joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d15d
Capabilities:
Create thread

Disassembly:
mov eax, 0x497fbe
call fcn.00497a30
sub esp, 0x5c
cmp byte [0x4b99a0], 0
mov eax, dword [0x4b8484]
mov dword [ebp - 0x10], eax
je 0x48d182
xor eax, eax
jmp 0x48d324
call fcn.0048b312
test al, al
jne 0x48d198
call fcn.0048a60f
xor eax, eax
inc eax
jmp 0x48d324
push ebx
mov bl, byte [ebp + 8]
push esi
mov byte [0x4b99a2], bl
call dword [0x4b99b4]
call dword [0x4b99b8]
call dword [0x4b99bc]
push eax
call dword [0x4b99c0]
xor esi, esi
push esi
push 0x400000
push 0x20
push eax
mov dword [0x4b99ac], eax
call dword [0x4b9a10]
add esp, 0x14
call fcn.0048a6a1
push 0x4b9978
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
push 0x400
push 0x48d124
call dword [sym.imp.MSVCR71.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push 4
push eax
call dword [0x4b9aa8]
test bl, bl
pop ecx
pop ecx
je 0x48d309
lea ecx, [ebp - 0x64]
call fcn.00483124
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.00483124
lea eax, [ebp - 0x64]
push str.ServUCert.crt
push eax
mov byte [ebp - 4], 1
call fcn.00482d5b
lea eax, [ebp - 0x40]
push str.ServUCert.key
push eax
call fcn.00482d5b
add esp, 0x10
push 1
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push dword [0x4b99ac]
call dword [0x4b99c8]
add esp, 0xc
test eax, eax
jne 0x48d271
push 2
jmp 0x48d2b3
push esi
push dword [0x4b99ac]
call dword [0x4b99d0]
push 0x48a679
push dword [0x4b99ac]
call dword [0x4b99cc]
add esp, 0x10
push 1
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push dword [0x4b99ac]
call dword [0x4b99d4]
add esp, 0xc
test eax, eax
jne 0x48d2d0
push 3
pop esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004833a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004833a3
mov eax, esi
jmp 0x48d322
lea eax, [ebp - 0x1c]
push 0xa
push eax
call dword [0x4b9ab4]
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [0x4b99ac]
call dword [0x4b99e0]
add esp, 0x14
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004833a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004833a3
push 1
push dword [0x4b99ac]
call dword [0x4b99dc]
pop ecx
pop ecx
mov byte [0x4b99a0], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00497a1c
leave
ret

Function at 0x48d429
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 8]
push 0x3e8
push dword [esp + 0xc]
push 0x4a4630
push str.RegistrationKey
push str.GLOBAL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [esp + 4]
call fcn.004820c0
pop ecx
ret 8
Function at 0x48d781
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x48f010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0x4b9be8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4b9c28]
cmp eax, 0x186a0
jae 0x48f0ca
push ebx
xor ebx, ebx
xor edi, edi
cmp dword [0x4b9c0c], eax
mov byte [ebp - 1], bl
jg 0x48f08f
mov eax, dword [esi + 0xc]
cmp eax, ebx
jle 0x48f051
cmp dword [esi + 0x10], eax
jge 0x48f08f
lea eax, [ebp - 8]
push eax
push ebx
push dword [esi + 4]
mov byte [ebp - 1], 1
push 0x48eda8
push 0x1000
push ebx
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
jbe 0x48f08c
inc dword [0x4b9c08]
inc dword [0x4b9c0c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x48f08f
xor edi, edi
inc edi
cmp byte [ebp - 1], bl
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], esi
mov ecx, 0x4b9c18
push eax
je 0x48f0b3
call fcn.0048ef07
jmp 0x48f0b8
call fcn.0048ef5d
push ebx
push 1
push dword [0x4b9c14]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop ebx
jmp 0x48f0cd
push 2
pop edi
push 0x4b9be8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x48f8cf
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0x400
mov dword [0x4bcdc4], 0
mov dword [0x4bcdb8], 1
push 0x48f8bc
call dword [sym.imp.MSVCR71.dll__beginthread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0x10
