joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f820
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x799274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], eax
call fcn.0040a820
cmp byte [edi], 0
mov dword [ebp - 4], 0
je 0x42f8c8
push dword [edi + 0xc]
lea eax, [ebp - 0x1b0]
push dword [edi + 8]
push eax
call fcn.0042f660
push eax
push 0xdb0
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 1
push eax
call fcn.0042f5f0
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.0040a910
push dword [ebp - 0x1e0]
call fcn.00448b76
push dword [ebp - 0x1b0]
mov byte [ebp - 4], 0
call fcn.00448b76
add esp, 8
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.0040b6e0
mov esi, eax
lea eax, [ebp - 0x1c8]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.0041c580
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x1bc]
add eax, 2
mov byte [ebp - 4], 3
lea eax, [eax + esi*2]
push eax
call fcn.0040a7c0
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0042f790
lea eax, [ebp - 0x1bc]
mov ecx, ebx
push eax
call fcn.0042f790
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040a6a0
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.0040ad40
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040ab70
lea ecx, [ebp - 0x19c]
call fcn.0040ad40
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040ab70
lea ecx, [ebp - 0x19c]
call fcn.0040ad40
cmp byte [edi + 1], 0
je 0x42f9e8
push 0x3f4
lea eax, [ebp - 0x1b0]
push eax
call fcn.00410f60
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.0040ab70
push dword [ebp - 0x1b0]
mov byte [ebp - 4], 5
call fcn.00448b76
add esp, 4
lea ecx, [ebp - 0x19c]
push 0x45a7ac
call fcn.0040abb0
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00410e70
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040abb0
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
push dword [ebp - 0x19c]
push eax
call fcn.00411a80
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040cfa0
push 0x110
push 0x160
lea ecx, [ebp - 0x190]
push ecx
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1b0]
mov esi, eax
call fcn.00448b76
add esp, 4
test esi, esi
je 0x42fa65
push dword [ebp - 0x1a4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.00448b76
push dword [ebp - 0x1bc]
call fcn.00448b76
push dword [ebp - 0x1c8]
call fcn.00448b76
push dword [ebp - 0x1d4]
call fcn.00448b76
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044896e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42fe10
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457fa4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x799274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x38]
mov dword [edi], 0x10000
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0xffffffff
call fcn.0040a820
lea ecx, [edi + 0x44]
mov dword [ebp - 4], 0
call fcn.0040a820
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 1
call fcn.0040a820
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
lea esi, [edi + 0x68]
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0040a820
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 4
call fcn.0040a820
add esi, 0x18
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0040a820
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 6
call fcn.0040a820
lea eax, [edi + 0x98]
push eax
call fcn.00409c00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431460
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov eax, dword [edx]
cmp eax, dword [edi + 0xb4]
jne 0x431490
cmp dword [edx + 8], 0xffffff65
jne 0x431490
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x4314ba
sub eax, 0x14
je 0x431498
sub eax, 2
je 0x4314ba
pop edi
xor al, al
pop esi
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x431490
lea ecx, [edi + 0xb4]
call fcn.00431c70
pop edi
mov al, 1
pop esi
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x431490
mov ecx, edi
call fcn.004304e0
pop edi
mov al, 1
pop esi
pop ebp
ret 8

Function at 0x433240
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x799274]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x79cd98], 0
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
jne 0x4332c0
push esi
push edx
lea eax, [ebp - 0x2c4]
push eax
call fcn.0040bbd0
push 0x4010
push 0x160
mov ecx, dword [eax]
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x80
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x2c4]
mov esi, eax
call fcn.00448b76
mov ecx, dword [ebp - 0x160]
add esp, 4
mov eax, esi
mov dword [edi], ecx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044896e
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x79cd90]
test eax, eax
je 0x4332e7
push 0x4010
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x2b4]
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0044896e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433300
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x799274]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov edx, 0x4011
test al, al
mov ecx, 0x4110
lea eax, [ebp - 0x164]
cmovne ecx, edx
push ecx
push 0x160
push eax
push 0x90
push 0x4596a4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044896e
mov esp, ebp
pop ebp
ret 4
Function at 0x4335c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455708
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x799274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xd66
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
lea ecx, [ebp - 0x18]
sete al
mov byte [esi + 0x30], al
call fcn.0040a820
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 8]
call fcn.00411960
lea ecx, [ebp - 0x18]
call fcn.0040bb30
lea ecx, [ebp - 0x18]
call fcn.0040bae0
lea eax, [ebp - 0x18]
push eax
call fcn.004106b0
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0xc]
call fcn.0040a910
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
push dword [ebp - 0x18]
call fcn.00448b76
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x433670
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458363
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x799274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], vtable.CExtractDialog.0
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [esi + 8], 0
call fcn.0040a820
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040a820
mov word [esi + 0x24], 0
mov eax, esi
mov word [esi + 0x30], 0
mov byte [esi + 0x30], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433e30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458430
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x799274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp + 0xc], edx
cmp eax, dword [ebx + 4]
jne 0x433ea3
mov esi, dword [ebx + 4]
jmp 0x433ea9
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x433ebd
movzx ecx, word [edi]
mov esi, dword [esi + 4]
cmp cx, word [esi + 8]
je 0x433f04
cmp esi, eax
jne 0x433eb0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x433eed
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x433f3f
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x433f61
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.00449187
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x433f47
mov dword [ecx], edi
jmp 0x433f61
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x433f61
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004397c0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43a030
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
mov esi, dword [edi + 0xc]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ecx + 1]
mov ecx, dword [edi + 0x18]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx + ecx]
mov ecx, dword [edi + 4]
lea edi, [esi + edx*4]
mov ebx, dword [esi + edx*4]
mov esi, dword [ebp + 0xc]
nop
cmp ebx, ecx
jne 0x43a078
mov edx, ecx
jmp 0x43a07d
mov edx, dword [edi + 4]
mov edx, dword [edx]
cmp eax, edx
je 0x43a0c9
mov dx, word [eax + 8]
cmp dx, word [esi]
je 0x43a08e
mov eax, dword [eax]
jmp 0x43a070
movzx esi, word [esi]
mov edx, eax
mov dword [ebp + 0xc], esi
cmp ebx, ecx
jne 0x43a09e
mov esi, ecx
jmp 0x43a0a3
mov esi, dword [edi + 4]
mov esi, dword [esi]
cmp eax, esi
je 0x43a0b4
mov esi, dword [ebp + 0xc]
cmp si, word [eax + 8]
jne 0x43a0b4
mov eax, dword [eax]
jmp 0x43a096
cmp edx, eax
je 0x43a0c9
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov dword [eax + 4], ecx
pop ebp
ret 8

Function at 0x43a0e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x43a139
cmp dword [ecx], edi
jne 0x43a131
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x43a141
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x43a141
cmp dword [ecx], edi
jne 0x43a144
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push 1
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
push edi
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.00439a00
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x401140
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x803548
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x401269
cmp dword fs:[0xc0], eax
je 0x40116b
mov dword [0x803544], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x80342c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x803430], eax
movzx edx, word [esi + 0xac]
mov dword [0x803434], edx
mov eax, dword [esi + 0xb0]
mov dword [0x803438], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4011cb
push 0x7f
push eax
push 0x80343c
call fcn.00401c70
mov edx, dword [0x803434]
add esp, 0xc
jmp 0x4011d3
xor eax, eax
mov word [0x80343c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x80353c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x80353e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x803540], ax
mov ecx, eax
mov byte [0x803542], 0
cmp byte [0x7ffe0268], 0
je 0x40121a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x803542], bl
cmp ebx, 1
pop ebx
jne 0x401234
and ecx, 0xffef
mov word [0x803540], cx
test edx, edx
jne 0x401269
call fcn.00401140
cmp dword [0x80342c], 6
ja 0x401269
jb 0x401251
cmp dword [0x803430], 4
jae 0x401269
call fcn.00401140
cmp dword [0x80342c], 0xa
jae 0x401269
mov dword [0x803434], 1
ret
Function at 0x4015f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40163b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40162b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x401611
jmp 0x401630
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40168b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401650
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401650
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40166c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401c70
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4016ad
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401720
mov esi, dword [ebx]
cmp esi, ebx
je 0x401720
test esi, esi
je 0x401720
cmp word [esi + 0x24], 2
jbe 0x40171a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40171a
cmp dword [esi + 0x18], 0
je 0x40171a
test ebp, ebp
je 0x4016d5
cmp ebp, eax
jne 0x40171a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401c70
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4016fa
cmp eax, dword [esi + 0x18]
jne 0x40171a
cmp dword [esp + 0x10], 0
je 0x40172d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403b50
add esp, 8
test eax, eax
je 0x40172d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4016b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x401740
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x803408]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4018ed
cmp dword [0x80340c], 0
jne 0x4018d9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00404400
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401790
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4017a0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x4017d5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00404400
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401834
sub edx, esi
sar edx, 1
je 0x4018ed
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401850
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4018ed
xor eax, eax
push ebx
test edx, edx
je 0x401888
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401888
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401871
xor eax, eax
test edx, edx
je 0x4018a2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4018a2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401890
xor eax, eax
test edx, edx
je 0x4018bf
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4018bf
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4018b0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x803408]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x4020a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x803f64]
sub esp, 0x11c
test eax, eax
jne 0x40219e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00404400
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x4020f0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402100
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402135
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403360
pop edi
pop esi
pop ebx
test eax, eax
je 0x402199
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402199
mov dword [0x803f64], eax
add esp, 0x11c
ret
mov eax, dword [0x803f64]
add esp, 0x11c
ret
Function at 0x403190
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x4031b8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x4031c6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x4031df
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4031ed
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403206
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x403214
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40322d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40323b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403282
add dword [esp], 5
retf

Function at 0x403360
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4033bb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403380
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40339c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401c70
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4033dd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40344f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40344f
test esi, esi
je 0x40344f
cmp word [esi + 0x24], 2
jbe 0x403449
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x403449
cmp dword [esi + 0x18], 0
je 0x403449
test ebp, ebp
je 0x403405
cmp ebp, eax
jne 0x403449
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401c70
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40342a
cmp edx, dword [esi + 0x18]
jne 0x403449
cmp dword [esp + 0x14], eax
je 0x40345c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403b50
add esp, 8
test eax, eax
je 0x40345c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4033e3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret