joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46047a
Capabilities:
Terminate process

Disassembly:
int3
add esp, 4
add esp, 4
pop edx
xor eax, eax
call fcn.004606cd
mov al, 0x34
sub edx, 1
jmp fcn.00463aee
sub edi, 1
push eax
mov edx, dword [ebx + esi*4 - 0xc]
cmp edi, edx
jb 0x46048d
mov al, 4
call fcn.00460a74
cmp dword [ebx + esi*4 - 8], 1
jne 0x460529
lea eax, [ebx + esi*4]
cmp byte [ebx + esi*4 - 1], 0x80
jbe 0x4604fb
cmp dword [0x4029fc], ebx
jne 0x460300
cmp ecx, 0xff
ja 0x4604bd
add esp, 4
mov byte [eax + edi], cl
ret
cmp ecx, 0x40000000
jl 0x4604ca
add dword [ebx + ecx*4 - 8], 1
pop eax
push esi
push ecx
mov ecx, edx
push eax
mov edx, dword [esp + 8]
call fcn.004634b7
pop edx
lea esi, [ebx + esi*4]
mov dword [edx], eax
mov edx, ecx
lea ecx, [ebx + edi*4]
lea edi, [ebx + eax*4]
xor eax, eax
add ecx, edi
lodsb al, byte [esi]
stosd dword es:[edi], eax
sub edx, 1
jne 0x4604eb
pop esi
pop edx
mov dword [ecx], esi
jmp fcn.0046362d
mov edx, dword [eax + edi*4]
jl 0x4602fb
cmp ecx, 0x40000000
jl 0x460511
add dword [ebx + ecx*4 - 8], 1
mov dword [eax + edi*4], ecx
pop eax
cmp edx, 0x40000000
jle 0x460528
sub dword [ebx + edx*4 - 8], 1
je fcn.0046362d
ret
sub dword [ebx + esi*4 - 8], 1
push ecx
cmp ecx, 0x40000000
jl 0x46053c
add dword [ebx + ecx*4 - 8], 1
cmp byte [ebx + esi*4 - 1], 0x80
jbe 0x46057d
cmp dword [0x4029fc], ebx
jne 0x4602fd
cmp ecx, 0xff
ja 0x4605dc
mov ecx, edx
mov edx, dword [esp + 4]
call fcn.00463402
shl esi, 2
mov dword [edx], eax
add ecx, 1
lea edx, [edi + eax*4]
lea edi, [ebx + eax*4]
pop eax
rep movsb byte es:[edi], byte [esi]
mov byte [edx], al
add esp, 4
ret
mov ecx, edx
jge 0x460586
mov al, byte [ebx + esi*4 - 1]
int3
mov edx, dword [esp + 8]
call fcn.00463499
call fcn.004634b7
mov edx, dword [esp + 4]
lea edi, [eax + edi]
shl esi, 2
shl edi, 2
mov dword [edx], eax
shl eax, 2
mov edx, dword [esi]
add esi, 4
mov dword [eax], edx
add eax, 4
cmp edx, 0x40000000
jl 0x4605bd
add dword [ebx + edx*4 - 8], 1
sub ecx, 1
jne 0x4605a6
mov edx, dword [edi]
pop ecx
pop eax
mov dword [edi], ecx
cmp edx, 0x40000000
jl 0x4605db
sub dword [ebx + edx*4 - 8], 1
je fcn.0046362d
ret
mov ecx, edx
mov edx, dword [esp + 8]
call fcn.004634b7
mov edx, dword [esp + 4]
add edi, eax
shl esi, 2
shl edi, 2
mov dword [edx], eax
mov edx, ecx
shl eax, 2
xor ecx, ecx
mov cl, byte [esi]
add esi, 1
mov dword [eax], ecx
add eax, 4
sub edx, 1
jne 0x4605fc
pop dword [edi]
pop eax
ret

Function at 0x460673
Capabilities:
Terminate process

Disassembly:
int3
sub edi, 1
mov edx, dword [ebx + esi*4 - 0xc]
cmp dword [0x4029fc], ebx
jne 0x460303
cmp edi, edx
jb 0x460693
push eax
mov al, 4
call fcn.00460a74
pop eax
cmp ecx, 0xff
ja 0x4602fc
cmp dword [ebx + esi*4 - 8], 1
jne 0x4606aa
mov byte [edi + esi*4], cl
ret
sub dword [ebx + esi*4 - 8], 1
push ecx
mov ecx, edx
mov edx, eax
call fcn.00463402
lea esi, [ebx + esi*4]
mov dword [edx], eax
add ecx, 1
lea edx, [edi + eax*4]
lea edi, [ebx + eax*4]
pop eax
rep movsb byte es:[edi], byte [esi]
mov byte [edx], al
ret
Function at 0x46090a
Capabilities:
Terminate process

Disassembly:
mov edx, dword [ebx + esi*4 - 0xc]
sub edi, 1
shl esi, 2
cmp edi, edx
jbe 0x460921
push ecx
mov cl, 8
call fcn.00460ad0
pop ecx
cmp ecx, edx
jbe 0x460932
push edi
mov edi, ecx
mov cl, 8
call fcn.00460b26
mov ecx, edi
pop edi
sub ecx, edi
jge 0x460947
add ecx, edi
add edi, 1
pop edx
mov al, 9
sub edx, 1
jmp fcn.00463aee
push eax
mov edx, edi
mov edi, dword [eax]
cmp dword [esi - 8], 1
jne 0x4609ae
cmp edx, 0
jne 0x4609ae
cmp edi, 0x40000000
jg 0x460975
cmp ecx, dword [esi - 0xc]
jne 0x4609ae
lea eax, [esi + 1]
pop edi
ror eax, 2
mov dword [esi - 8], 2
mov dword [edi], eax
ret
lea eax, [ebx + edi*4]
cmp eax, esi
jne 0x460987
mov dword [esi - 0xc], ecx
add esp, 4
mov byte [esi + ecx], 0
ret
cmp ecx, dword [esi - 0xc]
jne 0x4609ae
mov edx, edi
mov dword [esi - 8], 2
pop edi
add esi, 1
mov ecx, dword [eax - 8]
ror esi, 2
sub ecx, 1
mov dword [edi], esi
je fcn.0046362d
mov dword [eax - 8], ecx
ret
call fcn.00463402
add esi, edx
push eax
lea edi, [ebx + eax*4]
rep movsb byte es:[edi], byte [esi]
xor eax, eax
stosb byte es:[edi], al
pop eax
pop edi
mov edx, dword [edi]
mov dword [edi], eax
cmp edx, 0x40000000
jle 0x4609d7
sub dword [ebx + edx*4 - 8], 1
je fcn.0046362d
ret

Function at 0x460ad0
Capabilities:
Terminate process

Disassembly:
mov al, 5
jmp 0x460a60
int3
mov al, 0xa
jmp 0x460a60
sub edi, edx
mov al, 0xa
jmp 0x460a60
mov esi, edx
and ecx, 0xff
mov edx, dword [esp + ecx]
sub edx, 1
jmp fcn.00463aee
add edi, 1
jle 0x460b0b
cmp edi, 0x40000000
jl 0x460a4f
shl edi, 2
cmp byte [edi - 1], 0x12
jne 0x460a49
fld qword [edi]
call fcn.00461ddc
sub esp, 8
fistp qword [esp]
call fcn.00461dea
mov edi, dword [esp]
add esp, 8
cmp edi, 0
jge 0x460b18
add edi, edx
xor ebx, ebx
cmp edi, edx
ja 0x460a53
ret
sub edi, 1
xor ebx, ebx
cmp edi, edx
ja 0x460a4e
ret

Function at 0x460b26
Capabilities:
Terminate process

Disassembly:
int3
sub edi, edx
sub edi, 1
mov al, 0xb
jl 0x460b5e
cmp edi, 0x40000000
jl 0x460a5e
shl edi, 2
cmp byte [edi - 1], 0x12
jne 0x460a4d
fld qword [edi]
call fcn.00461ddc
sub esp, 8
fistp qword [esp]
call fcn.00461dea
mov edi, dword [esp]
add esp, 8
cmp edi, 0
jge 0x460b6d
lea edi, [edi + edx + 1]
xor ebx, ebx
cmp edi, edx
ja 0x460a59
ret
cmp edi, edx
ja 0x460a5e
xor ebx, ebx
ret

Function at 0x460d55
Capabilities:
Terminate process

Disassembly:
sub edi, 1
xor eax, eax
mov edx, dword [ebx + esi*4 - 0xc]
shl esi, 2
cmp edi, edx
jb 0x460d6c
mov al, 3
call fcn.00460a74
cmp dword [0x4029e0], ebx
jne 0x460b90
mov al, byte [esi + edi]
ret

