joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416fa0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x416fbe
pop edi
add esp, 0x1c
ret
mov eax, dword [esp + 0x24]
push esi
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x416fe5
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
push ebx
lea ecx, [esp + 0xc]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop esi
pop edi
add esp, 0x1c
ret

Function at 0x417560
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41763c
push ebx
push esi
push edi
push 0x4000
mov dword [esp + 0x10], 0x4000
call fcn.0041a6f2
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call fcn.0041a6f2
add esp, 8
lea edx, [esp + 0xc]
push edx
push esi
push 0
push 0
mov edi, eax
mov eax, dword [esp + 0x24]
push str.List
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x417628
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push edi
push ecx
push esi
call fcn.00417cb0
add esp, 0x18
test eax, eax
jne 0x41760c
push esi
call fcn.0041a615
push edi
call fcn.0041a615
add esp, 8
pop edi
pop esi
lea eax, [ebx + 5]
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push edx
push edi
push 7
push 0
push str.List
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
push esi
call fcn.0041a615
push edi
call fcn.0041a615
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x417a60
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.0041bfd0
push 0xfffffffffffffffe
push 0x43c660
push 0x41c330
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4417c0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x100c]
mov eax, dword [ebp + 0x1010]
mov dword [ebp - 0x1c], eax
mov eax, str.Windows
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417ac0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x24], eax
mov eax, str.SystemRoot
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417ae0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x20], eax
mov eax, str.___
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417b00
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, 0x435870
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417b20
sub eax, edx
sar eax, 1
mov edi, eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
push ecx
push str.Windows
push esi
call fcn.0041ee98
add esp, 0xc
test eax, eax
jne 0x417b7e
push esi
push 0x25
push 0x25
push str.___cSystemDrive_c_s
lea edx, [ebp]
push edx
call fcn.0041c953
add esp, 0x14
mov eax, dword [ebp + 0x1014]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x417c72
mov eax, dword [ebp - 0x20]
push eax
push str.SystemRoot
push esi
call fcn.0041ee98
add esp, 0xc
test eax, eax
jne 0x417bca
mov ecx, dword [ebp - 0x20]
lea edx, [esi + ecx*2]
push edx
push 0x25
push 0x25
push str.___cSystemRoot_c_s
lea eax, [ebp]
push eax
call fcn.0041c953
add esp, 0x14
mov ecx, dword [ebp + 0x1014]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x417c72
push ebx
push str.___
push esi
call fcn.0041ee98
add esp, 0xc
test eax, eax
jne 0x417c01
mov ecx, esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x417be2
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x417c7f
push edi
push 0x435870
lea ecx, [esi + 2]
push ecx
call fcn.0041ee98
add esp, 0xc
push esi
test eax, eax
jne 0x417c34
push str.___s
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0041c953
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x417c7f
push 0x25
push 0x25
push str.___cSystemRoot_cSystem32Drivers_s
lea eax, [ebp]
push eax
call fcn.0041c953
add esp, 0x14
mov ecx, dword [ebp + 0x1014]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x417c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0041a7bc
add ebp, 0x1004
mov esp, ebp
pop ebp
ret
Function at 0x418350
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x3a
push esi
call fcn.0041c28e
add esp, 8
test eax, eax
je 0x41836a
xor eax, eax
pop esi
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ecx, ecx
lea eax, [ebp + 0x400]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041aea6
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4183ae
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4183b6
push ebx
call fcn.0041af0b
add esp, 4
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0xc
cmp word [esi], 0x5c
push edi
jne 0x4183ee
xor eax, eax
mov word [ebx + 4], ax
mov eax, esi
mov edx, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4183c7
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4183e0
jmp 0x41844e
mov eax, ebx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4183f3
mov ecx, dword [str.drivers_]
mov dword [eax], ecx
mov edx, dword [0x43591c]
mov dword [eax + 4], edx
mov ecx, dword [0x435920]
mov dword [eax + 8], ecx
mov edx, dword [0x435924]
mov dword [eax + 0xc], edx
mov ecx, dword [0x435928]
mov dword [eax + 0x10], ecx
mov eax, esi
mov edx, esi
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418430
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x418442
mov edx, dword [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebp
mov ecx, eax
and ecx, 3
push ebx
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0041c2e0
push ebx
call fcn.0041af0b
add esp, 0x10
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 0xc
Function at 0x4199b0
Capabilities:
Delete file

Disassembly:
push 0x800
push 0
push 0x48a620
call fcn.0041a230
mov eax, dword [esp + 0x10]
push 0x400
push eax
push 0x48a620
call fcn.0041c2e0
add esp, 0x18
push 0x48a620
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret

Function at 0x419ae0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push 0x40
push 0
push ebp
push ebx
call fcn.00417430
add esp, 0x10
test eax, eax
jne 0x419c7d
mov eax, 0x5a4d
cmp word [ebp], ax
je 0x419b19
pop ebp
mov eax, 0x4d9
pop ebx
add esp, 0xc
ret
push esi
mov esi, dword [ebp + 0x3c]
test esi, esi
jl 0x419ca5
cmp esi, dword [esp + 0x24]
ja 0x419ca5
push 0x18
push esi
push ebp
push ebx
call fcn.00417430
add esp, 0x10
test eax, eax
jne 0x419c7c
cmp dword [esi + ebp], 0x4550
jne 0x419ca5
movzx eax, word [esi + ebp + 0x14]
movzx ecx, word [esi + ebp + 6]
mov edx, 0xe0
mov dword [esp + 0x10], ecx
cmp ax, dx
ja 0x419ca5
push edi
movzx edi, ax
push edi
add esi, 0x18
push esi
push ebp
push ebx
call fcn.00417430
add esp, 0x10
test eax, eax
jne 0x419c7b
add esi, edi
mov edi, dword [esp + 0x14]
movzx eax, di
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push esi
push ebp
push ebx
call fcn.00417430
add esp, 0x10
test eax, eax
jne 0x419c7b
add esi, ebp
xor ecx, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
cmp cx, di
jae 0x419c9b
jmp 0x419bc9
mov esi, dword [esp + 0x18]
movzx eax, ax
lea edx, [eax + eax*4]
test dword [esi + edx*8 + 0x24], 0x6000800
lea ebx, [esi + edx*8]
jne 0x419c87
mov ecx, dword [esp + 0x20]
cmp ecx, dword [0x48ae28]
jne 0x419c61
lea eax, [eax + eax*4]
lea esi, [esi + eax*8]
mov edi, 1
mov ecx, str..text
mov eax, esi
lea edx, [edi + 7]
sub eax, ecx
mov ebp, dword [eax + ecx]
cmp ebp, dword [ecx]
jne 0x419c17
sub edx, 4
add ecx, 4
cmp edx, 4
jae 0x419c03
xor edi, edi
mov eax, str.PAGE
mov edx, esi
mov ecx, 8
sub edx, eax
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x419c39
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x419c25
xor edi, edi
mov eax, str..edata
mov ecx, 8
sub esi, eax
mov edx, dword [esi + eax]
cmp edx, dword [eax]
jne 0x419c59
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x419c45
jmp 0x419c5d
test edi, edi
jne 0x419c83
mov ebp, dword [esp + 0x24]
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x20]
push eax
push ecx
push ebp
push edx
call fcn.00417430
add esp, 0x10
test eax, eax
je 0x419c87
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp ax, word [esp + 0x14]
jb 0x419bc5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x4d9
pop ebx
add esp, 0xc
ret
Function at 0x41a1a0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2004
call fcn.0041bfd0
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x2000], eax
mov ecx, dword [esp + 0x2008]
lea eax, [esp + 0x200c]
push eax
push ecx
lea edx, [esp + 8]
push 0x1000
push edx
call fcn.0041c792
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x2004
ret

Function at 0x41a7bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4417c0]
jne 0x41a7c6
repz ret
jmp fcn.0042050c

Function at 0x42c990
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00424332
and dword [ebp - 4], 0
cmp dword [0x48dae4], 0
mov ebx, eax
jne 0x42ca41
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42caf2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42caf2
push eax
call fcn.004242c0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48dae4], eax
call esi
push eax
call fcn.004242c0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48dae8], eax
call esi
push eax
call fcn.004242c0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48daec], eax
call esi
push eax
call fcn.004242c0
pop ecx
mov dword [0x48daf4], eax
test eax, eax
je 0x42ca41
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004242c0
pop ecx
mov dword [0x48daf0], eax
mov eax, dword [0x48daf0]
cmp eax, ebx
je 0x42ca99
cmp dword [0x48daf4], ebx
je 0x42ca99
push eax
call fcn.0042433b
push dword [0x48daf4]
mov esi, eax
call fcn.0042433b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42ca99
test edi, edi
je 0x42ca99
call esi
test eax, eax
je 0x42ca90
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42ca90
test byte [ebp - 0xc], 1
jne 0x42ca99
or dword [ebp + 0x10], 0x200000
jmp 0x42cad2
mov eax, dword [0x48dae8]
cmp eax, ebx
je 0x42cad2
push eax
call fcn.0042433b
pop ecx
test eax, eax
je 0x42cad2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42cad2
mov eax, dword [0x48daec]
cmp eax, ebx
je 0x42cad2
push eax
call fcn.0042433b
pop ecx
test eax, eax
je 0x42cad2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48dae4]
call fcn.0042433b
pop ecx
test eax, eax
je 0x42caf2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42caf4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x6720f5
Capabilities:
Encode data using xor

Disassembly:
push 1
pop ecx
cmp dword [esp + 8], ecx
jl 0x672115
mov eax, dword [esp + 4]
mov edx, ecx
and edx, 3
mov dl, byte [esp + edx + 0xc]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, dword [esp + 8]
jle 0x672102
ret
Function at 0x675dc1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x675de3
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x675dd4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x675f11
mov eax, dword [0x408a48]
cmp eax, 1
je 0x675eeb
test eax, eax
jne 0x675e14
cmp dword [0x4085d4], 1
je 0x675eeb
cmp edx, 0xfc
je 0x675f11
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x675e4b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006742cc
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006743cc
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x675e8e
lea eax, [ebp - 0x1a4]
push eax
call fcn.006743cc
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.006766fc
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006742cc
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006742dc
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.006742dc
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.006742dc
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00676673
add esp, 0x2c
pop edi
jmp 0x675f11
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.006743cc
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x719540
Capabilities:
Encode data using xor

Disassembly:
push 1
pop ecx
cmp dword [esp + 8], ecx
jl 0x719560
mov eax, dword [esp + 4]
mov edx, ecx
and edx, 3
mov dl, byte [esp + edx + 0xc]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, dword [esp + 8]
jle 0x71954d
ret
Function at 0x71d20c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x71d22e
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x71d21f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x71d35c
mov eax, dword [0x408a48]
cmp eax, 1
je 0x71d336
test eax, eax
jne 0x71d25f
cmp dword [0x4085d4], 1
je 0x71d336
cmp edx, 0xfc
je 0x71d35c
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x71d296
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0071b717
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0071b817
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x71d2d9
lea eax, [ebp - 0x1a4]
push eax
call fcn.0071b817
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.0071db47
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0071b717
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0071b727
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.0071b727
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0071b727
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0071dabe
add esp, 0x2c
pop edi
jmp 0x71d35c
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.0071b817
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1aacb2c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x101192c0]
xor edx, edx
cmp eax, edx
jne 0x1aacb52
xor eax, eax
mov byte [eax + 0x101191c0], al
inc eax
cmp eax, 0x100
jl 0x1aacb3a
mov dword [0x101192c0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x101191c0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1aacbe3
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1aacbb6
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1aacb84
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1aacc5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1aaccaf
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1aacc96
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1aacf2c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100df517
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.01ad648c
mov eax, dword [0x10117228]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x24], eax
mov ecx, dword [0x10117228]
mov dword [esi + 0x28], ecx
mov edx, dword [0x10117228]
mov dword [esi + 0x2c], edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 3
call fcn.01ad648c
lea edx, [esi + 0x48]
mov ecx, 0x1c
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x494]
mov byte [esp + 0x18], 4
mov dword [edx], 0x42444557
mov dword [edx + 4], 0x10000
call fcn.01b790f6
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x100e802c
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 0xffffffff
mov dword [esi + 0xd0], ebx
mov dword [esi + 0x4a8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1aacf43
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100df517
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.01ad648c
mov eax, dword [0x10117228]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x24], eax
mov ecx, dword [0x10117228]
mov dword [esi + 0x28], ecx
mov edx, dword [0x10117228]
mov dword [esi + 0x2c], edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 3
call fcn.01ad648c
lea edx, [esi + 0x48]
mov ecx, 0x1c
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x494]
mov byte [esp + 0x18], 4
mov dword [edx], 0x42444557
mov dword [edx + 4], 0x10000
call fcn.01b790f6
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x100e802c
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 0xffffffff
mov dword [esi + 0xd0], ebx
mov dword [esi + 0x4a8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1ac12fc
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100e0563
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.01b79ec5
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x100f1368
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x100e9058
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x100e7144]
push eax
mov ecx, edi
call fcn.01b80f32
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.01b825ed
test eax, eax
je 0x1ac1418
mov ecx, dword [esp + 0x3c]
call fcn.01b80f5f
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x100e7754]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x1ac13dc
push edi
mov ecx, esi
call fcn.01b7cbce
mov ecx, esi
call fcn.01ac157c
cmp dword [esp + 0x38], 1
jne 0x1ac1411
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.01b7cd09
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28