joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4253f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e36f
and dword [ebp - 4], 0
cmp dword [0x4506b0], 0
mov ebx, eax
jne 0x4254a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425557
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425557
push eax
call fcn.0041e2fd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4506b0], eax
call esi
push eax
call fcn.0041e2fd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4506b4], eax
call esi
push eax
call fcn.0041e2fd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4506b8], eax
call esi
push eax
call fcn.0041e2fd
pop ecx
mov dword [0x4506c0], eax
test eax, eax
je 0x4254a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e2fd
pop ecx
mov dword [0x4506bc], eax
mov eax, dword [0x4506bc]
cmp eax, ebx
je 0x4254fe
cmp dword [0x4506c0], ebx
je 0x4254fe
push eax
call fcn.0041e378
push dword [0x4506c0]
mov esi, eax
call fcn.0041e378
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4254fe
test edi, edi
je 0x4254fe
call esi
test eax, eax
je 0x4254f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4254f5
test byte [ebp - 0xc], 1
jne 0x4254fe
or dword [ebp + 0x10], 0x200000
jmp 0x425537
mov eax, dword [0x4506b4]
cmp eax, ebx
je 0x425537
push eax
call fcn.0041e378
pop ecx
test eax, eax
je 0x425537
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425537
mov eax, dword [0x4506b8]
cmp eax, ebx
je 0x425537
push eax
call fcn.0041e378
pop ecx
test eax, eax
je 0x425537
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4506b0]
call fcn.0041e378
pop ecx
test eax, eax
je 0x425557
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425559
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1065c2f0
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
cmp byte [esp + 8], 1
jne 0x1065ced2
pushal
mov esi, section.UPX1
lea edi, [esi - 0x41e000]
push edi
mov ebp, esp
lea ebx, [esp - 0x3e80]
xor eax, eax
push eax
cmp esp, ebx
jne 0x1065c313
inc esi
inc esi
push ebx
push 0x65a3e9
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408e84
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3dae3c3e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x40d25d81
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x406aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x398
push 0x44f4b0
push 0x43e2a8
call fcn.00409680
add esp, 0xc
test eax, eax
jne 0x406ac0
call fcn.00406710
call fcn.004068f0
jmp 0x40ba10
sub esp, 0x4c
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push 1
push 0
push 0x43f1bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40baf5
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea ecx, [esp + 8]
push edi
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0x43f1b4
push ecx
mov dword [esp + 0x24], 0x20
call ebx
test eax, eax
jne 0x40ba96
mov eax, dword [esp + 0xc]
cmp eax, 7
jbe 0x40ba96
mov ecx, eax
lea esi, [esp + 0x18]
mov edx, ecx
mov edi, 0x44d190
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
mov dword [0x44d200], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0x43f1ac
push eax
mov dword [esp + 0x24], 0x20
call ebx
test eax, eax
jne 0x40bae7
mov eax, dword [esp + 0xc]
cmp eax, 0x10
jbe 0x40bae7
mov ecx, eax
lea esi, [esp + 0x18]
mov edx, ecx
mov edi, 0x44d1d0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
mov dword [0x44d204], eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x409360
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x409388
lea ecx, [esp + 4]
push 0
push ecx
push 2
push 0x43ec38
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ecx
ret

Function at 0x4093c0
Capabilities:
Clear file content
Write file on windows

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.00409260
mov ecx, dword [esi]
add esp, 8
test ecx, ecx
je 0x4093fb
lea edx, [esp + 0x18]
push 0
push edx
push eax
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
add esp, 0x10
ret 4

Function at 0x409680
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4096a8
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
jne 0x4096d0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
pop edi
sete al
pop esi
ret

Function at 0x4096f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80000002
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40971b
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x409743
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
pop edi
sete al
pop esi
ret
Function at 0x409810
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
je 0x409824
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
mov ebx, dword [esp + 0x10]
push edi
push edi
push 3
cmp ebx, edi
push edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
push edi
je 0x40988c
mov eax, dword [esi]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x40985c
mov dword [esi + 4], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
push edi
push edi
push edi
push 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 0xc], eax
jne 0x409885
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
push edi
push edi
push edi
push 2
jmp 0x4098db
mov edx, dword [esi]
push DirectSoundCreate
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x4098ad
mov dword [esi + 4], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 0xc], eax
jne 0x4098d6
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esi + 4]
push edi
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
mov dword [esi + 8], ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret 4

