joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45169c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esi], 0x462500
xor ebx, ebx
mov ecx, 0x11
mov eax, 0xa
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 0x4624c4
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], 0x4624d8
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0x4624ec
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], 0x4624c0
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
mov byte [esp + 0x18], 3
je 0x4425de
push eax
call sub.MFC71U.DLL_operator_new_1
add esp, 4
mov dword [esi + 8], ebx
push 0x2c
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
xor eax, eax
mov dword [esi + 8], edi
mov ecx, 0xb
rep stosd dword es:[edi], eax
mov dword [esi + 0xc], 0xb
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, ebx
je 0x442610
push eax
call sub.MFC71U.DLL_operator_new_1
add esp, 4
mov dword [esi + 0x24], ebx
push 0xd4
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
xor eax, eax
mov dword [esi + 0x24], edi
mov ecx, 0x35
rep stosd dword es:[edi], eax
mov dword [esi + 0x28], 0x35
mov eax, dword [esi + 0x40]
add esp, 4
cmp eax, ebx
je 0x442645
push eax
call sub.MFC71U.DLL_operator_new_1
add esp, 4
mov dword [esi + 0x40], ebx
push 0xfc4
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
xor eax, eax
mov dword [esi + 0x40], edi
mov ecx, 0x3f1
rep stosd dword es:[edi], eax
mov dword [esi + 0x44], 0x3f1
mov eax, dword [0x47a344]
add esp, 4
cmp eax, ebx
mov eax, esi
jne 0x442678
mov dword [0x47a344], esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x443500
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x473388]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
push edx
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
push 0x40
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x4542cc
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x4435c3
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00443470
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [edi], eax
call fcn.00443470
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00443470
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [edi + 8], eax
call fcn.00443470
mov dword [edi + 0xc], eax
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.0044c8ef
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.0044c8ef
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4435e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x473388]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
push 0x40
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x4542cc
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x44367f
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00443470
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [edi], eax
call fcn.00443470
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.0044c8ef
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.0044c8ef
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4436a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x473388]
mov edx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [esp + 0x94], eax
mov esi, ecx
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x1f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x40
lea ecx, [esp + 0x18]
push ecx
push 0x4542cc
push edx
push eax
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
je 0x443755
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
push edx
mov ecx, esi
call fcn.00443470
xor ebx, ebx
mov bh, al
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00443470
mov bl, al
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
shl ebx, 8
call fcn.00443470
movzx edx, al
or ebx, edx
mov dword [edi], ebx
mov al, 1
mov ecx, dword [esp + 0x94]
call fcn.0044c8ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x94]
xor al, al
call fcn.0044c8ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44c6a8
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x463bd0
call fcn.0044cbbc
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x44c6e8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44c6e8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x44c700
cmp eax, 0x20b
je 0x44c6ed
mov dword [ebp - 0x1c], edi
jmp 0x44c714
cmp dword [ecx + 0x84], 0xe
jbe 0x44c6e8
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x44c70e
cmp dword [ecx + 0x74], 0xe
jbe 0x44c6e8
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x47a410], 0xffffffff
or dword [0x47a414], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x47a398]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x47a394]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x47a40c], eax
call fcn.0044cc14
call fcn.0044ccb4
cmp dword [0x4733b0], edi
jne 0x44c774
push fcn.0044ccb4
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0044cca2
push 0x4730c4
push 0x4730c0
call sub.MSVCR71.dll__initterm
push 0x44cc58
call fcn.0044c936
mov eax, dword [0x47a390]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x47a38c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x44c7c8
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4730bc
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x44c7f2
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x44c8ac
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x44c861
cmp ax, di
je 0x44c808
cmp dword [ebp - 0x20], edi
jne 0x44c861
mov ax, word [esi]
cmp ax, di
je 0x44c81d
cmp ax, 0x20
ja 0x44c81d
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x44c808
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x44c839
movzx eax, word [ebp - 0x54]
jmp 0x44c83c
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0044d366
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x44c859
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x44c8a6
cmp ax, 0x22
jne 0x44c872
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x44c7f2
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0044cbf7
ret
Function at 0x344d0900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x344d096c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x344d09b3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.3453a166
add esp, 8
test eax, eax
jne 0x344d09b1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x344d09b5
jmp 0x344d0963
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x34511760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x345823c7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x345a9fa0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.34510650
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.34510650
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.34510650
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.34511060
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.34511060
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.34511060
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x34511a40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x345824b7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x345a9fa0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.34510570
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.34510570
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.34510570
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.34511080
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.34511080
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.34511080
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x34529e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x34584fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x345a9fa0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x345ae288
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x345ae398
call fcn.344cb390
mov byte [esp + 0x38], 1
call fcn.34528a3b
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.344cb540
mov dword [esi], 0x345ae3bc
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x3455a878
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x3455a8fd
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.34535f30
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x3455a8c0
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x3455a8e2
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x3455a958
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.3455a5c8
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x3455a944
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x3455a958
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x3455a881
pop esi
pop ebx
leave
ret
Function at 0x40233f
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4051f8
call fcn.00402861
push 1
call fcn.004023c2
pop ecx
test al, al
jne 0x4021e8
push 7
call fcn.00402a74
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040238d
mov byte [ebp - 0x24], al
mov eax, dword [0x40633c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4021e1
test eax, eax
jne 0x402252
mov dword [0x40633c], ecx
push 0x40429c
push 0x404284
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402235
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402339
push 0x404280
push 0x40426c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40633c], 2
jmp 0x402257
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040251f
pop ecx
call fcn.00402a68
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402287
push esi
call fcn.00402492
pop ecx
test al, al
je 0x402287
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00402ca3
call esi
call fcn.00402a6e
mov esi, eax
cmp dword [esi], edi
je 0x4022a5
push esi
call fcn.00402492
pop ecx
test al, al
je 0x4022a5
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00402b89
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00402bbc
test al, al
jne 0x4022de
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4022e7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040253c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402339
call fcn.004028a7
ret
call fcn.00402059
jmp 0x4021c9

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x762b3ad9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7e800dd1
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219