joyce8/EMBER2024-capa huggingface dataset:
Function at 0x862058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8621a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x86207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x86206a
add dl, dl
jne 0x862089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8620dc
xor eax, eax
add dl, dl
jne 0x862096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x86217d
add dl, dl
jne 0x8620a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8620b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8620bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8620c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8620d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x862075
mov eax, 1
add dl, dl
jne 0x8620ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8620f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8620e1
sub eax, ebx
mov ebx, 1
jne 0x862128
mov ecx, 1
add dl, dl
jne 0x86210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x862119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x862105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x862075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x86213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x86214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x862136
cmp eax, 0x7d00
jae 0x86216d
cmp eax, 0x500
jb 0x862168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x862075
cmp eax, 0x7f
ja 0x862170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x862075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x86219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x862075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401119
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push ebx
push 0x14e9029
call fcn.004013c8
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push 0x49b7071
call fcn.004013c8
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], eax
jae 0x40122e
call fcn.004013b9
mov esi, eax
lea eax, [esi + 0x1c68]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
add ecx, 1
and ecx, 0xff
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], 0x19530e5
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
movzx edx, byte [edx + ebx]
add ecx, edx
and ecx, 0xff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], 0x571114d
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xcb4c4b
je 0x4011be
jmp 0x4011c7
mov dword [ebp - 0x24], 0x1f6212c
jmp 0x4011c7
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
push eax
call fcn.00401000
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
movzx ecx, byte [ecx + edx]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
movzx edx, byte [edx + ebx]
add ecx, edx
and ecx, 0xff
movsx eax, byte [eax + ecx]
mov dword [ebp - 0x30], eax
call fcn.004013e9
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
movsx ecx, byte [ecx + edx]
xor eax, ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
mov byte [ecx + edx], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
jmp 0x40115c
mov eax, 0
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401550
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x455c73
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ebx, [esi + 4]
xor eax, eax
mov dword [ebx], eax
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CBitmapObject.0
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], vtable.FCObjImage.0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
push str.bitmap
mov byte [esp + 0x18], 1
call fcn.00406d00
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4030c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x454668
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x403110
mov eax, dword [esi]
jmp 0x403112
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0xb0]
push edi
call eax
test eax, eax
jge 0x403133
push 0x45cac4
push edi
push eax
call fcn.00452890
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebp
call dword [sym.imp.MSVCR80.dll_memcpy_s]
add esp, 0x10
test esi, esi
mov word [esp + 0xc], 0
je 0x403185
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x403185
mov eax, dword [esi]
test eax, eax
je 0x40316c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40317c
push eax
call sub.MFC80U.DLL_Ordinal_266
add esp, 4
push esi
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
Function at 0x40a630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4586c8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
cmp dword [edi + 0x34], esi
je 0x40a77c
movzx eax, word [edi + 0x1a]
cmp ax, 0x20
jne 0x40a77c
xor eax, eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], vtable.FCObjImage.0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x88], esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x3c]
push eax
call fcn.004079a0
mov edx, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
mov eax, dword [esp + 0x50]
add esp, 0x14
mov dword [esp + 0x18], edx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x30], ecx
push edi
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.0040a7a0
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
push ebx
lea eax, [esp + 0x40]
call fcn.004078a0
add esp, 0x14
lea esi, [esp + 0x2c]
mov dword [esp + 0x2c], vtable.FCObjImage.0
call fcn.00406c80
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ae60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x457c08
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
xor eax, eax
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [esp + 0x14], eax
mov dword [edi], vtable.FCObjImage.0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
call fcn.00406750
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 4
Function at 0x40e560
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x453593
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov eax, 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], vtable.CTrackWindowBase.0
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov byte [esp + 0x14], al
push 0x10
mov dword [esi], vtable.CControlBase.1.0
mov dword [esi + 8], vtable.CControlBase.0
call sub.MFC80U.DLL_Ordinal_762
mov dword [esi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x412df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x457803
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push esi
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
lea ecx, [esi + 0xc]
call fcn.00414900
mov eax, dword [esi + 0x30]
push eax
lea ecx, [esp + 0x10]
call sub.MFC80U.DLL_Ordinal_326
mov eax, dword [ebp + 8]
mov dword [esp + 0xb0], 0
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 0x18]
push edx
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x412f4a
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
je 0x412f4a
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
je 0x412f4a
lea eax, [esp + 0x54]
push eax
call fcn.00414550
lea esi, [esp + 0x54]
call fcn.00406120
mov edx, dword [edi + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x64]
add edx, eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c], edx
push ecx
lea edx, [esp + 0x48]
