joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a397
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x419004]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov esi, dword [ebp + 8]
push 0x406f00
push 0x406f1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a3d1
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409496
push esi
lea ecx, [esp + 0x24]
call fcn.00408b70
lea ecx, [esp + 0x20]
call fcn.00408e9c
mov esi, eax
test esi, esi
jns 0x40a44f
lea ecx, [esp + 8]
call fcn.0040a30c
test al, al
je 0x40a499
cmp esi, 0x80040b00
jne 0x40a499
and dword [esp + 0x4c], 0
lea ecx, [esp + 0x20]
xor eax, eax
mov dword [esp + 0x50], 7
mov word [esp + 0x3c], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00408f41
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.004095f1
test esi, esi
js 0x40a499
mov esi, 0x80040b02
jmp 0x40a499
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40a45e
mov esi, dword [esp + 8]
push 0x406d74
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40a491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40a48a
jle 0x40a499
movzx esi, si
or esi, 0x80070000
jmp 0x40a499
mov esi, 0x80004005
jmp 0x40a499
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
cmp dword [esp + 0x20], 0
je 0x40a4aa
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x24]
call fcn.004095f1
lea ecx, [esp + 8]
call fcn.004095f1
mov ecx, dword [esp + 0x54]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ab91
mov esp, ebp
pop ebp
ret 0x10

Function at 0x44305f
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x2bd46
push section.packerBY
push 0x4434e3
call fcn.004434a8
cld
mov esi, 0x414000
mov ecx, 4
sub ecx, esi
cmp esi, 0x440290
ja 0x4430a7
lodsb al, byte [esi]
add al, 0x18
sub al, 2
jb 0x44309d
cmp al, 0x25
jne 0x443081
mov al, byte [esi]
and al, 0xf0
cmp al, 0x80
jne 0x443081
inc esi
lea edi, [esi + ecx]
sub dword [esi], edi
add esi, 4
jmp 0x443081
mov edx, 0x400000
lea esi, [edx + 0x4120c]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44310a
add eax, edx
mov edi, dword [esi + 0x10]
mov ebx, dword [esi]
test ebx, ebx
jne 0x4430c6
mov ebx, edi
add ebx, edx
add edi, edx
push edx
push edi
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop edi
pop edx
test eax, eax
je 0x443108
mov ecx, eax
mov eax, dword [ebx]
test eax, eax
je 0x443103
btr eax, 0x1f
jb 0x4430eb
lea eax, [eax + edx + 2]
push ecx
push edx
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
pop edi
pop edx
pop ecx
test eax, eax
je 0x443108
stosd dword es:[edi], eax
add ebx, 4
jmp 0x4430db
add esi, 0x14
jmp 0x4430b2
popal
ret
popal
jmp 0x440130
Function at 0x411cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
jmp 0x411cf2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x411d31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x29ff64e3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x411d2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411ce9
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x411d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x4c
mov dword [ebp - 4], 0
jmp 0x411d72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x411db1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x79547e8b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x411dac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411d69
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x411dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x4d
mov dword [ebp - 4], 0
jmp 0x411df2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x411e31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x344cc654]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x411e2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411de9
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x411e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x4f
mov dword [ebp - 4], 0
jmp 0x411e72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x19
jge 0x411eb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x431e0467]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x411eac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411e69
mov eax, 1
imul ecx, eax, 0x19
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x411ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x58
mov dword [ebp - 4], 0
jmp 0x411ef2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1b
jge 0x411f31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x4a7e66f3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x411f2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411ee9
mov eax, 1
imul ecx, eax, 0x1b
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x411f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x58
mov dword [ebp - 4], 0
jmp 0x411f72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x411fb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x65f66a79]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x411fac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411f69
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x411fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x5e
mov dword [ebp - 4], 0
jmp 0x411ff2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x412031
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x663954eb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41202c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x411fe9
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x412050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x65
mov dword [ebp - 4], 0
jmp 0x412072
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x4120b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x592a861c]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x4120ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x412069
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4120d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x6b
mov dword [ebp - 4], 0
jmp 0x4120f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x412131
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x40100f3f]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41212c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x4120e9
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x412150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x79
mov dword [ebp - 4], 0
jmp 0x412172
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x4121b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x5166242]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x4121ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x412169
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4121d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x7e
mov dword [ebp - 4], 0
