joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d00e4
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x4d0120
mov eax, dword [esp]
call fcn.004d004c
test al, al
je 0x4d0109
mov bl, 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x4d0134
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c48
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4d02bd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004d00e4
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004c4a48
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004c4a68
jmp 0x4d0273
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404a10
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409c94
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408db4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408db4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404ba4
je 0x4d0253
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404a10
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408db4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408db4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404ba4
jne 0x4d026a
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004c4a88
test eax, eax
jne 0x4d01b4
push ebx
call sub.kernel32.dll_CloseHandle_1
jmp 0x4d028b
mov eax, dword [ebp - 4]
call fcn.004d0134
mov eax, dword [ebp - 4]
call fcn.004cfedc
test al, al
jne 0x4d0283
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d02c4
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004047cc
lea eax, [ebp - 4]
call fcn.004047a8
ret
Function at 0x4d02d0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c48
mov eax, dword [ebp - 8]
call fcn.00404c48
xor eax, eax
push ebp
push 0x4d0368
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404c58
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x4d034b
push 4
mov eax, dword [ebp - 8]
call fcn.00404c58
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x4d0345
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4d033f
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d036f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047cc
ret

Function at 0x4d0378
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c48
xor eax, eax
push ebp
push 0x4d04a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4d0490
xor eax, eax
push ebp
push 0x4d0489
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404c58
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp dword [ebp - 0x10], 0
jne 0x4d040d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x424
jne 0x4d040d
mov ecx, 0x4d04bc
mov dl, 1
mov eax, dword [0x4080e8]
call fcn.0040d500
cmp dword [ebp - 0x10], 0
je 0x4d0472
xor eax, eax
push ebp
push 0x4d046b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x4d0454
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x420
jne 0x4d0454
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0472
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0490
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d04ad
lea eax, [ebp - 4]
call fcn.004047a8
ret
Function at 0x4d04e4
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c48
xor eax, eax
push ebp
push 0x4d05dd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4d05c7
xor eax, eax
push ebp
push 0x4d05c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404c58
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4d05a9
xor eax, eax
push ebp
push 0x4d05a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DeleteService
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d05a9
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d05c7
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d05e4
lea eax, [ebp - 4]
call fcn.004047a8
ret
Function at 0x10001a81
Capabilities:
Check if file exists
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push 0xc9
push 0x1000b1cc
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.10001a0a
add esp, 0x10
test eax, eax
je 0x10001c01
push dword [ebp + 8]
mov dword [ebp - 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, 0x80
test eax, eax
je 0x10001b73
push esi
push ebx
push 3
push esi
push 1
push SysAllocStringLen
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x10001c01
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x10001c01
cmp eax, dword [ebp - 4]
jne 0x10001b61
push eax
call fcn.1000427b
pop ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x18]
push esi
push ecx
mov dword [ebp - 0x18], esi
push dword [ebp - 0x14]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001bdb
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], eax
jne 0x10001bdb
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x10]
call fcn.100045d0
add esp, 0xc
test eax, eax
jne 0x10001b58
mov dword [ebp - 0x1c], esi
push dword [ebp - 8]
call fcn.100045c5
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], esi
je 0x10001c05
call fcn.1000199b
test eax, eax
je 0x10001c01
mov dword [ebp - 0xc], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 5
jg 0x10001c01
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x10001b83
lea ecx, [ebp - 0x1c]
push esi
push ecx
mov dword [ebp - 0x1c], esi
push dword [ebp - 4]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001bef
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jne 0x10001bef
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10001c05
push dword [ebp - 8]
call fcn.100045c5
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10001c01
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x10001c08
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001c6c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4048
call fcn.10004680
and word [ebp - 0x4048], 0
push edi
mov ecx, 0xfff
xor eax, eax
lea edi, [ebp - 0x4046]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10001d2e
lea ecx, [ebp - 0x4048]
push ecx
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10001d2e
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x4048]
push 0x1000b1ec
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10001d2e
and word [ebp - 0x48], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x46]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
