joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5594ee
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x5594fb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00559507

Function at 0x55adec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
push esi
push edi
sub eax, 0
je 0x55ae69
sub eax, 1
je 0x55ae5a
sub eax, 1
je 0x55ae4b
sub eax, 1
je 0x55ae33
sub eax, 1
je 0x55ae26
sub eax, 1
jne 0x55ae7f
cmp byte [ecx], 0
mov eax, str.true
mov edx, str.false
cmove eax, edx
push eax
jmp 0x55ae6e
cmp dword [ecx], 0
mov eax, 0x5b44c4
cmovne eax, dword [ecx]
jmp 0x55ae23
movsd xmm0, qword [ecx]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp + 8]
call fcn.0055cae3
add esp, 0xc
jmp 0x55ae76
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.0055cbe5
jmp 0x55ae46
push dword [ecx + 4]
push dword [ecx]
push dword [ebp + 8]
call fcn.0055cb7a
jmp 0x55ae46
push 0x5b44c4
mov ecx, dword [ebp + 8]
call fcn.00405560
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 4
push 8
pop ecx
mov esi, 0x5aa8f0
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
call fcn.0052c02c
int3

Function at 0x55aeb9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp esi, 0xffffffff
jne 0x55aed5
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x55aecc
sub esi, ecx
mov eax, accept
cmp esi, 0x7fffffff
cmovae esi, eax
lea eax, [esi + 1]
push eax
call fcn.00533a9e
mov edi, eax
pop ecx
test edi, edi
je 0x55af0a
push esi
push dword [ebp + 8]
push edi
call fcn.00528c60
add esp, 0xc
mov byte [edi + esi], 0
mov eax, edi
pop edi
pop esi
pop ebp
ret
push 9
pop ecx
mov esi, str.Failed_to_allocate_string_value_buffer
mov edi, 0x29a
rep movsd dword es:[edi], dword [esi]
push 0x7b
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.0052c02c
int3
Function at 0x56534b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
call fcn.0052fa92
mov ecx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0xc]
xorps xmm1, xmm1
movsd qword [ebp - 0x20], xmm1
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov al, byte [eax]
mov dword [esi], ecx
mov byte [ebp - 1], al
movzx eax, byte [ecx]
test byte [eax + 0x5ad5b9], 8
je 0x565396
inc ecx
movzx eax, byte [ecx]
test byte [eax + 0x5ad5b9], 8
jne 0x565386
mov dword [ebp + 8], ecx
lea eax, [ebp + 8]
push eax
call fcn.005649db
mov esi, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x18], eax
cmp byte [esi], 0x30
jne 0x5654d3
mov cl, byte [esi + 1]
cmp cl, 0x78
je 0x5653c0
cmp cl, 0x58
jne 0x5654d3
mov al, byte [ebp - 1]
add esi, 2
mov cl, byte [esi]
cmp cl, al
jne 0x5653db
cmp dword [ebp - 0xc], 0
jne 0x565439
mov dword [ebp - 0xc], 1
jmp 0x565436
movzx eax, cl
test byte [eax + 0x5ad5b9], 0x10
je 0x565439
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x5653f8
cmp cl, 0x30
jne 0x5653f8
inc dword [ebp - 0x14]
jmp 0x56542c
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x56542b
movsx eax, cl
push eax
call fcn.00564f46
movsd xmm1, qword [ebp - 0x20]
mulsd xmm1, qword [0x5ab790]
pop ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
jmp 0x56542c
inc edi
cmp dword [ebp - 0xc], 0
mov al, byte [ebp - 1]
je 0x565436
dec edi
inc esi
jmp 0x5653c6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], edi
push 0
pop edi
add eax, ecx
je 0x5654d3
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov cl, byte [esi]
shl eax, 2
cmp cl, 0x70
je 0x565464
cmp cl, 0x50
jne 0x5654b4
lea eax, [ebp + 8]
inc esi
push eax
mov dword [ebp + 8], esi
call fcn.005649db
mov edx, dword [ebp + 8]
mov esi, eax
pop ecx
mov al, byte [edx]
movzx ecx, al
test byte [ecx + 0x5ad5b9], 2
je 0x5654d3
imul ecx, edi, 0xa
movsx edi, al
add edi, 0xffffffd0
add edi, ecx
inc edx
movzx eax, byte [edx]
test byte [eax + 0x5ad5b9], 2
mov al, byte [edx]
jne 0x565485
test esi, esi
je 0x5654a5
neg edi
mov ecx, dword [ebp - 8]
mov eax, ecx
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, edi
mov dword [esi], edx
cmp dword [ebp - 0x18], 0
je 0x5654c1
xorps xmm1, xmmword [0x5bb7e0]
push eax
push ecx
push ecx
movsd qword [esp], xmm1
call fcn.0053386d
