joyce8/EMBER2024-capa huggingface dataset:
Function at 0x92af10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x93f9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x92b002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0092edff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x92b002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.009266e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0092f20b
push 0x10
call fcn.0092f1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x92afc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.0091b1c0
jmp 0x92afc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0092ab80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x92aff0
mov ecx, edi
call fcn.0091b2c0
push edi
call fcn.0092f1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x92b021
inc ebx
cmp ebx, 0x20
jb 0x92af3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x92c250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x940808
push 0x930288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x92c329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x92c329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0092f1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x92c329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x92c329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x92c32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0092c351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x92cd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x92cd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x92cd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x92cd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x92cd94
push eax
push esi
call fcn.0092f20b
add esp, 8
pop esi
ret 0x10

Function at 0x92cda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x92ce22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x92ce15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x945320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0092edff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x92cdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x92ce30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x92cec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x92ceb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x945320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0092edff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x92ceab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x92ce6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x92d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x92d131
push esi
call fcn.00930145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0091f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x92d131
push 0
push ebp
call fcn.0091f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0091f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x92d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0091f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x92d121
push 0x945918
push edi
call fcn.0092e3f0
push eax
push ebx
push esi
call fcn.0092cf60
push 0x9458f8
push edi
call fcn.0092e3f0
push eax
push ebx
push esi
call fcn.0092cf60
push 0x9458d8
push edi
call fcn.0092e3f0
push eax
push ebx
push esi
call fcn.0092cf60
push 0x9458c0
push edi
call fcn.0092e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0092cf60
push 0x9458a0
push edi
call fcn.0092e3f0
push eax
push ebx
push esi
call fcn.0092cf60
push 0x945888
push edi
call fcn.0092e3f0
push eax
push ebx
push esi
call fcn.0092cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x92e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0092e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0092e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0092e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0092e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x92ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x92ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x94087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x92ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x92ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001a978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001a987
pop dword [ebp - 0x10]
mov eax, 0xafaf9080
sub eax, 0x9fade6f9
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x36e66
push 0
mov eax, 0x4fe3a2c0
sub eax, 0x3fe1c15c
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xbbf580ec
add ecx, 0x440abe57
mov esi, eax
mov edi, 0xbc51b39f
add edi, 0x53b28a61
add edi, dword [ebp - 0x10]
mov ebx, 0x3ef38950
sub ebx, 0xe7721953
sub dword [ebp - 0xc], ecx
mov edx, dword [edi]
add dword [ebp - 8], eax
sub edx, ebx
sub dword [ebp - 8], 0x28807d2
mov dword [esi], edx
xor dword [ebp - 0xc], eax
add esi, 4
add edi, 4
loop 0x1001a9e6
add eax, 0xefdf
xor ebx, ebx
add ebx, eax
add eax, 0x13d59746
sub eax, 0x13d59741
mov ecx, 0x9ae70e8a
add ecx, 0x7518f176
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401d2a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x801c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004063d0
mov ecx, 0x7fff
sub esp, eax
xor eax, eax
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x8017]
mov esi, dword [ebp + 0xc]
rep stosb byte es:[edi], al
lea edi, [ebp - 0x8017]
mov dword [esp + 8], 0x7fff
mov dword [esp + 4], edi
mov dword [esp], str.Launch4j
call sub.kernel32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov dword [esp + 4], str.__l4j_debug
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401d9a
mov dword [esp + 4], str.debug
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401de8
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00401cb3
test eax, eax
mov dword [0x40b07c], eax
je 0x401e2c
mov dword [esp + 4], str.__l4j_debug_all
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
mov edx, 1
test eax, eax
jne 0x401de2
mov dword [esp + 4], str.debug_all
mov dword [esp], edi
call sub.msvcrt.dll_strstr
xor edx, edx
test eax, eax
setne dl
mov dword [0x40b020], edx
mov eax, dword [0x40b07c]
test eax, eax
je 0x401e09
mov dword [esp + 8], str.3.13
mov dword [esp + 4], str._n_nVersion:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x40b07c]
test eax, eax
je 0x401e30
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.CmdLine:_t_s__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x401e30
xor eax, eax
jmp 0x401e35
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401f26
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, dword [0x40b07c]
test eax, eax
je 0x401f55
mov dword [esp + 8], 0x4138bc
mov dword [esp + 4], str.Error_msg:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
test ebx, ebx
je 0x401fe7
lea eax, [ebp - 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0x1300
call sub.kernel32.dll_FormatMessageA
mov eax, dword [0x40b07c]
sub esp, 0x1c
test eax, eax
je 0x401fb7
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], str.Error:_t_t_s_n
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], 0x40813f
mov dword [esp], 0x4138bc
call sub.msvcrt.dll_strcat
mov ebx, dword [ebp - 0xc]
mov dword [esp], 0x4138bc
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.kernel32.dll_LocalFree
push ecx
mov dword [esp], 0x4138bc
call fcn.00401ec3
cmp byte [0x413cbc], 0
je 0x402054
mov eax, dword [0x40b07c]
test eax, eax
je 0x40201d
mov dword [esp + 8], 0x413cbc
mov dword [esp + 4], str.Open_URL:_t_s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x413cbc
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.shell32.dll_ShellExecuteA
sub esp, 0x18
call fcn.00401d11
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x403360
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403393
call fcn.00403340
test eax, eax
je 0x403393
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 0x19
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403400
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403434
call fcn.00403340
cmp eax, 7
jb 0x403434
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403440
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x403473
call fcn.00403340
test eax, eax
je 0x403473
mov edx, 1
lea ecx, [ebp - 0x10]
call fcn.00403320
mov eax, dword [ebp - 8]
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
shr eax, 9
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403570
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x89b474]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x4035b9
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4035b9
push 0xc00
call eax
test eax, eax
jne 0x40364e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40364e
cmp ecx, 0x104
ja 0x40364e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4035f2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40364d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x403615
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x403612
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004451ed
mov esp, ebp
pop ebp
ret
Function at 0x408b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.00446940
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [eax + ecx]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x408bc7
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0x456570]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x408c10
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x408bf4
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x408bf0
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x408c60
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x408c50
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x409c30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x409c7b
cmp edx, 0x40
je 0x409c67
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.00446940
add esp, 0xc
mov eax, dword [esi]
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov edx, edi
push 1
mov ecx, ebx
call eax
xor edx, edx
jmp 0x409c81
lea edi, [esi + 0x40]
lea ebx, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.00446940
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, edi
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebx
push 1
call eax
mov edi, dword [ebp + 0xc]
mov edx, ebx
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x409cc4
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebx
pop ebp
ret 8

Function at 0x409d30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [0x89b44c]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
pop ebp
ret 4

Function at 0x40a4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call fcn.00449297
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x40a50d
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc