joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bae0
Capabilities:
Read file on windows
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e023
mov eax, dword fs:[0]
push eax
mov eax, 0x2048
call fcn.004f5240
mov eax, dword [0x5e108c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2038], eax
mov dword [ebp - 0x203c], ecx
mov dword [ebp - 4], 0
test eax, eax
je 0x42bbe9
cmp dword [ebp + 0xc], 0
jle 0x42bbe9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
nop dword [eax]
push ecx
lea eax, [ebp - 0x202c]
push eax
call fcn.0042bda0
cmp dword [ebp - 0x2018], 8
lea eax, [ebp - 0x202c]
push 0
cmovae eax, dword [ebp - 0x202c]
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42bc20
call edi
cmp eax, 0xe7
jne 0x42bbde
cmp dword [ebp - 0x2018], 8
lea eax, [ebp - 0x202c]
push 0x4e20
cmovae eax, dword [ebp - 0x202c]
push eax
call ebx
test eax, eax
je 0x42bbde
mov eax, dword [ebp - 0x2018]
cmp eax, 8
jb 0x42bb50
inc eax
lea ecx, [ebp - 0x202c]
push eax
push dword [ebp - 0x202c]
call fcn.0040ca40
jmp 0x42bb50
lea ecx, [ebp - 0x202c]
call fcn.0040ba40
xor esi, esi
mov ecx, dword [ebp + 0x28]
cmp ecx, 8
jb 0x42bc00
inc ecx
push ecx
push dword [ebp + 0x14]
lea ecx, [ebp + 0x14]
call fcn.0040ca40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret 0x24
lea ecx, [ebp - 0x202c]
call fcn.0040ba40
test esi, esi
je 0x42bbe9
push 0
push 0
lea eax, [ebp - 0x2030]
mov dword [ebp - 0x2030], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x42bc5e
push str.SetNamedPipeHandleState_failed._n
call fcn.0042c240
add esp, 4
jmp 0x42bbe9
push 0
lea eax, [ebp - 0x2034]
push eax
push 0x2000
lea eax, [ebp - 0x2014]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2038]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x42bcc5
call edi
cmp eax, 0xea
jne 0x42bbe9
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
nop word [eax + eax]
push 0
lea eax, [ebp - 0x2034]
push eax
push 0x2000
lea eax, [ebp - 0x2014]
push eax
push esi
call ebx
test eax, eax
jne 0x42bcc5
call edi
cmp eax, 0xea
je 0x42bca0
mov eax, dword [ebp - 0x2034]
lea ecx, [ebp - 0x2054]
shr eax, 1
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.0042c1e0
mov ecx, dword [ebp - 0x203c]
push eax
mov byte [ebp - 4], 1
call fcn.00422380
lea ecx, [ebp - 0x2054]
call fcn.0040ba40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x42bbeb
Function at 0x42bd10
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
imul edi, dword [ebp + 8], 0x4028
add edi, ecx
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push edi
push dword [edi + 0x14]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x42bd5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x42bd52
cmp eax, 0x3e5
jne 0x42bd5f
mov esi, 1
jmp 0x42bd61
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x42bd61
xor esi, esi
xor eax, eax
mov dword [edi + 0x4024], esi
test esi, esi
sete al
mov dword [edi + 0x4020], eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x42c340
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e138
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5e108c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], edx
mov esi, ecx
mov dword [ebp - 0x48], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov bl, byte [ebp + 0xc]
mov dword [ebp - 4], 0
test bl, bl
je 0x42c458
push str..MD5
lea ecx, [ebp - 0x64]
call fcn.004275a0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.0042c270
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00422690
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x42c3e1
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.0040c0a0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
cmp eax, 0x10
jb 0x42c40c
inc eax
lea ecx, [ebp - 0x64]
push eax
push dword [ebp - 0x64]
call fcn.0040c0a0
cmp dword [edi + 0x14], 0x10
jb 0x42c416
mov eax, dword [edi]
jmp 0x42c418
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42c458
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00430d40
test al, al
je 0x42c458
push 0xffffffffffffffff
mov dword [esi + 0x14], 0xf
mov ecx, esi
push 0
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.0040bea0
lea ecx, [ebp - 0x28]
call fcn.0040bb00
jmp 0x42c4bc
mov ecx, dword [ebp - 0x2c]
mov edx, edi
call fcn.0042fb20
test al, al
je 0x42c496
test bl, bl
jne 0x42c488
push 0xffffffffffffffff
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], bl
call fcn.0040bea0
jmp 0x42c4a7
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00430d40
test al, al
jne 0x42c431
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42c4bc
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040c0a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret
Function at 0x42ca60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5d0ab0
push 0x507fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5e108c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x4c], edx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x54004e
mov dword [ebp - 0x2c], 0x4c0044
mov dword [ebp - 0x28], 0x2e004c
mov dword [ebp - 0x24], 0x4c0044
mov dword [ebp - 0x20], 0x4c
movaps xmm0, xmmword [0x5c8e30]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x6d654d6c
mov dword [ebp - 0x34], 0x79726f
mov eax, dword [0x60c084]
test eax, eax
jne 0x42cafb
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x60c084], eax
mov dword [ebp - 4], 0
push 4
push esi
lea ecx, [ebp + 8]
push ecx
push 0
lea ecx, [ebp - 0x4c]
push ecx
push 0xffffffffffffffff
call eax
mov ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x42cb34
mov eax, dword [ebp - 0x4c]
xor edx, edx
test ecx, ecx
cmovne eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42fe50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push esi
push edi
mov edi, edx
cmp ebx, 0x3fffffff
jae 0x42ff75
lea esi, [ebx + 2]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax*4 + 1]
cmp edi, eax
jl 0x42ff75
mov edi, dword [ebp + 8]
mov esi, ecx
cmp ebx, 3
jle 0x42ff0d
lea ecx, [ebx - 4]
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
sub ebx, eax
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 4]
push dword [edi]
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, eax
add edi, 3
mov ecx, edx
shr ecx, 0x1a
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, edx
shr ecx, 0x14
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov eax, edx
shr eax, 0xe
and eax, 0x3f
shr edx, 8
and edx, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x42feb4
mov ebx, dword [ebp + 0xc]
xor edx, edx
test ebx, ebx
je 0x42ff4e
lea ecx, [ebx*8]
nop word [eax + eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
shl edx, 8
add edx, eax
sub ebx, 1
jne 0x42ff20
test ecx, ecx
jle 0x42ff4e
shl edx, 6
mov eax, edx
shr eax, cl
sub ecx, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
test ecx, ecx
jg 0x42ff37
mov ecx, dword [ebp - 8]
mov eax, esi
sub eax, ecx
test al, 3
je 0x42ff69
nop dword [eax]
mov byte [esi], 0x3d
inc eax
inc esi
test al, 3
jne 0x42ff60
pop edi
mov byte [esi], 0
mov eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430b60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e5c3
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x5e108c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0xb4], esi
push ecx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0xb8], 0
call fcn.00422880
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x430bbc
mov edi, dword [edi]
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.004304e0
add esp, 8
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x430bd5
mov eax, dword [eax]
push ecx
push 0x21
push eax
lea ecx, [ebp - 0x160]
call fcn.00425c80
test eax, eax
lea ecx, [ebp - 0x170]
mov eax, dword [ebp - 0x170]
push 0
mov eax, dword [eax + 4]
jne 0x430c0d
mov edx, dword [ecx + eax + 0xc]
add ecx, eax
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
jmp 0x430c19
add ecx, eax
xor edx, edx
mov eax, 4
cmp dword [ecx + 0x38], edx
cmovne eax, edx
push eax
call fcn.0040dbd0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x430c3b
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0040ca40
cmp dword [ebp - 0x114], 0
jne 0x430c68
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push 0x5b2cd5
mov byte [esi], 0
call fcn.0040bda0
jmp 0x430d0c
lea eax, [ebp - 0x170]
mov byte [ebp - 0x48], 0
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xb0], 0x67452301
mov dword [ebp - 0xac], 0xefcdab89
mov dword [ebp - 0xa8], 0x98badcfe
mov dword [ebp - 0xa4], 0x10325476
call fcn.00434d40
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00435750
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.00425330
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x430cfa
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040c0a0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea ecx, [ebp - 0x170]
call fcn.00410e30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret
Function at 0x431570
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e728
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5e108c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x3c], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
xor ecx, ecx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
test eax, eax
je 0x4316f9
mov edi, dword [ebp + 8]
test edi, edi
je 0x4316f9
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x431635
push eax
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x431635
mov dword [esi + 0x14], 7
xor eax, eax
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00424a90
lea ecx, [ebp - 0x28]
call fcn.0040ba40
jmp 0x43172c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x43160a
push 0
push edi
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x43160a
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x38]
push 0
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push 4
push dword [ebp - 0x2c]
mov dword [ebp - 0x38], 4
call edi
test eax, eax
je 0x4316c2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.00431170
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push 0
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 2
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x4316d7
lea ecx, [ebp - 0x28]
call fcn.004222c0
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004223d0
lea ecx, [ebp - 0x28]
call fcn.0040ba40
jmp 0x43172c
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, esi
call fcn.00431480
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0040ba40
jmp 0x43172c
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00424a90
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x43172c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040ca40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret
Function at 0x431e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e828
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5e108c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0xc]
push 0x1c
call fcn.004f4666
mov ecx, dword [ebp + 8]
mov edi, eax
mov eax, dword [ebp + 0x20]
add esp, 4
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x48], 0xf
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [edi + 4], esi
mov dword [edi + 0xc], 0x5b2cd5
mov dword [edi + 0x10], str.GlobalVariables.cpp
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp byte [esi], 0
jne 0x431ec2
xor ecx, ecx
jmp 0x431ed0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431ec7
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040bda0
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
push ecx
lea eax, [ebp - 0x64]
mov ecx, ebx
push eax
call fcn.00434580
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x431f13
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.0040c0a0
cmp byte [ebp - 0x60], 0
jne 0x431fcd
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
cmp byte [esi], 0
jne 0x431f38
xor ecx, ecx
jmp 0x431f49
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431f40
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.0040bda0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x2e
push str.more_than_one_flags_defined_with_the_same_name
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0040bda0
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00431cc0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x431f9f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040c0a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x431fc6
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0040c0a0
push 0
call fcn.0051656d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x434b40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov byte [ebp - 1], 0
push esi
push edi
mov ecx, 0x40
mov esi, 0x5b6a10
mov edi, ebx
mov dword [ebx + 0x200], 1
mov dword [ebx + 0x204], 1
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, edx
nop
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div dword [ebp + 8]
movzx eax, byte [edx + edi]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x434b80
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434bd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x200]
sub edx, eax
mov bh, byte [edi + 0x208]
add ecx, eax
sub esi, eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], esi
cmp eax, ecx
jae 0x434c35
sub edx, esi
mov dword [ebp + 0xc], edx
movzx esi, al
mov bl, byte [esi + edi]
add bh, bl
movzx edx, bh
movzx ecx, byte [edx + edi]
mov byte [esi + edi], cl
mov byte [edx + edi], bl
movzx ecx, byte [esi + edi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp + 0xc]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + edi]
xor cl, byte [esi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 4]
jb 0x434c00
mov byte [edi + 0x208], bh
mov dword [edi + 0x200], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
sub dword [ebp + 8], eax
add ecx, eax
mov bh, byte [edi + 0x209]
sub edx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ecx
cmp eax, ecx
jae 0x434cca
sub edx, dword [ebp + 8]
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx ecx, al
add esi, ecx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 8]
jb 0x434c90
mov edi, dword [ebp - 0xc]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434ce0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x434d21
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.00434dd0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x43bfb8
Capabilities:
Hide graphical window

Disassembly:
push 0x34
mov eax, 0x57ffbf
call int.004f4926
mov eax, ecx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push esi
mov dword [ebp - 0x40], 0x30
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x38], 0x43bfae
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call edi
push 0x7f00
push esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_RegisterClassExW]
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
push 0
cmovae esi, dword [ebp + 8]
push 0
call edi
push eax
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xcf0000
push 0x5b2cec
push esi
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
mov esi, dword [ebp - 0x10]
push 0xfffffffffffffff8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test ebx, ebx
jne 0x43c09e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43c09e
push 1
push edi
mov ecx, esi
call fcn.0053054d
lea ecx, [ebp + 8]
call fcn.0040ba40
call fcn.004f4900
ret 0x18