joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x40524c
Capabilities:
Terminate process

Disassembly:
push 0x10
push eax
call fcn.0040bffc
add esp, 8
test eax, eax
jne 0x405289
mov byte [0x51c34f], al
mov eax, dword [0x51c3b4]
test eax, eax
jne 0x405273
mov dword [0x51c3b4], 2
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x405282
push eax
call fcn.00410f2c
push 2
call fcn.00429194
ret

Function at 0x40528c
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2b4
push esi
lea eax, [esp + 0xb8]
call fcn.004051bc
push eax
push 0x436040
lea eax, [esp + 0xc]
push 0xb2
push eax
call fcn.004145fc
mov eax, dword [case.0x6502ec.0]
add esp, 0x10
lea ecx, [esp + 4]
push ecx
push eax
mov esi, eax
call fcn.0041330c
test eax, eax
je 0x405329
push esi
call fcn.004115dc
push eax
push esi
call fcn.004115ec
push eax
mov eax, dword [0x51c3d4]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0x435ff0
push 0
call fcn.0040c8ac
mov eax, dword [0x51c3b4]
add esp, 0x1c
test eax, eax
jne 0x40530a
mov dword [0x51c3b4], 2
mov al, byte [0x51c34f]
test al, al
jne 0x405329
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x405322
push eax
call fcn.00410f2c
push 2
call fcn.00429194
mov ecx, dword [case.0x6502ec.0]
push edi
push ecx
call fcn.004110ec
mov esi, eax
test esi, esi
mov edi, 1
je 0x405379
push esi
call fcn.004115bc
test edx, edx
ja 0x40534f
test eax, eax
jbe 0x405373
push esi
call fcn.00412b7c
mov edx, dword [esp + 0x2c4]
mov eax, dword [eax]
mov ecx, dword [esp + 0x2c0]
dec edx
push edx
push eax
push ecx
call fcn.0041436c
add esp, 0xc
xor edi, edi
push esi
call fcn.0041042c
mov eax, edi
pop edi
pop esi
add esp, 0x2b4
ret
Function at 0x4058ac
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test byte [eax + 0xc], 0x20
je 0x405909
call fcn.00429448
mov ecx, dword [eax]
mov edx, dword [0x51c3d4]
push ecx
push edx
push 0x436254
push 0x51ae68
call fcn.004291d4
mov eax, dword [0x51c3b4]
add esp, 0x10
test eax, eax
jne 0x4058ea
mov dword [0x51c3b4], 5
mov al, byte [0x51c34f]
test al, al
jne 0x405909
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x405902
push eax
call fcn.00410f2c
push 5
call fcn.00429194
ret
Function at 0x405fcc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, eax
call fcn.00412ddc
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
mov dword [0x51c334], ecx
mov edx, dword [esi + 4]
mov eax, dword [edx]
push ebp
push 0x443338
push 0x435ed4
mov dword [0x51c348], eax
mov dword [0x51d678], 0x51ae48
call fcn.0040bc0c
push 0x401be0
push 0x4420a8
push edi
push ebp
call fcn.0040a84c
add esp, 0x20
test eax, eax
je 0x406029
push eax
call fcn.00429194
mov ecx, dword [esi]
mov edx, dword [0x51c334]
mov dword [ecx], edx
mov eax, dword [esi + 4]
mov ecx, dword [0x51c348]
mov dword [eax], ecx
mov al, byte [0x51c353]
test al, al
je 0x40604e
mov byte [fcn.00442054], 0
mov edi, dword [0x51c37c]
test edi, edi
mov edx, dword [0x51c388]
mov esi, dword [0x51c38c]
jne 0x406098
test edx, edx
jne 0x406087
test esi, esi
jne 0x406087
mov eax, dword [0x51c390]
test eax, eax
jne 0x406087
mov eax, dword [0x51c384]
test eax, eax
jne 0x406087
mov eax, dword [0x51c380]
test eax, eax
je 0x406098
mov edx, dword [0x51c3d4]
push edx
push 0x436880
jmp 0x40612f
mov al, byte [0x51c35c]
test al, al
je 0x4060b4
mov eax, dword [0x51be70]
test eax, eax
jne 0x4060b4
mov dword [0x51be70], 2
mov al, byte [0x51c35e]
test al, al
mov cl, byte [0x51c358]
je 0x4060d4
test cl, cl
je 0x4060d4
mov eax, dword [0x51c3d4]
push eax
push 0x436830
jmp 0x40612f
cmp dword [0x51be70], 0
je 0x4060e8
test al, al
sete cl
mov byte [0x51c358], cl
test al, al
jne 0x4060f0
test cl, cl
je 0x4060f7
mov byte [0x442052], 0
test edx, edx
je 0x40610d
test esi, esi
je 0x40610d
mov ecx, dword [0x51c3d4]
push ecx
push 0x4367e0
jmp 0x40612f
mov al, byte [0x51c355]
test al, al
jne 0x40611f
mov al, byte [0x51c356]
test al, al
je 0x406145
test edi, edi
je 0x406145
mov edx, dword [0x51c3d4]
push edx
push 0x43679c
push 0x51ae68
call fcn.004291d4
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [0x44205c]
mov edi, dword [0x51c330]
mov esi, dword [eax + 0x10]
mov eax, edi
lea esp, [esp]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x406180
test cl, cl
je 0x40617c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x406180
add eax, 2
add esi, 2
test cl, cl
jne 0x40615c
xor eax, eax
jmp 0x406185
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4061a6
push 0x10
push 0x20
push edi
call fcn.00409c7c
add esp, 0xc
test eax, eax
mov dword [0x44205c], eax
jne 0x4061a6
push 1
call fcn.00429194
mov eax, dword [ebp]
cmp eax, 1
jge 0x4061b8
mov cl, byte [0x51c356]
test cl, cl
je 0x4061c5
test eax, eax
jle 0x4061d3
mov al, byte [0x51c356]
test al, al
je 0x4061d3
call fcn.00404fcc
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov al, byte [0x51c35d]
test al, al
je 0x4061eb
push 0
call fcn.0041466c
add esp, 4
mov dword [0x51c370], eax
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x4061fc
Capabilities:
Terminate process

