joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d9d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc3b8
call fcn.0041bc70
mov eax, dword [0x436504]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str._Spawner__Constructing_command_line..._n
call fcn.0040855c
pop ecx
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
xor ebx, ebx
cmp dword [edi], ebx
pop ecx
mov byte [ebp - 0xc358], bl
mov dword [ebp - 0xc35c], ebx
je 0x406e2a
mov esi, edi
lea eax, [ebp - 0xc358]
push 0x42e6a4
push eax
call fcn.004172c0
push dword [esi]
lea eax, [ebp - 0xc358]
push eax
call fcn.004172c0
lea eax, [ebp - 0xc358]
push 0x433220
push eax
call fcn.004172c0
add esp, 0x18
inc dword [ebp - 0xc35c]
mov eax, dword [ebp - 0xc35c]
lea esi, [edi + eax*4]
cmp dword [esi], ebx
jne 0x406de4
lea eax, [ebp - 0xc358]
push eax
push str._Spawner__Creating_command_line__s_n
call fcn.0040855c
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
add esp, 0xc
push 0x44
lea eax, [ebp - 0xc3b8]
push ebx
push eax
call fcn.00418720
add esp, 0xc
push 0x10
lea eax, [ebp - 0xc370]
push ebx
push eax
call fcn.00418720
add esp, 0xc
lea eax, [ebp - 0xc370]
push eax
lea eax, [ebp - 0xc3b8]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0xc358]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.0040855c
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
add esp, 0xc
or eax, 0xffffffff
jmp 0x406f0d
push 0xffffffffffffffff
push dword [ebp - 0xc370]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xc360]
push eax
push dword [ebp - 0xc370]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xc370]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc36c]
call esi
push dword [ebp - 0xc360]
push str._Spawner__runSpawnerAndWait_returned__d_n
call fcn.0040855c
mov eax, dword [ebp - 0xc360]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fa4
leave
ret
Function at 0x406f1b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc3b8
call fcn.0041bc70
mov eax, dword [0x436504]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push str._Spawner__Constructing_command..._n
mov byte [ebp - 0xc358], bl
call fcn.0040855c
pop ecx
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
cmp dword [edi], ebx
pop ecx
mov dword [ebp - 0xc35c], ebx
je 0x406fa8
mov esi, edi
lea eax, [ebp - 0xc358]
push 0x42e6a4
push eax
call fcn.004172c0
push dword [esi]
lea eax, [ebp - 0xc358]
push eax
call fcn.004172c0
lea eax, [ebp - 0xc358]
push 0x433220
push eax
call fcn.004172c0
add esp, 0x18
inc dword [ebp - 0xc35c]
mov eax, dword [ebp - 0xc35c]
lea esi, [edi + eax*4]
cmp dword [esi], ebx
jne 0x406f62
lea eax, [ebp - 0xc358]
push eax
push str._Spawner__Executing_command__s_n
call fcn.0040855c
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
add esp, 0xc
push 0x44
lea eax, [ebp - 0xc3b8]
push ebx
push eax
call fcn.00418720
add esp, 0xc
push 0x10
lea eax, [ebp - 0xc36c]
push ebx
push eax
call fcn.00418720
add esp, 0xc
lea eax, [ebp - 0xc36c]
push eax
lea eax, [ebp - 0xc3b8]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0xc358]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40703c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.0040855c
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
add esp, 0xc
or eax, 0xffffffff
jmp 0x40706e
push str._Spawner__Create_process_seems_to_have_worked_n
call fcn.0040855c
pop ecx
call fcn.0041a955
add eax, 0x20
push eax
call fcn.004182e9
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp - 0xc36c]
call esi
push dword [ebp - 0xc368]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fa4
leave
ret

Function at 0x4071e5
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x437c20], esi
push esi
jne 0x407243
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x437c24
push esi
push 0x437c20
push 0x4072f8
push esi
push esi
mov dword [0x437c28], eax
call fcn.0041a251
add esp, 0x18
push 0x1388
push dword [0x437c28]
mov dword [0x437c20], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x407253
