joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025ca
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
adc eax, 0x6a0000
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b84]
mov cx, 0x80
mov di, 0xce
push 0x80
mov dword [0x435a84], eax
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435bd0]
add edi, esi
add edi, eax
mov eax, dword [0x435bc0]
mov dword [0x435ad0], eax
push 0xe10
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a9c]
mov edi, 0x40
mov ax, 0x6c
mov dword [0x435d78], edi
push 0x1632
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435ba8]
sub ecx, edi
mov edi, dword [0x435c4c]
mov edi, dword [0x435b10]
sub eax, eax
push 0x66
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c68]
add eax, esi
mov eax, dword [0x435c48]
sub eax, edi
mov ecx, dword [0x435d84]
push 0x73
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435d3c]
sub eax, eax
add eax, eax
mov ecx, dword [0x435c64]
xor eax, eax
push 0xc1
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435bf4]
mov ax, 0x80
add ecx, ecx
mov esi, dword [0x435d28]
add ecx, eax
push 0x9a
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b18]
add eax, eax
mov eax, dword [0x435c6c]
sub eax, eax
push 0x9a
mov dword [0x435abc], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435cd0]
sub eax, eax
sub eax, edx
push 0x31a
mov dword [0x435c30], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a48]
mov ecx, 0x9b
mov eax, dword [0x435cf8]
mov cx, 0x86
mov eax, dword [0x435e1c]
push 0x93
mov dword [0x435d64], ecx
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435aa0]
sub eax, eax
mov edx, dword [0x435d2c]
mov edi, dword [0x435a24]
add eax, eax
push 0xa7
push 0
call sub.user32.dll_LoadIconA
adc eax, dword [0x435b94]
add eax, edx
sub esi, eax
push 0xab
mov dword [0x435d08], esi
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a24]
mov cx, 0x20
mov eax, dword [0x435c1c]
add eax, eax
push 0x96
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d48]
sub eax, edi
add esi, eax
mov si, 0x10
mov dword [0x435a24], edi
push 0x6b
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435cec]
mov ax, 2
mov edi, dword [0x435d80]
mov edx, dword [0x435c18]
mov eax, 0xe5
push 0xa7
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435ad0]
mov eax, 0xbc
mov eax, dword [0x435ab0]
add edi, esi
push 0x6f
mov dword [0x435c34], edi
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435c50]
mov eax, 0x5e
mov edx, dword [0x435aec]
invalid
invalid

Function at 0x4027df
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
add byte [eax], al
add byte [ebx + 0x435a240d], cl
add byte [ecx], ch
enter 0xffffffffffffeca3, 0x5a
inc ebx
add byte [eax - 0x68], ch
add byte [eax], al
add byte [edx], ch
Function at 0x402914
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b8c]
add edi, ecx
add ecx, edi
push 0x89
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c54]
add ecx, edi
mov ecx, dword [0x435a24]
sub edi, ecx
mov cx, 0x87
push 0x6a
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435b24]
add eax, edx
sub eax, ecx
mov esi, dword [0x435ddc]
mov eax, 8
mov dword [0x435ba8], edi
push 0x72
push 0
call sub.user32.dll_LoadIconA
adc edx, dword [0x435cc8]
add eax, eax
mov eax, dword [0x435a48]
mov eax, dword [0x435bf0]
add edi, edi
push 0x86
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435da8]
mov eax, 0xaf
push 0x90
mov dword [0x435b1c], eax
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435b70]
sub edx, eax
xor ecx, dword [0x435be0]
xor eax, edi
push 0xed4
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435ac0]
or eax, eax
add eax, eax
mov eax, dword [0x435be4]
mov si, 0x20
push 0x73
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435b94]
mov esi, 2
invalid
invalid
invalid
pop esp
inc ebx
Function at 0x402b8f
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
pop esp
inc ebx
add byte [eax - 0x76], ch
add byte [eax], al
add byte [edx], ch
call sub.user32.dll_LoadIconA
mov eax, dword [0x435ce0]
mov ax, 8
mov edx, dword [0x435ce8]
push 0xbe
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435a40]
mov ax, 0x8a
mov cx, 0x40
push 0x94
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435a54]
mov eax, 0x43
add eax, edi
or eax, eax
push 0x199
mov dword [0x435c24], esi
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435abc]
mov eax, 2
sub eax, esi
mov eax, dword [0x435e00]
sub ecx, eax
mov dword [0x435c5c], esi
push 0xbf
mov dword [0x435c60], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435aec]
mov di, 0x44
mov edi, 2
add esi, eax
push 0x16d1
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435a48]
add eax, edi
mov edi, dword [0x435bb4]
push 0xb6
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435cbc]
mov si, 1
mov edx, dword [0x435d4c]
sub eax, eax
add ecx, esi
mov dword [0x435cd4], edx
push 0x73
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b7c]
mov eax, 8
mov edx, dword [0x435df8]
xor dword [0x435e0c], 0xff00ffff
push 0xa2
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d44]
mov si, 0x20
mov eax, dword [0x435cfc]
sub esi, edi
mov ax, 0xdb
push 0x163c
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435da8]
add eax, eax
and edi, eax
mov eax, 0x83
push 0xac
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435ad8]
mov edx, 1
mov di, 0x10
mov ecx, dword [0x435cbc]
mov edi, 8
push 0x199c
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435cd4]
add eax, edi
sub eax, dword [0x435b60]
add eax, eax
mov eax, dword [0x435a24]
push 0x96
mov dword [0x435d8c], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a40]
or edi, eax
mov ecx, dword [0x435a80]
sub edi, edi
push 0xa1
mov dword [0x435de8], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c28]
xor esi, eax
mov edi, dword [0x435ae4]
mov edx, dword [0x435c88]
push 0x6b
mov dword [0x435d08], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a80]
add eax, edi
sbb esi, dword [0x435c60]
mov ax, 0x40
push 0x8b
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435b94]
sub esi, edx
invalid
invalid
pop ebx
inc ebx

Function at 0x402e59
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
add byte [eax], al
add byte [eax - 0x39], ch
add byte [eax], al
add byte [edx], ch
Function at 0x40343e
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov eax, dword [0x435b08]
sub eax, edi
mov eax, dword [0x435acc]
push 0x91
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435bd0]
sub eax, ecx
mov ecx, dword [0x435cb0]
add edx, edi
add edi, eax
push 0x7e
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435d94]
add edx, eax
sub edi, eax
push 0x81
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435a24]
sub edi, edx
sub edx, eax
mov eax, dword [0x435dbc]
add edx, edx
push 0xb4
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435b8c]
mov eax, 0x10
mov edi, dword [0x435d08]
add edi, esi
push 0xc6
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a8c]
sub edx, eax
mov eax, dword [0x435c34]
mov ax, 8
push 0x93
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435bcc]
mov cx, 0x42
mov esi, dword [0x435a24]
xor eax, eax
push 0xa6
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435a24]
mov eax, 0x3e
mov edi, dword [0x435b20]
mov ecx, dword [0x435c74]
push 0xc5
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435a4c]
mov dx, 0x40
mov ecx, dword [0x435bc8]
mov ecx, 0x40
push 0x7d
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435bf0]
mov ax, 2
mov eax, dword [0x435e14]
add eax, esi
mov edi, dword [0x435cb4]
push 0xae
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435dec]
add ecx, eax
mov eax, 2
mov eax, dword [0x435a4c]
add ecx, edx
push 0x69
push 0
add al, ch
cld
add dword [ebx], eax
add byte [ebx + 0x435ba415], cl
add byte [esi - 0x48], ah
add al, byte [eax]

Function at 0x403726
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
xchg esp, eax
pop edx
inc ebx
add byte [ecx], al
shr dword [eax - 0x6c], 5
add byte [eax], al
Function at 0x403a82
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
rcr byte [ebp + 0x43], 1
add byte [ecx], al
sar byte [ecx + 0x10], 1
push 0x7c
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435acc]
add eax, eax
mov eax, dword [0x435c70]
mov eax, dword [0x435d70]
push 0x506
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435cc4]
add eax, esi
mov edx, dword [0x435a24]
mov esi, dword [0x435c80]
push 0xaa
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435abc]
mov ax, 0x20
mov eax, 0x10
sub eax, eax
push 0x7b
mov dword [0x435a24], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435aa0]
add eax, eax
mov edi, dword [0x435a80]
sub esi, eax
push 0x142a
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435a38]
sub esi, eax
sub edx, edi
push 0x9c
mov dword [0x435a9c], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435be4]
and ecx, eax
mov eax, dword [0x435a24]
mov dword [0x435ca0], 0x10
push 0xc6
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435c40]
mov cx, 0x34
mov eax, dword [0x435ad8]
mov ax, 8
mov eax, dword [0x435b50]
add ecx, edi
push 0x191
mov dword [0x435a44], edx
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435e10]
mov eax, 0xf3
mov ecx, dword [0x435df4]
mov eax, dword [0x435df4]
push 0x97
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435d9c]
xor eax, eax
mov eax, dword [0x435de0]
mov eax, dword [0x435ce4]
mov eax, 8
push 0x80
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435cd8]
add esi, eax
sub eax, ecx
mov dword [0x435d0c], eax
push 0x1d90
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435bd0]
mov di, 0x20
mov ecx, dword [0x435cd4]
push 0x15d3
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435c4c]
sub eax, eax
mov eax, 0xd3
mov eax, dword [0x435cd8]
push 0x99
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b30]
sub eax, eax
mov eax, dword [0x435b90]
mov edx, dword [0x435d74]
push 0x73
push 0
call sub.user32.dll_LoadIconA
add byte [ecx + 0x435bd8], ah
or eax, eax
sbb eax, dword [0x435da4]
mov ecx, 0x6a
push 0x8c
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435cc8]
mov ax, 0x10
mov eax, dword [0x435b14]
mov esi, dword [0x435b70]
sub eax, eax
mov dword [0x435bf8], eax
push 0xa3
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435a24]
mov di, 0x40
sub ecx, esi
mov edx, dword [0x435ab8]
invalid
invalid
Function at 0x404318
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d90]
add edi, eax
sub ecx, eax
mov esi, dword [0x435b9c]
push 0x94
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435c9c]
and ecx, ecx
mov eax, dword [0x435b78]
mov ax, 0x40
mov edi, dword [0x435b94]
push 0xb4
mov dword [0x435b20], eax
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435d44]
add edi, eax
sub eax, eax
mov ecx, 0x40
push 0xa2
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435cfc]
sub eax, eax
xor esi, dword [0x435a5c]
add eax, eax
add eax, esi
push 0xa1
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d90]
mov edi, 0x8a
mov ecx, dword [0x435a40]
xor eax, eax
mov di, 1
push 0x9d
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435cb0]
add esi, eax
mov edx, dword [0x435a58]
push 0x78