Function at 0x460d5a
Capabilities:
Terminate process

Disassembly:
sub edi, 1
xor eax, eax
mov edx, dword [ebx + esi*4 - 0xc]
shl esi, 2
cmp edi, edx
jb 0x460d6c
mov al, 3
call fcn.00460a74
cmp dword [0x4029e0], ebx
jne 0x460b90
mov al, byte [esi + edi]
ret

Function at 0x462460
Capabilities:
Terminate process

Disassembly:
push eax
fild dword [esp]
add esp, 4
call fcn.00463511
pop edx
mov al, 0x6e
sub edx, 1
mov ecx, edi
jmp fcn.00463aee

Function at 0x462485
Capabilities:
Write file on windows

Disassembly:
xor ebx, ebx
mov esi, dword [ebx + edi*4 - 0xc]
shl edi, 2
Function at 0x462772
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x402008]
mov edx, dword [edi]
add dword [eax - 8], 1
add eax, 1
ror eax, 2
mov dword [edi], eax
cmp edx, 0x40000000
jle 0x462799
sub dword [ebx + edx*4 - 8], 1
je fcn.0046362d
ret

Function at 0x46279a
Capabilities:
Terminate process

Disassembly:
mov eax, dword [edi + 4]
test eax, eax
jne 0x4627da
push ecx
push edx
push esi
push edi
mov ecx, 0x2ff8
call fcn.00462f6f
pop edi
pop esi
pop edx
pop ecx
test eax, eax
je 0x462980
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 0x40565342
mov dword [eax + 0x2ff4], 0x3c565342
ret
add esp, 4
mov edi, dword [0x402178]
call fcn.00462485
mov eax, dword [ebp + 0x18]
cmp dword [eax], ebx
je 0x4629d9
push eax
push ebp
mov edx, ebp
mov ebp, dword [ebp + 0x14]
cmp eax, dword [ebp + 0x18]
je 0x462997
push dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x18]
cmp dword [eax], ebx
je 0x4629b8
mov dword [ebp + 0x1c], 0x4629a5
jmp fcn.00462916
pop edx
mov dword [edx + 0x14], ebp
pop eax
cmp dword [eax], ebx
je 0x4629d0
push dword [eax]
mov ecx, 0x2ff8
call fcn.0046333d
pop eax
jmp 0x4629bd
pop ebp
pop dword [eax + 4]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
pop edx
mov al, 0x21
sub edx, 1
jmp fcn.00463aee

Function at 0x462aca
Capabilities:
Terminate process

Disassembly:
mov esi, dword [0x402008]
cmp eax, 0x40000000
jl 0x462ae3
pop edx
mov al, 0x57
sub edx, 1
jmp fcn.00463aee
cmp dword [ebp + 0x10], ebx
je 0x462af6
mov ecx, eax
pop edx
mov al, 0x2a
sub edx, 1
jmp fcn.00463aee
mov ecx, dword [0x402170]
mov edx, dword [esi + 0x54]
test ecx, ecx
jne 0x462b12
test edx, edx
je 0x462b12
mov ecx, dword [ebx + edx*4 + 4]
lea esp, [ebx + ecx*4 - 8]
ret
push eax
call fcn.0045e229
add esp, 4
pop eax
cmp eax, 0x103
jne 0x462b24
int3
push eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x462b35
Capabilities:
Terminate process

Disassembly:
cmp eax, 0x40000000
jl 0x462b41
add dword [ebx + eax*4 - 8], 1
cmp esi, 0x40000000
jl 0x462b4e
add dword [ebx + esi*4 - 8], 1
push edi
push esi
push eax
mov edx, 0x1c3
mov ecx, 0xe
call fcn.00462889
mov edx, dword [esp + 0xc]
pop dword [ebp]
pop dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp + 0x1c], 0x462b7c
mov dword [ebp + 0xc], edx
jmp 0x461e91
Function at 0x462bf5
Capabilities:
Terminate process

Disassembly:
cmp esi, 0x40000000
jge 0x462c10
fild dword [edi]
fldpi
call fcn.00463511
mov esi, dword [edi]
fstp qword [ebx + esi*4]
or dword [ebx + esi*4 - 4], eax
ret
mov ecx, dword [ebx + esi*4 - 4]
cmp eax, 0xffffffff
jne 0x462c27
pop edx
mov al, 0x48
mov edi, eax
sub edx, 1
jmp fcn.00463aee
test ecx, 0xffffff
je 0x462c46
and ecx, 0xff000000
cmp eax, 0
je 0x462c46
pop edx
mov al, 0x7b
sub edx, 1
jmp fcn.00463aee
or ecx, eax
mov edx, dword [edi]
mov dword [ebx + esi*4 - 4], ecx
add dword [ebx + esi*4 - 8], 1
mov dword [edi], esi
cmp edx, 0x40000000
jle 0x462c68
sub dword [ebx + edx*4 - 8], 1
je fcn.0046362d
ret

Function at 0x462d97
Capabilities:
Terminate process

Disassembly:
mov esi, dword [eax - 4]
and esi, 0xfffffffe
mov ecx, dword [esp + 0xc]
cmp dword [esi], 0x484253
je 0x462dad
int3
cmp ecx, dword [esi + 8]
jne 0x462e11
mov edi, dword [0x4021b8]
mov dword [esi + 4], ebx
mov dword [esi + 0xc], edi
or esi, 1
mov dword [eax], ecx
mov dword [eax - 4], esi
mov esi, eax
lea ecx, [ebx + edi*4 + 0xf0]
cmp dword [ebx + edi*4 + 0xec], 0x424343
je 0x462ddd
int3
cmp dword [ebx + edi*4 + 0x110], 0x424345
jne 0x462f61
push ecx
call fcn.00462d12
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + edi*4 + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [ecx + edi*4 + 0x14], esi
pop ecx
call fcn.00462d22
jmp 0x462ee4
push eax
sub eax, esi
sub eax, 0x1c
cmp dword [esi], 0x484253
jne 0x462f63
xor edx, edx
idiv ecx
test edx, edx
je 0x462e2c
int3
test eax, 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
jne 0x462e3f
add eax, ecx
jmp 0x462e45
sub eax, ecx
mov dword [esp + 8], eax
mov edi, dword [eax - 4]
xor esi, edi
cmp esi, 1
jbe 0x462e55
jmp fcn.00463298
test edi, 1
je 0x462ea5
cmp ecx, dword [eax]
jne 0x462ea5
add esp, 4
mov esi, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [esp + 8]
test edx, edx
jne 0x462e83
mov edx, dword [esp + 0x14]
test esi, esi
je 0x462e7d
mov dword [esi + 8], ebx
mov dword [edi + edx*4 + 0x14], esi
jmp 0x462e8d
mov dword [edx + 4], esi
test esi, esi
je 0x462e8d
mov dword [esi + 8], edx
mov eax, dword [esp + 4]
add edi, 4
add ecx, ecx
mov dword [esp + 8], edi
mov dword [esp + 0xc], ecx
mov dword [eax], ecx
jmp fcn.00462d97
pop eax
or edi, 1
mov edx, dword [esp + 0x14]
mov dword [eax - 4], edi
mov dword [eax + 8], ebx
mov edi, dword [esp + 8]
cmp dword [ebx + edx*4], 0x424354
je 0x462ec1
int3
mov ecx, dword [edi + edx*4 + 0x14]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x462ee0
cmp dword [ecx + 8], 0
mov dword [ecx + 8], eax
je 0x462ee0
pop edx
mov edi, edx
mov al, 0x20
jmp fcn.00463aee
mov dword [edi + edx*4 + 0x14], eax
ret 0xc
Function at 0x463470
Capabilities:
Terminate process

Disassembly:
ret
cmp dword [0x4021dc], 0
jne 0x46346f
mov al, 0x7c
mov dword [0x4021dc], 1
mov edx, dword [ebp + 0xc]
mov ebp, dword [ebp + 0x14]
sub cl, 1
jg 0x463485
sub edx, 1
jmp fcn.00463aee

Function at 0x463499
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4021d8]
test eax, 1
je 0x4634b6
mov al, 0x38
sub edx, 1
mov dword [0x4021d8], ebx
jmp fcn.00463aee
ret

Function at 0x4635c3
Capabilities:
Terminate process

Disassembly:
xor ebx, ebx
cmp eax, 0x40000000
jle 0x4635fc
cmp byte [ebx + eax*4 - 1], 0x12
je 0x4635df
pop edx
mov al, 0x30
sub edx, 1
jmp fcn.00463aee
sub esp, 8
fld qword [ebx + eax*4]
call fcn.00461ddc
fistp qword [esp]
call fcn.00461dea
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x463761
Capabilities:
Terminate process

Disassembly:
xor ebx, ebx
add ecx, 4
push edi
call fcn.00462f6f
test eax, eax
je 0x463775
mov dword [eax], edx
add eax, 4
pop edi
push ebx
push eax
fild qword [esp]
add esp, 8
jmp fcn.00463511

Function at 0x4637e9
Capabilities:
Terminate process

Disassembly:
shl eax, 2
je 0x46382a
lea ecx, [eax + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
pop eax
mov ecx, dword [eax]
mov edx, dword [esp]
call fcn.0046333d
ret

Function at 0x46387f
Capabilities:
Terminate process

Disassembly:
int3
int3
cmp eax, 2
jne 0x4638a8
cmp ecx, 0x1d
ja 0x4638a8
mov eax, 1
mov edx, dword [edi]
shl eax, cl
cmp edx, 0x40000000
mov dword [edi], eax
jle 0x4638a7
sub dword [ebx + edx*4 - 8], 1
je fcn.0046362d
ret
test ecx, ecx
jne 0x4638c3
cmp eax, 0x40000000
jl 0x4638ba
cmp byte [ebx + eax*4 - 1], 0x12
jne 0x46387d
mov edx, dword [edi]
mov eax, 1
jmp 0x463892
cmp ecx, 4
mov edx, 0xffffff4b
jbe 0x4638d7
cmp ecx, 9
mov edx, 0xfffffff6
ja 0x4638f5
cmp eax, edx
jl 0x4638f5
neg edx
cmp eax, edx
jg 0x4638f5
mov esi, eax
mov edx, dword [edi]
sub ecx, 1
je 0x463892
imul esi
sub ecx, 1
jne 0x4638ea
mov edx, dword [edi]
jmp 0x463892
cmp ecx, 0x40000000
jge 0x463906
push ecx
fild dword [esp]
add esp, 4
jmp 0x463914
cmp byte [ebx + ecx*4 - 1], 0x12
jne 0x46387d
fld qword [ebx + ecx*4]
cmp eax, 0x40000000
jge 0x463924
push eax
fild dword [esp]
add esp, 4
jmp 0x463932
cmp byte [ebx + eax*4 - 1], 0x12
jne 0x46387d
fld qword [ebx + eax*4]
fldz
fcomp st(1)
fnstsw ax
sahf
ja 0x4639ae
fxch st(1)
jne 0x463958
fldz
fcompp
fnstsw ax
sahf
jb fcn.00463511
pop edx
mov al, 0x66
sub edx, 1
jmp fcn.00463aee
fxch st(1)
fyl2x
fld st(0)
frndint
fsub st(1), st(0)
fxch st(1)
f2xm1
fld1
faddp st(1)
fscale
fxch st(1)
fstp st(0)
push 0xffefffff
push 0xffffffffffffffff
fld qword [esp]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x46387e
mov dword [esp + 4], 0x7fefffff
fld qword [esp]
add esp, 8
fcomp st(1)
fnstsw ax
test ah, 1
je fcn.00463511
pop edx
mov al, 0x23
sub edx, 1
jmp fcn.00463aee
fabs
fld st(1)
frndint
fcom st(2)
fnstsw ax
sahf
je 0x4639c7
pop edx
mov al, 0x36
sub edx, 1
jmp fcn.00463aee
sub esp, 4
fistp dword [esp]
pop eax
shr eax, 1
jae 0x46395a
fyl2x
fld st(0)
frndint
fsub st(1), st(0)
fxch st(1)
f2xm1
fld1
faddp st(1)
fscale
fchs
jmp 0x46396c
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x41b73a
push 0x14
push 0x458a98
call fcn.0041b750
push 1
call fcn.0041b31e
pop ecx
test al, al
je 0x41b724
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041b2ec
mov byte [ebp - 0x24], al
mov eax, dword [0x45fabc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41b724
test eax, eax
jne 0x41b648
mov dword [0x45fabc], ecx
push 0x44e384
push 0x44e36c
call fcn.0041fe31
pop ecx
pop ecx
test eax, eax
je 0x41b62b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41b714
push 0x44e368
push 0x44e314
call fcn.0041fdd5
pop ecx
pop ecx
mov dword [0x45fabc], 2
jmp 0x41b64d
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041b472
pop ecx
call fcn.0041bccb
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41b67e
push esi
call fcn.0041b3de
pop ecx
test al, al
je 0x41b67e
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x44e310]
call esi
call fcn.0041bcd1
mov esi, eax
cmp dword [esi], edi
je 0x41b69c
push esi
call fcn.0041b3de
pop ecx
test al, al
je 0x41b69c
push dword [esi]
call fcn.0041f294
pop ecx
call fcn.0041bae5
movzx esi, ax
call fcn.0041fd82
push esi
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041bb1e
test al, al
je 0x41b72b
test bl, bl
jne 0x41b6ca
call fcn.0041f26f
push edi
push 1
call fcn.0041b48f
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41b714
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0041b9ca
push esi
call fcn.0041f2cc
push dword [ebp - 0x20]
call fcn.0041f27e
int3
call fcn.0041bc18
jmp 0x41b5be

Function at 0x405595
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b1ad
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x45e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.004054a3
lea ecx, [esi + 0x78]
call fcn.004054a3
push dword [esi + 0x30]
call fcn.0041aea5
push dword [esi + 0x24]
call fcn.0041aea5
push dword [esi + 0x18]
call fcn.0041aea5
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4055f9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40560d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x405621
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi]
test ecx, ecx
je 0x405634
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x405d25
Capabilities:
Hide graphical window

Disassembly:
push dword [esp + 4]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
setne al
ret 4
Function at 0x406962
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x45e008]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
push 0x208
xor ebp, ebp
lea eax, [esp + 0x18]
push ebp
push eax
mov edi, edx
mov ebx, ecx
call fcn.0041c8f0
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocStringLen
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4069f4
mov edx, edi
mov ecx, esi
call fcn.0044a471
push dword [edi]
mov dword [esp + 0x14], ebp
call fcn.0041afdb
pop ecx
push ebp
lea ecx, [esp + 0x14]
mov dword [ebx], eax
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041ae97
add esp, 0x210
ret
Function at 0x428dbc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
shr edi, 2
xor ebp, ebp
mov eax, edi
xor ebx, ebx
shr eax, 1
inc ebp
add eax, 3
mov ecx, ebx
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x428ded
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x428de0
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [esp + 0x14], eax
test ebx, ebx
jne 0x428e56
movzx eax, dl
mov ebx, edi
push 0x1b
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + str.cw]
xor edx, ebp
add ebp, ebp
or edx, ecx
test ebp, 0x100
pop eax
cmovne ebp, eax
jmp 0x428ea3
cmp ebx, 4
jne 0x428ea7
cmp edi, 6
jbe 0x428ea7
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + str.cw]
or edx, ecx
mov eax, dword [esp + 0x14]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x428dfd
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x429ce2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x429d11
call fcn.00429d87
push 7
pop edx
cmp eax, edx
jb 0x429d11
lea ecx, [ebp - 0x10]
call fcn.00429d6f
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
leave
ret
xor eax, eax
leave
ret

Function at 0x429d21
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x429d42
lea ecx, [ebp - 0x10]
call fcn.00429d52
test eax, eax
je 0x429d42
mov eax, dword [ebp - 8]
leave
ret
xor eax, eax
leave
ret
Function at 0x429e1d
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x45e008]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x429e66
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429e66
push 0xc00
call eax
test eax, eax
jne 0x429f02
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x429f02
cmp eax, 0x104
ja 0x429f02
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x429e9d
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
mov cl, byte [str.userenv]
push esi
mov esi, str.userenv
test cl, cl
je 0x429f01
push ebx
push edi
lea edi, [ebp - 0x2d4]
push 0x6c
lea edi, [edi + eax*2]
pop ebx
mov edx, edi
inc esi
movzx eax, cl
mov cl, byte [esi]
inc esi
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x429ebe
push 0x2e
pop eax
push 0x64
mov word [edx], ax
pop eax
mov word [edx + 2], ax
xor eax, eax
push 8
push eax
mov word [edx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov word [edx + 4], bx
mov word [edx + 6], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov cl, byte [esi]
test cl, cl
jne 0x429ebb
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ae97
leave
ret