joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100022cc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x1001c954], 0x107
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1001c958], 0xa4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10002335
xor eax, eax
mov dword [0x1001c954], 0x1c0f
mov dword [ebp - 0x14], eax
jmp 0x10002420
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x100023c2
jmp 0x1000230c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x10002380
mov dword [0x1001c958], 0x1707
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], cl
mov al, byte [ebp - 0x25]
test al, 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], edx
jne 0x10002335
jmp 0x10002380
mov eax, dword [ebp - 0x20]
mov dword [0x1001c954], 0xffffff39
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1000230c
mov dword [0x1001c954], 0x8c4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002320
jmp 0x1000230c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1000230c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1000230c
mov dword [0x1001c958], 0xffffe667
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1000230c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1000230c
mov eax, dword [ebp - 0x14]
add esp, 0x28
pop ebp
ret
Function at 0x100025a3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1001c958], 0x1c22
mov esi, dword [0x1001c954]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x10005535]
mov dl, byte [eax + 0x10005506]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
jne 0x100025ce
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
add ecx, 0x38a
mov dword [0x1001c958], ecx
mov dword [0x1001c954], 0x2676
mov dword [ebp - 0x38], eax
call fcn.10002df2
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10001ee4
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x100026e6
mov eax, dword [ebp - 0x3c]
mov dword [0x1001c958], 0xdf2
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1001c958], 0x23a4
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.10003124
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x20], ecx
mov dword [0x1001c954], 0x2677
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x24], ecx
mov dword [0x1001c958], 0x680
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x100026e6
mov dword [0x1001c954], 0x1906
mov eax, dword [ebp - 0x44]
add eax, 0x158a
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x10002a3a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000109a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x10002b90
lea eax, [esp + 0x38]
mov dword [0x1001c954], 0x142d
mov dword [esp + 0x20], eax
call fcn.100022cc
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
jne 0x10002b88
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.100026ef
lea ecx, [0x10002544]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x74], edx
mov dword [esp + 0x3c], 0x141a00
mov edx, dword [0x1001c940]
mov dword [esp + 0x64], edx
mov edx, dword [0x1001c944]
mov dword [esp + 0x78], edx
mov edx, dword [0x1001c948]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1001c94c]
mov dword [esp + 0x44], edx
mov edx, dword [0x1001c950]
mov dword [esp + 0x54], edx
mov dword [0x1001c954], 0xca7
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10002b0e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10002b2c
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x1001c958], 0xfffff8b4
mov dword [esp + 0x14], eax
jmp 0x10002aeb
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x48], esi
mov dword [0x1001c954], 0x2489
mov dword [0x1001c958], 0xae5
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.100025a3
mov dword [0x1001c958], 0x74c
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10002b9a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1001c95c], 0
mov dword [0x1001c960], 0
mov dword [0x1001c96c], 0
mov ebx, dword [0x1001c958]
add ebx, 0xffffeb05
mov dword [0x1001c954], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10002d27
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add edx, 1
mov edi, eax
add edi, 1
mov dword [0x1001c954], 0x1641
mov dword [0x1001c958], 0xf08
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1001c95c], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1001c960], edx
mov dword [0x1001c954], 0x160e
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x1001c964], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1001c964]
mov edx, dword [0x1001c960]
mov byte [ebx + edx], cl
mov edx, dword [0x1001c95c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1001c960]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1001c96c], ecx
mov dword [0x1001c954], 0x2a72
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov ch, byte [edx + esi]
mov edx, dword [0x1001c958]
add edx, 0xfffff0cb
mov dword [0x1001c958], edx
mov dl, cl
add dl, byte [0x1001c971]
mov byte [0x1001c970], dl
mov byte [0x1001c971], ch
mov byte [0x1001c972], cl
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov dword [0x1001c954], 0x138b
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x34], edi
je 0x10002d27
mov eax, dword [0x1001c95c]
mov ecx, dword [0x1001c960]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x10002c05
mov dword [0x1001c958], 0x232
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002f37
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1001c958], 0x2446
mov dword [0x1001c960], 0
mov byte [0x1001c964], 0
mov dword [0x1001c95c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1001c954]
add eax, 0xcff
mov dword [0x1001c958], eax
mov eax, dword [0x1001c95c]
add eax, 1
mov dword [0x1001c95c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10002f7c
xor eax, eax
mov dword [0x1001c954], 0x1e5b
mov dword [0x1001c95c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x1001c968], 0
mov dword [0x1001c958], 0x1a8e
mov edi, dword [0x1001c960]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1001c968], esi
mov dword [0x1001c954], 0x1721
mov eax, esi
cdq
idiv ecx
mov dword [0x1001c960], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x1001c964], cl
mov dword [0x1001c954], 0x1c4e
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x1001c964]
mov esi, dword [0x1001c960]
mov byte [ebx + esi], cl
mov dword [0x1001c958], 0x257f
mov esi, dword [0x1001c95c]
add esi, 1
mov dword [0x1001c95c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x10002fca
mov dword [0x1001c954], 0x1a3f
mov dword [0x1001c958], 0x213
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xa05b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp + 8], eax
mov eax, dword [0xa050ac]
push esi
push edi
test eax, eax
jne 0xa05bcd
mov esi, 0xa05284
mov edx, dword [esi]
lea eax, [ebp - 0x24]
mov cl, byte [edx]
test cl, cl
je 0xa05b8b
lea edi, [ebp - 0x24]
sub edx, edi
xor cl, 0x55
mov byte [eax], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0xa05b7d
lea ecx, [ebp - 0x24]
mov byte [eax], 0
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov edx, dword [esi - 4]
add esi, 8
cmp esi, 0xa0529c
mov dword [edx], eax
jl 0xa05b6d
mov ecx, dword [0xa050ac]
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
push 0
push 0xa052ac
push ecx
mov dword [0xa050a4], eax
call fcn.00a05d80
add esp, 0xc
mov dword [0xa050a8], eax
mov dword [ebp - 4], 0
mov esi, 0xa05284
mov edx, dword [esi]
mov cl, byte [edx]
test cl, cl
je 0xa05c16
mov eax, dword [ebp + 8]
mov al, byte [eax]
test al, al
je 0xa05c16
cmp al, 0x5a
jg 0xa05c02
cmp al, 0x41
jl 0xa05c02
movsx edi, al
add edi, 0x20
movsx ebx, cl
xor edi, 0x55
cmp ebx, edi
je 0xa05c08
xor al, 0x55
cmp cl, al
jne 0xa05c16
mov ecx, dword [ebp + 8]
inc edx
inc ecx
mov dword [ebp + 8], ecx
mov cl, byte [edx]
test cl, cl
jne 0xa05be1
cmp byte [edx], 0
je 0xa05c36
mov edx, dword [ebp - 4]
add esi, 8
inc edx
cmp esi, 0xa0529c
mov dword [ebp - 4], edx
jl 0xa05bd9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov edx, dword [ecx*8 + 0xa05280]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret

Function at 0xa065e0
Capabilities:
Encode data using xor

Disassembly:
loopne 0xa06531
ret
test byte [esi - 0x80], ch
pop ss
xchg ebx, eax
adc byte [edi], 0x93
jo 0xa0650a
xchg ebp, esp
insd dword es:[edi], dx
mov ah, 0x22
push cs
jg 0xa06607
add al, cl
push ebp
jle 0xa06582
xchg ebx, eax
adc dword [esi + 0x46], ebx
sti
pop ecx
daa
dec ebx
push ecx
pop ebp
dec esi
adc eax, dword [ebx - 0x39ae4c85]
jecxz 0xa06593
invalid
jecxz 0xa06613
ja 0xa06584
aas
iretd
xchg edi, eax
jle 0xa0665e
pop ecx
stc
mov al, 0xc1
std
jb 0xa065f5
sar ebp, 0x72
in al, 0x2c
retf 0xf87b
sub al, 0xca
jnp 0xa0660d
push 0xbffaa70d
and dword [ecx + 0x6626c557], edi
push ecx
cmp eax, 0x9ea6e9d1
jle 0xa06626
add eax, 0x85306bab
hlt
invalid
mov dh, 0xe5
mov al, ch
aam 0xb2
and al, 0x1e
jg 0xa066b0
mov ebp, 0x272d9e2f
adc eax, 0x9d18425a
pop edi
pushal
inc esp
lodsd eax, dword [esi]
inc dword [ebx]
bound ebx, qword [eax + 0xb9ab3c3]
jae 0xa06650
xor al, 0x63
push esp
push ebx
jnp 0xa0660a
or al, 0xd7
push cs
sbb byte [ecx - 0x51], bl
stosb byte es:[edi], al
and dword [edi], esi
in al, dx
push esp
and dword [esi - 0x27745f4c], 0xaef0ee5c
dec ebp
fcomp dword [eax - 0x59]
inc ecx
insb byte es:[edi], dx
xlatb
or al, 0xf
test dword [edx], ecx
jecxz 0xa066aa
ret
and esi, dword [edi]
shl byte [edi], 0xcb
pop edi
jecxz 0xa06672
mov byte [0x857e6d71], al
hlt
Function at 0x40a44d
Capabilities:
Delete file
Move file

Disassembly:
push 4
mov eax, 0x4c1b03
call fcn.004ac37c
mov edi, dword [ebp + 8]
mov dword [edi], vtable.CInstallProcessorMainSE.0
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x48c]
test eax, eax
je 0x40a47a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0x49c]
test ebx, ebx
je 0x40a4a5
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x40a491
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x40a49e
mov eax, dword [ecx]
push 1
call dword [eax]
push ebx
call fcn.004a5452
pop ecx
mov eax, dword [edi + 0x498]
test eax, eax
je 0x40a4b4
call fcn.0040a55e
lea ebx, [edi + 0x4c0]
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x10], ebx
jb 0x40a4c7
mov eax, dword [ebx]
jmp 0x40a4c9
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40a4ed
cmp dword [ebx + 0x14], 8
jb 0x40a4e4
mov eax, dword [ebx]
jmp 0x40a4e6
mov eax, ebx
push 4
push 0
push eax
call esi
lea ebx, [edi + 0x4a4]
cmp dword [ebx + 0x14], 8
jb 0x40a4fd
mov eax, dword [ebx]
jmp 0x40a4ff
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40a51d
cmp dword [ebx + 0x14], 8
jb 0x40a514
mov eax, dword [ebx]
jmp 0x40a516
mov eax, ebx
push 4
push 0
push eax
call esi
mov eax, dword [edi + 0x490]
test eax, eax
je 0x40a535
push eax
call fcn.004a5452
and dword [edi + 0x490], 0
pop ecx
mov esi, dword [ebp - 0x10]
push 1
xor edi, edi
call fcn.0040a3ed
push 1
mov esi, ebx
call fcn.0040a3ed
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.0048ccb7
call fcn.004ac454
ret 4

Function at 0x40ac00
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x488], edi
jne 0x40ac3f
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push esi
push 0x40abef
push edi
push edi
mov dword [esi + 0x48c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x48c]
mov dword [esi + 0x488], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
ret
Function at 0x40bcfa
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [0x4f4f38], 0
push ebx
push esi
push edi
mov esi, 0x4f4f38
jne 0x40bda1
and dword [esp + 0x14], 0
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0x4cd1dc
push str.SoftwareSogouExplorer
mov ebx, SysReAllocString
push ebx
mov dword [esp + 0x28], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x40bda1
and dword [esp + 0x18], 0
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
call fcn.00477d67
pop ecx
test al, al
je 0x40bd85
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push str._08X_08X_08X_08X
push esi
call fcn.0040dac7
add esp, 0x18
push esi
call fcn.004a5ed0
pop ecx
push eax
push esi
push 1
push 0x4cd1dc
push str.SoftwareSogouExplorer
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f095
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
mov esi, ecx
xor ebx, ebx
push ebx
mov ecx, 0x4f2bc8
call fcn.0040a347
cmp dword [0x4f2bfc], 8
mov eax, dword [0x4f2be8]
mov byte [0x4f2be4], bl
mov dword [0x4f2bf8], ebx
mov edi, 0x4f2be8
jae 0x40f0cf
mov eax, edi
push ebx
push ebx
push ebx
push 0x40ee38
push ebx
xor ecx, ecx
push ebx
mov word [eax], cx
mov byte [ebp - 2], bl
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40f128
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40f11a
mov al, byte [0x4f2be4]
push 0xffffffffffffffff
mov byte [ebp - 1], al
push ebx
mov eax, edi
mov ecx, esi
call fcn.0040a347
mov byte [ebp - 2], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 2], bl
jne 0x40f13c
cmp dword [esi + 0x14], 8
mov byte [ebp - 1], 1
mov dword [esi + 0x10], ebx
jb 0x40f137
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f169
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x4f06b4]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 8], 6
mov edi, eax
jl 0x40f1e4
push 5
push 0x4cd708
push dword [edi + 4]
call fcn.004a6c39
add esp, 0xc
test eax, eax
jne 0x40f1e4
push str.SE_Install
lea eax, [esp + 0x14]
call fcn.00409d45
push dword [esp + 8]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.00487834
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x14]
call fcn.0040a3ed
xor eax, eax
jmp 0x40f22d
cmp byte [0x4f5a68], 0
jne 0x40f219
push 0x487675
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x48781a
call fcn.004aaa06