Function at 0x409c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x43ec68
mov dword [0x450664], 0
call fcn.00409760
add esp, 4
mov ecx, eax
mov dword [0x450358], eax
push 0
call fcn.00409810
test eax, eax
je 0x409d0e
mov eax, dword [0x450358]
mov ecx, dword [0x44fb48]
push ebp
push esi
push edi
mov edi, dword [eax + 0x10]
push 0x43ec64
push 0x43ec58
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [0x44fb48]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [0x450660], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor edx, edx
mov dword [0x450664], edx
cmp dword [eax], 0
je 0x409cff
lea ecx, [edx + edx*2]
shl ecx, 2
mov dword [ecx + 0x450364], edi
mov esi, dword [eax]
mov dword [ecx + 0x450360], esi
mov esi, dword [eax + 4]
mov dword [ecx + 0x450368], esi
mov ebp, dword [eax]
cmp ebp, 0x6c65766c
jne 0x409cd9
add esi, 0xfffff830
mov dword [ecx + 0x450368], esi
cmp dword [eax], 0x67616d65
jne 0x409ceb
add dword [ecx + 0x450368], 0xfffff830
mov ecx, dword [eax + 4]
add eax, 8
add edi, ecx
inc edx
cmp edx, 0x40
mov dword [0x450664], edx
jne 0x409ca1
mov eax, dword [0x450660]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebp
ret
Function at 0x409d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x44fb48]
push esi
push 0x43ec64
push 0x43ec78
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x44fb48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [0x450668], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor edx, edx
mov dword [0x45066c], edx
cmp dword [eax], 0
je 0x409dca
mov ecx, edx
lea esi, [eax + 0x10]
shl ecx, 4
mov dword [ecx + 0x44fb5c], esi
mov esi, dword [eax + 4]
mov dword [ecx + 0x44fb58], esi
mov esi, dword [eax + 8]
mov dword [ecx + 0x44fb60], esi
mov esi, dword [eax + 0xc]
mov dword [ecx + 0x44fb64], esi
mov ecx, dword [eax]
add eax, ecx
inc edx
cmp edx, 0x80
mov dword [0x45066c], edx
jne 0x409d89
pop esi
ret

Function at 0x40b2f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov esi, eax
rdtsc
mov dword [ebp - 8], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov ecx, eax
rdtsc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp eax, edx
mov dword [0x51b1ac], 0
jbe 0x40b341
cmp ecx, esi
jbe 0x40b341
sub eax, edx
sub ecx, esi
xor edx, edx
div ecx
mov dword [0x51b1ac], eax
mov eax, 0
cpuid
xor eax, eax
mov dword [0x51b18c], ebx
mov dword [0x51b190], edx
mov dword [0x51b194], ecx
mov dword [0x51b198], eax
mov eax, 1
cpuid
mov ebx, eax
mov ecx, eax
shr eax, 0xc
and eax, 3
mov dword [0x51b1a8], eax
shr ebx, 8
and ebx, 0xf
mov dword [0x51b184], ebx
shr ecx, 4
and ecx, 0xf
mov dword [0x51b1a4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b3a0
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x20]
mov dword [esp], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 8]
mov dword [0x51b19c], edx
mov edx, dword [esp + 0xc]
mov dword [0x51b1b0], eax
mov eax, dword [esp + 0x10]
mov dword [0x51b180], ecx
mov ecx, dword [esp + 0x14]
mov dword [0x51b1a0], edx
mov dword [0x51b188], eax
mov dword [0x51b1b4], ecx
add esp, 0x44
ret
Function at 0x40b800
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f18c
call fcn.00409310
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
call fcn.00409360
call fcn.0040b3a0
mov ecx, dword [0x44af04]
push 0x43f174
call fcn.00409310
mov eax, dword [0x51b180]
mov ecx, dword [0x44af04]
push eax
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f15c
call fcn.00409310
mov ecx, dword [0x51b1a0]
push ecx
mov ecx, dword [0x44af04]
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f148
call fcn.00409310
mov edx, dword [0x51b188]
mov ecx, dword [0x44af04]
push edx
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f134
call fcn.00409310
mov eax, dword [0x51b1b4]
mov ecx, dword [0x44af04]
push eax
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f11c
call fcn.00409310
mov ecx, dword [0x51b19c]
push ecx
mov ecx, dword [0x44af04]
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
call fcn.0040b2f0
mov ecx, dword [0x44af04]
push 0x43e6bc
call fcn.00409310
mov ecx, dword [0x44af04]
push 0x51b18c
call fcn.00409310
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f108
call fcn.00409310
mov edx, dword [0x51b1a8]
mov ecx, dword [0x44af04]
push edx
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f0f4
call fcn.00409310
mov eax, dword [0x51b184]
mov ecx, dword [0x44af04]
push eax
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f0e0
call fcn.00409310
mov ecx, dword [0x51b1a4]
push ecx
mov ecx, dword [0x44af04]
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
mov ecx, dword [0x44af04]
push 0x43f0cc
call fcn.00409310
mov edx, dword [0x51b1ac]
mov ecx, dword [0x44af04]
push edx
call fcn.004093c0
mov ecx, dword [0x44af04]
call fcn.00409360
call fcn.0040b400
mov ecx, dword [0x44af04]
jmp fcn.00409360