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call dword [sym.imp.USER32.dll_IntersectRect]
cmp dword [esp + 0x40], 0
jne 0x412f1d
cmp dword [esp + 0x38], 0
jne 0x412f1d
cmp dword [esp + 0x34], 0
jne 0x412f1d
cmp dword [esp + 0x3c], 0
jne 0x412f1d
mov ecx, esi
call fcn.00406e00
jmp 0x412f4a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x58]
push edx
push edi
call fcn.004145e0
lea esi, [esp + 0x54]
mov dword [esp + 0x54], vtable.FCObjImage.0
call fcn.00406c80
mov dword [esp + 0x54], vtable.FCObject.0
mov dword [esp + 0xb0], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CBrush.0
call fcn.00407b40
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x413cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4577c8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov dword [edi], vtable.CPaintMStateItem.0
lea esi, [edi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00414450
mov ecx, edi
mov dword [edi], vtable.CPaintBase.0
call fcn.004152d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x413e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45a4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
call fcn.004105c0
test eax, eax
mov esi, dword [esp + 0x94]
jne 0x413e94
cmp dword [esi + 0x28], 0xffffffff
jne 0x413fd9
call fcn.004105c0
mov ecx, dword [esi + 0x28]
push ecx
add eax, 0xc
call fcn.00410760
xor edi, edi
cmp eax, edi
je 0x413fd9
mov ebx, dword [eax + 0x1c]
mov esi, dword [esi + 0x44]
cmp ebx, esi
lea ecx, [eax + 0xc]
mov dword [esp + 0x18], ecx
jl 0x413fd9
mov eax, ebx
cdq
idiv esi
test edx, edx
jne 0x413fd9
mov eax, ebx
cdq
idiv esi
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x28], ebp
xor ebp, ebp
cmp esi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
jle 0x413fd9
jmp 0x413ef9
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], vtable.FCObjImage.0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x8c], edi
mov edx, dword [esp + 0x1c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x38]
push ecx
lea ebx, [esp + 0x40]
mov dword [eax + 0xc], edx
call fcn.0040b010
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, ebx
push ecx
call fcn.0040ac30
mov ecx, dword [esp + 0x94]
mov esi, ebx
add ecx, 0x30
call fcn.00414260
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x2c], vtable.FCObjImage.0
call fcn.00406c80
mov edx, dword [esp + 0x94]
add ebp, 1
cmp ebp, dword [edx + 0x44]
jl 0x413ef5
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret 4
Function at 0x414550
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x457798
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esp + 0x10], eax
mov dword [esi], vtable.FCObjImage.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
push 0x20
push esi
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
call fcn.00405430
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x418500
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x458328
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x476028]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], vtable.CMD5Checksum.0
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], 0x67452301
mov dword [esp + 0x5c], 0xefcdab89
mov dword [esp + 0x60], 0x98badcfe
mov dword [esp + 0x64], 0x10325476
mov eax, dword [esp + 0x7c]
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x78], ebx
call fcn.00418460
push esi
lea ecx, [esp + 0x10]
call fcn.004182d0
mov eax, esi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00452313
add esp, 0x70
ret

Function at 0x418800
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4544f2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push 0x67
push eax
call fcn.004290c0
mov esi, eax
lea ecx, [esp + 0x14]
push 0x66
push ecx
mov dword [esp + 0x2c], 0
call fcn.004290c0
add esp, 0x10
mov byte [esp + 0x1c], 1
mov esi, dword [esi]
mov eax, dword [eax]
push 0x41
push esi
push eax
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_4098
cmp eax, 1
lea ecx, [esp + 0xc]
sete bl
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
test bl, bl
je 0x4188aa
push 5
push 0
push 0
push str.http:__g.iciba.com_powerword_lite_zh_cn_getflashplayer
push 0x45e088
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [edi + 0x20]
push 0
push 0x1f4
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x41b650
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x476028]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x14], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b6ad
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00452313
add esp, 0x230
ret
push ebx
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41b71a
mov ebx, dword [sym.imp.MSVCR80.dll__wcsicmp]
jmp 0x41b6d0
lea edx, [esp + 0x30]
push str.explorer.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x41b6f7
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41b6d0
lea edi, [eax + 1]
jmp 0x41b71c
mov ecx, dword [esp + 0x14]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, eax
jmp 0x41b71c
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop ebx
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00452313
add esp, 0x230
ret
Function at 0x41d850
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x45538d
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x476028]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xac]
push str._tKSDNettoolsHelper::__InitProxySettingContent___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp + 8], 0
je 0x41d8a9
cmp dword [ebp + 0xc], 0
je 0x41d8f9
lea eax, [esp + 0x18]
push eax
call fcn.0041d4c0
lea esi, [ebp + 0xc]
mov dword [esp + 0xa4], 0
cmp dword [esi], 0
je 0x41d8d7
cmp dword [ebp + 8], 0
je 0x41d8d7
lea edi, [esp + 0x18]
call fcn.0041b440
jmp 0x41d8e0
lea ebx, [esp + 0x18]
call fcn.0041b160
test eax, eax
jne 0x41d8fd
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0xa8], 0xffffffff
call fcn.0041d660
xor eax, eax
jmp 0x41d96f
cmp dword [ebp + 8], 0
je 0x41d936
lea edx, [esp + 0x18]
cmp edx, esi
je 0x41d91d
mov eax, edx
mov ecx, esi
call fcn.0041d5e0
neg eax
sbb eax, eax
add eax, 1
jne 0x41d936
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0xa8], 0xffffffff
call fcn.0041d660
xor eax, eax
jmp 0x41d96f
lea ecx, [esp + 0x18]
cmp ecx, esi
mov dword [ebp + 8], 1
je 0x41d94c
mov eax, ecx
call fcn.0041d590
lea esi, [esp + 0x18]
mov ebx, ebp
call fcn.0041d9c0
mov edx, esi
push edx
mov dword [esp + 0xa8], 0xffffffff
call fcn.0041d660
mov eax, 1
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.00452313
add esp, 0x94
ret 4

Function at 0x41e010
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x458265
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x476028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_572
xor eax, eax
mov dword [esp + 0x14], eax
lea esi, [edi + 0x54]
mov dword [edi], vtable.CMenuEdit.0
mov dword [esi + 4], eax
mov dword [esi], vtable.CXDictColorMenu.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], vtable.CFont.0
push 0x8f
mov byte [esp + 0x18], 1
call fcn.00428940
call sub.MFC80U.DLL_Ordinal_1079
mov eax, dword [eax + 0xc]
push 0x93
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [edi + 0x8c], eax
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4