pop ecx
call fcn.0049a43f
call fcn.0049a7d6
call fcn.0049a56d
mov byte [0x4f5a68], 1
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
mov ecx, esi
push edi
call fcn.0040e807
add esp, 0xc
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.004a545d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f81e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c54ed
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x4f06b4]
xor eax, esp
mov dword [esp + 0x478], eax
push ebx
push esi
push edi
mov eax, dword [0x4f06b4]
xor eax, esp
push eax
lea eax, [esp + 0x490]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov ebx, 0x4cd72c
xor esi, esi
push ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], esi
call fcn.004a5eb4
pop ecx
push eax
push ebx
xor eax, eax
mov ecx, edi
call fcn.0040f26e
mov edi, eax
lea eax, [esp + 0x80]
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0x200
mov dword [esp + 0x7c], eax
mov dword [esp + 0x498], esi
cmp edi, 0xffffffff
je 0x40f9d7
jmp 0x40f8b7
mov edi, dword [esp + 0x18]
mov eax, edi
sub eax, dword [esp + 0x14]
lea esi, [esp + 0x58]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0040f240
and dword [esp + 0x4c], 0
xor eax, eax
mov dword [esp + 0x50], 7
mov word [esp + 0x3c], ax
mov esi, 0x4cd734
add edi, 2
push esi
mov byte [esp + 0x49c], 2
mov dword [esp + 0x18], edi
call fcn.004a5eb4
pop ecx
mov ecx, dword [esp + 0x10]
push eax
push esi
mov eax, edi
call fcn.0040f26e
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x40f95b
cmp eax, edi
jbe 0x40f95b
sub eax, edi
push eax
push edi
push dword [esp + 0x18]
lea esi, [esp + 0x2c]
call fcn.0040f240
mov ebx, eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x498], 3
call fcn.00409d73
push 1
xor edi, edi
mov byte [esp + 0x49c], 2
call fcn.0040a3ed
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x14], eax
mov ebx, 0x4cd72c
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
call fcn.0048f9a7
mov esi, eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x5c]
call fcn.00407acd
pop ecx
push eax
mov eax, esi
call fcn.00407acd
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.0040a3ed
push ebx
call fcn.004a5eb4
pop ecx
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push ebx
call fcn.0040f26e
push 1
lea esi, [esp + 0x40]
mov dword [esp + 0x1c], eax
call fcn.0040a3ed
push 1
lea esi, [esp + 0x5c]
mov byte [esp + 0x49c], 0
call fcn.0040a3ed
cmp dword [esp + 0x18], 0xffffffff
jne 0x40f8b3
push 0xffffffffffffffff
push dword [esp + 0x18]
lea esi, [esp + 0x28]
push dword [esp + 0x18]
call fcn.0040f240
lea ecx, [esp + 0x74]
push ecx
call fcn.00407acd
pop ecx
push 1
xor edi, edi
call fcn.0040a3ed
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x74]
xor eax, eax
mov word [ecx + edx*2], ax
mov esi, dword [esp + 0x7c]
push esi
call fcn.004a5eb4
pop ecx
mov ecx, esi
mov esi, dword [esp + 0x10]
call fcn.00409cca
lea eax, [esp + 0x80]
cmp dword [esp + 0x7c], eax
je 0x40fa39
push dword [esp + 0x7c]
call fcn.004a5f5b
pop ecx
mov ecx, dword [esp + 0x490]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x478]
xor ecx, esp
call fcn.004a545d
mov esp, ebp
pop ebp
ret
Function at 0x4126dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [esi + 0x118], ebx
jne 0x412735
push 0xffffffffffffffff
push ebx
push dword [ebp + 8]
lea ecx, [esi + 0xc4]
call fcn.0040a00c
push 0xffffffffffffffff
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0xe0]
call fcn.0040a00c
lea eax, [esi + 0xfc]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x41271d
mov eax, dword [eax]
push ebx
push ebx
push esi
push 0x41279a
push ebx
push ebx
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x118], eax
pop ebx
pop ebp
ret 8

Function at 0x41273a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [esi + 0x118], ebx
jne 0x412795
push 0xffffffffffffffff
push ebx
push dword [ebp + 8]
lea ecx, [esi + 0xfc]
call fcn.0040a00c
lea eax, [esi + 0xc4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x41276a
mov eax, dword [eax]
mov byte [eax], bl
lea eax, [esi + 0xe0]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x41277d
mov eax, dword [eax]
push ebx
push ebx
push esi
push 0x41279a
push ebx
push ebx
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x118], eax
pop ebx
pop ebp
ret 4

Function at 0x419c50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x419c7d
push esi
push edi
jmp 0x419c60
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4d5eb8]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x419c60
pop edi
pop esi
ret