joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410930
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x428], eax
test eax, eax
jne 0x410966
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], esi
push eax
push 9
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410953
push ebx
push edi
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor edi, edi
push 0x104
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x410a95
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x410a73
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410a67
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.004465ad
add esp, 8
test eax, eax
mov eax, 1
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x410a95
push 0x104
lea eax, [ebp - 0x20c]
inc edi
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4109d1
push dword [ebp - 0x418]
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
Function at 0x4115d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
jne 0x411602
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push 0
push str.SYSTEMCurrentControlSetServices_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41169f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x20c]
push esi
push 0x104
push eax
xor esi, esi
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x411690
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004527a9
add esp, 8
test eax, eax
je 0x4116b3
push 0x104
lea eax, [ebp - 0x20c]
inc esi
push eax
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
je 0x411662
xor ebx, ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
mov ebx, 1
jmp 0x411692
Function at 0x411ce0
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], 0
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
jne 0x411d65
xor ecx, ecx
jmp 0x411d7f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411d70
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.00402100
push 0x3e
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea ecx, [ebp - 0x848]
mov dword [ebp - 4], 0
call fcn.00405220
cmp word [esi], 0
jne 0x411db5
xor ecx, ecx
jmp 0x411dcf
mov ecx, esi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411dc0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x848]
call fcn.00405220
push 4
push str..lnk
lea ecx, [ebp - 0x848]
call fcn.00405220
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x411efc
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.004463a0
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004463a0
add esp, 0x18
lea ecx, [ebp - 0x848]
cmp dword [ebp - 0x834], 8
lea edx, [ebp - 0x830]
cmovae ecx, dword [ebp - 0x848]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x411e56
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0040fda0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411eb4
sub ecx, edx
sar ecx, 1
jne 0x411ee8
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x628]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x422], ax
test ax, ax
jne 0x411ed0
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x411efc
mov esi, 1
jmp 0x411efe
xor esi, esi
mov ecx, dword [ebp - 0x834]
cmp ecx, 8
jb 0x411f1c
inc ecx
push ecx
push dword [ebp - 0x848]
lea ecx, [ebp - 0x848]
call fcn.00402250
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
Function at 0x411f40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x633188]
test al, al
jne 0x411fe3
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x411fde
lea eax, [ebp - 0x20c]
push eax
call fcn.00452ac7
lea eax, [ebp - 0x20c]
push str.config_systemprofile
push eax
call fcn.004465ad
add esp, 0xc
test eax, eax
jne 0x411fc9
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.004465ad
add esp, 8
test eax, eax
je 0x411fde
mov al, 1
mov byte [0x633188], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
mov al, byte [0x633188]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x412ee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
push 0
push eax
mov esi, ecx
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x412f66
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x412f31
mov eax, dword [0x5a7cc8]
mov ecx, esi
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00412000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 4
Function at 0x417df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3755
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62e15c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
call fcn.004054f0
lea ecx, [esi + 0x160]
mov dword [ebp - 4], 0
call fcn.0040b950
lea ecx, [esi + 0x21c]
mov byte [ebp - 4], 1
call fcn.004140b0
lea ecx, [esi + 0x224]
mov byte [ebp - 4], 2
call fcn.004036c0
push 0x2710
push 1
mov byte [ebp - 4], 3
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004291b0
dec eax
add esp, 8
cmp eax, 0x63
ja 0x417eb7
mov dword [esi + 0x2c], 1
mov dword [esi + 0x218], 0
mov eax, esi
mov byte [esi + 0x2a4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418d40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a399a
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 9
xor eax, eax
mov dword [ebp - 0x44], 7
push str.WnUpd.exe
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.00402100
cmp dword [ebp - 0x48], 0
mov dword [ebp - 4], 0
je 0x418f1f
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x5a7890
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00402100
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x5a7890
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00402100
mov eax, dword [0x633164]
mov byte [ebp - 4], 2
test eax, eax
jne 0x418e21
push 0x120
call fcn.0043ab8a
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x418e16
mov ecx, eax
call fcn.00419c80
jmp 0x418e18
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x633164], eax
mov ecx, eax
call fcn.0043c629
mov edx, eax
cmp word [edx], 0
jne 0x418e34
xor ecx, ecx
jmp 0x418e4f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418e40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402100
push 9
push str.WnUpd.exe
lea ecx, [ebp - 0x28]
call fcn.00405220
push 1
push 0x5a9580
lea ecx, [ebp - 0x40]
call fcn.00402100
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00405110
push 2
push 0x5a9584
lea ecx, [ebp - 0x40]
call fcn.00405220
push 2
push 0x5a95ec
lea ecx, [ebp - 0x40]
call fcn.00405220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418ee1
cmp dword [ebp - 0x2c], 8
lea esi, [ebp - 0x40]
cmovae esi, dword [ebp - 0x40]
call fcn.0042c8d7
push esi
test eax, eax
je 0x418ed9
mov ecx, edi
call fcn.00419a30
jmp 0x418ee1
call fcn.00433570
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x418ef6
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402250
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x418f1f
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402250
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x418f34
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
Function at 0x419a30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
lea eax, [ebp - 8]
push str.EXPLORER.EXE
push eax
call fcn.004192e0
test eax, eax
jne 0x419a50
xor eax, eax
mov esp, ebp
pop ebp
ret 4
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 4]
mov dword [ebp - 0x54], str.winsta0default
mov dword [ebp - 4], 0
push 1
push dword [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x419a48
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push dword [ebp - 4]
push 0x420
push 0
push 0
push 0
push dword [ebp + 8]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esp, ebp
pop ebp
ret 4

Function at 0x41a8a0
Capabilities:
Create thread

Disassembly:
push esi
push 4
push 0x5a9738
mov esi, ecx
call fcn.0041b2d0
lea eax, [esi + 0x34]
push eax
push 0
push esi
push 0x41a920
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
pop esi
ret 8

Function at 0x41b220
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push eax
push str._s_Failed_error_0x_08lx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041b1a0
add esp, 0x14
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41b2b4
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 8

Function at 0x41b2d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push dword [edi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41b326
mov ecx, dword [edi + 4]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41b6e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3e83
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x62e15c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x6334e8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x6334e8
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5a765c
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041f240
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x637980], ecx
inc eax
cmp eax, 0x100
jb 0x421e62
cmp eax, 0x800
jae 0x421f33
nop
mov edx, dword [eax*4 + 0x637580]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x637980]
mov dword [eax*4 + 0x637980], edx
inc eax
cmp eax, 0x800
jb 0x421f10
mov dword [0x6334f4], 0x422cd0
call fcn.00422b00
mov ecx, dword [0x6334f4]
test eax, eax
mov edx, 0x422d70
cmove ecx, edx
mov dword [0x6334f4], ecx
ret
Function at 0x423050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x423070
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x4230a2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x42309f
inc esi
cmp esi, edx
jb 0x423090
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x4231cc
cmp ecx, 3
jbe 0x4230e2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x423120
cmp cl, 0xff
je 0x423120
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x423084
dec ecx
shl eax, cl
and eax, 7
je 0x4230ba
movzx ecx, byte [eax + 0x5aa184]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x5aa17c], 0
mov cl, byte [edx + 4]
je 0x42310a
test cl, cl
je 0x42310a
cmp cl, 0xff
jne 0x4230ba
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x423084
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x42314e
lea edx, [edi + ebx]
add edx, esi
jmp 0x423154
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x423192
movzx edi, byte [eax + 0x5aa184]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x42317e
cmp cl, 0xff
jne 0x423192
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x423141
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x423084
pop edi
pop esi
cmp ecx, 3
jbe 0x4231e1
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427aaf
Capabilities:
Write file on windows

Disassembly:
invalid
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x427ae5
xor eax, eax
jmp 0x427b96
call fcn.00425f22
test al, al
je 0x427b06
inc ecx
pop eax
jne 0x427a7d
jl 0x427b04
jp 0x427b62
pop edx
inc eax
jb 0x427b06
pushal
salc
aad 0xf9
test dword [ebx - 0x24cc078b], ecx
inc ebx
fild dword [ebx - 0x7d]
cld
add byte [ebp + 0x6afc45], cl
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425e53
test al, al
je 0x427b4b
mov byte [esi], ah
jbe 0x427b3c
and edi, dword [ebx]
xchg esp, eax
test al, 0x3e
retf
dec eax
mov esp, 0xafa47737
push esp
adc eax, 0xb8ef700
leave
jae 0x427b5b
call fcn.00425cb5
test al, al
je 0x427b69
inc esp
push cs
push ds
xchg ecx, eax
test eax, 0xc4c014d
dec byte [edi]
push 0x9bdbac2a
sub eax, 0x84355cc2
dec esp
or al, 0xfe
punpckhbw mm5, qword [edx]
lodsb al, byte [esi]
fistp dword [ebx + 0x355cc22d]
test al, ch
mov al, byte [0x84ffffe2]
sal byte [edx + edx - 7], 0xf8
call fcn.00425e0e
test al, al
je 0x427b84
stc
clc
jecxz 0x427bbb
sub eax, 0x6e155140
mov ebp, 0x71cbe6da
int1
wait
cwde
cmp dword cs:[ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x427b92
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x427b94
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jmp 0x427bda
pop ebp
ret 0xc
Function at 0x42aab6
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.0043b0b0
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.0042a973
test eax, eax
je 0x42ac60
xor ebx, ebx
push ebx
call fcn.00449ca1
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.00452df4
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.0042a7a4
add esp, 0x28
call fcn.00425d84
test al, al
je 0x42ab6e
cli
dec edx
adc al, 0xa0
inc ebx
pop esp
push ds
fisttp qword [ebx - 0x594a2f6c]
push es
scasd eax, dword es:[edi]
sub esi, dword [eax - 0xb427441]
invalid
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.00425ff1
test al, al
je 0x42ab9f
retf
push 0x5aa1d0
push edi
call fcn.00453541
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x42ac60
cmp dword [ebp - 0x200c], 0
jne 0x42abe2
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.004549db
add esp, 0x10
call fcn.00425f22
test al, al
je 0x42ac03
adc bh, byte [di - 0x49]
and byte [ebx - 0x1b], 0x69
xor dl, byte cs:[ecx + ecx*8]
jae 0x42ac52
into
jp 0x42ac79
retf
lea eax, [ebp - 0x2004]
push eax
call fcn.00454a97
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.004549db
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.004549db
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.004549db
push ebx
call fcn.0045333f
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ae55
mov esp, ebp
pop ebp
ret
pop edx
add al, ch
or dword [edi], eax
add dword [eax], eax