joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441940
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x476523
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00469454
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046eaf3
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00470073
test eax, eax
je 0x441a5c
mov ecx, dword [esp + 0x3c]
call fcn.0046eb20
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x441a20
push edi
mov ecx, esi
call fcn.0046c17f
mov ecx, esi
call fcn.00441bc0
cmp dword [esp + 0x38], 1
jne 0x441a55
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046c2ba
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x444480
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4444b3
push esi
call fcn.00447570
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4444ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x444539
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x444522
mov eax, dword [esi + 8]
test eax, eax
je 0x4444d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44451e
cmp eax, 2
je 0x444522
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4444ca
cmp eax, 3
je 0x4444fd
cmp eax, 1
jne 0x4444ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4444ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4444ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00444560
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x444548
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00444560
add esp, 4
pop esi
ret

Function at 0x4500e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x450183
test eax, eax
jbe 0x450183
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x450183
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45012e
xor esi, esi
jmp 0x450134
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45015f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00452110
add esi, eax
push esi
mov ebx, esi
call fcn.00452110
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x450140
pop ebp
test edi, edi
pop edi
jne 0x450183
test ebx, ebx
je 0x450183
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00458380
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4502c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4503dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4503dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004698a6
mov esi, eax
test esi, esi
je 0x4503dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4503dd
mov ecx, esi
call fcn.00450230
cmp edi, eax
jge 0x4503dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x450363
mov dword [esp + 0x34], 1
jmp 0x4503be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4503dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044f7c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x452280
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4522e6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4522e6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4522c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x452e20
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00452f70
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x452e40
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x452e21
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00452f70
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x452e40
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x452e70
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x452ec7
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x452edd
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00452f00
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x452f00
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x452f90
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x452fd9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x453450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x476c70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00453000
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00453080
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00453080
lea ecx, [esi + 0xc]
call fcn.00467e31
lea ecx, [esi + 0x10]
call fcn.00467e31
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004558b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004558b0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004558b0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00467ea6
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00467ea6
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4540f8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x476e98
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x454108
call fcn.00454620
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4541eb
cmp byte [edi], 0
je 0x4541eb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45412d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00452e20
test eax, eax
jne 0x45414d
push 0x4c2518
lea ecx, [esi + 0x38]
call fcn.00467fe3
jmp 0x4541eb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00452e70
test eax, eax
jne 0x45417c
mov ecx, esi
call fcn.00452f70
push edi
add esi, 0x38
push 0x4c24f4
push esi
call fcn.00465c0a
add esp, 0xc
jmp 0x4541eb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00454ea0
test eax, eax
je 0x4541e4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004542c0
test eax, eax
jne 0x454200
push edi
lea eax, [esi + 0x38]
push 0x4c24d0
push eax
call fcn.00465c0a
add esp, 0xc
mov ecx, esi
call fcn.00454620
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4542a8
mov ecx, dword [0x4c2818]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00465c0a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00452f20
test eax, eax
jne 0x45426a
push 0x4c24b4
lea ecx, [esi + 0x38]
call fcn.00467fe3
jmp 0x45427a
push 0xfa
mov ecx, esi
call fcn.00454ea0
test eax, eax
jne 0x454297
mov ecx, esi
call fcn.00454620
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00467ea6
jmp 0x4541eb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00467ea6
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x46a24a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46a282
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00468301
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004682d9
jmp 0x46a28e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46b93c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46b97e
call fcn.00471518
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46b97e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46b975
xor eax, eax
jmp 0x46b986
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046b98c
pop edi
pop esi
pop ebx
ret 4

Function at 0x471a48
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x471a76
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471a94
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004719ae
jmp 0x471a94
mov eax, dword [esi + 0x14]
test eax, eax
je 0x471a94
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004719ae
test edi, edi
mov eax, edi
jne 0x471a7e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0xfe1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0xfe5042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xfe5228
push 0xfe5290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xfe114b
xor eax, eax
jmp 0xfe1166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4011f4
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40121d
cmp al, 0x22
je 0x401215
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x401209
cmp byte [esi], 0x22
jne 0x401227
inc esi
jmp 0x401227
cmp al, 0x20
jle 0x401227
inc esi
cmp byte [esi], 0x20
jg 0x401221
mov al, byte [esi]
test al, al
je 0x401231
cmp al, 0x20
jle 0x40121a
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040129f
push 0x403004
push section..data
call fcn.00401285
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x401261
movzx eax, word [ebp - 0x14]
jmp 0x401264
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004012b7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404b90
Capabilities:
Terminate process

Disassembly:
sub esp, 0x108
mov eax, dword [0x41b1ac]
xor eax, dword [esp + 0x108]
push esi
mov esi, dword [esp + 0x110]
test esi, esi
mov dword [esp + 0x108], eax
jne 0x404bd4
mov eax, 0xffffd846
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, dword [esp + 0x108]
add esp, 0x108
jmp fcn.0040a3af
push esi
call fcn.004074b0
add esp, 4
cmp eax, 0x103
jle 0x404c03
mov eax, 0xffffd845
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, dword [esp + 0x108]
add esp, 0x108
jmp fcn.0040a3af
push 0x103
lea eax, [esp + 8]
push esi
push eax
call fcn.00407100
lea ecx, [esp + 0x10]
push ecx
call fcn.00404560
add esp, 0x10
push 0
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x404c55
push 0xffffffffffffffff
call fcn.00404220
add esp, 4
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, dword [esp + 0x108]
add esp, 0x108
jmp fcn.0040a3af
mov ecx, dword [esp + 0x108]
xor eax, eax
xor ecx, dword [esp + 0x10c]
pop esi
add esp, 0x108
jmp fcn.0040a3af

Function at 0x4053d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x108
mov eax, dword [0x41b1ac]
xor eax, dword [esp + 0x108]
push esi
mov esi, dword [esp + 0x110]
test esi, esi
mov dword [esp + 0x108], eax
jne 0x405414
mov eax, 0xffffd846
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, dword [esp + 0x108]
add esp, 0x108
jmp fcn.0040a3af
push esi
call fcn.004074b0
add esp, 4
cmp eax, 0x103
jle 0x405443
mov eax, 0xffffd845
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, dword [esp + 0x108]
add esp, 0x108
jmp fcn.0040a3af
push 0x103
lea eax, [esp + 8]
push esi
push eax
call fcn.00407100
lea ecx, [esp + 0x10]
push ecx
call fcn.00404560
mov al, byte [esp + 0x14]
mov cl, byte [esp + 0x15]
add esp, 0x10
cmp al, 0x5c
lea esi, [esp + 4]
jne 0x4054c1
cmp cl, 0x5c
jne 0x4054c1
lea edx, [esp + 6]
push 0x5c
push edx
call fcn.00407530
add esp, 8
test eax, eax
jl 0x4054ae
lea esi, [esp + eax + 7]
push 0x5c
push esi
call fcn.00407530
add esp, 8
test eax, eax
jl 0x4054a1
lea esi, [esi + eax + 1]
jmp 0x4054df
push esi
call fcn.004074b0
add esp, 4
add esi, eax
jmp 0x4054df
lea eax, [esp + 6]
push eax
call fcn.004074b0
add esp, 4
lea esi, [esp + eax + 6]
jmp 0x4054df
cmp cl, 0x3a
jne 0x4054d7
cmp byte [esp + 6], 0x5c
lea esi, [esp + 6]
jne 0x4054df
lea esi, [esp + 7]
jmp 0x4054df
cmp al, 0x5c
jne 0x4054df
lea esi, [esp + 5]
push ebx
push ebp
push edi
push 0x5c
push esi
call fcn.004075c0
mov ebp, dword [esp + 0x12c]
add esp, 8
test ebp, ebp
mov edi, eax
je 0x405524
lea ebx, [edi + esi + 1]
push ebx
call fcn.004074b0
add esp, 4
cmp eax, 0xff
jle 0x405515
mov eax, 0xffffd845
jmp 0x40555e
push 0xff
push ebx
push ebp
call fcn.00407100
add esp, 0xc
mov eax, dword [esp + 0x120]
test eax, eax
je 0x40555c
test edi, edi
jge 0x40553b
lea ecx, [esp + 0x10]
sub esi, ecx
jmp 0x405545
lea edx, [esp + 0x10]
sub edi, edx
add edi, esi
mov esi, edi
cmp esi, 0x103
jg 0x40550e
push esi
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00407100
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, dword [esp + 0x118]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x108
jmp fcn.0040a3af
Function at 0x4056f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10c
mov eax, dword [0x41b1ac]
xor eax, dword [esp + 0x10c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
test esi, esi
mov dword [esp + 0x114], eax
push edi
je 0x40589e
mov edi, dword [esp + 0x124]
test edi, edi
jne 0x405741
mov eax, dword [esp + 0x128]
test eax, eax
jne 0x405741
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x40589e
test edi, edi
mov ebp, esi
mov ebx, 2
je 0x40574f
mov byte [edi], 0
mov al, byte [esi]
cmp al, 0x5c
jne 0x4057ae
cmp byte [esi + 1], al
jne 0x4057ae
mov al, byte [esi + 2]
add esi, 2
test al, al
je 0x405790
cmp al, 0x5c
jne 0x40576d
dec ebx
test ebx, ebx
jle 0x405790
cmp al, 0x80
mov byte [esp + 0x10], al
jb 0x405789
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x405789
add esi, 2
jmp 0x40578a
inc esi
mov al, byte [esi]
test al, al
jne 0x405764
test edi, edi
je 0x405802
mov eax, esi
sub eax, ebp
cmp eax, 0x3f
jg 0x405889
push eax
push ebp
push edi
call fcn.00407100
add esp, 0xc
jmp 0x405802
cmp al, 0x80
mov byte [esp + 0x10], al
jb 0x4057ca
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x4057ca
add esi, 2
jmp 0x4057cb
inc esi
cmp byte [esi], 0x3a
jne 0x405800
test edi, edi
je 0x4057fd
push ebp
push edi
call fcn.00401370
lea edx, [esp + 0x12c]
push edx
call fcn.004013a0
mov cl, byte [esi]
mov eax, dword [esp + 0x130]
add esp, 0xc
mov byte [eax], cl
inc eax
inc esi
mov byte [eax], 0
jmp 0x405802
inc esi
jmp 0x405802
mov esi, ebp
push 0x103
lea edx, [esp + 0x18]
push esi
push edx
call fcn.00407100
lea eax, [esp + 0x20]
push eax
call fcn.00404560
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.004075c0
mov esi, eax
mov eax, dword [esp + 0x140]
add esp, 0x18
test eax, eax
je 0x40586a
test esi, esi
jge 0x405841
mov byte [eax], 0
jmp 0x40586a
jne 0x405853
push 0x416344
push eax
call fcn.00407480
add esp, 8
jmp 0x40586a
cmp esi, 0x103
jg 0x405889
push esi
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00407100
add esp, 0xc
mov edi, dword [esp + 0x12c]
test edi, edi
je 0x40589a
lea esi, [esp + esi + 0x15]
push esi
call fcn.004074b0
add esp, 4
cmp eax, 0xff
jle 0x405890
mov eax, 0xffffd739
jmp 0x4058a3
push esi
push edi
call fcn.00407480
add esp, 8
xor eax, eax
jmp 0x4058a3
mov eax, 0xffffd846
mov ecx, dword [esp + 0x118]
xor ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
jmp fcn.0040a3af
Function at 0x407590
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xd2
dec esp
imul ebx, dword [ebp + 0x3c80a0a9], 0x54
rol dword [edx - 0x71], 0xb6
scasb al, byte es:[edi]
pop eax
mov ch, bl
or eax, 0x3a57bdac
xor dword [edx - 0x79e997c9], 0x8a44eb79
fdivr st(7), st(0)
jp 0x407545
mov dh, 0xa2
lds esp, [ebx]
rcr byte [ebx - 0x6a], cl
add ch, byte [esi - 0x4a]
sbb byte [esi - 0x25e9330d], dl
push ss
ficomp dword [ebp - 0x4c77cac2]
invalid
push ecx
xor esi, dword [ebp - 4]
xor dword [ebx + edi*4 - 0x63a1e80b], ebx
mov esi, 0x7c3c9927
aam 0x11
out 0xf2, eax
wait
inc ecx
sub dword [ecx + 1], edi
add eax, 0x9643246d
adc al, 0x32
sbb byte [0x42605c16], ch
add byte [ecx + eax*4], al
xor byte [eax], bh
adc eax, dword [ebx + 0x4e21f11a]
out dx, eax
push es
or al, 0x1d
ret 0xe785

Function at 0x40ad42
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x41be78], esi
push edi
jne 0x40ad62
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x41be74], esi
mov byte [0x41be70], al
jne 0x40adc8
mov ecx, dword [0x41c4cc]
test ecx, ecx
je 0x40ada9
mov eax, dword [0x41c4c8]
sub eax, 4
cmp eax, ecx
jmp 0x40ada2
mov eax, dword [eax]
test eax, eax
je 0x40ad94
call eax
mov eax, dword [0x41c4c8]
sub eax, 4
cmp eax, dword [0x41c4cc]
mov dword [0x41c4c8], eax
jae 0x40ad8c
mov eax, 0x41b024
mov esi, 0x41b02c
cmp eax, esi
mov edi, eax
jae 0x40adc8
mov eax, dword [edi]
test eax, eax
je 0x40adc1
call eax
add edi, 4
cmp edi, esi
jb 0x40adb9
mov eax, 0x41b030
mov esi, 0x41b038
cmp eax, esi
mov edi, eax
jae 0x40ade7
mov eax, dword [edi]
test eax, eax
je 0x40ade0
call eax
add edi, 4
cmp edi, esi
jb 0x40add8
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x40ae02
push dword [ebp + 8]
mov dword [0x41be78], 1
call fcn.0040ac77
pop ecx
pop ebp
ret