joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cd20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46dd23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00461672
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00466d0b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00468227
test eax, eax
je 0x43ce3c
mov ecx, dword [esp + 0x3c]
call fcn.00466d38
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43ce00
push edi
mov ecx, esi
call fcn.0046439f
mov ecx, esi
call fcn.0043cfa0
cmp dword [esp + 0x38], 1
jne 0x43ce35
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004644da
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43f850
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f883
push esi
call fcn.00442940
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f87c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f909
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f8f2
mov eax, dword [esi + 8]
test eax, eax
je 0x43f8a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f8ee
cmp eax, 2
je 0x43f8f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f89a
cmp eax, 3
je 0x43f8cd
cmp eax, 1
jne 0x43f89a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f89a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f89a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f930
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f918
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f930
add esp, 4
pop esi
ret
Function at 0x44c240
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44c28a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x44c2b9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x44c2fb
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x462468
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4624a0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046051f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004604f7
jmp 0x4624ac
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463b59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x463b9b
call fcn.00469631
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x463b9b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x463b92
xor eax, eax
jmp 0x463ba3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00463ba9
pop edi
pop esi
pop ebx
ret 4

Function at 0x469b61
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469b8f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469bad
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00469ac7
jmp 0x469bad
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469bad
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00469ac7
test edi, edi
mov eax, edi
jne 0x469b97
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x585391
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
push esp
lea esp, [esp + 3]
mov dword [esp + 0x38], edi
jmp 0x5853e0
push dword [esp + 6]
pop dword [esp]
mov dword [esp], eax
pop word [esp + 2]
jmp 0x585363
lea esp, [esp + 1]
push word [esp]
pop word [esp]
push edx
jmp 0x58537a
mov ax, 0x894d
rdtsc
bswap ebx
jmp 0x5853f0
lea esp, [esp + 0x38]
pushfd
neg bx
jno 0x5853c5
jo 0x58548c
mov esi, dword [esp + 0x28]
btr ebp, edx
jle 0x58543e
mov bp, 0x9a29
sete ah
mov dl, 0x1c
jmp 0x58541c
mov bp, 0x9a29
jmp 0x585417
mov ax, 0x894d
rdtsc
bswap ebx
jmp 0x5853f0

Function at 0x5853b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
pop word [esp + 0xd]
mov dword [esp + 0x30], ebx
call fcn.0058529a
mov word [esp + 2], sp
push word [esp + 5]
push word [esp + 3]
mov byte [esp + 2], ch
jmp 0x585354
Function at 0x65060d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0x15d6e36e
push word [esp + 2]
not ah
rdtsc
pop esi
lea edi, [ecx*4]
jmp 0x650632
xchg ecx, eax
pop word [esp]
jmp 0x6505e6
mov edx, eax
mov al, 0xae
bsf bp, ax
not cx
bswap edx
lea eax, [edx + ebx]
jmp 0x6507f7
xchg ebp, ecx
mov di, word [esp]
neg ah
btc ebx, edi
mov bx, word [esp]
lea edi, [eax + edi]
jmp 0x650615
xchg ebx, eax
mov edi, dword [esp + 9]
lea esp, [esp]
mov bp, 0xeb77
btr esi, edx
jmp 0x650699
mov byte [esp + 7], dh
mov cx, word [esp + 0xa]
xchg byte [esp + 4], cl
lea ebx, [ecx + ebx]
lea esi, [esi - 0x9d]
mov ah, byte [esp]
jmp 0x650668
push word [esp + 9]
xchg dword [esp + 1], ebp
bswap ebx
setns bh
neg di
lea edi, [edx + edi]
jmp 0x6506d6
mov edi, 0x655f2d96
inc dx
push dword [esp + 1]
pop dword [esp]
push dword [esp + 2]
bswap ebp
jmp 0x65067e
clc
mov dword [esp + 5], ecx
mov esi, dword [esp + 3]
pushal
cmc
pop dword [esp + 0xe]
jmp 0x65073e
xchg si, di
mov dword [esp], ecx
xchg byte [esp + 2], bl
xchg word [esp + 2], bx
push word [esp + 2]
mov dword [esp], esi
jmp 0x6506c0
btc edi, edi
neg ch
mov ax, sp
mov edi, eax
mov cl, 2
mov dh, byte [esp + 0x11]
jmp 0x65076d
mov cx, word [esp + 0x14]
setae ah
pop di
mov si, dx
mov cl, ch
lea edx, [ebx + esi]
jmp 0x650708
add esp, 0xd
setl dh
xchg esi, eax
mov dx, 0x4f53
rdtsc
neg dx
jmp 0x650724
sub esp, 6
xchg ch, dl
lea ebx, [edi*4]
mov eax, 0xcf5a1c0
add esp, 0x15
xchg bp, ax
jmp 0x650782
xchg byte [esp], cl
mov dx, 0x668d
mov ebx, dword [esp + 0xf]
rol bp, cl
xchg ah, bl
xchg di, si
jmp 0x650750
sub esp, 8
mov dword [esp + 0xa], ebp
rdtsc
lea edi, [edx*4]
jmp 0x6507cf
btc edi, ebx
mov bl, 0x10
xchg esi, edx
xchg byte [esp + 4], cl
rcr ah, 1
pop ebp
jmp 0x6506ef
push dword [esp + 0xa]
mov ebp, 0x53804a38
pop ebp
pop ecx
pop word [esp + 3]
push dword [esp + 0xc]
jmp 0x6507e1
lea ecx, [esi + 0xcd]
mov dl, 0xa4
cpuid
shr edi, 0x1d
cpuid
cmc
jmp 0x6507af
push dword [esp + 0xf]
xchg ah, bl
xchg ah, bl
call fcn.006508a2
xchg ebp, eax
push ss
test bl, ah
push ds
clc
pop es
scasb al, byte es:[edi]
mov ecx, 0x870cec83
frstor dword [esi - 9]
fidiv word [edx - 0x899a604]
fucomi st(3)
xchg ebp, eax
sub esp, 0xc
xchg ebp, ebx
neg si
mov dl, 0xfc
pop ecx
neg bx
jmp 0x65079c
xchg bp, bx
mov dword [esp + 0xe], ecx
bsr bx, cx
lea esp, [esp + 0xf]
jmp 0x650877
xchg byte [esp + 4], al
pushal
rdtsc
cpuid
cmc
setg bh
jmp 0x6508b2
neg ecx
xchg cx, dx
mov cx, word [esp + 8]
xchg word [esp + 5], bp
mov edi, eax
lea edi, [esi + 0x8d]
jmp 0x650854
lea esp, [esp + 0x27]
cld
add esp, 0
not edi
mov cx, dx
push word [esp + 3]
jmp 0x65099f
bswap esi
call fcn.006508fd
bsr di, bp
xchg byte [esp], cl
mov ax, word [esp + 3]
cpuid
lea eax, [eax + 0xa1]
neg ebp
jmp 0x650964

Function at 0x6508a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 0x14]
xchg ecx, ebx
sub dx, 0x1f60
mov ax, sp
mov si, 0xd89
rdtsc
jmp 0x650807
neg edi
mov dl, dh
xchg byte [esp + 8], al
xchg bh, cl
mov word [esp + 7], bx
not bp
jmp 0x65081d
lea esi, [eax - 0xe1]
mov cx, dx
push word [esp + 0x15]
jmp 0x650840
Function at 0x650fae
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
mov dword [esp + 5], ecx
pop edx
mov ebx, dword [esp + 1]
inc ebp
jmp 0x650f81

Function at 0x6513dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebp
jmp 0x6515c8
btc esi, edi
mov ebp, esi
xchg esi, ecx
sub edx, eax
mov bx, word [esp]
lea ebp, [eax + 0x39]
jmp 0x6514c0
xchg word [esp + 0x11], ax
popal
pop edi
lea esi, [edi*4]
inc bx
neg eax
jmp 0x651445
lea ebx, [ebp*4]
sub esp, 0x1c
xchg ch, dl
lea esp, [esp + 0xe]
bsr dx, cx
mov ecx, ebp
jmp 0x6514d6
mov ecx, dword [esp]
btr eax, esp
xchg byte [esp], al
and cl, bh
mov dx, word [esp]
btr edx, edx
jmp 0x651479
mov ebp, dword [esp]
rdtsc
lea edx, [edx*4]
rdtsc
lea eax, [eax + ebx]
add esp, 0
jmp 0x6514a1
xchg ebp, eax
call 0x6514ec
insd dword es:[edi], dx
imul esp, dword [ecx + ebp*2 + 0x53], 0x61657274
insd dword es:[edi], dx
push ebx
je 0x651558
jo 0x6514eb
sbb byte [edi - 0x74fedbbc], cl
xor al, 0x24
rol ax, cl
lea edx, [ecx - 0x53]
call fcn.00651599
jnp 0x651552
int 0x5c
pushal
stc
stc
bswap edi
inc dx
push dword [esp + 0x15]
jmp 0x651465
bswap ebp
rcl di, cl
pop dx
cmc
pop di
stc
jmp 0x65159d
push edx
jae 0x6515bb
je 0x651558
mov ch, 0x45
mov dword [esp + 8], ecx
xchg byte [esp + 4], cl
mov al, 0x1e
pop word [esp]
mov edx, esi
jmp 0x65153e
mov al, 0x3e
not ebx
add esp, 0xa
mov bl, bh
setnp ch
cld
jmp 0x6515b0
lea esp, [esp + 4]
xchg cx, di
lea edi, [edx + esi]
setg ch
sub bl, ah
cmc
lahf
lds ebp, [edx]
fdivr st(5), st(0)
jmp 0x6516f8
xchg ebx, eax
inc esi
btc edx, ebx
not ch
mov eax, 0xd9f056de
and cl, bh
jmp 0x651502
xchg dh, al
mov cl, ch
call fcn.00651631

Function at 0x651439
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 2]
xchg ch, dl
mov byte [esp + 1], ch
xchg dword [esp], eax
setge ch
pop dword [esp + 6]
pop bx
pop dword [esp]
add al, dh
shr ch, 5
jmp 0x6511b2
rdtsc
lea eax, [ebp*4]
push edx
lea esi, [ebx*4]
bswap ecx
shl dx, cl
jmp 0x651345
add esp, 0x13
push dword [esp + 3]
jmp 0x651365

Function at 0x651599
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, word [esp + 2]
rcr eax, 0x17
xchg esi, eax
mov word [esp], bx
neg esi
mov ah, byte [esp + 2]
jmp 0x651574
add esp, 0x10
inc dl
xchg dh, al
mov bh, byte [esp]
mov dl, 0xb4
mov bh, byte [esp]
jmp 0x651512
inc ebp
sub esp, 0x12
not bx
cpuid
rdtsc
mov di, 0x9a5d
bswap ebp
jmp 0x651559
rdtsc
jmp 0x65152d
Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret

Function at 0xc65aa8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xc65ab2
pushal
call 0xc65ab8
pop ebp
sub ebp, 0x10
sub ebp, 0x865aa8
jmp 0xc65ace
mov eax, 0x865aa8
add eax, ebp
add eax, 0x4c
mov ecx, 0x60d
mov edx, 0xf46d2609
xor byte [eax], dl
inc eax
dec ecx
jne 0xc65ae5
jmp 0xc65af8
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x9090900]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0xc65b1f
test byte [ebp + 0x2d], ch
cmc
or byte [0xb0fd612d], 7
or dword [ecx - 0x43], esp
test eax, 0x2508097e
sub eax, 0x1978b061
fsubrp st(1)
or al, 9
or dword [ecx], ecx
loopne 0xc65b7c
or dword [ecx], ecx
or dword [ebp + ebp*2 + 0x2580f52d], eax
sub eax, 0x8c82545d
add dword [ecx], ecx
or dword [ecx], ecx
sbb byte [ebp + eax - 0x7df6f6f7], 0x84
sbb dword [ecx], ecx
or dword [ecx], ecx
enter 0xbe0, 0x38
or ecx, dword [edx + 0x6400dcb]
invalid
or dword [ecx - 3], esp
mov al, 7
or dword [ecx - 0x43], esp
test eax, 0x2508097e
sub eax, 0x90ce158
or dword [ecx], ecx
loopne 0xc65bde
or ecx, dword [ecx]
or dword [ebp + ebx*2 + 0x54], ebx
idiv byte [ebp + eax - 0xa]
jl 0xc65b9f
loope 0xc65c11
jno 0xc65baa
or dword [ecx], ecx
or dword [edx + 0x90901b4], eax
or dword [eax + 0x5f5faef8], ecx
or dword [ecx], ecx
xor byte [ecx + eax - 0x77f6f6f7], 0xf8
clc
scasb al, byte es:[edi]
pop edi
pop edi
xlatb
mov al, bh
clc
scasb al, byte es:[edi]
pop edi
pop edi
xlatb
cmp al, al
cmp bl, bl
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
or dword [edi - 0x78], ebp
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0xc65bb2
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0xc65c07
loopne 0xc65bb0
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe25069ee
jecxz 0xc65c16
mov ah, cl
or al, 0xe0
mov byte [0x82f6f6f6], al
and eax, 0x2d6d842d
or eax, 0x5c0905cb
and byte [0x2d6d842d], 0xd
retf
sub eax, 0x905cb0d
pop esp
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd
Function at 0x4014e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4014f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40150d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40152e
cmp esi, eax
jae 0x401507
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401520
cmp esi, eax
jae 0x401507
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403d50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
mov eax, dword [0x4e833c]
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0xdc], eax
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [section.Shared], esi
je 0x403d9f
mov eax, dword [section.Shared]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
mov ecx, dword [esp + 0xdc]
call fcn.0040ac43
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
mov dword [0x4e8ce8], ecx
xor eax, eax
lea edx, [esp + 0x40]
mov ecx, 0x25
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x50], 1
jne 0x403de4
cmp dword [esp + 0x44], 5
jae 0x403de4
cmp dword [esp + 0x48], 0x5a
ja 0x403de4
mov byte [0x4e8cec], 1
lea ecx, [esp + 0x10]
call fcn.00402480
push esi
push 0x64
call fcn.00401540
add esp, 8
cmp eax, esi
je 0x403e08
push 0x64
push eax
lea ecx, [esp + 0x18]
call fcn.004026c0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x20a0000
push ecx
mov ecx, 0x4e8d98
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.00404b70
test eax, eax
lea ecx, [esp + 0x10]
jne 0x403e55
call fcn.004015d0
xor eax, eax
mov ecx, dword [esp + 0xdc]
call fcn.0040ac43
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.004015d0
push esi
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea edx, [esp + 0x30]
push edx
call esi
test eax, eax
jle 0x403ecf
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ebx, [ebx]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
mov ecx, 0x4e8d98
call fcn.00403fe0
test eax, eax
jne 0x403ebe
lea eax, [esp + 0x24]
push eax
mov ecx, 0x4e8d98
call fcn.004038d0
test eax, eax
jne 0x403ebe
lea ecx, [esp + 0x24]
push ecx
call edi
lea edx, [esp + 0x24]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call esi
test eax, eax
jg 0x403e80
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0xdc]
mov eax, 1
call fcn.0040ac43
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404d30
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
mov dword [esp + 0x18], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x10], edi
mov edx, 0xc6ef3720
mov dword [esp + 0x24], esi
mov edi, 0x20
lea esp, [esp]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
sub ecx, esi
add edx, 0x61c88647
dec edi
jne 0x404d70
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret

Function at 0x405a20
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e833c]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [esp + 0x48]
cmp edi, ebx
mov dword [esp + 0x34], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
jle 0x405a74
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
push ebp
push ebx
push esi
mov ecx, esi
call fcn.004058c0
dec edi
jne 0x405a65
xor ebx, ebx
mov ebp, dword [esp + 0x44]
push esi
push ebp
mov ecx, esi
call fcn.00405990
xor eax, eax
mov word [esp + 0x49], ax
mov byte [esp + 0x48], 0
mov byte [esp + 0x4b], al
lea edi, [esp + 0x10]
mov dword [esp + 0x10], ebx
xor esi, esi
jmp 0x405aa0
movzx ecx, byte [esi + ebp]
push ecx
push str._02x
lea edx, [esp + 0x50]
push 4
push edx
call fcn.0040b6c5
push 2
lea eax, [esp + 0x5c]
push eax
push edi
call fcn.0040b590
add esp, 0x1c
add edi, 2
inc esi
cmp esi, 0x10
jl 0x405aa0
mov byte [edi - 1], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [ebp + 4], edx
mov dword [ebp + 8], eax
pop esi
mov dword [ebp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
pop ebp
pop ebx
call fcn.0040ac43
add esp, 0x28
ret 0x10
Function at 0x406bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x412ba8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
push eax
mov dword [esp + 0xc], edi
call fcn.00406800
mov ecx, dword [esp + 0x20]
mov dword [edi + 4], ecx
push 0x40100000
push 0x3e800000
push 0x3f400000
push 1
lea esi, [edi + 0xc]
push 0x11
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00403c70
mov ecx, dword [esp + 0xc]
mov eax, edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], 0x4c
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x406c50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4e833c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x13c]
test edi, edi
mov dword [esp + 0x134], eax
mov ebp, ecx
jne 0x406c74
mov edi, ebp
mov esi, dword [esp + 0x140]
test esi, esi
je 0x406dee
push ebx
mov ebx, dword [esp + 0x148]
jmp 0x406c90
mov edx, dword [ebp + 0x34]
push 0
lea ecx, [esp + 0x20]
lea eax, [esi + ebx]
push ecx
push eax
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x406cbb
call fcn.00405690
mov edx, dword [ebp + 0x34]
push 0
lea eax, [esp + 0x14]
push eax
push 0x10
lea ecx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406ce4
call fcn.00405690
mov eax, dword [esp + 0x24]
sub eax, esi
cmp eax, 0x103
jbe 0x406cf6
mov eax, 0x103
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [ebp + 0x34]
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406d1e
call fcn.00405690
movsx edx, byte [esp + 0x34]
mov ecx, dword [esp + 0x14c]
cmp edx, ecx
lea eax, [esp + 0x34]
je 0x406d3d
sub byte [eax], cl
movsx edx, byte [eax + 1]
inc eax
cmp edx, ecx
jne 0x406d32
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ecx, edi
call fcn.00405f50
test eax, eax
jne 0x406db1
lea ecx, [edi + 0x24]
call fcn.004057c0
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.00406bc0
mov eax, dword [edi]
cmp eax, dword [edi + 0x18]
jbe 0x406d93
mov ecx, dword [edi + 0x20]
test ecx, ecx
jne 0x406d93
push eax
mov ecx, edi
call fcn.00405770
push eax
mov ecx, edi
call fcn.00407470
mov eax, dword [esi + 4]
xor edx, edx
div dword [edi + 8]
mov eax, dword [edi + 4]
mov ecx, dword [eax + edx*4]
mov dword [esi + 8], ecx
mov eax, dword [edi + 4]
mov dword [eax + edx*4], esi
inc dword [edi]
add esi, 0xc
jmp 0x406db4
lea esi, [eax + 0xc]
push ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.00406690
test byte [esi + 0x34], 1
je 0x406de1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x406de1
mov edx, dword [esp + 0x14c]
push edx
push ebx
push eax
push esi
mov ecx, ebp
call fcn.00406c50
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x406c90
pop ebx
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
call fcn.0040ac43
add esp, 0x12c
ret 0x10