joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42702c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x427048
cmp dword [esi + 4], 0
je 0x427075
test byte [ebx + 0x45], 1
jne 0x427067
mov eax, ebx
call fcn.00425f64
test eax, eax
jne 0x427067
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x427185
mov edx, esi
mov eax, ebx
call fcn.00426ca4
jmp 0x427185
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42717e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00428ffc
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00423f08
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0042702c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00428ffc
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427185
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4307d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004038d8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x430827
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00403b08
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4381d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4477d8
cmp dword [edi], 0
jne 0x43824c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4477d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x446894
mov ecx, 2
call fcn.004027e4
mov edx, 0x4381a8
lea eax, [esi + 5]
call fcn.004381c8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004381c8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x438221
mov dword [0x4477d4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x438368
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4383b8]
test si, 4
je 0x43837c
or bl, 1
test si, 8
je 0x438386
or bl, 4
test si, 1
je 0x438390
or bl, 8
test si, 2
je 0x43839a
or bl, 0x10
test si, 0x10
je 0x4383a4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4383b3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4383bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4383f4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4383d5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4383e4
or bl, 4
test esi, 0x20000000
je 0x4383ef
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x43e59c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x43e5ae
add esp, 0xfffffff0
call fcn.00402f50
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411bc8
mov eax, ebx
call fcn.0043e8e8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x43e56c
push eax
push 0
push 0
mov eax, dword [0x446ce0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x413090]
call fcn.0041436c
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x413090]
call fcn.0041436c
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x413090]
call fcn.0041436c
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0043ecc8
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43ebe4
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43ebe4
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43ebe4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43e6bd
call fcn.00402fa8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43e9c8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43eb73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x43eb54
mov dl, 1
mov eax, dword [0x40bfd8]
call fcn.00402c38
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004038d8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x43eb43
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0042d3f8
test al, al
je 0x43eb36
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x43eb84
lea eax, [ebp - 0x254]
call fcn.004084ec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43eb36
xor eax, eax
push ebp
push 0x43eb2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x43ebbc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x43eb18
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00403b08
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x43eb18
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00403b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43eb36
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x43ea39
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040ec5c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43eb7a
lea eax, [ebp - 0x260]
call fcn.004038d8
ret

Function at 0x43f3c0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4477c8]
cmp byte [eax + 0x95], 0
jne 0x43f431
cmp dword [0x4477e4], 0
jne 0x43f3f2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x43f37c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4477e4], eax
cmp dword [0x4477e0], 0
jne 0x43f40d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4477e0], eax
cmp dword [0x4477e8], 0
jne 0x43f431
push esp
push 0
push 0
push 0x43f320
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4477e8], eax
pop edx
ret
Function at 0x43f528
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x43f53f