call esi
mov dword [0x4bcdb8], 0
push 1
call esi
mov eax, dword [0x4bcdc4]
mov ecx, dword [0x4bcdc4]
shr eax, 3
xor eax, ecx
mov ecx, dword [0x4bcdc0]
shr eax, 3
xor eax, ecx
mov ecx, dword [0x4bcdc4]
xor eax, ecx
mov dword [0x4bcdc4], eax
and dword [0x4bcdc4], 7
mov eax, dword [0x4bcdc4]
mov dword [0x4bcdc0], eax
mov eax, dword [0x4bcdbc]
mov ecx, dword [0x4bcdc4]
shl eax, 3
xor eax, ecx
mov dword [0x4bcdbc], eax
mov eax, dword [0x4bcdbc]
pop esi
ret
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
call 0x48f8cf
jmp 0x48f8cf

Function at 0x4900a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4b9c40]
cmp dword [eax + 0x22c], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
jne 0x490173
mov eax, dword [ebx + 8]
test eax, eax
jl 0x490173
cmp eax, 1
jg 0x490173
push dword [ebx + 4]
call fcn.00491840
test eax, eax
pop ecx
je 0x490173
cmp dword [ebp + 0x10], 1
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
push esi
jne 0x490102
call fcn.00490266
jmp 0x490107
call fcn.004901f1
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
add eax, 0xffffffe2
cmp eax, 5
mov dword [edi], eax
jl 0x490173
xor edx, edx
test eax, eax
jle 0x490145
mov dword [ebp + 8], 0xffffffe2
sub dword [ebp + 8], esi
lea ecx, [esi + 0x1e]
mov al, byte [edx + esi]
xor byte [ecx], al
lea eax, [edx + 1]
cdq
push 0x1e
pop ebx
idiv ebx
mov eax, dword [ebp + 8]
inc ecx
add eax, ecx
cmp eax, dword [edi]
jl 0x49012a
mov ebx, dword [ebp - 8]
push 0x1e
push esi
push dword [edi]
lea eax, [esi + 0x1e]
push eax
push dword [ebx + 8]
mov ecx, ebx
push dword [ebx + 4]
call fcn.0048fdff
test al, al
je 0x490173
push dword [edi]
lea eax, [esi + 0x1e]
push eax
push esi
call dword [sym.imp.MSVCR71.dll_memmove]
add esp, 0xc
mov al, 1
jmp 0x490175
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x490266
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
xor esi, esi
mov dword [edx], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 5], bl
mov byte [ebp - 6], bl
mov byte [ebp - 7], bl
mov byte [ebp - 8], bl
xor ecx, ecx
cmp byte [ebp - 1], bl
jne 0x4902f7
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edi]
inc dword [ebp - 0xc]
xor ebx, ebx
cmp al, bl
je 0x4902ee
cmp al, 0x41
jl 0x4902af
cmp al, 0x5a
jg 0x4902af
sub al, 0x41
jmp 0x4902c5
cmp al, 0x61
jl 0x4902bb
cmp al, 0x7a
jg 0x4902bb
sub al, 0x47
jmp 0x4902c5
cmp al, 0x30
jl 0x4902cb
cmp al, 0x39
jg 0x4902cb
add al, 4
mov byte [ebp + ecx - 8], al
jmp 0x4902e6
cmp al, 0x2b
jne 0x4902d6
mov byte [ebp + ecx - 8], 0x3e
jmp 0x4902e6
cmp al, 0x2f
jne 0x4902e1
mov byte [ebp + ecx - 8], 0x3f
jmp 0x4902e6
cmp al, 0x3d
jne 0x4902e7
inc esi
inc ecx
cmp ecx, 4
jl 0x49028f
jmp 0x4902f7
push 4
pop esi
mov byte [ebp - 1], 1
sub esi, ecx
cmp ecx, ebx
jne 0x490300
cmp byte [ebp - 1], bl
jne 0x490365
mov al, byte [ebp - 7]
mov cl, byte [ebp - 8]
mov bl, al
shr bl, 4
and bl, 3
shl cl, 2
or bl, cl
mov cl, byte [ebp - 6]
mov byte [ebp + 8], bl
mov bl, cl
shl al, 4
shr bl, 2
and bl, 0xf
or bl, al
mov al, byte [ebp - 5]
and al, 0x3f
shl cl, 6
or al, cl
mov byte [ebp + 0xa], al
push 3
pop eax
mov byte [ebp + 9], bl
xor ebx, ebx
sub eax, esi
xor ecx, ecx
cmp eax, ebx
jle 0x490358
mov edx, dword [edx]
mov bl, byte [ebp + ecx + 8]
mov byte [edi + edx], bl
mov edx, dword [ebp + 0xc]
inc dword [edx]
inc ecx
cmp ecx, eax
jl 0x490343
xor ebx, ebx
cmp esi, ebx
jne 0x490365
cmp byte [ebp - 1], bl
je 0x490281
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4909b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, 1
push ebp
call fcn.00490690
mov edi, eax
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, 0xe
mov dword [edi + 0x134], eax
mov dword [edi + 0x130], eax
xor dword [edi + 0x9c], ebx
mov ebp, 0x25
mov eax, ecx
sub ebx, esi
add ecx, 0xe
cdq
idiv ebp
mov eax, esi
xor dword [edi + edx*4 + 0x9c], esi
mov esi, ebx
cmp ecx, 0x206
mov ebx, eax
jl 0x4909dd
mov esi, 0x3e8
call fcn.00490920
dec esi
jne 0x490a06
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x491d90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
mov ebx, dword [esp + 0x18]
push edi
push ebp
mov edi, 5
mov eax, dword [esp + 0x1c]
push ebx
push eax
call fcn.00491c70
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x18]
push ebx
push eax
call fcn.00491c70
mov ecx, dword [esp + 0x2c]
add esp, 8
sub esi, eax
mov eax, dword [esp + 0x28]
mov dword [ecx], 1
mov dword [eax], 0
jne 0x491de0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov dword [esp + 0x10], 0
cmp ebx, 5
jg 0x491df7
mov dword [esp + 0x10], 1
mov edi, ebx
test esi, esi
mov esi, 1
jg 0x491e05
mov esi, 0xffffffff
lea ebp, [ebx - 1]
sub ebx, edi
cmp ebp, ebx
jle 0x491e45
mov ecx, dword [esp + 0x24]
add esi, esi
mov eax, dword [esp + 0x1c]
push ebp
push eax
inc dword [ecx]
call fcn.00491c70
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x18]
push ebp
push eax
call fcn.00491c70
add esp, 8
sub edi, eax
je 0x491e40
jle 0x491e3b
inc esi
test edi, edi
jge 0x491e40
dec esi
dec ebp
cmp ebp, ebx
jg 0x491e0e
cmp dword [esp + 0x10], 0
jne 0x491e62
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
je 0x491e62
mov ecx, dword [esp + 0x28]
inc dword [ecx]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
jne 0x491e96
mov eax, esi
mov ecx, dword [esp + 0x28]
cdq
sub eax, edx
inc dword [ecx]
sar eax, 1
mov edx, dword [esp + 0x24]
mov esi, eax
dec dword [edx]
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
je 0x491e72
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4953b0
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
xor eax, eax
mov ecx, 0x50
lea edi, [edx + 0x1c]
rep stosd dword es:[edi], eax
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], 0x67452301
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
mov dword [edx + 0x18], 0xc3d2e1f0
pop edi
ret
Function at 0x495440
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x20
add ecx, 0x1c
push ebx
push esi
mov edx, ecx
push edi
mov esi, 0x40
push ebp
mov eax, dword [edx + 8]
xor eax, dword [edx + 0x20]
xor eax, dword [edx + 0x34]
xor eax, dword [edx]
add edx, 4
mov edi, eax
add eax, eax
shr edi, 0x1f
or edi, eax
dec esi
mov dword [edx + 0x3c], edi
jne 0x495455
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], edx
mov esi, eax
mov ebp, dword [ebx + 0x18]
mov edi, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x14
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
shr ebx, 0x1b
xor eax, esi
and eax, edx
mov ebp, dword [esp + 0x10]
shl ebp, 5
xor eax, dword [esp + 0x14]
or ebx, ebp
add ecx, 4
add eax, ebx
add eax, dword [ecx - 4]
lea ebx, [eax + edi + 0x5a827999]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x10], ebx
dec dword [esp + 0x18]
jne 0x4954ad
mov ebx, dword [esp + 0x34]
mov ecx, 0x14
add ebx, 0x6c
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
shr eax, 0x1b
add ebx, 4
shl ebp, 5
or eax, ebp
mov ebp, edx
xor ebp, dword [esp + 0x14]
xor ebp, esi
add eax, ebp
add eax, dword [ebx - 4]
lea ebp, [eax + edi + 0x6ed9eba1]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
dec ecx
mov dword [esp + 0x10], ebp
jne 0x495504
mov dword [esp + 0x18], 0x14
mov ecx, dword [esp + 0x34]
add ecx, 0xbc
mov ebx, edx
mov eax, edx
or ebx, esi
and eax, esi
and ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
shl ebp, 5
or ebx, eax
mov eax, dword [esp + 0x10]
add ecx, 4
shr eax, 0x1b
or eax, ebp
add ebx, eax
add ebx, dword [ecx - 4]
lea eax, [ebx + edi - 0x70e44324]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
jne 0x49555a
mov ecx, dword [esp + 0x34]
mov ebx, 0x14
add ecx, 0x10c
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
shr eax, 0x1b
add ecx, 4
shl ebp, 5
or eax, ebp
mov ebp, edx
xor ebp, dword [esp + 0x14]
xor ebp, esi
add eax, ebp
add eax, dword [ecx - 4]
lea ebp, [eax + edi - 0x359d3e2a]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
dec ebx
mov dword [esp + 0x10], ebp
jne 0x4955b6
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x34]
add eax, ebp
add edx, dword [esp + 0x20]
add esi, dword [esp + 0x24]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x28]
add edi, dword [esp + 0x2c]
add eax, dword [esp + 0x14]
mov dword [ebx + 0xc], edx
pop ebp
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x495630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
push 0x80
mov edi, dword [esi]
mov ebx, dword [esi + 4]
push esi
call fcn.004953f0
add esp, 8
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 0x1c0
je 0x495672
push 0
push esi
call fcn.004953f0
add esp, 8
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 0x1c0
jne 0x495659
push esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], edi
call fcn.00495440
mov ebp, dword [esp + 0x1c]
add esp, 4
xor edi, edi
mov eax, edi
mov cl, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ebx, dword [esi + eax*4 + 8]
mov eax, edi
cdq
xor eax, edx
inc edi
sub eax, edx
and eax, 3
xor eax, edx
sub eax, edx
sub cl, al
shl cl, 3
shr ebx, cl
mov byte [edi + ebp - 1], bl
cmp edi, 0x14
jl 0x495687
push esi
call fcn.004953b0
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4977ec
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4a45c8
call fcn.00497b4c
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x49782c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49782c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x497844
cmp eax, 0x20b
je 0x497831
mov dword [ebp - 0x1c], ebx
jmp 0x497858
cmp dword [ecx + 0x84], 0xe
jbe 0x49782c
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x497852
cmp dword [ecx + 0x74], 0xe
jbe 0x49782c
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4bcdcc], 0xffffffff
or dword [0x4bcdd0], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4b9c54]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4b9c50]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4bcdc8], eax
call fcn.00497bbc
call fcn.00497c5c
cmp dword [0x4b8490], ebx
jne 0x4978b8
push fcn.00497c5c
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00497c4a
push 0x4b5054
push 0x4b5050
call sub.MSVCR71.dll__initterm
push 0x497c00
call fcn.0049778a
mov eax, dword [0x4b9c4c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4b9c48]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x49790c
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4b504c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x49798a
cmp al, bl
je 0x497936
cmp dword [ebp - 0x20], ebx
jne 0x49798a
mov al, byte [esi]
cmp al, bl
je 0x497946
cmp al, 0x20
ja 0x497946
inc esi
mov dword [ebp - 0x24], esi
jmp 0x497936
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x497962
movzx eax, word [ebp - 0x54]
jmp 0x497965
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00468365
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x497982
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x4979df
cmp al, 0x22
jne 0x497999
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x4979ac
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x497924
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00497b87
ret
Function at 0x401040
Capabilities:
Terminate process

Disassembly:
mov eax, dword [section..data]
push 4
push eax
mov eax, dword [0x45d288]
push 0
push 0
push 0
push 0
lea ecx, [eax*4 + 0x45d1e0]
push ecx
push 0
push eax
call fcn.0040139c
add esp, 0x24
test eax, eax
mov dword [0x45d284], eax
je 0x40108c
push 0
push 0x44a1b0
push 0x44a1a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0042da86
ret

Function at 0x4010f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x45b954]
xor eax, esp
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov word [esp + 0xc], ax
mov eax, dword [0x45d3c0]
cmp eax, 1
jne 0x401121
mov eax, 0x10
jmp 0x4011b0
cmp eax, 2
jne 0x401130
mov eax, 0x14
jmp 0x4011b0
cmp eax, 3
jne 0x40113c
mov eax, 0x18
jmp 0x4011b0
cmp eax, 4
jne 0x401148
mov eax, 0x1c
jmp 0x4011b0
cmp eax, 5
jne 0x401154
mov eax, 0x20
jmp 0x4011b0
cmp eax, 6
jne 0x401160
mov eax, 0x24
jmp 0x4011b0
cmp eax, 7
jne 0x40116c
mov eax, 0x28
jmp 0x4011b0
cmp eax, 8
jne 0x401178
mov eax, 0x2c
jmp 0x4011b0
cmp eax, 0x47
jne 0x401184
mov eax, 0x40
jmp 0x4011b0
cmp eax, 0x48
jne 0x401190
mov eax, 0x44
jmp 0x4011b0
cmp eax, 0x15
je 0x4011a6
cmp eax, 0x1f
je 0x4011a6
cmp eax, 0x51
jne 0x4011ad
mov eax, 0x4c
jmp 0x4011b0
mov eax, 0x48
jmp 0x4011b0
mov eax, dword [esp]
mov ecx, dword [section..data]
push 4
push ecx
push 4
push eax
mov eax, dword [0x45d288]
push 0
lea edx, [esp + 0x18]
push edx
lea ecx, [eax*4 + 0x45d1e0]
push ecx
push 3
push eax
call fcn.0040139c
add esp, 0x24
test eax, eax
mov dword [0x45d284], eax
jne 0x4012c8
mov eax, dword [0x45d3c0]
cmp eax, 1
push esi
push edi
jne 0x4011fe
mov edi, str.Agxz
jmp 0x40129e
cmp eax, 2
jne 0x40120f
mov edi, str.Brxz
xor eax, eax
jmp 0x4012a0
cmp eax, 3
jne 0x40121e
mov edi, str.Crxx
jmp 0x40129e
cmp eax, 4
jne 0x40122c
mov edi, str.Dqtz
xor eax, eax
jmp 0x4012a0
cmp eax, 5
jne 0x401238
mov edi, str.Ebtz
jmp 0x40129e
cmp eax, 6
jne 0x401246
mov edi, str.Fbtx
xor eax, eax
jmp 0x4012a0
cmp eax, 7
jne 0x401252
mov edi, str.Gysq
jmp 0x40129e
cmp eax, 8
jne 0x401260
mov edi, str.Hdjs
xor eax, eax
jmp 0x4012a0
cmp eax, 0x47
jne 0x40126c
mov edi, str.Mygz
jmp 0x40129e
cmp eax, 0x48
jne 0x40127a
mov edi, str.Nyzm
xor eax, eax
jmp 0x4012a0
cmp eax, 0x15
jne 0x401286
mov edi, str.Oxcs
jmp 0x40129e
cmp eax, 0x1f
jne 0x401294
mov edi, str.Oxcs
xor eax, eax
jmp 0x4012a0
cmp eax, 0x51
jne 0x4012ad
mov edi, str.Pylt
xor edx, edx
mov ecx, 5
lea esi, [esp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
je 0x4012e3
push 0
push 0x44a1d8
push 0x44a1b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0042da86
push 0
push 0x44a1d8
push 0x44a1b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0042da86
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.0042db12
add esp, 0x14
ret
Function at 0x401300
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, str.580218630708
mov dword [esp], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401310
mov ecx, dword [section..data]
push 4
push ecx
sub eax, edx
push eax
mov eax, dword [0x45d288]
push 0
lea edx, [esp + 0x10]
push edx
push str.580218630708
lea ecx, [eax*4 + 0x45d1e0]
push ecx
push 5
push eax
call fcn.0040139c
add esp, 0x24
test eax, eax
mov dword [0x45d284], eax
jne 0x40137e
mov eax, dword [esp]
cmp eax, 0xbee524cf
je 0x401399
cmp eax, 0xd6b8b7a4
je 0x401399
push 0
push 0x44a260
push 0x44a250
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0042da86
push 0
push 0x44a260
push 0x44a240
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0042da86
pop ecx
ret

Function at 0x402369
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004023ea
and byte [ebp - 8], 0
and byte [ebp - 7], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x46
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x30
call fcn.00402419
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004023ea
add esp, 0xc
test esi, esi
je 0x4023e5
push dword [ebp + 8]
call esi
jmp 0x4023e7
xor eax, eax
pop esi
leave
ret

Function at 0x402419
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004023ea
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x458034], 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x40247b
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x458034], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004023ea
mov eax, dword [0x458034]
add esp, 0xc
leave
ret