joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b7e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x200]
mov ecx, 0x80
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5126a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0x4f1198
push str.serverset.txt
call fcn.004764d0
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x41b854
mov esi, esp
push 0
push 0
push str.serverset.txt
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.004749e0
push 0
call fcn.00478580
jmp 0x41b957
lea eax, [ebp - 0x12c]
push eax
push 0x4f1188
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.00478600
add esp, 0xc
mov eax, dword [ebp - 0x120]
push eax
call fcn.00476160
add esp, 4
mov eax, dword [ebp - 0x12c]
push eax
push str.serverset__d_serverlist.msl
lea ecx, [ebp - 0x114]
push ecx
call fcn.00476770
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x51e240
call fcn.00402aa9
mov eax, dword [ebp - 0x12c]
push eax
push str.serverset__d_serverlist_Public.msl
lea ecx, [ebp - 0x114]
push ecx
call fcn.00476770
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x51e240
call fcn.00402491
mov ecx, dword [ebp - 0xc]
call fcn.00402ad6
test eax, eax
jne 0x41b8ec
mov dword [0x530d44], 1
mov eax, dword [0x530d44]
cmp eax, dword [ebp - 0x12c]
jne 0x41b905
mov dword [ebp - 0x200], 1
jmp 0x41b90f
mov dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 0
jne 0x41b930
push 0
mov eax, dword [0x51220c]
add eax, 0x1b
push eax
push str.c:jobmx_code2_cc_servermodule_bootmanager.cpp
call fcn.00402d0b
add esp, 0xc
movzx eax, word [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00402d29
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004017b2
push edx
mov ecx, ebp
push eax
lea edx, [0x41b988]
call fcn.00474980
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474a10
add esp, 0x200
cmp ebp, esp
call fcn.004749e0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4230b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4f4]
mov ecx, 0x13d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5126a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x400
jg 0x4230f2
mov dword [ebp - 0x4f4], 1
jmp 0x4230fc
mov dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
jne 0x42311d
push 0
mov eax, dword [0x512278]
add eax, 3
push eax
push str.c:jobmx_code2_cc_servermodule_serverlistmanager.cpp
call fcn.00402d0b
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.00472130
add esp, 0xc
mov dword [ebp - 0x420], 0
jmp 0x42315e
mov eax, dword [ebp - 0x420]
add eax, 1
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
add edx, 1
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp + 0xc]
jge 0x4231b0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 0xc]
jne 0x423181
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
movsx ecx, byte [eax + ecx]
mov edx, dword [ebp - 0x420]
movsx eax, byte [ebp + edx - 0x414]
add eax, ecx
mov ecx, dword [ebp - 0x420]
mov byte [ebp + ecx - 0x414], al
jmp 0x423140
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.004743b0
add esp, 0x10
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
jne 0x4231e6
mov dword [ebp - 0x4f4], 1
jmp 0x4231f0
mov dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
jne 0x423211
push 0
mov eax, dword [0x512278]
add eax, 0xe
push eax
push str.c:jobmx_code2_cc_servermodule_serverlistmanager.cpp
call fcn.00402d0b
add esp, 0xc
cmp dword [ebp - 0x42c], 1
jne 0x423226
mov dword [ebp - 0x4f4], 1
jmp 0x423230
mov dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
push edx
mov ecx, ebp
push eax
lea edx, [0x423268]
call fcn.00474980
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474a10
add esp, 0x4f4
cmp ebp, esp
call fcn.004749e0
mov esp, ebp
pop ebp
ret 8
Function at 0x4033ff
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0043f4c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40346c
push 0x2a
push 0x4034cd0
push 6
call fcn.0043d143
add esp, 0xc
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40347c
push ebx
call fcn.0043d131
add esp, 4
cmp dword [ebp - 4], 0
jg 0x40348d
mov dword [ebp - 4], 0x100
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0043f4e0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4034c0
push ebx
call fcn.0043d131
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4034f9
push 0x125
push 0x4034cd0
push 6
call fcn.0043d143
add esp, 0xc
push OleUIBusyA
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40350c
mov eax, 0x4642b0
push eax
push 1
mov ebx, 0x174
call fcn.0043f520
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403536
push ebx
call fcn.0043d131
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x4642b0
push dword [ebp - 8]
call fcn.00401a30
add esp, 8
cmp eax, 0
jne 0x403573
call fcn.004035aa
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40356f
push ebx
call fcn.0043d131
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x40358f
push eax
mov ebx, eax
call fcn.00401230
inc eax
push eax
call fcn.0043d137
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x403594
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4035a5
push ebx
call fcn.0043d131
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40cbb7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40cbe7
mov edx, 0xffffffff
mov eax, 0xffffffff
jmp 0x40cc22
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40cc17
push 0xa0
push 0x4034705
push 6
call fcn.0043d143
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40cc22
mov esp, ebp
pop ebp
ret 4

Function at 0x40e7d6
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x40e801
mov eax, 0x464343
jmp 0x40e963
cmp dword [ebp + 0xc], 0
jg 0x40e859
mov dword [ebp - 0xc], esp
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e845
push 0xe2
push 0x4034704
push 6
call fcn.0043d143
add esp, 0xc
cmp dword [ebp + 0xc], 0
jg 0x40e859
mov eax, 0x464343
jmp 0x40e963
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.0040e97b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e890
mov eax, 0x464343
jmp 0x40e963
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e8ca
push 0x2a4
push 0x4034704
push 6
call fcn.0043d143
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40e8e1
mov eax, 0x464343
jmp 0x40e963
push 0x80000301
push 0
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.0043f400
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40e920
push ebx
call fcn.0043d131
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040ea08
mov eax, dword [ebp - 8]
test eax, eax
je 0x40e95e
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0043d137
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e963
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40e974
push ebx
call fcn.0043d131
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x434bd9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x434be3
add dword [esp], 5
retf

Function at 0x435439
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x46663e]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x435474
add dword [esp], 5
retf

Function at 0x43dc80
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00442350
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x45d5a0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x43dd42
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x43dd3b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x43dd26
lea edx, [esi + 1]
push edx
call fcn.0043da10
mov edi, eax
add esp, 4
test edi, edi
je 0x43dd18
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.004425e0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x43dcd2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x43dd55
push eax
call fcn.00442780
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0043da10
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x45d59c
call fcn.00442550
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x43e020
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0045554e
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x43e08a
push esi
lea edi, [eax + 0x400]
call fcn.00455577
push edi
call fcn.0045554e
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x43e05a
push esi
xor edi, edi
call dword [0x466d60]
add esp, 4
test eax, eax
je 0x43e0a6
push eax
push esi
call fcn.00443530
add esp, 8
mov edi, eax
push esi
call fcn.00455577
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43f5e0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret
Function at 0x4400c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4400de
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4400d3
pop esi
ret
Function at 0x440db0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00443eb0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x466d60]
add esp, 8
test ebx, ebx
je 0x440ef4
test eax, eax
je 0x440ef4
inc eax
push eax
call fcn.0045554e
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0044a390
mov edi, eax
add esp, 0xc
test edi, edi
je 0x440e22
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x440ee1
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0045554e
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x440eaa
cmp eax, 0xea
jne 0x440ecd
push esi
call fcn.00455577
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0045554e
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x440e75
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x440eb8
cmp eax, 2
jne 0x440ecd
push esi
call dword [0x466d60]
push eax
push esi
call fcn.00443530
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.00455577
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00455577
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x440f1d
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x440f29
mov esi, dword [esp + 0x40]
test esi, esi
je 0x440f29
push esi
call dword [0x466d60]
push eax
push esi
call fcn.00443530
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x440f40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x440fa9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0043da10
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x441220
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x4412a0
push edi
call dword [0x466d60]
add esp, 4
test eax, eax
jbe 0x4412a0
test esi, esi
je 0x44125e
cmp esi, 0xffffffff
je 0x44125e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x4412e2
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x44128c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x4412a0
jmp 0x44129b
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x4412a0
mov ebp, 1
test esi, esi
je 0x4412e2
cmp esi, 0xffffffff
je 0x4412e2
test ebp, ebp
jne 0x441319
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x4412ef
call edi
test eax, eax
je 0x4412e2
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x441319
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x4412ca
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x4412e2
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x441319
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x4412fc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x466d60]
inc eax
push eax
call fcn.0043da10
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret

Function at 0x442a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x442a41
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x442a9b
inc edi
cmp edi, esi
jl 0x442a35
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x442ad0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x442a8a
cmp byte [eax], bl
je 0x442aa5
cmp byte [eax + 1], bl
je 0x442aae
cmp byte [eax + 2], bl
je 0x442ab8
cmp byte [eax + 3], bl
je 0x442ac4
add eax, 4
cmp eax, edi
jb 0x442a61
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x4430b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x4430e2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x443142
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x443119
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x4431f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x44328c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x44321b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x457f19
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x457f5b
call fcn.0045b266
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x457f5b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x457f52
xor eax, eax
jmp 0x457f63
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00457f69
pop edi
pop esi
pop ebx
ret 4