add esp, 0xfffffff0
call fcn.00402f50
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411bc8
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40bcd8]
call fcn.00402c38
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x4137c4]
call fcn.004191b8
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x43f6b4
mov eax, dword [0x446c08]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00419588
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44104c
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x446c08]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00409874
test eax, eax
je 0x43f632
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407ea0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040989c
test eax, eax
je 0x43f646
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00403b08
mov eax, dword [0x446b0c]
cmp byte [eax], 0
jne 0x43f677
mov eax, ebx
call fcn.0043f7a0
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43f6a9
call fcn.00402fa8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43fa10
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4477c8]
cmp dword [eax + 0x24], 0
je 0x43fab3
cmp dword [ebx + 0x84], 0
jne 0x43faad
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43f9a0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x43faad
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43fa76
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43faad
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d39c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43fa85
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4404c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4404f5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004039c0
jmp 0x4404ff
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.0040392c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4413c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x4413f8
mov eax, esi
call fcn.004292f8
test al, al
je 0x4413f8
mov eax, dword [ebx + 0x74]
call fcn.00428ffc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4413f8
push 0
mov eax, dword [ebx + 0x74]
call fcn.00428ffc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x402560
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
test ecx, ecx
je 0x402665
test edx, edx
je 0x402665
mov ebp, dword [esp + 0x2c]
test ebp, ebp
mov dword [esp], ecx
je 0x4025aa
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x4025b1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x402590
jmp 0x4025b3
mov esi, 0x1505
jmp 0x4025b3
mov esi, ecx
mov ebp, dword [esp]
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x402665
mov dword [esp + 8], edx
mov eax, ecx
or eax, 0xfffffffe
mov edx, ecx
and ecx, 0xfffffffe
lea edi, [eax + ecx]
inc edi
and edi, esi
lea eax, [edx - 1]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0xc], eax
mov ebx, edi
not ebx
inc edi
mov ecx, ebp
mov ebp, edi
jmp 0x4025f9
dec ebx
mov ebp, dword [esp + 0x14]
inc ebp
dec edx
je 0x402663
mov edi, ecx
mov eax, dword [esp + 0x10]
or eax, ebx
mov dword [esp + 0x14], ebp
add eax, ebp
mov ecx, dword [esp + 0xc]
mov ebp, dword [ecx + eax*4]
cmp ebp, 0xffffffff
je 0x402663
mov ecx, edi
mov eax, dword [edi + 8]
cmp dword [eax + ebp*4], esi
jne 0x4025f0
mov eax, dword [ecx + 0xc]
mov edi, dword [eax + ebp*4]
push edi
mov dword [esp + 8], edx
call fcn.00408ec0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x2c]
jne 0x4025f0
push dword [esp + 0x2c]
push edi
push dword [esp + 0x10]
call fcn.00408ee0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x4025f0
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x402665
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403440
Capabilities:
Compute adler32 checksum
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4035e6
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0x4035df
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0x4034d8
add ebp, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov eax, edi
mov esi, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mul esi
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov edx, dword [esp + 4]
mov eax, edx
xor eax, ebx
not edx
and edx, ebx
add edx, edx
mov ebx, edx
mov esi, 0x15b0
sub ebx, eax
je 0x4035df
xor eax, eax
cmp esi, 8
jb 0x403541
mov eax, esi
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop
nop
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
mov edi, esi
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 6]
add eax, esi
mov esi, edi
add ecx, eax
movzx edi, byte [ebp + 7]
add edi, eax
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, esi
jb 0x4034f0
mov eax, dword [esp]
mov edx, esi
sub edx, eax
mov dword [esp + 4], esi
jbe 0x403498
mov dword [esp + 0xc], edx
mov dword [esp], eax
not eax
add eax, esi
mov edx, esi
and edx, 3
mov dword [esp + 0x10], ebx