add esp, 0xc
jmp 0x5654d5
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56b2c3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004a0800
mov eax, dword [0x5cb074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1018], ebx
call fcn.0055d8de
push ebx
lea esi, [eax - 1]
mov dword [ebp - 0x1020], esi
call fcn.00577085
pop ecx
pop ecx
test esi, esi
jne 0x56b339
push 1
push ebx
push edi
call fcn.0056b94d
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov ebx, eax
inc esi
push dword [ebp - 0x1018]
call fcn.005303bf
pop ecx
test eax, eax
je 0x56b495
push 0
push 0
push edi
call fcn.0055ef3e
jmp 0x56b490
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.0055edb0
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp - 0x1020]
add esp, 0xc
inc ebx
mov dword [ebp - 0x101c], esi
dec eax
mov dword [ebp - 0x1020], eax
test ebx, ebx
je 0x56b316
push esi
push edi
call fcn.0055e694
pop ecx
pop ecx
cmp eax, 3
jne 0x56b406
push esi
push edi
call fcn.0055ec3d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x56b3b6
mov ebx, dword [ebp - 0x1018]
push ebx
call fcn.00530810
mov esi, eax
push ebx
push esi
call fcn.00530f69
push 0x5b44c4
push edi
call fcn.0055dda4
xor ebx, ebx
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x56b3fe
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.0055eb91
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.0055f4c7
push dword [ebp - 0x1018]
push esi
push 1
push eax
call fcn.00531371
mov esi, eax
lea eax, [ebp - 0x1014]
add dword [ebp - 0x100c], esi
push eax
call fcn.0055f546
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [ebp - 0x101c]
jmp 0x56b46a
push 0
push esi
push edi
call fcn.0055ec9d
add esp, 0xc
cmp byte [eax], 0x2a
jne 0x56b418
inc eax
movsx eax, byte [eax]
sub eax, 0x4c
je 0x56b457
sub eax, 0x15
je 0x56b444
sub eax, 0xb
je 0x56b440
dec eax
sub eax, 1
jne 0x56b484
push dword [ebp - 0x1018]
push edi
call fcn.0056ba62
pop ecx
pop ecx
jmp 0x56b468
push 1
jmp 0x56b459
push dword [ebp - 0x1018]
push edi
call fcn.0056b8d9
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x56b46a
push 0
push dword [ebp - 0x1018]
push edi
call fcn.0056b94d
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1020]
inc esi
mov dword [ebp - 0x101c], esi
test eax, eax
jne 0x56b35d
jmp 0x56b316
push str.invalid_format
push esi
push edi
call fcn.0055eab4
add esp, 0xc
jmp 0x56b4af
test ebx, ebx
jne 0x56b4aa
push 0xfffffffffffffffe
push edi
call fcn.0055e35f
push edi
call fcn.0055dd72
add esp, 0xc
sub esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fa97
mov esp, ebp
pop ebp
ret
Function at 0x56b4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0055d8de
mov edi, dword [ebp + 0x10]
pop ecx
push 1
pop esi
sub eax, edi
je 0x56b586
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.0055e694
pop ecx
pop ecx
cmp eax, 3
jne 0x56b559
push edi
push ebx
call fcn.0055d999
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x56b51b
call fcn.0055e4eb
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.0055ca90
add esp, 0x1c
jmp 0x56b536
call fcn.0055e5b4
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0055ca90
add esp, 0x10
test esi, esi
je 0x56b53e
test eax, eax
jg 0x56b581
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x56b4df
test esi, esi
jne 0x56b586
push esi
push esi
push ebx
call fcn.0055ef3e
add esp, 0xc
jmp 0x56b589
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.0055ec9d
add esp, 0xc
test esi, esi
je 0x56b53e
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.00530c0b
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x56b53e
xor esi, esi
inc esi
jmp 0x56b540
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56b8d9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a0800
mov eax, dword [0x5cb074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1014]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.0055eb91
pop ecx
pop ecx
mov edi, 0x1000
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.0055f4c7
push esi
push edi
push 1
push eax
call fcn.00531371
add dword [ebp - 0x100c], eax