push str.Error_starting_SplashThread_n
call fcn.0040855c
pop ecx
pop esi
ret
push 2
push 6
push dword [0x437c24]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop esi
ret
Function at 0x4081b5
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x436504]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.ALLUSERSPROFILE
call fcn.00419fa9
mov dword [ebp - 0xdc], eax
pop ecx
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0xe0], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x70]
push eax
call fcn.00417220
mov ebx, eax
xor edi, edi
test ebx, ebx
pop ecx
mov esi, 0x811c9dc5
jle 0x408237
mov al, byte [ebp + edi - 0x70]
movzx ecx, al
xor ecx, esi
imul ecx, ecx, 0x1000193
mov esi, ecx
movsx eax, al
push esi
push eax
push edi
push str.__d___d__d_n
call fcn.0040855c
add esp, 0x10
inc edi
cmp edi, ebx
jl 0x40820e
test esi, esi
jge 0x40823d
neg esi
push 0x64
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.00418720
add esp, 0xc
push esi
lea eax, [ebp - 0xd8]
push 0x42ff90
push eax
call fcn.00417cc2
lea eax, [ebp - 0x70]
add esp, 0xc
push eax
xor esi, esi
call fcn.00417220
test eax, eax
pop ecx
jbe 0x408290
lea eax, [ebp + esi - 0x70]
cmp byte [eax], 0x80
jb 0x408281
mov byte [eax], 0x5f
lea eax, [ebp - 0x70]
push eax
inc esi
call fcn.00417220
cmp esi, eax
pop ecx
jb 0x408275
push 0x1388
call fcn.00417090
pop ecx
push dword [ebp - 0xdc]
mov esi, eax
push esi
mov byte [esi], 0
call fcn.004172c0
push str.JWUser_
call fcn.004084da
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
push esi
call fcn.004172c0
push 0x42ed9c
push esi
call fcn.004172c0
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.004172c0
push esi
call fcn.004084bb
mov ecx, dword [ebp - 4]
add esp, 0x1c
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fa4
leave
ret
Function at 0x4082f5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x436504]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.APPDATA
mov dword [ebp - 0xa0], 0x94
call fcn.00419fa9
mov esi, eax
test esi, esi
pop ecx
mov ebx, 0x1388
je 0x408382
push esi
call fcn.00417220
cmp eax, 2
pop ecx
jbe 0x408382
cmp byte [esi], 0x5c
jne 0x408382
cmp byte [esi + 1], 0x5c
jne 0x408382
push str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040855c
pop ecx
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4083c6
cmp dword [ebp - 0x9c], 5
jbe 0x40838e
push str.LOCALAPPDATA
call fcn.00419fa9
pop ecx
mov esi, eax
push esi
push str._Extractor__Local_AppData_directory_resolved_to__s_n
call fcn.0040855c
pop ecx
jmp 0x4083c5
push str._Extractor__Local_AppData_directory_detected_n
call fcn.0040855c
jmp 0x4083c5
push str.USERPROFILE
call fcn.00419fa9
pop ecx
push ebx
mov edi, eax
call fcn.00417090
pop ecx
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.004172c0
push str.Local_Settings
call fcn.004084da
add esp, 0xc
push str.Application_Data
call fcn.004084da
pop ecx
push str.Validating_directory..._n
call fcn.0040855c
pop ecx
push esi
push str.Shared_dir_detected_is__s_n
call fcn.0040855c
push esi
call fcn.00408193
add esp, 0xc
test eax, eax
je 0x40844e
push esi
push str.Checking_if_string_is_cAscii__s_n
call fcn.0040855c
push esi
xor edi, edi
call fcn.00417220
add esp, 0xc
test eax, eax
jbe 0x408415
cmp byte [edi + esi], 0x80
jae 0x40844e
push esi
inc edi
call fcn.00417220
cmp edi, eax
pop ecx
jb 0x408403
push esi
push str.Checking_if__s_contains_a___n
call fcn.0040855c
push esi
xor edi, edi
call fcn.00417220
add esp, 0xc
test eax, eax
jbe 0x408441
cmp byte [edi + esi], 0x21
je 0x40844e
push esi
inc edi
call fcn.00417220
cmp edi, eax
pop ecx
jb 0x40842f
push str.Shared_directory_appears_valid._n
call fcn.0040855c
pop ecx
jmp 0x4084aa
push esi
push str.The_directory__s_appears_invalid._n
call fcn.0040855c
push esi
push str.Trying_the_short_path_instead._n
call fcn.0040855c
push ebx
call fcn.00417090
add esp, 0x14
push 0x400
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40849c
push edi
push str.Got_short_path_of__s_n
call fcn.0040855c
push esi
call fcn.00408193
add esp, 0xc
test eax, eax
je 0x40849c
mov eax, edi
jmp 0x4084ac
push edi
call fcn.00416fb3
pop ecx
call fcn.004081b5
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fa4
leave
ret
Function at 0x4088ad
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x436504]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push str.perm_all
push esi
call fcn.00418a20
test eax, eax
pop ecx
pop ecx
jne 0x40894c
push str.Permanent_install_for_all_users_n
call fcn.0040855c
pop ecx
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x408911
cmp dword [ebp - 0x9c], 5
jbe 0x408911
push str.PROGRAMDATA
call fcn.00419fa9
pop ecx
jmp 0x408974
push str.ALLUSERSPROFILE
call fcn.00419fa9
mov edi, eax
mov dword [esp], 0x1388
call fcn.00417090
pop ecx
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.004172c0
push str.Application_Data
call fcn.004084da
add esp, 0xc
push esi
call fcn.004084bb
pop ecx
jmp 0x408976
push str.perm_user
push esi
call fcn.00418a20
test eax, eax
pop ecx
pop ecx
jne 0x408964
push str.Permanent_install_for_current_user_n
jmp 0x408969
push str.Temporary_install_n
call fcn.0040855c
pop ecx
call fcn.004082f5
mov esi, eax
test esi, esi
jne 0x40898c
push str.ERROR:_Unable_to_get_shared_dir_
call fcn.0040855c
pop ecx
push 1
call fcn.00418021
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416fa4
leave
ret
Function at 0x40a800
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40a820
push 0xd0
push str.._srchashes_sha2_sha256.c
push 0x42b498
call fcn.0040c980
add esp, 0xc
mov dword [esi + 0x2a0], 0
mov dword [esi + 0x278], 0
mov dword [esi + 0x27c], 0
mov dword [esi + 0x280], 0x6a09e667
mov dword [esi + 0x284], 0xbb67ae85
mov dword [esi + 0x288], 0x3c6ef372
mov dword [esi + 0x28c], 0xa54ff53a
mov dword [esi + 0x290], 0x510e527f
mov dword [esi + 0x294], 0x9b05688c
mov dword [esi + 0x298], 0x1f83d9ab
mov dword [esi + 0x29c], 0x5be0cd19
xor eax, eax
pop esi
ret

Function at 0x40ada0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40adbd
push 0x2a
push str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
push 0x42b498
call fcn.0040c980
add esp, 0xc
mov dword [esi + 0x2a0], 0
mov dword [esi + 0x278], 0
mov dword [esi + 0x27c], 0
mov dword [esi + 0x280], 0xc1059ed8
mov dword [esi + 0x284], 0x367cd507
mov dword [esi + 0x288], 0x3070dd17
mov dword [esi + 0x28c], 0xf70e5939
mov dword [esi + 0x290], 0xffc00b31
mov dword [esi + 0x294], 0x68581511
mov dword [esi + 0x298], 0x64f98fa7
mov dword [esi + 0x29c], 0xbefa4fa4
xor eax, eax
pop esi
ret
Function at 0x416fa4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436504]
jne 0x416fae
repz ret
jmp fcn.0041bc9b

Function at 0x41aff2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x41b01f
call fcn.004174cc
mov dword [eax], esi
call fcn.004174b9
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041daff
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x41affb
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41b04e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004174df
pop ecx
call fcn.004174b9
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x41b075
test al, 1
je 0x41b075
test byte [esp + 0xc], 2
je 0x41b075
call fcn.004174cc
mov dword [eax], 5
call fcn.004174b9
mov dword [eax], 0xd
jmp 0x41b045
xor eax, eax
pop esi
ret
Function at 0x4241e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041db86
xor ebx, ebx
cmp dword [0x4399e8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4242ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x424225
xor eax, eax
jmp 0x42437e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42421e
push eax
call fcn.0041db23
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4399e8], eax
call esi
push eax
call fcn.0041db23
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4399ec], eax
call esi
push eax
call fcn.0041db23
mov dword [0x4399f0], eax
lea eax, [ebp - 8]
push eax
call fcn.00417e4e
test eax, eax
pop ecx
pop ecx
je 0x424288