jmp 0x4121f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x412231
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x32799422]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41222c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x4121e9
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x412250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x97
mov dword [ebp - 4], 0
jmp 0x412272
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x4122b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x452a6d08]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x4122ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x412269
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4122d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x9c
mov dword [ebp - 4], 0
jmp 0x4122f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x412331
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x70bd1f54]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41232c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x4122e9
mov eax, 1
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x412350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa3
mov dword [ebp - 4], 0
jmp 0x412372
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x4123b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x75b8ab9c]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x4123ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x412369
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4123d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xad
mov dword [ebp - 4], 0
jmp 0x4123f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x412431
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x65383494]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41242c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x4123e9
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x412450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xb3
mov dword [ebp - 4], 0
jmp 0x412472
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x4124b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x593381da]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x4124ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x412469
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4124d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xdf
mov dword [ebp - 4], 0
jmp 0x4124f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa
jge 0x412531
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x53740b6d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41252c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x4124e9
mov eax, 1
imul ecx, eax, 0xa
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x412550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xe0
mov dword [ebp - 4], 0
jmp 0x412572
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x4125b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x7165564a]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x4125ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x412569
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4125d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xfc
mov dword [ebp - 4], 0
jmp 0x4125f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jge 0x412631
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6e45f066]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x41262c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x4125e9
mov eax, 1
imul ecx, eax, 0x11
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4193f0
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x45ae18]
mov dword [ebp - 4], eax
mov ecx, dword [0x45acf4]
mov dword [ebp - 0xc], ecx
push 4
push 0x3000
mov edx, dword [ebp + 8]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
mov eax, dword [ebp + 8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esp, ebp
pop ebp
ret
Function at 0x419a70
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x4479fc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x419a94
mov al, 1
jmp 0x419a96
xor al, al
pop ebp
ret

Function at 0x41a270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440a18
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x45a264]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x28]
call fcn.00413840
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
add eax, 1
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043d87c
add esp, 4
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00418280
lea ecx, [ebp - 0x41]
call fcn.00403380
mov dword [ebp - 0x64], eax
lea edx, [ebp - 0x70]
push edx
lea ecx, [ebp - 0x28]
call fcn.0042a2e0
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x68], ecx
lea edx, [ebp - 0x74]
push edx
lea ecx, [ebp - 0x28]
call fcn.00427e20
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x40]
call fcn.004076d0
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403480
mov eax, dword [ebp - 0x54]
or eax, 1
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x40]
call fcn.00403ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00416830
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043de0e
mov esp, ebp
pop ebp
ret
Function at 0x41bee0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440d48
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x45a264]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], 0xffffffff
jne 0x41bf1c
or eax, 0xffffffff
jmp 0x41c042
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x1c]
push ecx
push 0x8004667e
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
mov dword [ebp - 0x20], 0
push 8
lea ecx, [ebp - 0x18]
call fcn.00405840
push 0x200
lea ecx, [ebp - 0x18]
call fcn.00414c20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0041b2a0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x2c], edx
push 0
push 0x200
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x41bfce
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x41bfb1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00416bc0
jmp 0x41c040
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00416bc0
mov eax, dword [ebp - 0x30]
jmp 0x41c042
cmp dword [ebp - 0x20], 0
jne 0x41bff1
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00416bc0
mov eax, dword [ebp - 0x34]
jmp 0x41c042
cmp dword [ebp - 0x20], 0
jle 0x41c021
cmp dword [ebp - 0x20], 0x400
jge 0x41c00c
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.0041c940
mov eax, dword [ebp - 0x24]
add eax, 0x30
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.004314d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00416bc0
cmp dword [ebp - 0x20], 0
je 0x41c040
cmp dword [ebp - 0x20], 0xffffffff
jne 0x41bf40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043de0e
mov esp, ebp
pop ebp
ret