Function at 0x40bb00
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 2
push 0
push 0x43f1bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bb69
mov ecx, dword [0x44d200]
mov edx, dword [esp]
inc ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push 0x44d190
push 1
push eax
push 0x43f1b4
push edx
call esi
mov eax, dword [0x44d204]
mov ecx, dword [esp + 4]
inc eax
push eax
push 0x44d1d0
push 1
push 0
push 0x43f1ac
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x4170b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, dword [0x2548a50]
sub esp, 0x1c
push esi
xor esi, esi
cmp ecx, esi
je 0x41724d
mov eax, dword [0x43e0a0]
push ebx
cmp eax, esi
je 0x4170f1
mov eax, 0x200
xor edx, edx
div ecx
mov ebx, eax
cmp ebx, 0x50
jbe 0x4170e5
mov ebx, 0x50
jmp 0x417112
cmp ebx, 0xa
jae 0x417112
mov ebx, 0xa
jmp 0x417112
mov eax, 0x12c
xor edx, edx
div ecx
mov ebx, eax
cmp ebx, 0x28
jbe 0x417108
mov ebx, 0x28
jmp 0x417112
cmp ebx, 6
jae 0x417112
mov ebx, 6
cmp ecx, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
jbe 0x41722e
lea eax, [ebx + ebx*2]
mov esi, 0x257c462
shl eax, 3
push ebp
push edi
mov dword [esp + 0x28], eax
mov ebp, 0x254c274
mov dword [esp + 0x18], esi
xor edx, edx
mov dl, byte [esi - 2]
mov dword [esp + 0x1c], edx
xor edx, edx
fild dword [esp + 0x1c]
mov dl, byte [esi]
mov dword [esp + 0x1c], edx
fmul dword [0x43a454]
test ebx, ebx
fadd dword [0x43a40c]
fstp dword [esp + 0x20]
fild dword [esp + 0x1c]
fmul dword [0x43a454]
fadd dword [0x43a40c]
fstp dword [esp + 0x1c]
jbe 0x417214
mov edx, dword [esp + 0x10]
mov esi, ebp
add edx, ebx
mov edi, ebx
mov dword [esp + 0x10], edx
add ebp, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [esi - 4], eax
mov dword [esi], 0x3a83126f
mov dword [esi + 4], ecx
call fcn.0043092f
and eax, 0xff
sub eax, 0x80
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul dword [0x43a450]
fstp dword [esi + 8]
call fcn.0043092f
and eax, 0x7f
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul dword [0x43a44c]
fadd dword [0x43a448]
fstp dword [esi + 0xc]
call fcn.0043092f
and eax, 0xff
add esi, 0x18
sub eax, 0x80
dec edi
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul dword [0x43a450]
fstp dword [esi - 8]
jne 0x41718d
mov ecx, dword [0x2548a50]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add esi, 4
inc edx
mov dword [esp + 0x18], esi
cmp edx, ecx
mov dword [esp + 0x14], edx
jb 0x41713c
pop edi
pop ebp
mov edx, dword [esp + 8]
mov dword [0x257ddcc], 0x9c4
mov dword [0x257ddc8], edx
mov dword [0x2548a84], 0xdfdf8f
pop ebx
pop esi
add esp, 0x1c
ret
Function at 0x417260
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x1c
xor ecx, ecx
push ebx
push esi
mov esi, dword [0x2548a50]
cmp esi, ecx
je 0x417410
cmp dword [0x43e0a0], ecx
je 0x4172a0
mov eax, 0x200
xor edx, edx
div esi
mov ebx, eax
cmp ebx, 0x50
jbe 0x417294
mov ebx, 0x50
jmp 0x4172c1
cmp ebx, 0xa
jae 0x4172c1
mov ebx, 0xa
jmp 0x4172c1
mov eax, 0x12c
xor edx, edx
div esi
mov ebx, eax
cmp ebx, 0x28
jbe 0x4172b7
mov ebx, 0x28
jmp 0x4172c1
cmp ebx, 6
jae 0x4172c1
mov ebx, 6
cmp esi, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
jbe 0x417410
lea ecx, [ebx + ebx*2]
push ebp
shl ecx, 3
push edi
mov dword [esp + 0x24], ecx
mov eax, 0x254c274
mov ebp, 0x257c460
mov dl, byte [ebp + 3]
test dl, dl
je 0x4173cf
xor edx, edx
mov dl, byte [ebp]
mov dword [esp + 0x18], edx
xor edx, edx
fild dword [esp + 0x18]
mov dl, byte [ebp + 2]
mov dword [esp + 0x18], edx
fmul dword [0x43a454]
test ebx, ebx
fadd dword [0x43a40c]
fstp dword [esp + 0x1c]
fild dword [esp + 0x18]
fmul dword [0x43a454]
fadd dword [0x43a40c]
fstp dword [esp + 0x18]
jbe 0x4173cf
mov edx, dword [esp + 0x10]
mov esi, eax
add edx, ebx
add eax, ecx
mov edi, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esi - 4], eax
mov dword [esi], 0x3a83126f
mov dword [esi + 4], ecx
call fcn.0043092f
and eax, 0xff
sub eax, 0x80
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fmul dword [0x43a450]
fstp dword [esi + 8]
call fcn.0043092f
and eax, 0x7f
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fmul dword [0x43a44c]
fadd dword [0x43a448]
fstp dword [esi + 0xc]
call fcn.0043092f
and eax, 0xff
add esi, 0x18
sub eax, 0x80
dec edi
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fmul dword [0x43a450]
fstp dword [esi - 8]
jne 0x417348
mov esi, dword [0x2548a50]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
add ebp, 4
inc edx
cmp edx, esi
mov dword [esp + 0x14], edx
jb 0x4172e7
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebp
jbe 0x417410
push 5
mov dword [0x257ddc8], eax
mov dword [0x257ddcc], 0x9c4
call fcn.0040aea0
add esp, 4
mov dword [0x2548a84], 0xdfdf8f
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4236d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x200
push esi
call fcn.00422e50
mov eax, dword [0x25b60f4]
mov ecx, dword [0x25b43dc]
mov dword [esp + 4], eax
mov dword [esp + 0x14], ecx
xor esi, esi
mov eax, 3
mov edx, 0x20
mov ecx, 4
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x74656d70
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x9c
mov dword [esp + 0x38], 5
mov dword [esp + 0x34], 0x666e7433
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], 0x62616c6c
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], 0x786f6e69
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], 0x73706565
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], 0x6d6f6e79
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x84], 0x61616161
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], 0xc0
mov dword [esp + 0x98], eax
mov dword [esp + 0x94], 0x72727272
mov dword [esp + 0x9c], 0x40
mov dword [esp + 0xa0], 0xc0
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xa4], 0x6d313031
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xb4], 0x6d313032
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], 0x30
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xc4], 0x6d313033
mov dword [esp + 0xcc], esi
mov dword [esp + 0xd0], 0x60
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xd4], 0x6d313034
mov dword [esp + 0xdc], esi
mov dword [esp + 0xe0], 0x90
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xe4], 0x6d313036
mov dword [esp + 0xec], esi
mov dword [esp + 0xf0], 0xc0
mov dword [esp + 0xf8], 7
mov dword [esp + 0xf4], 0x6e726567
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], esi
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], 0x767a7276
mov dword [esp + 0x10c], 0xf0
mov dword [esp + 0x110], edx
mov dword [esp + 0x118], 6
mov dword [esp + 0x114], 0x31313131
mov dword [esp + 0x11c], esi
mov dword [esp + 0x120], esi
mov dword [esp + 0x124], esi
lea edx, [esp + 4]
push edx
call fcn.004058f0
add esp, 4
call fcn.004058a0
test eax, eax
jne 0x42392b
push esi
call dword [sym.imp.USER32.dll_MessageBeep]
pop esi
add esp, 0x200
ret