov dword [ebp - 0x84], 0
jmp 0x403975
mov ecx, dword [ebp - 0x84]
add ecx, 1
mov dword [ebp - 0x84], ecx
cmp dword [ebp - 0x84], 0x38
jge 0x40399b
mov edx, dword [ebp - 0x84]
movsx eax, byte [edx + str.91__]
mov ecx, dword [ebp - 0x84]
mov dl, byte [ebp + eax - 0x49]
mov byte [ebp + ecx - 0x80], dl
jmp 0x403966
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.004039c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409b17
mov esp, ebp
pop ebp
ret 8
Function at 0x403f40
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x430090]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.00409620
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.00409620
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.00409620
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.00403c20
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.004042f0
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00409b60
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.00409b60
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x404061
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x40408d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.00404140
jmp 0x404052
push 0x20
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00409b60
add esp, 0xc
push 0x20
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.00409b60
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x4040d5
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x404106
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x429658]
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x600], dl
jmp 0x4040c6
push 0x40
mov eax, dword [ebp - 0x114]
add eax, 0x600
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x680
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.00404550
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409b17
mov esp, ebp
pop ebp
ret 8

Function at 0x4042f0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x40430b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jge 0x40432c
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + str.:2_]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x404302
mov esp, ebp
pop ebp
ret 8