joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c141480
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x26c
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 0x248], 0x208
test ecx, ecx
jne 0x6c141538
movzx eax, byte [esi + 0x38]
cmp eax, dword [ebx + 0x48]
jae 0x6c1414bf
lea eax, [eax + eax*2]
lea edx, [ebx + eax*4]
mov eax, dword [edx + 0x4c]
test eax, eax
je 0x6c1414bf
dec eax
mov dword [edx + 0x4c], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
and ecx, 4
mov dword [ebp - 0x25c], ecx
jne 0x6c141500
mov esi, dword [ebx + 0x38]
mov edi, dword [ebx + 0x3c]
mov ecx, edx
cmp eax, esi
sbb ecx, edi
jae 0x6c141610
sub esi, eax
sbb edi, edx
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], edi
mov eax, dword [ebp - 0x25c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebx + 0x40]
mov edi, dword [ebx + 0x44]
mov ecx, edx
cmp eax, esi
sbb ecx, edi
jae 0x6c141630
mov dword [ebp - 0x25c], 0
sub esi, eax
mov eax, dword [ebp - 0x25c]
sbb edi, edx
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x248]
lea edi, [ebp - 0x220]
mov dword [esp + 0xc], 0
add ecx, esi
mov dword [esp + 8], edx
mov dword [esp + 4], edi
movzx edx, byte [esi + 0x38]
mov dword [esp], edx
mov edx, ebx
call sym._urlcache_create_file_pathW
test eax, eax
je 0x6c1414a5
lea eax, [ebp - 0x244]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetFileAttributesExW]
sub esp, 0xc
test eax, eax
je 0x6c1414a5
mov eax, dword [ebp - 0x230]
or eax, dword [ebp - 0x22c]
jne 0x6c141660
xor edx, edx
xor eax, eax
mov word [ebp - 0x24c], dx
mov word [ebp - 0x24a], ax
xor eax, eax
cmp word [esi + 0x5c], ax
jne 0x6c1414a5
movzx eax, word [ebp - 0x24a]
cmp word [esi + 0x5e], ax
jne 0x6c1414a5
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x6c1414a5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x25c], eax
cmp eax, 5
je 0x6c1414ef
cmp eax, 0x20
je 0x6c1414ef
jmp 0x6c1414a5
mov eax, dword [ebp - 0x25c]
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x24a]
mov dword [esp + 8], eax
lea eax, [ebp - 0x24c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x230]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x24c]
sub esp, 0xc
jmp 0x6c1415b8
Function at 0x6c144530
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
lea ebx, [ebp - 0xc]
sub esp, 0x10
movsx esi, byte [eax]
mov eax, edi
sub esi, edi
lea edx, [esi + eax]
inc eax
movzx edx, dl
movzx edx, byte [edx + 0x6c152be0]
mov byte [eax - 1], dl
cmp eax, ebx
jne 0x6c144548
movsx edx, byte [ecx + 1]
lea esi, [ecx + 1]
test dl, dl
je 0x6c14458f
lea esi, [esi]
nop
mov eax, edi
movzx ecx, byte [eax]
inc eax
xor ecx, edx
movzx ecx, byte [ecx + 0x6c152be0]
mov byte [eax - 1], cl
cmp eax, ebx
jne 0x6c144572
movsx edx, byte [esi + 1]
inc esi
test dl, dl
jne 0x6c144570
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6c146c90
Capabilities:
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 0x198]
sub esp, 0x1b4
mov dword [esp + 4], eax
mov dword [esp], 0x101
call dword [sym.imp.ws2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x6c146ce0
mov dword [0x6c147428], 1
mov ecx, dword [ebp - 4]
mov eax, 1
leave
lea esp, [ecx - 4]
ret 0xc
test byte [0x6c1471b4], 2
je 0x6c146ccc
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.WSAStartup_failed:__lu_n
mov dword [esp + 8], str.winsock_startup
mov dword [esp + 4], 0x6c1471b4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_6
mov ecx, dword [ebp - 4]
mov eax, 1
leave
lea esp, [ecx - 4]
ret 0xc