add esp, 0x18
cmp eax, edi
je 0x56b90c
lea eax, [ebp - 0x1014]
push eax
call fcn.0055f546
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049fa97
mov esp, ebp
pop ebp
ret
Function at 0x575689
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5cb074]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5f11d8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x5f11c8
jne 0x575713
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005296a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x444]
call fcn.004053a0
push eax
mov ecx, edi
call fcn.00405350
push 0
push 1
lea ecx, [ebp - 0x444]
call fcn.00405c70
push ebx
lea ecx, [ebp - 0x42c]
call fcn.00405420
cmp dword [0x5f11dc], 8
lea ecx, [ebp - 0x444]
cmovae edi, dword [0x5f11c8]
push edi
call fcn.004053a0
push str._install_path_
lea ecx, [ebp - 0x45c]
call fcn.004053a0
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00575624
add esp, 0xc
lea ecx, [ebp - 0x45c]
xor ebx, ebx
push ebx
push 1
call fcn.00405c70
push ebx
push 1
lea ecx, [ebp - 0x444]
call fcn.00405c70
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005296a0
add esp, 0xc
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
call fcn.004053a0
cmp dword [esi + 0x14], 8
mov byte [ebp - 0x45d], 0x5c
mov byte [ebp - 0x45e], 0x2f
jb 0x5757e6
mov ecx, dword [esi]
jmp 0x5757e8
mov ecx, esi
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
jb 0x5757f8
mov ecx, dword [esi]
jmp 0x5757fa
mov ecx, esi
lea edx, [ebp - 0x45d]
push edx
lea edx, [ebp - 0x45e]
push edx
push eax
push ecx
call fcn.0051e74f
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ebx
push 1
call fcn.00405c70
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fa97
mov esp, ebp
pop ebp
ret
Function at 0x575833
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5cb074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x22c
push 0
push eax
call fcn.005296a0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x5758d2
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x5758c7
cmp dword [edi + 0x14], 8
jb 0x575898
mov eax, dword [edi]
jmp 0x57589a
mov eax, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x5758ba
lea eax, [ebp - 0x228]
mov ecx, ebx
push eax
call fcn.00576253
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x57588e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fa97
mov esp, ebp
pop ebp
ret

Function at 0x5758e3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5cb074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.005296a0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x575926
xor al, al
jmp 0x575995
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x575988
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004053a0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041a890
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.00424e20
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00406120
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405c70
lea eax, [ebp - 0x260]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x57593f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fa97
mov esp, ebp
pop ebp
ret
Function at 0x576a76
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
push ecx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [eax], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x576aeb
push esi
push edi
call fcn.0049fd23
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x576ae3
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x5b5f78
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x576ae3
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.0049faee
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x576af1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x576b13
cmp word [ebp - 0x24], 6
je 0x576b13
xor al, al
jmp 0x576b15
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40411c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x990
mov edi, ecx
movzx ecx, byte [ecx + 0x519]
call fcn.00404139
Function at 0x40ee3f
Capabilities:
Encode data using base64
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x380
mov eax, dword [ecx + 8]
mov ebx, ecx
test al, 1
jne 0x40ef69
mov edx, dword [ebx + 4]
lea ecx, [esp + 0xb8]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], 2
and dword [ecx + 0xc], 0
lea eax, [esp + 0x15c]
mov dword [esp + 4], edx
mov dword [eax], 0x110002
mov dword [ecx + 0x10], eax
call fcn.00401628
test al, 1
je 0x40ef78
lea esi, [esp + 0x188]
lea edi, [esp + 0xb8]
mov dword [esp + 8], ebx
mov ebx, edx
mov ecx, esi
mov edx, edi
call fcn.00401714
mov ecx, dword [esi]
xor eax, eax
dec eax
inc ecx
cmove ecx, eax
cmp ecx, 9
push 8
pop eax
cmovb ecx, eax
xor edx, edx
call fcn.0050d387
lea ecx, [esp + 0x8c]
mov byte [edx], bl
mov edi, edx
mov dword [ecx], eax
mov dword [ecx + 4], edx
lea edx, [esp + 0xb8]
mov dword [ecx + 8], 1
mov eax, dword [edx + 0x10]
movq xmm0, qword [edx]
movq xmm1, qword [edx + 8]
mov dword [esi + 0x10], eax
movq qword [esi + 8], xmm1
movq qword [esi], xmm0
xor esi, esi
inc esi
lea ecx, [esp + 0x188]
call fcn.00401628
test al, 1
je 0x40ef81
cmp esi, dword [esp + 0x8c]
mov ebx, edx
mov eax, esi
jne 0x40ef5a
lea ecx, [esp + 0x108]
lea edx, [esp + 0x188]
call fcn.00401714
mov edx, dword [esp + 0x108]
mov eax, 0xffffffff
lea ecx, [esp + 0x8c]
inc edx
cmove edx, eax
call fcn.005de5e8
mov edi, dword [esp + 0x90]
mov eax, esi
mov byte [edi + eax], bl
inc eax
mov esi, eax
mov dword [esp + 0x94], eax
jmp 0x40ef05
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
call fcn.00518bab
jmp 0x40f6b4
xor edi, edi
xor ecx, ecx
xor esi, esi
inc edi
jmp 0x40ef8c
mov ecx, dword [esp + 0x8c]
mov ebx, dword [esp + 8]
mov eax, dword [esp + 0x15c]
cmp eax, 0x110002
mov dword [esp + 0x3c], eax
jne 0x40efaa
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], edi
mov esi, ecx
jmp 0x40efc1
mov eax, dword [esp + 0x160]
mov edx, edi
mov dword [esp + 0x50], eax
call fcn.00518bab
mov esi, 0x80000000
mov edx, dword [esp + 4]
mov ecx, dword [ebx]
call fcn.00518bab
cmp esi, 0x80000000
je 0x40f6b4
mov dword [esp + 0x84], esi
lea esi, [esp + 0xb8]
mov edx, 0x638e6c
mov ecx, esi
push 2
call fcn.004536d0
pop eax
cmp dword [esi], 0x80000000
jne 0x40ffa8
mov esi, dword [esp + 0xbc]
mov edi, dword [esp + 0xc0]
push esi
jmp 0x7f7b58
push 4
pop ecx
xor edx, edx
call fcn.0050d387
mov esi, eax
mov edi, edx
mov dword [edx], 0x31727265
mov ecx, esi
mov edx, edi
call fcn.00518bab
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0xb8]
movsd xmm1, qword [esp + 0xc0]
lea eax, [esp + 0x188]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x638e70
push 0x63775c
push eax
call fcn.0062d770
int3
Function at 0x411147
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, edx
mov edx, dword [edx + 4]
lea esi, [esp + 0x10]
mov ebx, ecx
mov ecx, esi
mov dword [esp], edx
push dword [edi + 8]
call fcn.005aabd0
pop eax
mov ecx, dword [esi]
mov ebp, dword [esi + 4]
mov eax, dword [esi + 8]
cmp ecx, 0x80000000
je 0x4111a1
lea edx, [esp + 0x1c]
lea esi, [esp + 4]
mov dword [edx], ecx
mov dword [edx + 4], ebp
mov dword [edx + 8], eax
mov ecx, esi
push 1
call fcn.005b17b0
pop eax
mov eax, dword [esi]
mov ebp, dword [esi + 4]
cmp eax, 0x80000000
jne 0x4111ba
mov eax, dword [esp + 0xc]
mov esi, dword [esp]
mov dword [ebx + 4], eax
mov dword [ebx], ebp
mov ecx, dword [edi]
mov edx, esi
call fcn.00518bab
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, eax
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4111cc
mov byte [ebx], 4
jmp 0x4111d7
call sub.KERNEL32.dll_GetLastError
mov byte [ebx], 0
mov dword [ebx + 4], eax
test esi, esi
mov esi, dword [esp]
je 0x4111a9
push 2
pop edx
mov ecx, ebp
call fcn.004533f0
jmp 0x4111a9

Function at 0x414f2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 2
jne fcn.004170c8
add ecx, 4
push ecx
call fcn.00416dc5
pop eax
ret
Function at 0x427328
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
cmp dword [edx], 0
mov edi, edx
je 0x427356
lea edx, [edi + 8]
mov eax, dword [edi + 0x30]
cmp dword [edi + 0x24], 0xffffffff
mov esi, dword [edi + 0x34]