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435cfc]
sub edi, edx
mov eax, dword [0x435a24]
mov eax, dword [0x435cb4]
push 0x9d
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435ae0]
sub eax, esi
mov eax, dword [0x435bb0]
mov ax, 1
mov edi, dword [0x435af8]
push 0xbe
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435b94]
add esi, edx
mov eax, dword [0x435c50]
mov eax, 0x20
mov esi, dword [0x435d18]
sub ecx, esi
push 0xba
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435afc]
cld
pop edx
inc ebx
add byte [ecx], al
int1
Function at 0x4049ef
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov edx, dword [0x435de8]
add eax, ecx
mov ecx, dword [0x435b2c]
mov edi, 0x40
mov dword [0x435bf8], ecx
push 0x96
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435aac]
mov si, 0xa2
or ecx, eax
mov eax, dword [0x435dd0]
mov si, 2
push 0xe77
mov dword [0x435be8], edx
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c98]
add ecx, ecx
mov eax, dword [0x435d18]
sub edx, eax
mov dword [0x435b14], eax
push 0x56e
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435be4]
mov eax, 0x80
mov eax, dword [0x435d74]
mov eax, 0x4a
push 0x90
mov dword [0x435ac4], eax
push 0
call sub.user32.dll_LoadIconA
sub eax, dword [0x435db4]
add eax, eax
sub edi, eax
mov dword [0x435a40], eax
push 0xa9
mov dword [0x435c58], edx
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435abc]
sub eax, eax
mov eax, dword [0x435a8c]
add eax, eax
push 0x7d
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435c10]
mov di, 0xc8
mov di, 0x10
mov eax, dword [0x435abc]
mov dword [0x435bec], esi
push 0x82
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435c2c]
add edi, eax
mov ecx, dword [0x435bdc]
push 0x7f
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435e1c]
sub ecx, esi
sbb edi, dword [0x435a88]
mov dword [0x435c84], esi
push 0xbb
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b2c]
add edi, eax
mov edi, dword [0x435ce4]
sub eax, eax
mov edi, dword [0x435dbc]
push 0x93
mov dword [0x435b1c], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435cc0]
mov si, 0x51
mov eax, dword [0x435c9c]
sub esi, ecx
mov eax, dword [0x435b28]
sub edi, eax
mov dword [0x435be8], esi
push 0x79
or dword [0x435de0], 0xffff00ff
push 0
call sub.user32.dll_LoadIconA
sbb eax, dword [0x435a94]
sub eax, ecx
mov edx, dword [0x435e18]
mov ax, 0xf2
mov dword [0x435cfc], esi
push 0xbc
push 0
call sub.user32.dll_LoadIconA
add eax, dword [0x435c30]
sub edi, ecx
push 0x7b
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b84]
add eax, esi
mov esi, 1
mov eax, 0x72
push 0xb9
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435b34]
mov ax, 4
mov eax, dword [0x435c44]
push 0xca7
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435a88]
sub edx, eax
mov edi, dword [0x435a44]
push 0x8a
mov dword [0x435b50], esi
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a24]
mov eax, 2
add eax, edi
mov eax, dword [0x435ca8]
mov dword [0x435ba0], edx
push 0xb3
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435af8]
mov ecx, 0x3a
mov eax, dword [0x435dac]
mov eax, dword [0x435b14]
add eax, eax
push 0xa8
mov dword [0x435a70], esi
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435ce8]
add eax, eax
sar byte [esi + 4], 0xa1
nop
pop esp
inc ebx
add byte [ecx], ch
xlatb
Function at 0x40559d
Capabilities:
Terminate process

Disassembly:
xchg edi, eax
add byte [ecx + 0x435bbc25], al
add bh, bh
invalid

Function at 0x4055cc
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push 0x66
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435c88]
or eax, eax
mov edi, dword [0x435a84]
add ecx, eax
mov ecx, dword [0x435d40]
mov edx, 0x80
mov dword [0x435ca4], eax
push 0x86
add byte [edx], ch
Function at 0x406138
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov eax, dword [0x435c58]
mov edx, dword [0x435c14]
push 0xbf
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435aec]
sub edi, eax
mov eax, dword [0x435b3c]
sub eax, eax
mov edx, dword [0x435a24]
sub eax, eax
push 0x67
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435b94]
mov cx, 0x20
mov ecx, dword [0x435ab4]
invalid
Function at 0x406a77
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435e1c]
inc ebx
add byte [ecx], ch
into

Function at 0x406bc9
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
pop edx
inc ebx
add byte [esi - 0x48], ah
jmp 0x207df6d3

Function at 0x406d01
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
mov ecx, dword [0x435b1c]
mov eax, 0x20
sub esi, esi
push 0x68
mov dword [0x435dbc], eax
push 0
call sub.user32.dll_LoadIconA
sbb eax, dword [0x435be8]
add edx, eax
mov eax, dword [0x435a24]
sub edx, eax
push 0x1b5f
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435b14]
sub eax, ecx
mov eax, dword [0x435c7c]
mov ax, 0x10
push 0x6d
mov dword [0x435c54], eax
push 0
call sub.user32.dll_LoadIconA
adc eax, dword [0x435e1c]
or eax, eax
add esi, ecx
add ecx, eax
push 0xbe
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c9c]
sub ecx, eax
mov eax, 0x10
mov eax, dword [0x435ce4]
add eax, edx
push 0x7b
mov dword [0x435a34], eax
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435cbc]
sub esi, esi
mov ecx, dword [0x435a24]
mov edi, 0xd
mov dword [0x435c54], 2
push 0x45f
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435bcc]
mov eax, 1
mov dword [0x435cec], eax
push 0x780
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435cc0]
mov eax, 0xaa
mov ecx, dword [0x435bfc]
xor eax, ecx
push 0x82
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435dd0]
mov eax, 0x9c
add eax, ecx
add dword [0x435c94], 0x6f
push 0xad
mov dword [0x435ba8], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a2c]
mov cx, 0xd1
mov ecx, 1
mov dword [0x435b9c], eax
push 0xd5c
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c18]
mov ax, 0xff
mov eax, dword [0x435a24]
mov eax, 0x80
push 0x180a
push 0
call sub.user32.dll_LoadIconA
add ecx, dword [0x435df4]
sub ecx, esi
add eax, eax
mov edi, dword [0x435cc8]
mov cx, 2
push 0xc1
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435c60]
mov di, 0x5e
add byte [ebx], ch
add eax, 0x435c94
Function at 0x406fb0
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
add byte [esi + 0x15], bh
mov eax, dword [0x435cd0]
mov si, 0x40
push 0x71
push 0
add al, ch
mov al, 0xc7
add al, byte [eax]
mov edi, dword [0x435d80]
mov ax, 0x71
add eax, eax
mov ecx, dword [0x435cd8]
push 0x89
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435e18]
sub eax, edx
mov eax, dword [0x435b74]
mov ecx, dword [0x435b2c]
add edx, ecx
push 0x8f
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435cec]
add eax, eax
mov edi, dword [0x435c30]
push 0xbf
push 0
call sub.user32.dll_LoadIconA
push edi
mov dword [edx], 0xa80d8b00
pop edx
inc ebx
add byte [eax + 1], bh
add eax, edx
or edi, eax
push 0x8f
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a70]
mov eax, 0x6c
mov ecx, dword [0x435b64]
mov eax, dword [0x435ab8]
sub edx, eax
push 0xac
or dword [0x435bb8], eax
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435cd4]
and esi, eax
add ecx, ecx
mov edi, dword [0x435ce8]
xor edi, edx
push 0x9e
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435aa4]
mov esi, 0xbb
mov edx, dword [0x435d18]
mov eax, dword [0x435ad0]
sub eax, edx
push 0xb2
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435d9c]
mov eax, 0x20
mov esi, dword [0x435c50]
add edx, edx
mov dword [0x435d8c], edx
push 0xaf
mov dword [0x435c88], esi
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b40]
mov eax, 0xc4
mov eax, dword [0x435a24]
mov eax, dword [0x435a88]
add eax, eax
push 0xa9
mov dword [0x435a24], eax
push 0
call sub.user32.dll_LoadIconA
jg 0x4070bd
add al, byte [eax]
adc eax, dword [0x435b34]
add edx, eax
mov eax, dword [0x435bf8]
push 0x172b
mov dword [0x435d8c], eax
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a24]
sub eax, edi
mov eax, dword [0x435a80]
mov esi, 0x40
mov eax, dword [0x435ad0]
push 0x6a
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435a94]
add eax, ecx
mov edi, 0x21
xor eax, dword [0x435cc0]
mov dword [0x435cd8], eax
push 0x9e
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435d58]
sub edi, edi
sub eax, dword [0x435b60]
mov ax, 0x73
mov esi, dword [0x435b4c]
push 0xae
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c64]
mov ax, 0xd5
mov eax, dword [0x435d78]
mov eax, dword [0x435a5c]
push 0x77
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d5c]
mov eax, 1
mov eax, dword [0x435bec]
mov ax, 4
push 0x64
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435a3c]
mov ax, 8
mov eax, dword [0x435ad0]
mov si, 0x70
push 0x206
push 0
call sub.user32.dll_LoadIconA
mov ecx, dword [0x435ce8]
sub esi, edi
mov ecx, dword [0x435cfc]
mov edx, dword [0x435aa8]
mov eax, 4
push 0x7d
push 0
call sub.user32.dll_LoadIconA
and ecx, dword [0x435b04]
sub eax, eax
sub eax, eax
mov eax, dword [0x435c50]
add eax, edx
mov dword [0x435b38], eax
push 0x81
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b08]
sub ecx, eax
sub edx, eax
push 0x277
mov dword [0x435a24], eax
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435c9c]
mov ax, 4
add esi, edx
adc eax, dword [0x435c10]
add eax, eax
push 0x99
push 0
call sub.user32.dll_LoadIconA
mov edi, dword [0x435af4]
mov ax, 0xcf
invalid
Function at 0x407804
Capabilities:
Terminate process

