joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x2c
push 0
push 0x40e578
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40e57c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40e578], eax
call section..text
call fcn.004032f2
call fcn.0040b340
call fcn.0040aa70
call fcn.0040a496
call fcn.00409eb1
call fcn.00409e5e
call fcn.00409dc4
call fcn.00409320
call fcn.0040745c
call fcn.00406d00
call fcn.00406216
call fcn.004056fa
call fcn.00405641
call fcn.00405414
call fcn.004041cc
call fcn.00403a32
call fcn.00403827
call fcn.00403510
call fcn.0040330e
mov dword [0x40e594], 1
mov byte [0x40e5a0], 3
call fcn.004011b1
mov byte [0x40e5a0], al
movsx ebx, byte [0x40e5a0]
cmp ebx, 4
jne 0x4010d4
call fcn.00401e06
mov byte [0x40e5a0], al
movsx ebx, byte [0x40e5a0]
push ebx
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4010f3
push dword [0x40e594]
xor eax, eax
push eax
call fcn.0040151f
jmp 0x40114d
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401110
push dword [0x40e594]
mov eax, 1
push eax
call fcn.0040151f
jmp 0x40114d
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401132
call fcn.00401d49
push dword [0x40e594]
mov eax, 1
push eax
call fcn.0040151f
jmp 0x40114d
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40114d
push dword [0x40e594]
mov eax, 2
push eax
call fcn.0040151f
pop eax
push 0
jmp 0x40115a
call 0x401174
call fcn.0040b390
push dword [0x40e578]
call sub.KERNEL32.dll_HeapDestroy
call main
call fcn.0040381b
call fcn.004039dc
call fcn.00403f55
call fcn.004041a9
call fcn.00405413
call fcn.00405640
call fcn.004056ee
call fcn.00409340
call fcn.00409e52
call fcn.00409e93
call fcn.0040ab95
call fcn.0040aa60
ret

Function at 0x40342f
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x403484
push dword [esp + 0x10]
push 0x4033ae
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x40e5a4]
test esi, esi
je 0x4034dd
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40347c
cmp byte [esi + 0x10], 0
je 0x40347c
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x403458
jmp 0x4034dd
mov esi, dword [0x40e5a4]
test esi, esi
je 0x4034dd
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x4034d6
cmp byte [esi + 0x11], 0
je 0x4034b2
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x4034c9
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x40e5a4
call fcn.0040b2fc
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x403491
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x403580
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x40e77c]
call fcn.0040ab96
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x403680
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x4035d6
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x4035ce
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x403616
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x403658
push 0x22
pop edx
cmp cx, dx
je 0x403608
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4035f8
xor ecx, ecx
cmp word [eax], cx
je 0x403658
mov ecx, eax
add eax, 2
jmp 0x40365a
test dx, dx
je 0x403660
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x403608
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x40364e
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x403658
cmp cx, dx
je 0x40364b
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x40363b
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x403620
jmp 0x403608
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x403662
xor edx, edx
cmp dword [ebp], ebx
jne 0x40366b
test edi, edi
jne 0x403688
test edx, edx
je 0x403670
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x4035c4
test edi, edi
jne 0x403699
mov eax, ebx
jmp 0x40369d
test esi, esi
je 0x403699
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x40369d
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x403fac
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404122
mov eax, dword [esp + 0x24]
dec eax
je 0x404105
dec eax
jne 0x404122
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00403f65
pop ecx
test eax, eax
je 0x404063
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x404026
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x404101
dec ebx
je 0x4040fd
dec ebx
je 0x4040dc
dec ebx
je 0x404096
sub ebx, 4
jne 0x404122
test edi, edi
jne 0x404122
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x404122
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x404026
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x404021
sub edi, 0
je 0x4040ce
dec edi
je 0x4040c0
dec edi
je 0x4040b2
dec edi
jne 0x404122
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x404122
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x404122
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x404122
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x404122
sub edi, 0
je 0x4040f9
dec edi
je 0x4040f5
dec edi
jne 0x404122
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x404122
push 0x3c
jmp 0x404121
push 0x32
jmp 0x404121
push 0x14
jmp 0x404121
push 5
jmp 0x404121
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40411f
cmp eax, 0xa
je 0x40411b
cmp eax, 0x5a
jne 0x404122
push 0x28
jmp 0x404121
push 0x1e
jmp 0x404121
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x40511f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4051b7
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4051b4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4051b4
lea eax, [esi - 1]
push eax
push dword [0x40e7cc]
call fcn.0040abff
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4051b6
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4051ab
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x40529e
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x405191
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x40525d
push eax
call esi
test al, al
jns 0x40525d
push 0x11
call esi
test al, al
js 0x40525d
push 0x10
call esi
test al, al
js 0x40525d
push 0x12
call esi
test al, al
js 0x40525d
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x40525d
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x405231
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x405248
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x4052a8
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4052a8
test ebp, ebp
je 0x405281
push 0x11
call esi
test al, al
js 0x405279
push 0x10
call esi
test al, al
js 0x405279
push 0x12
call esi
test al, al
jns 0x405281
push 1
push ebp
call fcn.004052b4
test ebx, ebx
je 0x405295
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4052a8
test edi, edi
je 0x4052a8
mov eax, dword [edi + 8]
jmp 0x4052aa
and dword [esp + 0x14], 0
jmp 0x4051b6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x4073f0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x407422
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40741d
cmp dword [esp + 0xc], esi
je 0x407439
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x40209d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
push eax
nop
nop
nop
nop
mov eax, dword fs:[0x30]
nop
nop
nop
nop
mov dword [ebp - 4], eax
nop
nop
pop eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
add esi, 0x14
mov edi, dword [esi]
jmp 0x4020db
push dword [ebp + 8]
push dword [edi + 0x28]
call dword [0x42f094]
test eax, eax
je 0x4020e5
mov edi, dword [edi]
cmp edi, esi
jne 0x4020c9
xor al, al
pop edi
pop esi
leave
ret
mov al, 1
jmp 0x4020e1
Function at 0x4053d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebx + 1]
push eax
push 0
call dword [0x42f058]
push eax
call dword [0x42f048]
and dword [ebp - 4], 0
mov edi, eax
mov byte [edi + ebx], 0
test ebx, ebx
je 0x405437
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp - 4]
push dword [ebp + 0xc]
add esi, edi
call dword [0x42f0a4]
mov ecx, eax
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov al, byte [edx + eax]
xor al, byte [ecx + esi]
inc dword [ebp - 4]
mov byte [esi], al
cmp dword [ebp - 4], ebx
jb 0x405409
pop esi
mov eax, edi
pop edi
leave
ret

Function at 0x40562f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43c078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x33323130
mov dword [ebp - 0xc], 0x37363534
mov word [ebp - 8], 0x3938
mov byte [ebp - 6], 0
mov ecx, edi
mov eax, esi
push ebx
push 0xa
cdq
pop ebx
idiv ebx
inc ecx
test eax, eax
jne 0x40565f
mov byte [ecx], al
pop ebx
mov eax, esi
xor edx, edx
push 0xa
pop esi
div esi
dec ecx
mov dl, byte [ebp + edx - 0x10]
mov esi, eax
mov byte [ecx], dl
test esi, esi
jne 0x40566d
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.0041d928
leave
ret
Function at 0x407555
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x980
mov eax, dword [0x43c078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
sub esp, 0xc
mov dword [ebp - 0x8d8], eax
lea eax, [ebp + 0xc]
mov esi, esp
call fcn.00411798
lea eax, [ebp - 0x980]
push eax
call fcn.004056a7
add esp, 0x10
push 0xf
pop ecx
mov esi, eax
lea edi, [ebp - 0x944]
rep movsd dword es:[edi], dword [esi]
push 0x4359db
lea esi, [ebp - 0x8f8]
call fcn.00411766
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push dword [ebp + 0x18]
call dword [0x6e8ee4]
push dword [0x6e8bac]
mov dword [ebp - 0x8dc], eax
push dword [ebp - 0x940]
xor esi, esi
call dword [0x6e8fc0]
test eax, eax
jne 0x4075dc
inc esi
cmp dword [ebp - 0x8dc], ebx
je 0x407760
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x92c]
push dword [ebp - 0x934]
push dword [ebp - 0x8dc]
call dword [0x6e8fe4]
mov dword [ebp - 0x8e8], eax
cmp eax, ebx
je 0x407754
mov eax, esi
neg eax
push ebx
sbb eax, eax
and eax, 0x800000
add eax, 0x400100
push eax
push ebx
push ebx
push dword [0x6e89f8]
push dword [ebp - 0x918]
push str.Select__From_Win32_OperatingSystem
push dword [ebp - 0x8e8]
call dword [0x6e9024]
mov edi, eax
mov dword [ebp - 0x8e0], edi
cmp edi, ebx
je 0x407748
cmp esi, ebx
je 0x407675
or dword [ebp - 0x8ec], 0x10300
push 4
lea eax, [ebp - 0x8ec]
push eax
push 0x1f
push edi
call dword [0x6e8ddc]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [0x6e8fac]
push ebx
mov esi, eax
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x13
push edi
mov dword [ebp - 0x8fc], 0x100
call dword [0x6e903c]
test eax, eax
jne 0x4076bd
push 0x436a2c
mov esi, dword [ebp - 0x8d8]
call fcn.00411766
jmp 0x407771
lea edx, [ebp - 0x104]
call fcn.00412d7c
cmp eax, 0xc8
jne 0x40779d
cmp esi, ebx
je 0x40773c
mov edi, 0x7cf
jmp 0x40771d
mov eax, dword [ebp - 0x8e4]
cmp eax, ebx
je 0x40773c
mov byte [ebp + eax - 0x8d4], bl
lea eax, [ebp - 0x8d4]
push eax
lea esi, [ebp - 0x908]
lea eax, [ebp - 0x8f8]
call fcn.00411888
lea esi, [ebp - 0x8f8]
call fcn.0041180c
mov eax, dword [ebp - 0x908]
call fcn.00403510
lea eax, [ebp - 0x8e4]
push eax
push edi
lea eax, [ebp - 0x8d4]
push eax
push dword [ebp - 0x8e0]
call dword [0x6e8f0c]
test eax, eax
jne 0x4076de
push dword [ebp - 0x8e0]
call dword [0x6e8ee0]
push dword [ebp - 0x8e8]
call dword [0x6e8ee0]
push dword [ebp - 0x8dc]
call dword [0x6e8ee0]
mov esi, dword [ebp - 0x8d8]
lea eax, [ebp - 0x8f8]
call fcn.00411798
mov eax, dword [ebp - 0x8f8]
call fcn.00403510
mov eax, dword [ebp + 0xc]
call fcn.00403510
mov eax, dword [ebp + 0x18]
call fcn.00403510
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d928
leave
ret
push 0x436a34
jmp 0x4076ad
Function at 0x408331
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0x40
push 0
push esi
call fcn.004088cd
add esp, 0x10
test eax, eax
jne 0x408351
xor eax, eax
inc eax
jmp 0x4083e7
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4083e4
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4083e4
push dword [ebp + 8]
lea edi, [esi + 0x40]
push 0xf8
push eax
push edi
call fcn.004088cd
add esp, 0x10
test eax, eax
je 0x408349
cmp dword [edi], 0x4550
jne 0x4083e4
mov eax, 0x10b
cmp word [esi + 0x58], ax
jne 0x4083e4
movzx eax, word [esi + 0x46]
test ax, ax
je 0x4083e4
imul eax, eax, 0x28
push eax
mov dword [esi + 0x140], eax
call fcn.00412df7
pop ecx
mov dword [esi + 0x138], eax
test eax, eax
jne 0x4083b9
push 3
jmp 0x4083e6
push dword [ebp + 8]
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push dword [esi + 0x140]
lea ecx, [ecx + edx + 0x18]
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.004088cd
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x4083e7
push 2
pop eax
pop edi
pop ebp
ret
Function at 0x41089c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0x3c]
xor ebx, ebx
add esi, eax
mov dword [ebp - 0x14], ebx
xor eax, eax
cmp dword [esi], 0x4550
push edi
jne 0x410962
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00424520
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push 4
pop edi
push edi
push 1
push ebx
push ebx
push 0x4355b5
push 0x4356f4
call dword [0x6e8e90]
test eax, eax
je 0x410960
push edi
push 0x1000
push edi
push ebx
call dword [0x6e8f4c]
mov ebx, eax
push ebx
mov dword [ebx], 0x10007
push dword [ebp - 0x20]
call dword [0x42f0ac]
test eax, eax
je 0x410960
push 0
push edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x24]
call dword [0x42f0b4]
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
push dword [ebp - 0x24]
call dword [0x42f0b8]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x410967
push dword [ebp - 0x20]
call dword [0x6e9000]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [0x42f174]
push 0
push dword [esi + 0x54]
push dword [ebp + 8]
push eax
push dword [ebp - 0x24]
call edi
and dword [ebp - 0xc], 0
xor eax, eax
cmp ax, word [esi + 6]
jae 0x4109c1
and dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 8]
push 0
lea eax, [eax + ecx + 0xf8]
push dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x10]
add edx, ecx
push edx
push eax
push dword [ebp - 0x24]
call edi
movzx eax, word [esi + 6]
inc dword [ebp - 0xc]
add dword [ebp - 8], 0x28
cmp dword [ebp - 0xc], eax
jl 0x41098a
push 0
push 4
lea eax, [esi + 0x34]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x24]
call edi
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x10]
push ebx
mov dword [ebx + 0xb0], eax
push dword [ebp - 0x20]
call dword [0x42f0b0]
push dword [ebp - 0x20]
call dword [0x6e9000]
mov eax, dword [ebp - 0x1c]
jmp 0x410962
Function at 0x412482
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc60
mov eax, dword [0x43c078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp + 0xc]
push 0x4357b3
lea esi, [ebp - 0xc1c]
mov dword [ebp - 0xc28], eax
call fcn.00411766
lea eax, [ebp - 0xc10]
push eax
xor edi, edi
mov ebx, 0x20019
push ebx
push edi
push dword [0x6e8c68]
mov dword [ebp - 0xc10], edi
push dword [ebp - 0xc28]
mov dword [ebp - 0xc0c], edi
mov dword [ebp - 0xc2c], 0xf003f
mov dword [ebp - 0xc08], edi
call dword [0x6e8ed0]
test eax, eax
jne 0x4126f7
mov dword [ebp - 0xc24], edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0xc24]
mov esi, 0x400
push dword [ebp - 0xc10]
mov dword [ebp - 0xc08], esi
call dword [0x6e8fdc]
mov dword [ebp - 0xc30], eax
cmp eax, edi
jne 0x4126cb
lea eax, [ebp - 0x804]
push eax
push dword [0x6e8c68]
lea eax, [ebp - 0xc04]
push 0x435da0
push eax
call dword [0x6e8e00]
add esp, 0x10
lea eax, [ebp - 0xc0c]
push eax
push ebx
push edi
lea eax, [ebp - 0xc04]
push eax
push dword [ebp - 0xc28]
call dword [0x6e8ed0]
test eax, eax
jne 0x4126df
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc2c]
push eax
push edi
push dword [0x6e8cd4]
mov dword [ebp - 0xc08], esi
push dword [ebp - 0xc0c]
call dword [0x6e8eb8]
test eax, eax
jne 0x4126bf
lea eax, [ebp - 0x404]
push eax
call dword [0x6e8ea4]
cmp eax, 1
jle 0x4126bf
push 0x435da8
lea esi, [ebp - 0xc3c]
lea eax, [ebp - 0xc1c]
call fcn.00411888
lea esi, [ebp - 0xc1c]
call fcn.0041180c
mov eax, dword [ebp - 0xc3c]
call fcn.00403510
lea eax, [ebp - 0x404]
push eax
lea esi, [ebp - 0xc48]
lea eax, [ebp - 0xc1c]
call fcn.00411888
lea esi, [ebp - 0xc1c]
call fcn.0041180c
mov eax, dword [ebp - 0xc48]
call fcn.00403510
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc2c]
push eax
push edi
push dword [0x6e8b04]
mov dword [ebp - 0xc08], 0x400
push dword [ebp - 0xc0c]
call dword [0x6e8eb8]
test eax, eax
jne 0x4126bf
push 0x435dac
lea esi, [ebp - 0xc60]
lea eax, [ebp - 0xc1c]
call fcn.00411888
lea esi, [ebp - 0xc1c]
call fcn.0041180c
mov eax, dword [ebp - 0xc60]
call fcn.00403510
lea eax, [ebp - 0x404]
push eax
lea esi, [ebp - 0xc54]
lea eax, [ebp - 0xc1c]
call fcn.00411888
lea esi, [ebp - 0xc1c]
call fcn.0041180c
mov eax, dword [ebp - 0xc54]
call fcn.00403510
push dword [ebp - 0xc0c]
call dword [0x6e8f50]
inc dword [ebp - 0xc24]
cmp dword [ebp - 0xc30], edi
je 0x412506
jmp 0x4126eb
push dword [ebp - 0xc0c]
call dword [0x6e8f50]
push dword [ebp - 0xc10]
call dword [0x6e8f50]
mov esi, dword [ebp - 0xc20]
lea eax, [ebp - 0xc1c]
call fcn.00411798
mov eax, dword [ebp - 0xc1c]
call fcn.00403510
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d928
leave
ret
Function at 0x418e9b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0x41aeef
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ebx, eax
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x41af1d
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.00424520
mov eax, ebx
movzx ecx, word [eax*8 + 0x435152]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax*8 + 0x435150]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax*8 + 0x435154]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax*8 + 0x435156]
add esp, 0xc
mov dword [esi + 0x6af94], eax
cmp ebx, 2
jg 0x41af80
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x41af8c
cmp ebx, 8
jl 0x41af8c
mov eax, dword [ebp + 8]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x41aff1
cmp eax, 0xffffffff
je 0x41aff1
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x41afcc
call fcn.0041b147
mov dword [esi + 0x6af7c], edi
xor eax, eax
movzx ecx, byte [ebx + eax]
shl edi, 5
xor edi, ecx
and edi, 0x7fff
inc eax
mov dword [esi + 0x6af7c], edi
cmp eax, 2
jb 0x41afd4
jmp 0x41b001
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret