joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e30
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], 0
push ebx
mov ebx, ecx
push edi
cmp eax, 1
jne 0x408e52
mov edi, dword [ebx + 4]
mov byte [esp + 0xb], 0
jmp 0x408e63
cmp eax, 2
jne 0x40903d
mov edi, dword [ebx + 8]
mov byte [esp + 0xb], 1
mov dword [esp + 0x10], edi
test edi, edi
jne 0x408e75
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
push 2
push 0xc
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x408e9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x18], eax
mov eax, 0x1d
pop edi
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x18]
push ebp
xor ebp, ebp
mov dword [esp + 0x10], eax
push esi
test eax, eax
je 0x408f28
nop
lea eax, [esp + 0x1c]
push eax
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x409025
mov ecx, dword [esp + 0x1c]
test byte [ecx + 1], 0x10
jne 0x408f1f
mov eax, dword [ebx + 0x28]
mov esi, dword [eax + 0xc]
test esi, esi
je 0x408f1f
lea esp, [esp]
mov edi, esi
test esi, esi
je 0x40904a
cmp byte [esp + 0x13], 0
mov esi, dword [esi]
mov edi, dword [edi + 8]
je 0x408efc
cmp byte [edi + 0x15], 0
jmp 0x408f00
cmp byte [edi + 0x14], 0
je 0x408f17
push dword [edi + 0xc]
lea eax, [ecx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x408f34
mov ecx, dword [esp + 0x1c]
test esi, esi
jne 0x408ee0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, eax
jb 0x408eb0
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [edi + 0x10]
test eax, 0x200
je 0x408f5e
mov edi, dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x40900d
mov eax, dword [esp + 0x14]
dec eax
dec ebp
mov dword [esp + 0x14], eax
jmp 0x408f23
test eax, 0x100
je 0x408f95
mov eax, dword [edi + 0x18]
mov ecx, ebx
push dword [eax + 0xc]
push ebp
push dword [esp + 0x20]
call fcn.00409050
mov esi, eax
test esi, esi
jne 0x408fbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
mov dword [ebx + 0x18], eax
mov eax, 0x1f
pop edi
pop ebx
add esp, 0x1c
ret 4
test eax, 0x400
je 0x408f1b
mov eax, dword [edi + 0x18]
mov ecx, ebx
push dword [eax + 0xc]
push ebp
push dword [esp + 0x20]
call fcn.00409260
mov esi, eax
test esi, esi
je 0x408f7d
inc dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp eax, 1
jne 0x408fde
mov ecx, ebx
call fcn.0040b910
mov edi, esi
mov dword [ebx + 4], esi
mov dword [esp + 0x18], edi
mov byte [ebx + 0x2d], 1
jmp 0x408f1f
cmp eax, 2
jne 0x408fee
mov ecx, ebx
call fcn.0040b940
mov eax, dword [esp + 0x30]
mov edi, esi
cmp eax, 2
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], edi
jne 0x408f23
mov dword [ebx + 8], esi
mov byte [ebx + 0x2e], 1
jmp 0x408f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
mov dword [ebx + 0x18], eax
mov eax, 0x1e
pop edi
pop ebx
add esp, 0x1c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
mov dword [ebx + 0x18], eax
mov eax, 0x1d
pop edi
pop ebx
add esp, 0x1c
ret 4
pop edi
mov eax, 3
pop ebx
add esp, 0x1c
ret 4
call fcn.00415b4d
int3
Function at 0x40a0f0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x14
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
test edi, edi
je 0x40a128
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x40a128
push 2
push 0xc
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x40a133
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x14
ret 0xc
push ebx
xor ebx, ebx
cmp dword [esp + 0x18], ebx
jbe 0x40a1f4
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x40a1e6
mov eax, dword [esp + 0x10]
add eax, 8
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40a1e6
mov eax, dword [esp + 0x10]
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x40a1e6
mov edx, dword [esi + 0x34]
mov ecx, dword [edi + 4]
call fcn.0040c800
mov ecx, dword [esp + 0x10]
mov esi, eax
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
mov edx, dword [edx + 0x34]
call fcn.0040c800
cmp esi, eax
jne 0x40a1e2
cmp byte [esp + 0x2c], 0
mov eax, dword [esp + 0x10]
je 0x40a1dc
mov cl, byte [eax + 1]
test cl, 3
je 0x40a1e2
mov dl, byte [edi + 1]
test cl, 4
je 0x40a1bb
test dl, 0xf
jmp 0x40a1c1
mov al, dl
xor al, cl
test al, 0xb
je 0x40a1d0
and cl, 0xa
cmp cl, 0xa
jne 0x40a1e2
test dl, 0xf
jne 0x40a1e2
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x14
ret 0xc
test byte [eax + 1], 1
jne 0x40a1d0
mov esi, dword [esp + 0x14]
inc ebx
movzx eax, bx
cmp eax, dword [esp + 0x18]
jb 0x40a142
pop ebx
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x14
ret 0xc
Function at 0x40a200
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp], 0
push ebp
mov ebp, ecx
mov dword [esp + 8], ebp
push edi
test eax, eax
je 0x40a3c1
mov edi, dword [esp + 0x40]
test edi, edi
je 0x40a3c1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
lea ecx, [esp + 0x1c]
push 2
push 0xc
push ecx
push eax
call esi
test eax, eax
je 0x40a259
push 2
push 0xc
lea eax, [esp + 0x30]
push eax
push edi
call esi
test eax, eax
jne 0x40a264
pop esi
pop edi
xor al, al
pop ebp
add esp, 0x28
ret 0x10
cmp dword [esp + 0x28], 0
push ebx
mov dword [esp + 0x1c], 0
jbe 0x40a382
mov bl, byte [esp + 0x40]
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_GetAce]
lea ecx, [esp + 0x10]
push ecx
push eax
push edi
call esi
test eax, eax
je 0x40a36c
mov eax, dword [esp + 0x10]
test bl, bl
je 0x40a2a3
test byte [eax + 1], 3
jmp 0x40a2a7
test byte [eax + 1], 1
je 0x40a36c
push dword [ebp + 0xd8]
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40a2cb
test bl, bl
jne 0x40a2cb
mov ebp, dword [esp + 0x44]
jmp 0x40a2d2
mov ebp, dword [esp + 0x10]
add ebp, 8
xor edi, edi
cmp dword [esp + 0x20], edi
jbe 0x40a3b5
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esp + 0x44]
call esi
test eax, eax
je 0x40a3a7
mov eax, dword [esp + 0x18]
push ebp
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40a3a7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40a3a7
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
mov edx, dword [edx + 0x34]
call fcn.0040c800
mov ecx, dword [esp + 0x10]
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
mov edx, dword [eax + 0x34]
call fcn.0040c800
cmp esi, eax
mov esi, dword [sym.imp.ADVAPI32.dll_GetAce]
jne 0x40a3a7
test bl, bl
je 0x40a364
mov eax, dword [esp + 0x10]
mov al, byte [eax + 1]
test al, 4
je 0x40a38e
mov eax, dword [esp + 0x18]
test byte [eax + 1], 0xf
jne 0x40a3a7
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
movzx eax, ax
cmp eax, dword [esp + 0x2c]
jb 0x40a284
pop ebx
pop esi
pop edi
xor al, al
pop ebp
add esp, 0x28
ret 0x10
mov ecx, dword [esp + 0x18]
mov dl, byte [ecx + 1]
mov cl, dl
xor cl, al
test cl, 3
jne 0x40a3a7
test dl, 8
je 0x40a364
test al, 8
jne 0x40a364
inc edi
movzx eax, di
cmp eax, dword [esp + 0x20]
jb 0x40a2e0
pop ebx
pop esi
pop edi
mov al, 1
pop ebp
add esp, 0x28
ret 0x10
pop edi
xor al, al
pop ebp
add esp, 0x28
ret 0x10
Function at 0x40a5f0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
jne 0x40a62b
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
push ebx
lea ebx, [edi + 0xc]
test eax, eax
je 0x40a643
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebx], 0
cmp byte [edi + 8], 0
je 0x40a680
push ebx
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x40a66e
mov dword [ebx], eax
mov eax, 6
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004158c3
mov ecx, eax
test ecx, ecx
jne 0x40a695
push 0x80004005
call fcn.0040f120
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [0x48744c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [eax - 0xc], ecx
cmove eax, ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [edi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [0x48744c]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [edi - 0xc], eax
cmove edi, eax
test edx, edx
jns 0x40a70a
push 0x80070057
call fcn.0040f120
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x40a727
push edx
lea ecx, [ebp - 0x1c]
call fcn.0040ed40
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [eax + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x40a754
mov ecx, edi
call fcn.0040c340
mov dword [ebx], eax
push dword [esi - 8]
push esi
call fcn.00430e92
add esp, 8
test eax, eax
js 0x40a700
cmp eax, dword [esi - 8]
jg 0x40a700
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x40a77d
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov dword [ebp - 4], 0xffffffff
cmp dword [ebx], edi
mov eax, 6
cmove edi, eax
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a7a8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b6c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f81b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi], vtable.CSD.0
call fcn.004158c3
mov ecx, eax
test ecx, ecx
jne 0x40b6fb
push 0x80004005
call fcn.0040f120
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x1c]
push 0
mov dword [ebp - 4], 0
push 0x472d50
mov dword [esi + 0x28], eax
call fcn.0040ee90
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x30], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40cbe0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push 0
push 0
push str.computername
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x40cc0b
mov ecx, esi
call fcn.0040ec20
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4
js 0x40cc71
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x40cc28
push edi
mov ecx, esi
call fcn.0040ed40
push edi
push dword [esi]
push str.computername
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
test eax, eax
jne 0x40cc40
xor ecx, ecx
jmp 0x40cc52
push dword [eax - 8]
push eax
call fcn.00430e92
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x40cc71
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x40cc71
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov ebx, 1
pop edi
pop esi
mov word [eax + ecx*2], dx
mov eax, ebx
pop ebx
ret 4
push 0x80070057
call fcn.0040f120
int3

Function at 0x40e800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40e813
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40e856
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40e852
jmp 0x40e840
cmp esi, edx
jae 0x40e856
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40e840
cmp esi, edx
jb 0x40e85a
xor eax, eax
pop esi
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
ret
Function at 0x414500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46029a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.0042623a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x4145ad
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
mov dword [ebp - 0x18], str.bad_locale_name
mov byte [ebp - 0x14], 1
call fcn.00429710
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x47eae4
push eax
call fcn.0042a3f6
push eax
push esi
call fcn.004260ee
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x43be95
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043bb58

Function at 0x43bea0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043bcd9

Function at 0x43e15a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043dac8

Function at 0x43e165
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043dd03

Function at 0x448caf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x45a4eb
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x45a4b4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x45a4d2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x45a530
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x45a517
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x45a520
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x45a52a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x45a50c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x45a496
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x45a57d
dec eax
je 0x45a574
sub eax, 3
je 0x45a56b
mov dword [ebp - 4], 0x40
jmp 0x45a59a
mov dword [ebp - 4], 4
jmp 0x45a580
mov dword [ebp - 4], 0x20
jmp 0x45a580
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x45a5cc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x45a54c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00459ddd
sahf
cmp esi, ebx
sub bh, bh
jne 0x45a5d7
push 1
push esi
call edi
mov eax, esi
jmp 0x45a5d8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
push ebp
clc
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45a635
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edx
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]

Function at 0x45a6c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
invalid
invalid
dec esi
Function at 0x5b9e60
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
mov eax, dword [0x7c9028]
mov edx, dword [0x7c902c]
mov dword [esp + 4], 0
lea ecx, [eax + eax]
mov eax, dword [0xbc3048]
or ecx, edx
mov dword [esp], ecx
fild qword [esp]
test eax, eax
fadd qword [0x7c9040]
fstp qword [0x7c9040]
jne 0x5b9f14
push esi
push 0
call sub.comdlg32.dll_ChooseColorA
push str.Crypt32.dll
mov dword [0x7c9e0c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CertCloseStore
push eax
mov dword [0xbc3048], eax
call esi
mov edx, dword [0xbc3048]
push str.CertEnumCertificatesInStore
push edx
mov dword [0xbc3044], eax
call esi
mov dword [0xbc3034], eax
mov eax, dword [0xbc3048]
push str.CertFreeCertificateContext
push eax
call esi
mov ecx, dword [0xbc3048]
push str.PFXImportCertStore
push ecx
mov dword [0xbc302c], eax
call esi
mov edx, dword [0xbc3048]
push str.CryptAcquireCertificatePrivateKey
push edx
mov dword [0xbc3040], eax
call esi
mov dword [0xbc3030], eax
pop esi
add esp, 8
ret

Function at 0x5f82e7
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x598f7db
cmp dh, byte [esi]
add eax, 0x4b0bffdc
or al, 0xf9
xor eax, 0x7e1714d9
cmp ch, byte [edi]
push 0xffffffffffffffc4
lds ecx, [edx - 0x65]
push esp
pop ecx
loop 0x5f82ee
push edi
test byte [esi - 0x75], 0x13
or dword [edx], esp
sub eax, 0x163c3655
cli
push ebp
les edx, es:[edi - 0x80]
mov ecx, 0x83736e35
cmp dh, byte [esi]
sbb eax, 0x32b2f572
and eax, 0xb6b889da
invalid
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40892a
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add ebx, 0x94cd33f8
call fcn.0040895d
xor dword [ecx], edi
push 0x78f2d568
pop ebx
push ebx
pop esi
inc ecx
cmp ecx, eax
jne fcn.0040892a
and esi, esi
mov ebx, 0x35712c07
ret