je 0x403591
mov dword [esp + 8], eax
neg edx
xor eax, eax
mov ebx, ebp
nop
movzx esi, byte [ebx]
inc ebx
add edi, esi
add ecx, edi
dec eax
cmp edx, eax
jne 0x403570
mov edx, dword [esp]
sub edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0x403490
jmp 0x40359f
mov ebx, ebp
mov edx, dword [esp]
cmp eax, 3
jb 0x403490
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x4035b0
jmp 0x403490
shl ecx, 0x10
or ecx, edi
jmp 0x4035eb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403674
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
not edx
test ecx, ecx
je 0x40366b
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [eax + esi]
mov ebx, edx
shr ebx, 4
and edx, 0xf
mov ebp, edx
xor ebp, edx
xor ebp, 0xf
and ebp, edi
xor ebp, edx
mov ebp, dword [ebp*4 + 0x43ca18]
mov edx, ebp
and edx, ebx
add edx, edx
sub ebp, edx
add ebp, ebx
mov edx, ebp
shr edx, 4
shr edi, 4
and ebp, 0xf
xor ebp, edi
mov edi, dword [ebp*4 + 0x43ca18]
mov ebx, edx
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
inc esi
cmp ecx, esi
jne 0x403620
lea eax, [edx + edx]
not eax
add eax, edx
jmp 0x403676
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov eax, edi
and eax, 0xfff
imul ecx, eax, 0x5556
add ecx, 0xaaac
shr ecx, 0x10
inc ecx
mov dword [esi + 0xc], ecx
mov ecx, edi
shr ecx, 0xe
and ecx, 1
mov dword [esi + 0x14], ecx
shr eax, 2
mov ecx, edi
shr ecx, 1
and ecx, 4
xor eax, 2
add eax, ecx
imul eax, eax, 0x5556
shr eax, 0x10
inc eax
movzx eax, ax
mov dword [esi + 0x10], eax
test di, di
js 0x404be9
lea eax, [esi + 0x29272]
push 0x10000
push 0
push eax
call fcn.00408dd0
add esp, 0xc
lea ecx, [esi + 0x9272]
lea edx, [esi + 0x9273]
lea eax, [esi + 0x39272]
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x9272], 0
mov dword [esi + 0x38], 8
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x18], 1
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
test di, di
js 0x404ceb
lea eax, [esi + 0x90]
push 0x8101
push 0
push eax
call fcn.00408dd0
add esp, 0xc
add esi, 0x8192
push 0x280
push 0
push esi
call fcn.00408dd0
add esp, 0xc
xor eax, eax
pop esi
pop edi
ret
Function at 0x4094d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.004095f0
sub esp, 0x100
mov esi, esp
call fcn.00437460
test al, 1
jne 0x4094ef
jmp 0x4095b7
call fcn.0042f7a0
test al, 1
jne 0x4094fd
jmp 0x4095b2
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
jl 0x4095b0
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
jl 0x4095a6
call fcn.0040a650
test al, 1
jne 0x409582
jmp 0x4095a4
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004095d0
add esp, 8
call fcn.0040ee90
call fcn.0040c470
jmp 0x4095a6
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4095ae
jmp 0x4095b0
jmp 0x4095b2
call fcn.00437cd0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x416060
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x416080
sar esi, 1
lea edi, [esp + 0x84]
push edi
push 0
push 0
push esi
push eax
push 0
call dword [0x446c1c]
mov ebx, dword [esp + 0x84]
test ebx, ebx
jns 0x4160b5
mov eax, 0xffffffff
jmp 0x4160b8
lea eax, [ebx + ebx]
push eax
call fcn.00408d40
add esp, 4
push edi
push ebx
mov dword [esp + 0x54], eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x446c1c]
mov dword [esp + 0x18], 0x632e611c
mov dword [esp + 0x1c], 0x67f56505
mov dword [esp + 0x20], 0x6b4a69fc
mov dword [esp + 0x24], 0x6f0b6d1a
mov dword [esp + 0x28], 0x93019102
mov dword [esp + 0x2c], 0x97f995fd
mov dword [esp + 0x30], 0x9b9a99f6
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3b], 0
mov dword [esp + 0xb8], 0
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x26
ja 0x416196
nop
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb8]
movzx edx, byte [esp + edx + 0x18]
lea esi, [ecx - 0x710a0210]
add ecx, 0xf0
or ecx, esi
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0x90], esi
mov ecx, dword [esp + 0x90]
add cl, 0x70
mov edx, dword [esp + 0xb8]
mov byte [esp + edx + 0x18], cl
inc dword [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
cmp ecx, 0x27
jb 0x416140
lea edi, [esp + 0xb8]
lea edx, [esp + 0x18]
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xd4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x84]
mov ecx, eax
add ecx, 0xd
jns 0x4161cf
mov eax, 0xffffffff
jmp 0x4161d4
add eax, eax
add eax, 0x1a
push eax
call fcn.00408d40
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x4c]
movzx ecx, word [eax]
mov eax, ebx
test cx, cx
je 0x416211
mov eax, dword [esp + 0x4c]
lea edx, [eax + 2]
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416200
mov word [eax], 0
movzx ecx, word [esp + 0xb8]
test cx, cx
je 0x416241
lea edx, [esp + 0xba]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x416230
mov word [eax], 0
lea eax, [esp + 0x50]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0043a480
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44111c]