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041da03
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4242ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041db23
cmp eax, ebx
pop ecx
mov dword [0x4399f8], eax
je 0x4242ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041db23
pop ecx
mov dword [0x4399f4], eax
mov eax, dword [0x4399f4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x424333
cmp dword [0x4399f8], esi
je 0x424333
push eax
call fcn.0041db8f
pop ecx
call eax
cmp eax, ebx
je 0x424300
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4399f8]
call fcn.0041db8f
pop ecx
call eax
test eax, eax
je 0x424300
test byte [ebp - 0x18], 1
jne 0x424333
lea eax, [ebp - 0xc]
push eax
call fcn.00417e85
test eax, eax
pop ecx
je 0x42431b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041da03
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42432a
or dword [ebp + 0x10], 0x200000
jmp 0x424364
or dword [ebp + 0x10], 0x40000
jmp 0x424364
mov eax, dword [0x4399ec]
cmp eax, esi
je 0x424364
push eax
call fcn.0041db8f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x424364
mov eax, dword [0x4399f0]
cmp eax, esi
je 0x424364
push dword [ebp - 4]
push eax
call fcn.0041db8f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4399e8]
call fcn.0041db8f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x400
push edi
lea eax, [esp + 0x40c]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.00403008
lea edi, [esp + 0x10]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401026
mov ax, word [0x40b1fc]
lea ecx, [esp + 4]
push ecx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x4017d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
mov edx, dword [str.f2npmsW8GlatqcSYCpSrlQzGzQhHdbUtUKIxkDcFyF3B79TaWJEsiFHDQWu1De6W]
push ebx
mov ebx, dword [0x40d044]
push ebp
push esi
movsx esi, byte [edx]
mov eax, esi
test eax, eax
push edi
mov dword [esp + 0x10], ebx
mov ecx, edx
je 0x401807
mov edi, dword [esp + 0x10]
imul edi, edi, 0x21
inc ecx
add edi, eax
movsx eax, byte [ecx]
test eax, eax
mov dword [esp + 0x10], edi
jne 0x4017f2
mov eax, esi
test eax, eax
mov ecx, ebx
mov edi, edx
je 0x40181e
imul ecx, ecx, 0x21
inc edi
add ecx, eax
movsx eax, byte [edi]
test eax, eax
jne 0x401811
add ecx, 0xc6f4ea35
mov eax, esi
test eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
mov ecx, edx
je 0x401849
mov edi, dword [esp + 0x14]
imul edi, edi, 0x21
inc ecx
add edi, eax
movsx eax, byte [ecx]
test eax, eax
mov dword [esp + 0x14], edi
jne 0x401834
mov eax, esi
test eax, eax
mov ebp, ebx
mov ecx, edx
je 0x401860
imul ebp, ebp, 0x21
inc ecx
add ebp, eax
movsx eax, byte [ecx]
test eax, eax
jne 0x401853
mov eax, esi
test eax, eax
mov edi, ebx
mov ecx, edx
je 0x40187d
lea ebx, [ebx]
imul edi, edi, 0x21
inc ecx
add edi, eax
movsx eax, byte [ecx]
test eax, eax
jne 0x401870
mov eax, esi
test eax, eax
mov ecx, ebx
je 0x401892
imul ecx, ecx, 0x21
inc edx
add ecx, eax
movsx eax, byte [edx]
test eax, eax
jne 0x401885
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov edx, dword [eax + esi - 0x390b1607]
add edx, dword [esp + 0x18]
mov eax, dword [edx + esi]
mov edx, dword [esp + 0x14]
add eax, esi
mov edx, dword [eax + edx - 0x390b162b]
mov ebp, dword [eax + ebp - 0x390b1627]
mov edi, dword [eax + edi - 0x390b1623]
mov eax, dword [ecx + eax - 0x390b161f]
add eax, esi
add ebp, esi
add edi, esi
xor ebx, ebx
test edx, edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
jbe 0x401913
mov edi, edi
mov eax, dword [edi + ebx*4]
movsx ecx, byte [eax + esi]
mov edx, dword [0x40d044]
add eax, esi
test ecx, ecx
je 0x401900
imul edx, edx, 0x21
inc eax
add edx, ecx
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4018f3
cmp edx, dword [esp + 0x24]
je 0x40190f
mov eax, dword [esp + 0x20]
inc ebx
cmp ebx, eax
jb 0x4018e0
mov edx, dword [esp + 0x20]
cmp ebx, edx
jne 0x401921
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + ebx*2]
mov eax, dword [ebp + ecx*4]
pop edi
add eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x401950