Disassembly:
push eax
push esi
call fcn.004115ec
push eax
push esi
call fcn.004115dc
push eax
push 0
push 0x4368b4
push 0
call fcn.0040c8ac
mov eax, dword [0x51c3b4]
add esp, 0x18
test eax, eax
jne 0x40622f
mov dword [0x51c3b4], 2
mov al, byte [0x51c34f]
test al, al
jne 0x40624e
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x406247
push eax
call fcn.00410f2c
push 2
call fcn.00429194
ret

Function at 0x40625c
Capabilities:
Terminate process

Disassembly:
sub esp, 0x214
push esi
mov esi, eax
mov al, byte [0x51c34c]
test al, al
je 0x40628c
test esi, esi
mov eax, esi
jne 0x406279
mov eax, 0x436034
push eax
push 0x436904
push 0x51ae68
call fcn.004291d4
add esp, 0xc
push 0x51bf78
call fcn.00410c7c
mov al, byte [0x51c352]
test al, al
je 0x4062ad
push 0
push 1
push 0x51bf78
call fcn.0041134c
mov eax, dword [0x51c3bc]
test eax, eax
je 0x4062c7
push 0x51c3bc
push 9
push 0x51bf78
call fcn.0041134c
mov eax, dword [0x51c3b8]
test eax, eax
je 0x4062dd
push eax
push 0xa
push 0x51bf78
call fcn.0041134c
mov eax, dword [0x51c330]
push eax
push 7
push 0x51bf78
call fcn.0041134c
mov ecx, dword [0x51c3b0]
mov edx, dword [0x51c3a8]
mov eax, dword [esp + 0x220]
push 0
push ecx
mov ecx, dword [esp + 0x224]
push edx
push 0
push eax
push ecx
push esi
push 0x51bf78
call fcn.00411b6c
test eax, eax
mov dword [case.0x6502ec.0], eax
jne 0x406341
mov eax, 0x4368ec
mov esi, 0x51bf78
call fcn.004061fc
mov eax, 1
pop esi
add esp, 0x214
ret
push 0x51bf78
call fcn.0041363c
cmp eax, 0x9ca4
jae 0x406359
mov byte [0x51c359], 0
mov edx, dword [case.0x6502ec.0]
push case.0x40a202.2
push 0x4368cc
lea eax, [esp + 0xc]
push 0x214
push eax
mov byte [edx + 0x381], 0
call fcn.004145fc
mov esi, dword [case.0x6502ec.0]
add esp, 0x10
lea ecx, [esp + 4]
push ecx
push esi
call fcn.0041330c
test eax, eax
je 0x406403
push esi
call fcn.004115dc
push eax
push esi
call fcn.004115ec
push eax
mov eax, dword [0x51c3d4]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0x435ff0
push 0
call fcn.0040c8ac
mov ecx, dword [case.0x6502ec.0]
add esp, 0x1c
push ecx
call fcn.00410f2c
mov eax, dword [0x51c3b4]
test eax, eax
jne 0x4063e0
mov dword [0x51c3b4], 2
mov al, byte [0x51c34f]
test al, al
jne 0x406334
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x4063fc
push eax
call fcn.00410f2c
push 2
call fcn.00429194
xor eax, eax
pop esi
add esp, 0x214
ret
Function at 0x4062a1
Capabilities:
Terminate process

Disassembly:
sub esp, 0x214
push esi
mov esi, eax
mov al, byte [0x51c34c]
test al, al
je 0x40628c
test esi, esi
mov eax, esi
jne 0x406279
mov eax, 0x436034
push eax
push 0x436904
push 0x51ae68
call fcn.004291d4
add esp, 0xc
push 0x51bf78
call fcn.00410c7c
mov al, byte [0x51c352]
test al, al
je 0x4062ad
push 0
push 1
push 0x51bf78
call fcn.0041134c
mov eax, dword [0x51c3bc]
test eax, eax
je 0x4062c7
push 0x51c3bc
push 9
push 0x51bf78
call fcn.0041134c
mov eax, dword [0x51c3b8]
test eax, eax
je 0x4062dd
push eax
push 0xa
push 0x51bf78
call fcn.0041134c
mov eax, dword [0x51c330]
push eax
push 7
push 0x51bf78
call fcn.0041134c
mov ecx, dword [0x51c3b0]
mov edx, dword [0x51c3a8]
mov eax, dword [esp + 0x220]
push 0
push ecx
mov ecx, dword [esp + 0x224]
push edx
push 0
push eax
push ecx
push esi
push 0x51bf78
call fcn.00411b6c
test eax, eax
mov dword [case.0x6502ec.0], eax
jne 0x406341
mov eax, 0x4368ec
mov esi, 0x51bf78
call fcn.004061fc
mov eax, 1
pop esi
add esp, 0x214
ret
push 0x51bf78
call fcn.0041363c
cmp eax, 0x9ca4
jae 0x406359
mov byte [0x51c359], 0
mov edx, dword [case.0x6502ec.0]
push case.0x40a202.2
push 0x4368cc
lea eax, [esp + 0xc]
push 0x214
push eax
mov byte [edx + 0x381], 0
call fcn.004145fc
mov esi, dword [case.0x6502ec.0]
add esp, 0x10
lea ecx, [esp + 4]
push ecx
push esi
call fcn.0041330c
test eax, eax
je 0x406403
push esi
call fcn.004115dc
push eax
push esi
call fcn.004115ec
push eax
mov eax, dword [0x51c3d4]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0x435ff0
push 0
call fcn.0040c8ac
mov ecx, dword [case.0x6502ec.0]
add esp, 0x1c
push ecx
call fcn.00410f2c
mov eax, dword [0x51c3b4]
test eax, eax
jne 0x4063e0
mov dword [0x51c3b4], 2
mov al, byte [0x51c34f]
test al, al
jne 0x406334
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x4063fc
push eax
call fcn.00410f2c
push 2
call fcn.00429194
xor eax, eax
pop esi
add esp, 0x214
ret

Function at 0x40641c
Capabilities:
Terminate process

Disassembly:
push esi
lea eax, [ebx + ebx + 1]
push 0x10
push eax
call fcn.0040bffc
mov esi, eax
add esp, 8
test esi, esi
jne 0x406460
mov byte [0x51c34f], al
mov eax, dword [0x51c3b4]
test eax, eax
jne 0x40644a
mov dword [0x51c3b4], 2
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x406459
push eax
call fcn.00410f2c
push 2
call fcn.00429194
mov ecx, dword [esp + 8]
push ebx
push ecx
push esi
push 0x51bf78
call fcn.0041372c
push edi
push 0x27
call fcn.0042961a
push edi
push esi
call fcn.004294cd
push edi
push 0x27
call fcn.0042961a
push edi
call fcn.004058ac
push esi
call fcn.0040c08c
add esp, 0x20
pop esi
ret
Function at 0x40649c
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, ecx
lea ebx, [edi + eax]
cmp edi, ebx
je 0x406508
jmp 0x4064ac
movsx eax, byte [edi]
lea ecx, [eax - 0x22]
cmp ecx, 0x1c
ja 0x4064f9
movzx ecx, byte [ecx + 0x40267c]
jmp dword [ecx*4 + 0x402668]
push esi
push eax
call fcn.0042961a
add esp, 8
inc edi
cmp edi, ebx
jne 0x4064ac
test byte [esi + 0xc], 0x20
pop edi
pop ebx
je 0x406562
call fcn.00429448
mov edx, dword [eax]
mov eax, dword [0x51c3d4]
push edx
push eax
push 0x436254
push 0x51ae68
call fcn.004291d4
mov eax, dword [0x51c3b4]
add esp, 0x10
test eax, eax
jne 0x406543
mov dword [0x51c3b4], 5
mov al, byte [0x51c34f]
test al, al
jne 0x406562
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x40655b
push eax
call fcn.00410f2c
push 5
call fcn.00429194
ret

Function at 0x40667c
Capabilities:
Terminate process

Disassembly:
push ecx
push ebp
push esi
push edi
push ebx
mov esi, eax
call fcn.0041344c
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push eax
push 0x436968
push esi
call fcn.004291d4
push esi
call fcn.004058ac
add esp, 0x10
push 0
push ebx
call fcn.004134cc
push ebx
call fcn.0041341c
mov edi, eax
test edi, edi
je 0x406763
xor ebp, ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
cmp dword [edx + ebp], 0
je 0x406750
push esi
push 0x20
call fcn.0042961a
mov eax, dword [edi + 0x24]
mov ecx, dword [edi]
call fcn.0040649c
push esi
push 0x436964
call fcn.004294cd
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + ebp]
mov ecx, dword [ecx + ebp]
call fcn.0040649c
push esi
push 0x22
call fcn.0042961a
mov al, byte [esi + 0xc]
add esp, 0x18
test al, 0x20
je 0x406750
call fcn.00429448
mov eax, dword [eax]
mov ecx, dword [0x51c3d4]
push eax
push ecx
push 0x436254
push 0x51ae68
call fcn.004291d4
mov eax, dword [0x51c3b4]
add esp, 0x10
test eax, eax
jne 0x406747
mov dword [0x51c3b4], 5
mov al, byte [0x51c34f]
test al, al
je 0x4067ca
push ebx
add ebp, 4
call fcn.0041341c
mov edi, eax
test edi, edi
jne 0x4066bf
push esi
push 0x43695c
call fcn.004294cd
mov al, byte [esi + 0xc]
add esp, 8
test al, 0x20
je 0x4067e0
call fcn.00429448
mov edx, dword [eax]
mov eax, dword [0x51c3d4]
push edx
push eax
push 0x436254
push 0x51ae68
call fcn.004291d4
mov eax, dword [0x51c3b4]
add esp, 0x10
test eax, eax
jne 0x4067ab
mov dword [0x51c3b4], 5
mov al, byte [0x51c34f]
test al, al
jne 0x4067e0
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x4067c3
push eax
call fcn.00410f2c
push 5
call fcn.00429194
mov eax, dword [case.0x6502ec.0]
test eax, eax
je 0x4067d9
push eax
call fcn.00410f2c
push 5
call fcn.00429194
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x40772c
Capabilities:
Terminate process

Disassembly:
sub esp, 0x184
push esi
mov esi, eax
mov eax, dword [case.0x6502ec.0]
push esi
push eax
call fcn.00410d8c
test eax, eax
je 0x407762
mov esi, dword [case.0x6502ec.0]
mov eax, 0x436e30
call fcn.004061fc
mov eax, 1
pop esi
add esp, 0x184
ret
mov eax, dword [0x51c37c]
test eax, eax
jne 0x4078ad
mov al, byte [0x51c35b]
test al, al
jne 0x4078ad
mov al, byte [0x51c355]
test al, al
jne 0x407792
mov al, byte [0x51c356]
test al, al
je 0x4078ad
mov al, byte [0x51c354]
push edi
lea edi, [esp + 8]
mov ecx, esi
call fcn.0040515c
mov edi, eax
mov al, byte [case.0x7aa0c9.35]
test al, al
je 0x4077cf
mov ecx, dword [0x51d678]
push edi
push 0x436e10
push ecx
call fcn.004291d4
mov edx, dword [0x51d678]
push edx
call fcn.004058ac
add esp, 0x10
mov al, byte [0x51c357]
test al, al
jne 0x40788c
push edi
push 0x436de8
lea eax, [esp + 0x94]
push 0x100
push eax
call fcn.004145fc
mov edx, dword [case.0x6502ec.0]
add esp, 0x10
lea ecx, [esp + 0x8c]
push ecx
push edx
call fcn.0041330c
test eax, eax
jne 0x40785a
mov eax, dword [case.0x6502ec.0]
push eax
call fcn.004110ec
mov esi, eax
test esi, esi
je 0x40785a
mov al, byte [0x51c365]
test al, al
je 0x40783e
mov ecx, dword [0x51d678]
push edi
push 0x436dbc
push ecx
call fcn.004291d4
add esp, 0xc
push esi
call fcn.00412b7c
mov eax, dword [eax + 4]
test eax, eax
je 0x40788c
mov edx, dword [0x51d678]
push eax
push 0x436db4
push edx
jmp 0x407884
mov al, byte [0x51c365]
test al, al
je 0x407877
mov eax, dword [0x51d678]
push edi
push 0x436d88
push eax
call fcn.004291d4
add esp, 0xc
mov ecx, dword [0x51d678]
push edi
push 0x436d58
push ecx
call fcn.004291d4
add esp, 0xc
mov edx, dword [0x51d678]
push edi
push fcn.00436d4c
push edx
call fcn.004291d4
mov eax, dword [0x51d678]
push eax
call fcn.004058ac
add esp, 0x10
pop edi
mov al, byte [0x442051]
test al, al
je 0x4078dd
push 0x400
push 0x400
push 0x435d58
push 0x51be60
call fcn.0040cc8c
add esp, 0x10
test al, al
je 0x4078dd
push 4
call fcn.00429194
xor eax, eax
pop esi
add esp, 0x184
ret
Function at 0x40911c
Capabilities:
Terminate process

Disassembly:
mov eax, dword [fcn.00442058]
push edi
mov dword [0x51c330], eax
xor eax, eax
mov ecx, 0xe
mov edi, 0x51d640
mov byte [case.0x40a202.2], 0
rep stosd dword es:[edi], eax
mov dword [0x51c3d4], 0x434208
call fcn.0040d6bc
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x10]
call fcn.00405fcc
add esp, 4
test eax, eax
je 0x409171
push 0
call fcn.0040d45c
add esp, 4
push 1
call fcn.00429194
mov edx, dword [0x51c370]
mov eax, dword [0x51c374]
push edx
push eax
mov eax, dword [0x51c378]
call fcn.0040625c
add esp, 8
test eax, eax
je 0x409196
push 2
call fcn.00429194
mov eax, dword [0x51c37c]
test eax, eax
push esi
jne 0x4091b1
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx]
mov esi, dword [0x51d678]
call fcn.0040590c
mov al, byte [0x51c358]
test al, al
jne 0x4091c3
mov eax, dword [0x51be70]
test eax, eax
je 0x4091d6
mov esi, dword [case.0x6502ec.0]
call fcn.0040538c
test eax, eax
jne 0x4092d4
mov al, byte [0x51c35e]
test al, al
je 0x409201
mov edi, dword [0x51be70]
mov esi, dword [case.0x6502ec.0]
test edi, edi
setne dl
push edx
call fcn.0040547c
add esp, 4
test eax, eax
jne 0x4092d4
mov al, byte [0x51c35c]
test al, al
je 0x40921d
mov esi, dword [case.0x6502ec.0]
call fcn.0040543c
test eax, eax
jne 0x4092d4
mov al, byte [0x51c358]
test al, al
jne 0x40922f
mov eax, dword [0x51be70]
test eax, eax
je 0x40926b
mov al, byte [0x51c350]
test al, al
je 0x40924d
mov eax, dword [case.0x6502ec.0]
push 2
push eax
call fcn.004135ac
test eax, eax
jne 0x4092d4
mov eax, dword [0x51be70]
test eax, eax
mov byte [0x51c350], 0
je 0x40926b
mov eax, dword [case.0x6502ec.0]
call fcn.004078ec
test eax, eax
jne 0x4092d4
mov al, byte [0x51c35e]
test al, al
je 0x409283
mov esi, dword [case.0x6502ec.0]
call fcn.004053fc
test eax, eax
jne 0x4092d4
mov al, byte [0x51c356]
test al, al
je 0x409293
call fcn.0040904c
jmp 0x4092c5
mov eax, dword [esp + 0xc]
cmp eax, 1
jle 0x4092bc
mov cl, byte [0x51c355]
test cl, cl
jne 0x4092bc
mov ecx, dword [esp + 0x10]
lea edx, [ecx + 4]
mov ecx, dword [ecx]
push edx
dec eax
push ecx
call fcn.00408cdc
add esp, 8
jmp 0x4092c5
mov eax, dword [esp + 0x10]
call fcn.004090dc
mov edx, dword [0x51c3b8]
push edx
call fcn.0040c08c
add esp, 4
mov al, byte [0x51c34c]
test al, al
je 0x4092fe
mov eax, dword [0x51c378]
test eax, eax
jne 0x4092eb
mov eax, 0x436034
push eax
push 0x436014
push 0x51ae68
call fcn.004291d4
add esp, 0xc
mov eax, dword [case.0x6502ec.0]
push eax
call fcn.00410f2c
mov eax, dword [0x51c37c]
test eax, eax
jne 0x40931d
mov esi, dword [0x51d678]
call fcn.00405a4c
mov eax, dword [0x51d678]
cmp eax, 0x51ae48
pop esi
je 0x409335
push 0
push eax
call fcn.0040ca3c
add esp, 8
mov ecx, dword [0x51c370]
push ecx
call fcn.0040c08c
mov eax, dword [0x51d658]
add esp, 4
test eax, eax
je 0x40935a
push 0x51d640
call fcn.0040c1ec
add esp, 4
mov al, byte [0x442051]
test al, al
je 0x409370
push 0x51be60
call fcn.0040ce8c
add esp, 4
mov al, byte [0x51c36c]
test al, al
je 0x409386
push 0x51c338
call fcn.0040ce8c
add esp, 4
push 0
call fcn.0040d45c
mov eax, dword [0x51c3b4]
add esp, 4
pop edi
ret
Function at 0x40bffc
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x40c00b
mov edi, 1
push edi
call fcn.00429d00
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40c05f
push esi
call fcn.00429448
mov esi, eax
call fcn.0040e39c
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov esi, eax
and esi, 8
je 0x40c042
mov edx, dword [0x44337c]
mov dword [fcn.00443378], edx
test al, 0x18
je 0x40c053
push edi
push 0x24
push 5
call fcn.0040c6dc
add esp, 0xc
test esi, esi
pop esi
je 0x40c07a
push 1
call fcn.00429194
test byte [esp + 0x10], 0x20
je 0x40c07a
mov ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x42019c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
je 0x4202f1
cmp byte [esi], 0
je 0x4202e4
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [esp + 0x10], eax
mov eax, esi
mov dword [esp + 0x14], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4201d2
sub eax, ecx
push eax
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.0042011c
push 8
lea edx, [esp + 0x28]
push edi
push edx
call fcn.0042011c
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
xor eax, ecx
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
xor eax, edi
add esp, 0x18
mov esi, edx
xor edx, edx
div ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov edi, edx
jae 0x42028c
sub eax, ecx
mov dword [esp + 0x10], eax
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
mov esi, edx
lea eax, [edi + esi + 0x21]
xor edx, edx
div ecx
test esi, esi
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
mov edi, edx
jge 0x420259
fadd qword [0x43a770]
fmul qword [0x43a788]
sub esp, 8
fmul qword [0x43a780]
fstp qword [esp]
call fcn.0042bf1c
fadd qword [0x43a778]
add esp, 8
call fcn.0042bbec
mov byte [ebx], al
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x42022d
lea eax, [edi + esi*2]
add eax, esi
xor edx, edx
mov ecx, 0x3fffffff
div ecx
test edx, edx
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
jge 0x4202ac
fadd qword [0x43a770]
fmul qword [0x43a788]
sub esp, 8
fmul qword [0x43a780]
fstp qword [esp]
call fcn.0042bf1c
add esp, 8
call fcn.0042bbec
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x4202da
xor byte [ecx], al
inc ecx
cmp ecx, ebx
jne 0x4202d3
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42030c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
lea eax, [esp + 0x28]
push esi
push eax
call fcn.0042278c
mov edx, dword [esp + 0xa4]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42032c
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x34]
push ecx
call fcn.00422fbc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00422f5c
lea ecx, [esp + 0x40]
push ecx
call fcn.0042278c
push 0x14
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00422fbc
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.00422f5c
lea eax, [esp + 0x58]
push eax
call fcn.0042278c
mov ecx, dword [esp + 0xcc]
push 0x14
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.00422fbc
push 0x14
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.00422fbc
mov esi, dword [esp + 0xe0]
add esp, 0x48
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.00422f5c
lea ecx, [esi + 0x14]
add esp, 8
cmp esi, ecx
mov eax, esi
jae 0x4203e2
push ebx
push edi
lea edi, [esp + 0xc]
sub edi, esi
mov bl, byte [eax]
mov dl, byte [edi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x4203d2
pop edi
pop ebx
pop esi
add esp, 0x90
ret

Function at 0x42278c
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 0x24], cx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
xor eax, eax
ret