joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4126d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42dfcd
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x148], esi
xor eax, eax
mov dword [ebp - 0x28], 0
push eax
push 0x4354f8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040c560
lea eax, [ebp - 0x144]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x144], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41282c
mov eax, dword [ebp - 0x140]
cmp eax, 6
jne 0x412812
mov eax, dword [ebp - 0x13c]
cmp eax, 1
jne 0x4127f0
push 4
push str.Win7
mov dword [esi], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0040c560
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4127d4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4127ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41288b
push edx
push ecx
call fcn.00417807
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x412801
push 4
push str.Win8
jmp 0x41277a
cmp eax, 3
jne 0x41282c
push 6
push str.Win8.1
jmp 0x41277a
cmp eax, 0xa
jne 0x41282c
cmp dword [ebp - 0x13c], 0
jne 0x41282c
push 5
push str.Win10
jmp 0x41277a
push 1
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
push 0x435040
mov word [esi], ax
call fcn.0040c560
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4127d4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4127ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4127ca
call fcn.0041af8c
int3
Function at 0x412aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], 8
push eax
push 1
xor esi, esi
xorps xmm0, xmm0
push esi
push str.SoftwareMicrosoftBingWallpaperApp
xor bl, bl
movlpd qword [ebp - 0xc], xmm0
push 0x80000001
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x412aed
mov esi, 0x80004005
jmp 0x412b11
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.ConfigDownloadDate
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne esi, ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x412b1f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x412c40
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, 1
mov edi, 0xd6bf94d5
mul dword [ebp - 8]
mov ebx, eax
xor eax, eax
mul dword [ebp - 8]
add ebx, edx
mov ecx, eax
add ecx, dword [ebp - 0xc]
mov edx, 0xe57a42bd
mov eax, ecx
adc ebx, esi
mul edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov esi, edx
mov eax, ecx
mov ecx, 0xe57a42bd
mul edi
mov edi, eax
mov dword [ebp - 8], edx
mov eax, ebx
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp - 0x10]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 0x20], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 8]
adc ecx, 0
mov dword [ebp - 0x14], edi
xor eax, eax
mov edi, 0xd6bf94d5
add ebx, ecx
mov ecx, dword [ebp - 0x20]
adc eax, eax
add ecx, ebx
adc edx, eax
mov eax, 1
shrd ecx, edx, 0x17
mul dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov ebx, eax
xor eax, eax
mul dword [ebp - 0x18]
add ebx, edx
mov ecx, eax
add ecx, dword [ebp - 0x1c]
mov edx, 0xe57a42bd
mov eax, ecx
adc ebx, 0
mul edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, ecx
mov ecx, 0xe57a42bd
mul edi
mov edi, eax
mov dword [ebp - 0x10], edx
mov eax, ebx
mul ecx
mov ecx, eax
mov ebx, edx
mov eax, dword [ebp - 8]
mov edx, 0xd6bf94d5
mul edx
add ecx, esi
mov dword [ebp - 8], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
adc ecx, 0
xor eax, eax
add ebx, ecx
mov ecx, dword [ebp - 8]
pop edi
adc eax, eax
add ecx, ebx
pop esi
adc edx, eax
movzx eax, byte [ebp - 0x21]
shrd ecx, edx, 0x17
pop ebx
sub ecx, dword [ebp - 0x20]
cmp ecx, 0x2d0
mov ecx, 1
cmovle eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004177f9
mov esp, ebp
pop ebp
ret
Function at 0x421742
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x421781
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421781
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421781
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x421781
cmp dword [ecx + 0x74], 0xe
jbe 0x421781
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x423784
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43190c
push 0x431904
push str.FlsAlloc
push 0x1f
call fcn.004236bf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4237b8
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f29c]
call esi
jmp 0x4237be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x423802
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43191c
push 0x431914
push str.FlsGetValue
push 0x21
call fcn.004236bf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423839
push dword [ebp + 8]
mov ecx, esi
call dword [0x42f29c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x423841
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x431924
push 0x43191c
push str.FlsSetValue
push 0x22
call fcn.004236bf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42387b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42f29c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x424ce2
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x424d2d
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00424e7d
test al, al
jne 0x424d27
sub edx, 2
cmp edx, edi
jne 0x424d0d
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x424d4f
lea eax, [edi + 2]
cmp edx, eax
je 0x424d4f
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00424c2e
add esp, 0x10
jmp 0x424e49
push esi
lea ecx, [ebp - 0x255]
call fcn.00424e7d
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424d92
push dword [ebp - 0x25c]
jmp 0x424d3f
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x424dcf
cmp word [ebp - 0x226], 0
je 0x424df0
cmp word [ebp - 0x226], ax
jne 0x424dcf
cmp word [ebp - 0x224], 0
je 0x424df0
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00424c2e
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x424e3c
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x424da9
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x424e24
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x424e49
push 0x424a5e
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00428e90
add esp, 0x10
jmp 0x424e19
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004177f9
leave
ret
Function at 0x4028f9
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x402956
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x402956
mov eax, dword [esi + 0x70]
test eax, eax
je 0x402935
push ebx
push esi
call eax
push esi
push ebx
push dword [0x43ba04]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x43beb0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x43beb4], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x40454f
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x188
push 8
push dword [0x43ba04]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x43beb0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x43beb4], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.0040fe29
mov dword [esi + 0x58], 0x40577d
mov eax, esi
mov dword [esi + 0x5c], 0x4057c9
mov dword [esi + 0x10], fcn.004046b6
mov dword [esi + 0x30], 0x404842
mov dword [esi + 0x64], 0x404a59
mov dword [esi + 0x60], 0x404ab1
mov dword [esi + 0x34], 0x4050eb
mov dword [esi + 0x24], 0x404f9d
mov dword [esi + 0x28], 0x404fc6
mov dword [esi + 0x2c], 0x404ff1
mov dword [esi + 0x44], 0x405572
mov dword [esi + 0x68], 0x404641
mov dword [esi + 0x6c], 0x4046a0
pop esi
ret 4
Function at 0x40aa5e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0041a280
mov eax, dword [0x43b2d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00418224
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x40aaa0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x40abfc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041a1d0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43c408]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00419d55
mov ecx, dword [esi*4 + 0x43c408]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x40abf5
cmp eax, dword [ecx + edi + 0x24]
jne 0x40abf5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40abf5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00419d55
add esp, 0x14
test edx, edx
jl 0x40abf5
jg 0x40ab6b
test eax, eax
jb 0x40abf5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x40abf5
jl 0x40ab85
cmp dword [ebp - 0x1008], eax
ja 0x40abf5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x40aba3
test ebx, ebx
je 0x40abdc
cmp ecx, edi
jae 0x40abdc
mov al, byte [ecx]
cmp al, 0xd
jne 0x40abbd
lea eax, [edi - 1]
cmp ecx, eax
jae 0x40abc9
cmp byte [ecx + 1], 0xa
jne 0x40abc9
inc ecx
jmp 0x40abc9
movzx eax, al
movsx eax, byte [eax + 0x43b2e0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x40aba3
cmp edx, ebx
jne 0x40aba3
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x40abfa
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041839c
leave
ret

Function at 0x40b060
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40b098
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b093
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.0040f3f0
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x40cc56
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42e280
push 0x42e278
push str.FlsAlloc
push 0x1f
call fcn.0040d06d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40cc8a
push dword [ebp + 8]
mov ecx, esi
call dword [0x439238]
call esi
jmp 0x40cc90
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ccd4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42e290
push 0x42e288
push str.FlsGetValue
push 0x21
call fcn.0040d06d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40cd0b
push dword [ebp + 8]
mov ecx, esi
call dword [0x439238]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40cd13
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42e298
push 0x42e290
push str.FlsSetValue
push 0x22
call fcn.0040d06d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40cd4d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x439238]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x413f8c
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x414038
imul eax, dword [esp + 0x1c]
imul ecx, dword [esp + 0x24], 3
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
add eax, dword [esp + 0x1c]
add ecx, eax
mov eax, dword [esp + 0x24]
mov edx, dword [edi + 0xcc]
mov ebp, ecx
imul edx, ebx
add edx, dword [edi + 0xc8]
add edx, eax
cmp dword [esp + 0x34], 0
jle 0x414019
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [edx + 2], al
mov al, byte [ebp + 1]
xor byte [edx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [edx], al
add edx, edi
sub esi, 1
jne 0x413ff2
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x38], esi
jne 0x41402e
sub ecx, dword [esp + 0x20]
jmp 0x414032
add ecx, dword [esp + 0x20]
test esi, esi
jne 0x413fd0
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x24

Function at 0x4140b5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul ecx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ecx
test ebx, ebx
je 0x414187
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x28]
imul edx, dword [esp + 0x1c], 3
push ebp
mov ebp, dword [esp + 0x24]
push esi
imul esi, dword [esp + 0x2c], 3
add eax, dword [esp + 0x1c]
push edi
mov dword [esp + 0x14], edx
add esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], esi
mov edi, dword [eax + 0xcc]
imul edi, ebp
mov dword [esp + 0x28], esi
add edi, dword [eax + 0xc8]
add edi, edx
test ecx, ecx
jle 0x41415b
mov ebp, dword [esp + 0x28]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov esi, ecx
movzx eax, byte [ebp]
imul eax, dword [esp + 0x40]
movzx ecx, byte [edi]
imul ecx, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [edi], al
inc edi
sub esi, 1
jne 0x414121
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x414174
sub esi, dword [esp + 0x24]
jmp 0x414178
add esi, dword [esp + 0x24]
mov dword [esp + 0x38], esi
test ebx, ebx
jne 0x4140f9
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x414a43
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x414aef
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
add ecx, dword [esp + 0x18]
push ebp
lea edx, [ecx + eax*4]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x34], 0
jle 0x414ad0
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, edi
sub esi, 1
jne 0x414aa9
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x38], esi
jne 0x414ae5
sub edx, dword [esp + 0x20]
jmp 0x414ae9
add edx, dword [esp + 0x20]
test esi, esi
jne 0x414a87
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x24
Function at 0x414b8f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov edx, dword [esp + 0x28]
test edx, edx
je 0x414d9f
mov ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
imul esi, dword [esp + 0x20], 3
add ecx, dword [esp + 0x18]
push edi
mov edi, 0xff
cmp dword [esp + 0x3c], edi
jne 0x414cad
lea ebp, [ecx + eax*4]
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [ecx + 0xcc]
imul ebx, eax
mov dword [esp + 0x2c], ebp
add ebx, dword [ecx + 0xc8]
add ebx, esi
cmp dword [esp + 0x34], 0
jle 0x414c7f
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
movzx edi, byte [ebp + 3]
mov esi, 0xff
movzx eax, byte [ebp + 2]
sub esi, edi
movzx ecx, byte [ebx + 2]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x414c04
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x3c]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
jne 0x414c98
sub ebp, dword [esp + 0x20]
jmp 0x414c9c
add ebp, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
test edx, edx
jne 0x414bdc
jmp 0x414d9b
lea ebx, [ecx + eax*4]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], eax
mov ebp, dword [ecx + 0xcc]
imul ebp, eax
mov dword [esp + 0x2c], ebx
add ebp, dword [ecx + 0xc8]
add ebp, esi
cmp dword [esp + 0x34], 0
jle 0x414d72
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
movzx eax, byte [ebx + 3]
mov esi, 0xff
imul eax, dword [esp + 0x3c]
movzx ecx, byte [ebp + 2]
cdq
idiv edi
mov edi, eax
movzx eax, byte [ebx + 2]
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebp + 1]
mov byte [ebp + 2], al
movzx eax, byte [ebx + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [ebp]
movzx ecx, byte [ebx]
lea ebx, [ebx + 4]
imul eax, esi
imul ecx, edi
mov edi, 0xff
add eax, ecx
cdq
idiv edi
sub dword [esp + 0x30], 1
mov byte [ebp], al
lea ebp, [ebp + 3]
jne 0x414cec
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
jne 0x414d8b
sub ebx, dword [esp + 0x20]
jmp 0x414d8f
add ebx, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
test edx, edx
jne 0x414cc4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x28
Function at 0x416bf7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push dword [esp + 0x78]
xor esi, esi
mov ebx, esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x416d8e
push dword [esp + 0x28]
call fcn.00402b16
test eax, eax
je 0x416c37
push dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x416d8e
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x416d7b
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x416d73
push 0x2c
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00401020
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x50], 0x28
mov word [esp + 0x5c], ax
pop eax
push esi
push esi
mov word [esp + 0x62], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x416d73
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push edi
call esi
push 2
xor eax, eax
push eax
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x90]
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x2c]
push edi
call esi
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x416d73
mov ebp, dword [esp + 0x38]
xor esi, esi
mov edx, dword [esp + 0x3c]
mov eax, ebp
shl eax, 2
mov dword [esp + 0x10], eax
test edx, edx
jle 0x416d73
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
sub ecx, esi
add eax, 3
dec ecx
xor ebx, ebx
imul ecx, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x7c], eax
test ebp, ebp
jle 0x416d6a
push esi
push ebx
push edi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x7c]
test eax, eax
setne al
dec al
mov byte [ecx], al
add ecx, 4
mov ebp, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x7c], ecx
cmp ebx, ebp
jl 0x416d42
mov edx, dword [esp + 0x3c]
inc esi
cmp esi, edx
jl 0x416d25
mov ebx, dword [esp + 0x1c]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [esp + 0x2c]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x68
ret 4