mov ebx, dword [edi + 0x38]
mov edi, dword [edi + 0x3c]
je 0x427438
push 0
jmp 0x42743a
mov dword [esp + 4], ecx
mov al, byte [edi + 0xe]
mov edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
mov esi, dword [edi + 4]
mov bl, byte [edi + 0xc]
xor ebp, ebp
mov byte [esp + 3], al
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
cmp byte [esp + 3], 0
jne 0x42745f
mov edx, dword [esp + 0xc]
mov eax, ebx
mov ecx, esi
xor al, 1
mov byte [edi + 0xc], al
push dword [esp + 0x10]
call fcn.00419409
pop ecx
test eax, eax
je 0x42746d
test edx, edx
je 0x427448
mov bh, byte [eax]
movzx ecx, bh
test bh, bh
jns 0x4273fc
mov dword [esp + 8], esi
movzx esi, byte [eax + 1]
and ecx, 0x1f
and esi, 0x3f
cmp bh, 0xdf
jbe 0x4273ec
movzx edx, byte [eax + 2]
shl esi, 6
and edx, 0x3f
or edx, esi
cmp bh, 0xf0
jb 0x4273f3
movzx eax, byte [eax + 3]
and ecx, 7
shl edx, 6
shl ecx, 0x12
and eax, 0x3f
or eax, edx
or ecx, eax
jmp 0x4273f8
shl ecx, 6
or ecx, esi
jmp 0x4273f8
shl ecx, 0xc
or ecx, edx
mov esi, dword [esp + 8]
test bl, bl
jne 0x42744c
cmp ecx, 0x110000
je 0x42745b
cmp ecx, 0x80
mov eax, 1
jb 0x42742c
cmp ecx, 0x800
push 2
pop eax
jb 0x42742c
cmp ecx, 0x10000
push 4
pop eax
sbb eax, 0
add esi, eax
mov bl, 1
mov dword [edi + 4], esi
jmp 0x427377
push 1
push edi
push ebx
push esi
push eax
call fcn.004194bf
add esp, 0x28
jmp 0x427468
test bl, bl
je 0x42745b
mov eax, dword [esp + 4]
xor ebp, ebp
inc ebp
mov dword [eax + 4], esi
mov dword [eax + 8], esi
jmp 0x427463
mov byte [edi + 0xe], 1
mov eax, dword [esp + 4]
mov dword [eax], ebp
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0x7883cc
push edx
push esi
call fcn.0062d9d0
Function at 0x4428b4
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x250
mov esi, esp
mov dword [esi + 0x238], ebp
lea eax, [esi + 0x240]
mov dword [esi + 0xec], ecx
lea edi, [esi + 0x1e4]
mov dword [esi + 0x3c], edx
mov edx, str.SYSTEMROOTC:WindowsSystem32drivers.sys
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5e6b90
mov ecx, dword fs:[0]
mov dword [eax], ecx
call fcn.00442901
Function at 0x45e830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x45e880
cmp esi, edi
ja 0x45e8e8
cmp edi, dword [esp + 0x1c]
ja 0x45e8f6
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x45e882
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x45e870
jmp 0x45e8df
ja 0x45e888
cmp eax, edx
mov esi, edi
jne 0x45e843
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x45e8c0
mov ebp, esi
sub ecx, edx
jns 0x45e8d7
jmp 0x45e8e1
cmp esi, edi
je 0x45e906
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x45e8e1
xor al, 1
cmp ebp, edi
jne 0x45e8a0
jmp 0x45e8e1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x707ef0
call fcn.0062d670
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x707ef0
call fcn.0062d450
mov ecx, 0x707ee0
call fcn.0062d7f0
Function at 0x463dd4
Capabilities:
Get system information on windows

Disassembly:
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x30]
mov edi, esp
xorps xmm0, xmm0
mov eax, dword [esi]
mov byte [eax], 0
and dword [edi + 0x20], 0
movups xmmword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
push edi
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [edi + 0x14]
lea ecx, [eax*4]
test eax, eax
push 4
pop edx
cmovne edx, ecx
xor eax, eax
inc eax
mov ecx, edx
sub ecx, eax
bsr ecx, ecx
xor edi, edi
dec edi
not ecx
shr edi, cl
mov ecx, dword [esi + 4]
inc edi
cmp edx, eax
cmovb edi, eax
mov ecx, dword [ecx]
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov al, 1
add esp, 0x24
pop esi
pop edi
ret

Function at 0x468daf
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, edx
mov dword [esp], ecx
mov esi, dword [esp]
test ebp, ebp
je 0x468df3
lea eax, [esi + ebp]
mov ebx, ebp
mov dword [esp], eax
push 2
push ebp
push esi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor ebp, ebp
cmp eax, 0xbfffffff
jbe 0x468db9
mov edi, eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x468db9
add edi, 0x80000000
jmp 0x468df5
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret