joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c7c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409e6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x94]
mov edx, 0x94
call fcn.0040499c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov byte [ebx], 0
cmp dword [ebp - 0x84], 2
jne 0x409d13
mov eax, dword [ebp - 0x90]
sub eax, 3
je 0x409cfb
dec eax
je 0x409d03
dec eax
je 0x409d0b
jmp 0x409dc8
mov byte [ebx], 5
jmp 0x409dc8
mov byte [ebx], 6
jmp 0x409dc8
mov byte [ebx], 7
jmp 0x409dc8
cmp dword [ebp - 0x90], 4
jne 0x409d63
cmp dword [ebp - 0x8c], 0
jne 0x409d63
mov byte [ebx], 1
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.004038f0
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00405e6c
mov eax, dword [ebp - 0x98]
mov edx, 0x409e84
call fcn.00403a68
jne 0x409dc8
mov byte [ebx], 2
jmp 0x409dc8
cmp dword [ebp - 0x90], 4
jne 0x409db3
cmp dword [ebp - 0x8c], 0xa
jne 0x409db3
mov byte [ebx], 3
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.004038f0
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.00405e6c
mov eax, dword [ebp - 0xa0]
mov edx, 0x409e90
call fcn.00403a68
jne 0x409dc8
mov byte [ebx], 4
jmp 0x409dc8
cmp dword [ebp - 0x90], 4
jne 0x409dc8
cmp dword [ebp - 0x8c], 0x5a
jne 0x409dc8
mov byte [ebx], 8
cmp byte [ebx], 5
jne 0x409dd9
mov eax, esi
mov edx, 0x409e9c
call fcn.004036fc
cmp byte [ebx], 6
jne 0x409dea
mov eax, esi
mov edx, 0x409eb0
call fcn.004036fc
cmp byte [ebx], 7
jne 0x409dfb
mov eax, esi
mov edx, 0x409ec4
call fcn.004036fc
cmp byte [ebx], 1
jne 0x409e0c
mov eax, esi
mov edx, 0x409ed8
call fcn.004036fc
cmp byte [ebx], 2
jne 0x409e1d
mov eax, esi
mov edx, 0x409eec
call fcn.004036fc
cmp byte [ebx], 3
jne 0x409e2e
mov eax, esi
mov edx, 0x409f00
call fcn.004036fc
cmp byte [ebx], 4
jne 0x409e3f
mov eax, esi
mov edx, 0x409f14
call fcn.004036fc
cmp byte [ebx], 8
jne 0x409e50
mov eax, esi
mov edx, 0x409f28
call fcn.004036fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e75
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.004036cc
ret

Function at 0x409f64
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.004036a8
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x409fbe
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x409fb2
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.00406248
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x409fa3
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40b68c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
mov eax, 0x40b5ec
call fcn.0040476c
xor eax, eax
push ebp
push 0x40b7a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
push 0x40db88
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x44]
mov edx, 0x40db88
mov ecx, 0x105
call fcn.004038f0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.00404a94
mov eax, dword [ebp - 0x40]
mov edx, 0x40b7bc
call fcn.00404ad4
test al, al
je 0x40b78a
push 0x40b7cc
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
test eax, eax
je 0x40b714
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x40b78a
push 0x40db84
push 0
push 0
push 0x40b528
push 0
push 0
call sub.kernel32.dll_CreateThread
push 0x104
push 0x40db88
mov eax, dword [0x40d660]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x40db88
call sub.kernel32.dll_LoadLibraryA
push 0x40b7d4
push 0
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
push 0
push 0
push 0x12
mov eax, dword [ebx]
push eax
call sub.user32.dll_PostThreadMessageA
push ebx
call sub.kernel32.dll_UnmapViewOfFile
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7ac
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004036cc
ret
Function at 0x401000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
mov ebx, 1
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x535
jae 0x40107c
mov ecx, dword [0x422b20]
mov dl, byte [0x422b34]
xor eax, eax
test ecx, ecx
mov cl, byte [0x422b0e]
setne al
and cl, dl
mov dword [0x422b28], eax
mov byte [0x422afc], cl
call fcn.00401090
mov dl, byte [0x422b02]
mov cl, byte [0x422b1c]
add dl, cl
cmp eax, 0xd0000000
mov byte [0x422afc], dl
ja 0x40106a
cmp eax, 0x80000000
jae 0x401082
mov word [0x422b0e], bx
call esi
sub eax, edi
cmp eax, 0x535
jb 0x40101d
pop edi
mov al, bl
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x402a60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x64
mov cx, word [0x422b04]
push esi
movsx eax, word [0x422b12]
mov esi, dword [0x422b28]
push edi
movsx edx, cx
and eax, esi
imul edx, edx, 0x6b7dffff
xor esi, esi
or cl, al
mov dword [0x422b18], eax
mov byte [0x422afc], cl
mov ecx, 0x11
mov eax, esi
lea edi, [esp + 0x28]
mov dword [0x422b20], edx
movsx dx, byte [0x422afa]
rep stosd dword es:[edi], eax
setne al
mov dword [0x422b30], eax
inc word [0x422b10]
movsx eax, byte [0x422af9]
xor ecx, ecx
or eax, 0xc1edffff
mov dword [esp + 8], ecx
mov dword [0x422b38], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov byte [0x422afe], 0xff
neg edx
mov byte [0x422afc], 0xff
mov dword [esp + 0x14], ecx
mov word [0x422b0e], dx
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [0x422b00], 0xfe
mov cl, byte [eax]
mov dword [esp + 0x28], 0x44
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov ecx, dword [edx]
push ecx
push esi
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov eax, dword [esp + 0x1c]
mov dl, byte [0x422b34]
test eax, eax
mov byte [0x422aff], dl
mov dword [0x422b18], 0xa1ffff
jne 0x402b54
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [esp + 8]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x402be8
movsx eax, byte [0x422aff]
imul eax, dword [0x422b30]
movsx cx, byte [0x422afe]
mov edx, dword [0x422b2c]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x422b18], eax
mov eax, dword [esp + 8]
or edx, 0x8adbffff
push eax
mov esi, 1
mov word [0x422b12], cx
mov dword [0x422b38], edx
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov dl, byte [0x422afe]
mov al, byte [0x422afc]
mov ecx, dword [0x422b30]
and al, dl
mov byte [0x422afc], al
xor eax, eax
test ecx, ecx
setne al
mov dword [0x422b18], eax
mov edx, dword [0x422b18]
mov ecx, 0xe43bffff
sub ecx, edx
mov byte [0x422aff], 0xff
mov dword [0x422b20], ecx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x402c2c
mov al, byte [ecx - 1]
test al, al
je 0x402c22
cmp al, 0xff
je 0x402c22
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
add esp, 0x64
ret
dec ecx
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x64
ret
Function at 0x40c940
Capabilities:
Write file on windows

Disassembly:
mov al, byte [0x422afc]
push ebx
xor ebx, ebx
mov edx, dword [esp + 8]
test al, al
setne al
xor ecx, ecx
mov byte [0x422afd], al
cmp word [0x422b0e], cx
push edi
setne cl
mov dword [0x422b20], ecx
mov eax, dword [edx + 4]
test eax, eax
jne 0x40c975
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c9f3
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
test eax, eax
jne 0x40c9a6
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea edx, [esp + 0x10]
push 0
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 8]
cmp eax, ecx
pop esi
jne 0x40c9d9
mov al, byte [0x422afe]
xor ecx, ecx
test al, al
setne cl
mov dword [0x422b34], ecx
mov ebx, 1
movsx edx, byte [0x422af8]
add edx, 0x2d91ffff
push edi
mov dword [0x422b30], edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
movsx eax, byte [0x422b00]
mov ecx, dword [0x422b28]
pop edi
and ecx, eax
mov eax, ebx
mov byte [0x422af9], 0xff
mov dword [0x422b28], ecx
pop ebx
ret
Function at 0x40ed00
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041a770
mov eax, dword [0x422b38]
mov cl, byte [0x422b00]
and eax, 0xfd25ffff
push esi
mov dword [0x422b34], eax
mov eax, dword [0x422b30]
neg cl
xor edx, edx
push edi
test eax, eax
push 0
lea eax, [ebp - 0x80c]
push 0x24
push eax
setne dl
push 0
mov byte [ebp - 0x80c], 0
mov byte [0x422afb], cl
mov dword [0x422b28], edx
call dword [0x422f98]
mov al, byte [ebp - 0x80c]
test al, al
jne 0x40ee2d
mov al, byte [0x4227f4]
add al, 0x62
and eax, 0xff
add eax, 3
and al, 0xfc
call fcn.0041a770
mov ecx, esp
lea edx, [ebp - 0x80c]
push 0x800
push edx
mov edx, 0x4227f4
call fcn.004196b0
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
push eax
call esi
mov al, byte [ebp - 0x80c]
test al, al
jne 0x40ee2d
mov al, byte [0x4227ec]
add al, 0x62
and eax, 0xff
add eax, 3
and al, 0xfc
call fcn.0041a770
mov ecx, esp
lea eax, [ebp - 0x80c]
push 0x800
push eax
mov edx, 0x4227ec
call fcn.004196b0
push eax
call esi
mov al, byte [ebp - 0x80c]
test al, al
jne 0x40ee2d
mov al, byte [0x4227e0]
add al, 0x62
and eax, 0xff
add eax, 3
and al, 0xfc
call fcn.0041a770
mov ecx, esp
mov edx, 0x4227e0
call fcn.004196b0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x80c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x80c]
push ecx
call dword [0x422f68]
mov dl, byte [0x422b02]
mov esi, eax
inc dl
test esi, esi
mov byte [0x422afa], dl
jl 0x40ee8c
cmp esi, 0x19
jg 0x40ee8c
mov al, byte [0x4227d8]
add al, 0x62
and eax, 0xff
add eax, 3
and al, 0xfc
call fcn.0041a770
add esi, 0x41
mov ecx, esp
push esi
mov edx, 0x4227d8
call fcn.004196b0
push eax
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x40eebf
mov al, byte [0x4227d0]
add al, 0x62
and eax, 0xff
add eax, 3
and al, 0xfc
call fcn.0041a770
mov ecx, esp
mov edx, 0x4227d0
call fcn.004196b0
lea ecx, [ebp - 0x100c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea edx, [ebp - 0x180c]
push 0x800
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0xc]
push eax
lea edx, [ebp - 4]
push ecx
push edx
lea eax, [ebp - 0x200c]
push 0x800
lea ecx, [ebp - 0x100c]
push eax
push ecx
mov word [0x422b06], 1
mov dword [0x422b2c], 0xdb21fffe
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x40ef0c
mov esi, dword [ebp - 4]
mov al, byte [0x422b0e]
lea esp, [ebp - 0x2014]
imul byte [0x422afd]
movsx edx, byte [0x422af8]
mov byte [0x422afa], al
mov eax, dword [0x422b2c]
and edx, eax
mov eax, esi
pop edi
mov dword [0x422b38], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f640
Capabilities:
Hash data with md5

Disassembly:
lea edx, [ecx + 0x10]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov edx, dword [0x422b38]
test edx, edx
setne al
mov byte [0x422afd], 0xfe
mov dword [0x422b18], eax
mov dword [ecx], 0x67452301
mov dl, byte [0x422b04]
dec dl
mov byte [0x422af9], dl
mov dword [ecx + 4], 0xefcdab89
mov ax, word [0x422b34]
imul ax, word [0x422b10]
mov word [0x422b12], ax
mov dword [ecx + 8], 0x98badcfe
movsx dx, byte [0x422afd]
add edx, dword [0x422b24]
mov word [0x422b0a], dx
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x414110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41bc19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
movsx eax, byte [0x422afb]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov cl, byte [esp + 0x30]
or eax, 0x44d1ffff
mov byte [esp + 0xc], cl
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov dword [0x422b28], eax
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
mov dword [esp + 0x24], ebx
jae 0x4141ea
mov dl, byte [0x422b04]
mov byte [0x422afd], 1
neg dl
mov byte [0x422afb], dl
mov ecx, dword [esi + 4]
mov edx, eax
dec eax
mov ecx, dword [ecx]
test edx, edx
je 0x4141c8
mov edx, dword [0x422ffc]
lea esi, [eax + 1]
mov eax, dword [ecx + 8]
cmp eax, edx
je 0x4141ac
mov ecx, eax
mov eax, dword [ecx]
cmp eax, edx
je 0x4141c5
mov ecx, eax
mov eax, dword [ecx]
cmp eax, edx
jne 0x4141a2
jmp 0x4141c5
mov eax, dword [ecx + 4]
cmp ecx, dword [eax + 8]
jne 0x4141be
mov ecx, eax
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x4141b4
cmp dword [ecx + 8], eax
je 0x4141c5
mov ecx, eax
dec esi
jne 0x414193
mov al, byte [0x422b02]
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [0x422af9], al
add ecx, 0xc
mov eax, dword [edx]
push eax
push ebx
push ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov esi, dword [esp + 0x2c]
mov cl, byte [esp + 0xc]
mov byte [esi], cl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [esp + 0xc]
mov eax, dword [edx]
push eax
push ebx
push ecx
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x414238
mov al, byte [ecx - 1]
cmp al, bl
je 0x41422e
cmp al, 0xff
je 0x41422e
dec al
mov byte [ecx - 1], al
jmp 0x414238
dec ecx
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x415f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x422b0e]
mov dl, byte [0x422afe]
mov eax, dword [0x422b2c]
push ebx
add cl, dl
mov dx, word [0x422b0a]
push esi
push edi
movsx si, byte [0x422afb]
movsx edi, dx
add eax, 0x2ac3ffff
mov byte [0x422af8], cl
movsx cx, byte [0x422af9]
mov dword [0x422b34], eax
mov eax, dword [esp + 0x18]
add edi, 0x1659ffff
mov dword [0x422b18], 0x611ffff
mov dword [0x422b20], edi
mov ebx, dword [eax]
add ecx, esi
mov byte [0x422afa], dl
mov word [0x422b12], cx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
or esi, edi
movsx edx, byte [0x422afe]
mov edi, dword [esp + 0x20]
add edx, 0x44120001
mov dword [0x422b2c], edx
mov word [0x422b02], si
movsx edx, byte [0x422afb]
and edx, 0xf91bffff
xor esi, esi
test edi, edi
mov dword [0x422b28], edx
jle 0x416094
push ebp
jmp 0x415fb9
mov ebx, dword [esp + 0x14]
mov bp, word [0x422b06]
mov byte [0x422afe], 1
movsx edx, bp
imul edx, edx, 0x1e63ffff
inc bl
mov dword [0x422b18], edx
and ebx, 0xff
mov edi, ebx
mov bl, byte [0x422b04]
neg cl
mov edx, dword [eax + edi*4 + 8]
mov byte [0x422afd], bl
movsx bx, byte [0x422af9]
imul bx, bp
mov word [0x422b06], bx
mov bl, byte [esp + 0x1c]
mov dword [esp + 0x10], edx
add dl, bl
and edx, 0xff
mov dword [0x422b24], 1
mov byte [0x422afa], cl
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + edx*4 + 8]
mov dword [esp + 0x14], edi
mov dword [eax + edi*4 + 8], ecx
mov edi, dword [esp + 0x1c]
movsx edx, byte [0x422afd]
or edx, 0x7dc1ffff
mov dword [0x422b30], edx
mov edx, dword [esp + 0x10]
add cl, dl
mov dword [eax + edi*4 + 8], edx
and ecx, 0xff
mov word [0x422b02], 0xffff
mov dl, byte [eax + ecx*4 + 8]
mov ecx, dword [esp + 0x20]
mov bl, byte [esi + ecx]
xor bl, dl
mov byte [esi + ecx], bl
mov ecx, dword [esp + 0x24]
inc esi
cmp esi, ecx
mov cx, word [0x422b12]
jl 0x415fb5
mov edx, dword [0x422b28]
mov ebx, dword [esp + 0x14]
pop ebp
sub dx, cx
pop edi
mov word [0x422b02], dx
pop esi
movsx ecx, dx
movsx dx, byte [0x422af9]
sub ecx, 0x5a9bffff
neg edx
mov dword [0x422b38], ecx
mov ecx, dword [esp + 0x10]
mov word [0x422b0e], dx
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
add esp, 8
ret
Function at 0x419170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41bfc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call dword [sym.imp.MSVCP60.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Init_void_]
mov ebx, dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
lea ecx, [esp + 0x10]
mov dword [esi + 0x34], eax
call ebx
mov eax, dword [sym.imp.MSVCP60.dll_class_std::locale::_Locimp__std::locale::_Locimp::_Global]
lea ecx, [esp + 0xc]
mov edi, dword [eax]
call ebx
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4191bf
inc eax
mov dword [edi + 4], eax
mov edi, dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
lea ecx, [esp + 0xc]
call edi
lea ecx, [esp + 0x10]
call edi
lea ecx, [esi + 4]
lea edx, [esi + 0x14]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x18]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ecx
lea eax, [esi + 8]
lea edx, [esi + 0x24]
lea ecx, [esi + 0x28]
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], ecx
mov dword [eax], 0
mov edx, dword [esi + 0x20]
mov dword [edx], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov ecx, dword [esi + 0xc]
mov dword [ecx], 0
mov edx, dword [esi + 0x1c]
mov dword [edx], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov ecx, dword [esp + 0x28]
push 0
push 0
push 0
push ecx
mov ecx, esi
mov dword [esp + 0x30], 0
mov dword [esi], 0x41d400
call dword [sym.imp.MSVCP60.dll_protected:_void___thiscall_std::strstreambuf::_Init_int__char___char___int_]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x419740
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, edx
mov ebp, ecx
xor eax, eax
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x419752
cmp word [0x422b04], bx
mov byte [esp + 0x14], bl
setne al
cmp word [0x422b0e], bx
mov byte [0x422afd], al
je 0x41978c
cmp word [0x422b0a], bx
mov word [0x422b0a], 1
jne 0x419793
mov word [0x422b0a], bx
mov byte [esp + 0x10], bl
xor esi, esi
mov eax, esi
xor edx, edx
div edi
mov al, byte [esp + esi + 0x18]
mov word [0x422b12], 0xffff
mov dword [0x422b38], 0x22a40001
mov dword [0x422b28], 0x24edfffe
mov cl, byte [edx + ebp]
mov dl, byte [esp + 0x10]
add cl, al
add dl, cl
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x10]
and edx, 0xff
mov cl, byte [esp + edx + 0x18]
lea eax, [esp + edx + 0x18]
mov dl, byte [esp + esi + 0x18]
mov byte [esp + esi + 0x18], cl
mov byte [eax], dl
mov dx, word [0x422b0a]
dec dx
inc esi
cmp esi, 0x100
mov word [0x422b02], dx
jb 0x419799
mov ebp, dword [esp + 0x124]
test ebp, ebp
jbe 0x4198e1
mov esi, dword [esp + 0x11c]
mov edi, dword [esp + 0x120]
sub edi, esi
jmp 0x419829
mov bl, byte [esp + 0x10]
mov dl, byte [esp + 0x14]
mov byte [0x422afe], 0xff
inc dl
mov byte [esp + 0x14], dl
mov eax, dword [esp + 0x14]
and eax, 0xff
mov dl, byte [esp + eax + 0x18]
lea ecx, [esp + eax + 0x18]
mov al, byte [0x422afb]
add bl, dl
mov dl, byte [0x422b24]
mov byte [esp + 0x10], bl
sub dl, al
mov byte [0x422afa], dl
movsx edx, word [0x422b04]
mov eax, edx
shl eax, 4
add eax, edx
lea eax, [eax + eax*2]
shl eax, 3
sub eax, edx
shl eax, 0x15
sub eax, edx
mov edx, dword [esp + 0x10]
and edx, 0xff
mov dword [0x422b1c], eax
mov bl, byte [esp + edx + 0x18]
lea eax, [esp + edx + 0x18]
mov dl, byte [ecx]
mov byte [ecx], bl
mov byte [eax], dl
mov al, byte [eax]
mov dl, byte [ecx]
mov word [0x422b0e], 0xffff
add al, dl
mov dl, byte [edi + esi]
and eax, 0xff
mov cl, byte [esp + eax + 0x18]
xor cl, dl
mov byte [esi], cl
mov dword [0x422b1c], 0x99fa0001
movsx edx, word [0x422b0e]
imul edx, dword [0x422b28]
inc esi
dec ebp
mov dword [0x422b2c], edx
jne 0x419825
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc

Function at 0x419900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov al, byte [0x4229d4]
add al, 0x62
and eax, 0xff
add eax, 3
and al, 0xfc
call fcn.0041a770
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, esp
push eax
push edx
mov edx, 0x4229d4
call fcn.004196b0
push eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea esp, [ebp]
pop ebp
ret