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x40d050]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00403238
mov ecx, dword [0x40d04c]
push ecx
mov ebx, eax
call fcn.00403238
mov esi, eax
mov eax, dword [0x40d054]
add esp, 8
xor ebp, ebp
xor ecx, ecx
test eax, eax
jbe 0x4019af
mov eax, esi
sub eax, ebx
mov dword [esp + 0x10], eax
jmp 0x401990
mov eax, dword [esp + 0x10]
mov edi, edi
lea edi, [ecx + ebx]
mov byte [eax + edi], cl
mov eax, ecx
cdq
idiv dword [esp + 0x24]
mov eax, dword [esp + 0x20]
inc ecx
mov dl, byte [edx + eax]
mov byte [edi], dl
cmp ecx, dword [0x40d054]
jb 0x40198a
mov eax, dword [0x40d058]
xor edi, edi
test eax, eax
jbe 0x4019fa
mov eax, ebx
sub eax, esi
mov ecx, esi
mov dword [esp + 0x10], eax
jmp 0x4019d0
mov eax, dword [esp + 0x10]
lea ebx, [ebx]
movzx edx, byte [eax + ecx]
mov bl, byte [ecx]
add edx, ebp
movzx eax, bl
add eax, edx
xor edx, edx
div dword [0x40d05c]
inc edi
inc ecx
mov ebp, edx
mov al, byte [esi + ebp]
mov byte [esi + ebp], bl
mov byte [ecx - 1], al
cmp edi, dword [0x40d058]
jb 0x4019c6
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
test ecx, ecx
jle 0x401a7f
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
sub eax, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
jmp 0x401a20
xor edx, edx
lea eax, [edi + 1]
div dword [0x40d060]
push 0
push 0
mov edi, edx
mov cl, byte [edi + esi]
movzx eax, cl
add eax, ebx
xor edx, edx
div dword [0x40d064]
mov ebx, edx
mov al, byte [ebx + esi]
mov byte [ebx + esi], cl
mov byte [edi + esi], al
call dword [sym.imp.USER32.dll_ShowWindow]
movzx ecx, byte [ebx + esi]
movzx eax, byte [edi + esi]
add eax, ecx
xor edx, edx
div dword [0x40d068]
mov eax, dword [esp + 0x10]
mov cl, byte [eax + ebp]
mov eax, dword [esp + 0x1c]
mov dl, byte [edx + esi]
xor dl, cl
mov byte [ebp], dl
inc ebp
dec eax
mov dword [esp + 0x1c], eax
jne 0x401a20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402d80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x58
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
call fcn.00401b90
test eax, eax
jne 0x402da2
push 0xfff43714
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x1c51b
push esi
push edi
mov ecx, 0x13
mov esi, str.nygNeFTdF8g4wvh9ye_FMAgNmS94_SkFb7O8eXZnw_3byj2LBCNR2EjoMnghG2AZv3GXa
lea edi, [esp + 0x18]
mov dword [0x40d04c], eax
mov dword [0x40d050], eax
mov dword [0x40d054], eax
mov dword [0x40d058], eax
mov dword [0x40d05c], eax
mov dword [0x40d060], eax
mov dword [0x40d064], eax
mov dword [0x40d068], eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401b20
test eax, eax
je 0x402ef9
lea eax, [esp + 0xc]
push eax
push 0x2096
call fcn.00401a90
add esp, 8
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x402ef9
mov ebx, dword [0x40d044]
push ebp
mov ebp, dword [str.f2npmsW8GlatqcSYCpSrlQzGzQhHdbUtUKIxkDcFyF3B79TaWJEsiFHDQWu1De6W]
push ebx
push ebp
call fcn.00401730
mov esi, eax
push ebx
push ebp
sub esi, 0x390b1603
call fcn.00401730
mov edi, eax
push ebx
push ebp
sub edi, 0x390af643
call fcn.00401730
add esp, 0x18
push esi
sub eax, 0x390b0643
or eax, edi
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
call dword [0x40da98]
test eax, eax
pop ebp
jl 0x402e81
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x18]
push 0x4c
lea ecx, [esp + 0x20]
push ecx
push edx
push eax
call fcn.00401950
add esp, 0x14
call dword [esp + 0x10]
mov esi, dword [esp + 0x70]
push esi
call fcn.0040ad48
push str.reglagesepare
push esi
call fcn.00403770
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov dword [0x40dab8], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0xb4aeb5
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esp + 0x68]
push 0x6e
push ecx
mov dword [0x40da80], eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [0x40daa4]
push 0
push 0x401c90
push 0
push 0x65
push edx
mov dword [0x40daa0], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
push str.OK_GOOGLE___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10