Disassembly:
mov edi, 0x5330002
pop esp
pop edx
inc ebx
add byte [ecx], ch
invalid

Function at 0x4088e3
Capabilities:
Inspect load icon resource
Terminate process

Disassembly:
test al, 0x5d
inc ebx
add byte [edx], ch
call sub.user32.dll_LoadIconA
mov eax, dword [0x435d88]
mov eax, 4
mov eax, dword [0x435aec]
mov eax, dword [0x435c7c]
mov cx, 0xf8
push 0xab5
push 0
call sub.user32.dll_LoadIconA
mov esi, dword [0x435d20]
xor eax, eax
mov edi, dword [0x435c44]
mov ax, 2
sbb eax, dword [0x435c58]
sbb dword [0x435bcc], edx
push 0x1de5
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435a24]
mov edx, 8
mov dx, 0x9e
push 0xc3
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435b70]
add ecx, eax
mov esi, dword [0x435af0]
mov ax, 0x42
push 0x7f
push 0
call sub.user32.dll_LoadIconA

Function at 0x408970
Capabilities:
Terminate process

Disassembly:
mov edi, dword [0x435cb4]
mov edi, 0xb4
sub eax, dword [0x435af0]
mov ax, 1
mov eax, dword [0x435ccc]
xor ecx, eax
mov dword [0x435a88], eax
push 0xa9
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435bcc]
mov ax, 0x80
mov eax, dword [0x435a94]
mov eax, 2
push 0x8a
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435e14]
and ecx, eax
push 0xc6
push 0
call sub.user32.dll_LoadIconA
mov edx, dword [0x435d64]
mov cx, 0x46
mov edx, dword [0x435ca4]
add edi, eax
push 0xa3
mov dword [0x6a000000], eax
add al, ch
mov ch, byte [ebp + 0x358b0002]
cld
pop edx
inc ebx
add byte [edi + 0x20], bh

Function at 0x409055
Capabilities:
Terminate process

Disassembly:
mov edx, eax
mov esi, 0x435b61
mov edi, dword [esi + 0xc]
sub edi, esi
mov dword [esi + 0x14], edi
mov edi, dword [0x435ca0]
mov edi, dword [0x435d84]
sub edi, esi
mov esi, 2
sbb dword [0x435d78], edi
mov dword [0x435c14], esi
mov dword [0x435b50], esi
mov eax, dword [edx]
inc edx
cmp eax, dword [0x43594a]
jne 0x409089
mov ecx, dword [0x435abc]
and edi, esi
mov ecx, dword [0x435a58]
mov dword [0x435a28], ecx
push 0x97
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435de0]
add ecx, eax
add edx, ecx
mov dword [0x435d70], eax
push 0x76
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435ca4]
mov di, 0x40
push 0x651
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435db4]
xor eax, esi
mov eax, dword [0x435a34]
or edi, dword [0x435c6c]
mov dword [0x435bb4], eax
push 0x9f
push 0
call sub.user32.dll_LoadIconA
call fcn.004092d8
push 0xa6
push 0
call sub.user32.dll_LoadIconA
mov eax, dword [0x435c38]
mov eax, 0x40
mov eax, 2
call fcn.004094a1
adc edi, dword [0x435d00]
sub eax, edx
mov eax, dword [0x435dd0]
mov edi, dword [0x435d18]
call fcn.004013f2
mov edi, dword [0x435d20]
mov edx, 0x10
mov eax, dword [0x435a8c]
mov ecx, 0x10
mov dword [0x435ac4], edx
push 0xa7
mov dword [0x435ba8], esi
push 0
invalid
invalid
cmpsb byte [esi], byte es:[edi]
invalid