push ecx
movzx ecx, word [eax + 8]
mov eax, dword [eax + 8]
push ecx
shr eax, 0x10
push eax
lea eax, [ebp - 0x48]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringLen]
push 1
pop eax
jmp 0x10001d30
xor eax, eax
pop edi
leave
ret
Function at 0x100020db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
and dword [ebp - 8], 0
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x1000212a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10002115
call esi
mov esi, eax
jmp 0x100021ef
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100021ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000215e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x1000216e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100021e6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x10002172
jmp 0x1000213d
call esi
jmp 0x100021e4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x100021a5
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.10004680
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.10004290
add esp, 0xc
and byte [edi + esi], 0
test edi, edi
jne 0x100021ad
xor ebx, ebx
jmp 0x100021d8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.10004680
mov ebx, esp
push esi
push ebx
xor eax, eax
push 0xffffffffffffffff
push edi
push eax
push eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ebx
call fcn.100021fb
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10002b3e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.10002b00
mov edi, eax
cmp edi, esi
je 0x10002b7e
cmp dword [ebp - 4], esi
je 0x10002b77
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10002c1b
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x10002bef
lea eax, [ebp - 0x214]
lea ecx, [ebp - 4]
push eax
call fcn.10002b3e
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x10002bdc
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 4]
jmp 0x10002ba1
cmp dword [ebp - 4], esi
je 0x10002bea
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x10002c1b
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10002c02
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x10002c19
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10002c22
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.10004680
push ebx
push esi
push edi
lea eax, [ebp - 0x4018]
mov edi, ecx
push eax
mov dword [ebp - 0x18], edi
call fcn.10002357
xor esi, esi
cmp eax, esi
jl 0x10002da5
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x4018]
push eax
call fcn.10002db2
pop ecx
test eax, eax
pop ecx
jne 0x10002c6d
mov eax, 0x80020009
jmp 0x10002da5
mov ecx, edi
call fcn.1000232e
lea eax, [ebp - 0x2018]
mov ecx, edi
push eax
call fcn.10002357
cmp eax, esi
jl 0x10002da5
movzx eax, word [ebp - 0xe]
sub eax, 8
je 0x10002d6a
sub eax, 9
je 0x10002cca
dec eax
dec eax
jne 0x10002d94
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x2018]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x10002d85
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
jne 0x10002d02
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.10004680
mov edi, esp
push ebx
push esi
push edi
call fcn.10004c10
add esp, 0xc
cmp edi, esi
jne 0x10002d0c
mov eax, 0x80004005
jmp 0x10002da5
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jle 0x10002d5a
lea eax, [ebp - 0x2018]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + edi]
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
call fcn.10002e39
pop ecx
add dword [ebp - 0xc], 2
mov ecx, dword [ebp - 4]
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x10002d1d
xor esi, esi
mov eax, dword [ebp + 8]
push ebx
push edi
push 3
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
jmp 0x10002d8e
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2018]
push eax
push 1
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.10002357
cmp eax, esi
jl 0x10002da5
xor eax, eax
lea esp, [ebp - 0x4024]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push esi
push edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
xor edi, edi
push edi
push str.Hello
push str.Welcome_to_My_Program.
push edi
call esi
push edi
push str.Goodbye
push str.Thank_you_for_using_My_Program._n_n_You_can_uninstall_this_by_going_to_Add_Remove_Programs_in_Control_Panel._
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x41b170
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x651828]
xor edx, edx
cmp eax, edx
jne 0x41b196
xor eax, eax
mov byte [eax + 0x651728], al
inc eax
cmp eax, 0x100
jl 0x41b17e
mov dword [0x651828], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x651728
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41b227
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41b1fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41b1c8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41b2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41b2f3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41b2da
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x41f7b1
cmp eax, 8
jg 0x41f7b1
cmp dword [esp + 0x8c], 2
jl 0x41f7b1
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x41f7b1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x41f7b1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x41f617
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x41f79a
mov ebp, dword [0x46a438]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x41f649
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x41f781
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x41f669
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x46a448]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x41f6a8
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x46a444]
lea ecx, [esp + 0x28]
push ecx
call dword [0x46a404]
test eax, eax
jne 0x41f768
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.0041eba0
cmp eax, 1
jne 0x41f792
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0041f450
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x41f65d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x41f79a
jmp 0x41f634
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.0041e7a0
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c