joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa501b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a50140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a50140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a50140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a50140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa50bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa50c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa6287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa50c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa50c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x40b113
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
add esi, edi
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jbe 0x40b149
lea eax, [edi + ebx*4]
add eax, dword [esi + 0x20]
je 0x40b143
mov ecx, dword [eax]
push 0xffffffffffffffff
push dword [esp + 0x10]
add ecx, edi
or eax, 0xffffffff
call fcn.0040ed98
test eax, eax
je 0x40b150
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x40b125
xor eax, eax
pop esi
pop ebx
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + edi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x40b14b

Function at 0x40b1c6
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push esi
push edi
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40b1e9
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40b1e0
cmp edi, 0x6a4abc5b
mov eax, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40b1d6
pop edi
pop esi
ret

Function at 0x40bbbc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x588
push esi
push 0x2266108
push edi
call dword [0x2261630]
mov ecx, dword [0x229b2f8]
add ecx, dword [0x229ac34]
add esp, 0xc
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x40bbe2
pop esi
ret

Function at 0x40c8af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 8]
dec eax
dec eax
push edi
je 0x40c91c
call fcn.0040c80f
test al, al
jne 0x40c8cc
xor al, al
jmp 0x40c94a
lea edi, [esi + 4]
xor ebx, ebx
cmp dword [edi], ebx
jne 0x40c905
mov eax, dword [esi + 8]
sub eax, ebx
je 0x40c8e8
dec eax
jne 0x40c8ef
mov dword [ebp - 4], 0x8004
jmp 0x40c8ef
mov dword [ebp - 4], 0x8003
push edi
push ebx
push ebx
push dword [ebp - 4]
push dword [esi]
call dword [0x2261014]
test eax, eax
jne 0x40c905
mov dword [edi], ebx
jmp 0x40c8c8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [0x226101c]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x40c94a
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
cmp dword [ebp + 0xc], ebx
jbe 0x40c946
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x229b308]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x40c927
mov dword [esi], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40dd36
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, edx
push 0x14
sub ecx, eax
sub esi, eax
pop edi
mov dl, byte [ecx + eax]
xor dl, byte [eax]
mov byte [esi + eax], dl
inc eax
dec edi
jne 0x40dd41
pop edi
pop esi
ret
Function at 0x414fdb
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebx
lea ecx, [eax - 0xd]
push esi
push edi
cmp ecx, 6
ja 0x415034
xor esi, esi
xor bl, bl
lea ecx, [eax - 1]
jmp 0x41501d
mov eax, dword [esp + 0x10]
mov al, byte [ecx + eax]
sub al, 0x30
cmp al, 9
ja 0x415034
test bl, bl
je 0x415014
add al, al
cmp al, 9
jle 0x415012
movsx eax, al
cdq
push 0xa
pop edi
idiv edi
lea eax, [edx + 1]
test bl, bl
movsx eax, al
sete bl
add esi, eax
dec ecx
cmp ecx, 0xffffffff
jg 0x414fef
xor edx, edx
push 0xa
mov eax, esi
pop ecx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
jmp 0x415036
xor al, al
pop edi
pop esi
pop ebx
ret 4

Function at 0x42026e
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x22666b0]
xor edx, edx
xor ecx, ecx
cmp dx, word [eax + 2]
jae 0x42029b
push esi
mov edx, dword [eax + 4]
movzx esi, cx
mov dl, byte [edx + esi]
xor dl, byte [eax]
xor dl, cl
inc ecx
mov byte [esi + edi], dl
cmp cx, word [eax + 2]
jb 0x420283
pop esi
movzx eax, word [eax + 2]
mov byte [eax + edi], 0
ret

Function at 0x4202a4
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x22666b0]
xor ecx, ecx
xor edx, edx
cmp cx, word [eax + 2]
jae 0x4202e3
push ebx
push edi
mov edi, dword [eax + 4]
movzx ebx, byte [eax]
movzx ecx, dx
movsx di, byte [edi + ecx]
xor di, bx
xor di, dx
mov ebx, 0xff
and di, bx
inc edx
mov word [esi + ecx*2], di
cmp dx, word [eax + 2]
jb 0x4202ba
pop edi
pop ebx
movzx eax, word [eax + 2]
xor ecx, ecx
mov word [esi + eax*2], cx
ret

Function at 0x420f7c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
mov cl, byte [eax + 0x100]
mov byte [ebp - 1], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 2], cl
test edx, edx
je 0x420fe3
mov ecx, dword [ebp + 8]
sub ecx, edi
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp + 8], edx
push esi
inc byte [ebp - 1]
movzx esi, byte [ebp - 1]
mov dl, byte [esi + eax]
add byte [ebp - 2], dl
movzx ecx, byte [ebp - 2]
mov bl, byte [ecx + eax]
mov byte [esi + eax], bl
mov byte [ecx + eax], dl
movzx ecx, byte [esi + eax]
movzx edx, dl
add ecx, edx
mov edx, dword [ebp - 8]
and ecx, 0xff
mov cl, byte [ecx + eax]
xor cl, byte [edx + edi]
mov byte [edi], cl
inc edi
dec dword [ebp + 8]
jne 0x420fa7
pop esi
pop ebx
mov cl, byte [ebp - 1]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 2]
mov byte [eax + 0x101], cl
pop edi
leave
ret 4
Function at 0x421028
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jbe 0x421110
push ebx
lea edx, [ebp - 8]
push esi
sub ecx, edx
push edi
mov edi, ecx
push 3
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
pop esi
cmp dword [ebp + 0xc], 0
jbe 0x421062
mov dl, byte [edi + ecx]
dec dword [ebp + 0xc]
inc byte [ebp - 1]
mov byte [ecx], dl
jmp 0x421065
mov byte [ecx], 0
inc ecx
dec esi
jne 0x42104f
movzx ecx, byte [ebp - 8]
mov edx, ecx
shr edx, 2
mov bl, byte [edx + 0x2268a18]
movzx edx, byte [ebp - 7]
and ecx, 3
mov esi, edx
shl ecx, 4
shr esi, 4
or esi, ecx
mov cl, byte [esi + 0x2268a18]
add edi, 3
cmp byte [ebp - 1], 1
mov byte [ebp - 0xb], cl
jbe 0x4210b2
movzx ecx, byte [ebp - 6]
and edx, 0xf
shl edx, 2
shr ecx, 6
or ecx, edx
mov dl, byte [ecx + 0x2268a18]
jmp 0x4210b4
mov dl, 0x3d
cmp byte [ebp - 1], 2
jbe 0x4210c9
movzx ecx, byte [ebp - 6]
and ecx, 0x3f
mov cl, byte [ecx + 0x2268a18]
jmp 0x4210cb
mov cl, 0x3d
cmp byte [ebp + 0x10], 0
je 0x4210f2
movzx esi, bl
mov word [eax], si
movzx esi, byte [ebp - 0xb]
movzx edx, dl
movzx ecx, cl
mov word [eax + 2], si
mov word [eax + 4], dx
mov word [eax + 6], cx
add eax, 8
jmp 0x421103
mov byte [eax], bl
mov bl, byte [ebp - 0xb]
mov byte [eax + 1], bl
mov byte [eax + 2], dl
mov byte [eax + 3], cl
add eax, 4
cmp dword [ebp + 0xc], 0
ja 0x421045
pop edi
pop esi
pop ebx
sub eax, dword [ebp + 8]
leave
ret 0xc

Function at 0x4211ed
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov al, byte [esi]
mov byte [ecx], al
cmp edx, 1
jbe 0x42120d
lea eax, [ecx + 1]
sub esi, ecx
lea ecx, [edx - 1]
mov dl, byte [esi + eax]
xor dl, byte [eax - 1]
mov byte [eax], dl
inc eax
dec ecx
jne 0x421201
pop esi
ret

Function at 0x42120f
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 4], esi
je 0x421224
push edi
push dword [esp + 8]
push esi
call dword [0x2261630]
add esp, 0xc
lea eax, [edi - 1]
test eax, eax
je 0x421235
mov cl, byte [eax + esi - 1]
xor byte [eax + esi], cl
dec eax
jne 0x42122b
ret 4
Function at 0x425281
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor ecx, ecx
mov dword [0x229ba10], eax
inc ecx
mov eax, 0x229ba10
push esi
mov edx, dword [eax]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, ecx
mov dword [eax + 4], esi
add eax, 4
inc ecx
cmp eax, 0x229c3cc
jl 0x42528f
mov dword [0x229ba0c], ecx
pop esi
ret

Function at 0x4252b6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x229ba0c]
cmp eax, 0x270
jl 0x425376
push esi
push edi
xor edx, edx
mov esi, 0x7fffffff
mov ecx, edx
mov eax, dword [ecx*4 + 0x229ba14]
xor eax, dword [ecx*4 + 0x229ba10]
and eax, esi
xor eax, dword [ecx*4 + 0x229ba10]
mov edi, eax
shr eax, 1
and edi, 1
xor eax, dword [edi*4 + 0x229a8b0]
xor eax, dword [ecx*4 + 0x229c044]
inc edx
mov dword [ecx*4 + 0x229ba10], eax
cmp edx, 0xe3
jl 0x4252cf
cmp edx, 0x26f
jge 0x425348
lea ecx, [edx*4 + 0x229ba10]
mov eax, dword [ecx]
xor eax, dword [ecx + 4]
and eax, esi
xor eax, dword [ecx]
mov edi, eax
and edi, 1
mov edi, dword [edi*4 + 0x229a8b0]
xor edi, dword [ecx - 0x38c]
shr eax, 1
xor edi, eax
mov dword [ecx], edi
add ecx, 4
cmp ecx, 0x229c3cc
jl 0x42531c
mov ecx, dword [0x229c3cc]
mov eax, dword [0x229ba10]
xor eax, ecx
and eax, esi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x229a8b0]
pop edi
xor eax, dword [0x229c040]
pop esi
mov dword [0x229c3cc], eax
xor eax, eax
mov ecx, dword [eax*4 + 0x229ba10]
inc eax
mov dword [0x229ba0c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x42de10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x10
push dword [ebp + 8]
mov ebx, ecx
lea ecx, [ebp - 0x10]
push ecx
call fcn.0040aba6
xor dword [ebp - 0x10], eax
xor word [ebp - 0xc], ax
shr eax, 0x10
xor word [ebp - 0xa], ax
xor edi, edi
xor ecx, ecx
xor eax, eax
mov dl, byte [ebp + eax + 0xc]
xor byte [ebp + ecx - 8], dl
inc eax
cmp eax, 4
cmove eax, edi
inc ecx
cmp ecx, 8
jb 0x42de40
cmp dword [ebp + 0x10], edi
je 0x42de7f
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], edi
call fcn.0042129a
push 0x10
pop edx
lea esi, [ebp - 0x10]
lea eax, [ebp - 0x118]
call fcn.004212e8
movzx eax, byte [ebp + 0x14]
sub eax, edi
je 0x42deab
dec eax
je 0x42de96
dec eax
jne 0x42deab
mov eax, 0x2269494
push 7
jmp 0x42de9d
mov eax, 0x22694a4
push 6
pop edi
push eax
mov eax, edi
mov esi, ebx
call fcn.0040e74f
lea ebx, [ebx + edi*2]
push 0x28
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [0x226167c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x430fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x431019
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00430a72
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x430ff0
sub eax, ebx
jmp 0x430ff2
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x430fe1
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x43100f
sub eax, ebx
jmp 0x431011
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x431000
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4310eb
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.00430f30
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x431063
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x431077
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x430fa5
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x4310eb
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x4310ba
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x43109e
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.00430a78
add esp, 0xc
add ebx, esi
pop esi
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x4310eb
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x4310d4
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.00430a78
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebx
ret
Function at 0x433610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x433635
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x43364d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x43367c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x4336be
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x433792
sub edx, 0x10000
js 0x433792
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x4336a4
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x4336a4
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x433715
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x433712
add edx, 8
jne 0x4336f9
jmp 0x433783
add edx, 4
test eax, 0xffff
jne 0x433722
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x433783
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x433756
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4336a4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x433792
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4336a4
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4337a3
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408c90
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444c30]
jne 0x408c9a
repz ret
jmp fcn.0040b7ac

Function at 0x40af77
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405127
and dword [ebp - 4], 0
cmp dword [0x445fc4], 0
mov ebx, eax
jne 0x40b028
push 0x402ab4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b0d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402aa8
push edi
call esi
test eax, eax
je 0x40b0d9
push eax
call fcn.004050b5
mov dword [esp], 0x402a98
push edi
mov dword [0x445fc4], eax
call esi
push eax
call fcn.004050b5
mov dword [esp], 0x402a84
push edi
mov dword [0x445fc8], eax
call esi
push eax
call fcn.004050b5
mov dword [esp], 0x402a68
push edi
mov dword [0x445fcc], eax
call esi
push eax
call fcn.004050b5
pop ecx
mov dword [0x445fd4], eax
test eax, eax
je 0x40b028
push 0x402a50
push edi
call esi
push eax
call fcn.004050b5
pop ecx
mov dword [0x445fd0], eax
mov eax, dword [0x445fd0]
cmp eax, ebx
je 0x40b080
cmp dword [0x445fd4], ebx
je 0x40b080
push eax
call fcn.00405130
push dword [0x445fd4]
mov esi, eax
call fcn.00405130
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b080
test edi, edi
je 0x40b080
call esi
test eax, eax
je 0x40b077
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b077
test byte [ebp - 0xc], 1
jne 0x40b080
or dword [ebp + 0x10], 0x200000
jmp 0x40b0b9
mov eax, dword [0x445fc8]
cmp eax, ebx
je 0x40b0b9
push eax
call fcn.00405130
pop ecx
test eax, eax
je 0x40b0b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b0b9
mov eax, dword [0x445fcc]
cmp eax, ebx
je 0x40b0b9
push eax
call fcn.00405130
pop ecx
test eax, eax
je 0x40b0b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445fc4]
call fcn.00405130
pop ecx
test eax, eax
je 0x40b0d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b0db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ff2
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0xc]
mov esi, ebx
push dword [esi + 0x30]
mov edi, dword [0x406034]
call dword [sym.imp.MSVCR90.dll__wcslwr]
pop ecx
jmp 0x402027
imul edi, edi, 0x65
movzx ecx, cl
add edi, ecx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x40201e
cmp edi, 0x22edae
je 0x402042
mov esi, dword [esi]
cmp esi, ebx
jne 0x40200c
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x18]
jmp 0x40203d

Function at 0x402047
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
and dword [ebp - 4], 0
add eax, esi
mov edx, dword [eax + 0x20]
push ebx
mov ebx, dword [eax + 0x24]
push edi
mov edi, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
add ebx, esi
add edx, esi
add edi, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
test eax, eax
jbe 0x4020b9
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
mov eax, dword [0x406034]
add ecx, esi
mov dword [ebp - 8], eax
mov al, byte [ecx]
test al, al
je 0x4020a6
mov ebx, dword [ebp - 8]
imul ebx, ebx, 0x65
movzx eax, al
add ebx, eax
inc ecx
mov al, byte [ecx]
mov dword [ebp - 8], ebx
test al, al
jne 0x40208e
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
je 0x4020bf
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x402078
xor eax, eax
pop edi
pop ebx
leave
ret
mov eax, dword [ebp - 4]
movzx eax, word [ebx + eax*2]
mov eax, dword [edi + eax*4]
add eax, esi
jmp 0x4020bb
Function at 0x4020cd
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x406018]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x78], eax
xor ecx, ecx
mov eax, ecx
cdq
push 0x31
pop esi
idiv esi
mov eax, dword [ebp + 0x1a0]
mov byte [ebp + ecx + 0x8c], cl
inc ecx
cmp ecx, 0x100
mov al, byte [edx + eax]
mov byte [ebp + ecx - 0x75], al
jl 0x4020f8
xor eax, eax
movzx esi, byte [ebp + eax - 0x74]
lea ecx, [ebp + eax + 0x8c]
mov dl, byte [ecx]
movzx ebx, dl
add esi, edi
add ebx, esi
mov edi, ebx
and edi, 0x800000ff
jns 0x402146
dec edi
or edi, 0xffffff00
inc edi
lea esi, [ebp + edi + 0x8c]
mov bl, byte [esi]
inc eax
cmp eax, 0x100
mov byte [esi], dl
mov byte [ecx], bl
jl 0x40211f
mov edx, dword [ebp + 0x19c]
and dword [ebp - 0x7c], 0
test edx, edx
jle 0x4021e5
mov edi, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x198]
sub ecx, edi
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x78], edx
inc eax
and eax, 0x800000ff
jns 0x402189
dec eax
or eax, 0xffffff00
inc eax
lea ecx, [ebp + eax + 0x8c]
movzx edx, byte [ecx]
add edx, dword [ebp - 0x7c]
and edx, 0x800000ff
jns 0x4021a6
dec edx
or edx, 0xffffff00
inc edx
mov bl, byte [ecx]
lea esi, [ebp + edx + 0x8c]
mov dword [ebp - 0x7c], edx
mov dl, byte [esi]
mov byte [esi], bl
mov byte [ecx], dl
movzx ecx, dl
movzx edx, byte [esi]
add ecx, edx
and ecx, 0x800000ff
jns 0x4021d0
dec ecx
or ecx, 0xffffff00
inc ecx
mov cl, byte [ebp + ecx + 0x8c]
mov edx, dword [ebp - 0x80]
xor cl, byte [edx + edi]
mov byte [edi], cl
inc edi
dec dword [ebp - 0x78]
jne 0x40217a
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040272c
add ebp, 0x190
leave
ret

Function at 0x40272c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x402736
repz ret
jmp fcn.00402b6a