Function at 0x6c146d20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x80000000
push esi
push ebx
sub esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x6c146d9b
mov dword [ebp - 0x14], 3
jmp 0x6c146d48
inc dword [ebp - 0x14]
sar dword [ebp - 0x10], 1
je 0x6c146d9b
test byte [ebp - 0x10], 1
je 0x6c146d40
mov eax, dword [ebp - 0x14]
mov edx, 0x80000000
and eax, 0x1f
mov esi, dword [eax*4 + 0x6c153220]
mov eax, edi
xor edi, edi
jmp 0x6c146d86
mov ebx, eax
shr eax, 1
mov ecx, eax
and ebx, 1
shr edx, 1
xor ecx, 0xedb88320
test ebx, ebx
cmovne eax, ecx
test esi, edx
je 0x6c146d70
lea ecx, [edx - 1]
xor edi, eax
test ecx, esi
jne 0x6c146d70
inc dword [ebp - 0x14]
sar dword [ebp - 0x10], 1
jne 0x6c146d48
add esp, 8
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41deb2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00416fce
and dword [ebp - 4], 0
cmp dword [0x430a1c], 0
mov ebx, eax
jne 0x41df63
push 0x426ddc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e014
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x426dd0
push edi
call esi
test eax, eax
je 0x41e014
push eax
call fcn.00416f5c
mov dword [esp], 0x426dc0
push edi
mov dword [0x430a1c], eax
call esi
push eax
call fcn.00416f5c
mov dword [esp], 0x426dac
push edi
mov dword [0x430a20], eax
call esi
push eax
call fcn.00416f5c
mov dword [esp], 0x426d90
push edi
mov dword [0x430a24], eax
call esi
push eax
call fcn.00416f5c
pop ecx
mov dword [0x430a2c], eax
test eax, eax
je 0x41df63
push 0x426d78
push edi
call esi
push eax
call fcn.00416f5c
pop ecx
mov dword [0x430a28], eax
mov eax, dword [0x430a28]
cmp eax, ebx
je 0x41dfbb
cmp dword [0x430a2c], ebx
je 0x41dfbb
push eax
call fcn.00416fd7
push dword [0x430a2c]
mov esi, eax
call fcn.00416fd7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41dfbb
test edi, edi
je 0x41dfbb
call esi
test eax, eax
je 0x41dfb2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41dfb2
test byte [ebp - 0xc], 1
jne 0x41dfbb
or dword [ebp + 0x10], 0x200000
jmp 0x41dff4
mov eax, dword [0x430a20]
cmp eax, ebx
je 0x41dff4
push eax
call fcn.00416fd7
pop ecx
test eax, eax
je 0x41dff4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41dff4
mov eax, dword [0x430a24]
cmp eax, ebx
je 0x41dff4
push eax
call fcn.00416fd7
pop ecx
test eax, eax
je 0x41dff4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430a1c]
call fcn.00416fd7
pop ecx
test eax, eax
je 0x41e014
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e016
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7fe83efb
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x23057c9a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1004ef30
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1004f0fd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
push edi
or ebp, 0xffffffff
jmp 0x1004ef5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1004ef61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1004ef50
mov eax, 1
add ebx, ebx
jne 0x1004ef73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1004ef68
jne 0x1004ef84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1004ef68
xor ecx, ecx
sub eax, 3
jb 0x1004ef98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1004f00a
mov ebp, eax
add ebx, ebx
jne 0x1004efa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1004efb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1004efd4
inc ecx
add ebx, ebx
jne 0x1004efc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1004efb5
jne 0x1004efd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1004efb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1004eff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1004efe5
jmp 0x1004ef56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1004eff4
add edi, ecx
jmp 0x1004ef56
pop esi
mov edi, esi
mov ecx, 0x12f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1004f012
cmp byte [edi], 0x11
jne 0x1004f012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1004f017
lea edi, [esi + 0x4b000]
mov eax, dword [edi]
or eax, eax
je 0x1004f08f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4f0ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1004f044
mov ecx, edi
jns 0x1004f073
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4f0f0]
or eax, eax
je 0x1004f089
mov dword [ebx], eax
add ebx, 4
jmp 0x1004f061
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1004f0c0
cmp al, 0xef
ja 0x1004f0b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1004f095
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1004f0a2
mov ebp, dword [esi + 0x4f0f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1004f0f4
sub esp, 0xffffff80
jmp 0x1001f6e6
Function at 0x402680
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40268e
call dword [0x446014]
or eax, eax
je 0x40268f
ret
mov al, 1
jmp fcn.0040270c

Function at 0x402698
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026a6
call dword [0x446018]
or eax, eax
jne 0x4026a7
ret
mov al, 2
jmp fcn.0040270c

Function at 0x4026b0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4026e8
test edx, edx
je 0x4026d2
push eax
mov eax, ecx
call dword [0x44601c]
pop ecx
or eax, eax
je 0x4026e1
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040270c
mov dword [eax], edx
mov eax, ecx
call dword [0x446018]
or eax, eax
jne 0x4026cb
ret
mov al, 1
jmp fcn.0040270c
test edx, edx
je 0x4026fc
push eax
mov eax, edx
call dword [0x446014]
pop ecx
or eax, eax
je 0x4026e1
mov dword [ecx], eax
ret

Function at 0x40270c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x447004]
test ecx, ecx
je 0x40271c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402735]
jns 0x402730
call fcn.00405c0c
mov eax, dword [eax + 4]
jmp fcn.00403870

Function at 0x402850
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40287f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403960
jmp 0x40289d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004027d8
mov edi, eax
test ebx, ebx
je 0x40289d
cmp dword [esi], 0
je 0x40289d
dec ebx
jmp 0x402886
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402b54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402bec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402bcc
xor eax, eax
push ebp
push 0x402bc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c08
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402bcc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402e6c
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402e86
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402e86
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402e72
mov al, 0xa
jmp fcn.0040270c
ret

Function at 0x402eb8
Capabilities:
Terminate process

Disassembly:
cmp dword [0x447018], 0
je 0x4028c3
call dword [0x447018]
mov eax, 0xd2
jmp fcn.00403870
push eax
push ecx
mov eax, dword [eax]
call fcn.00402e88
pop ecx
pop eax
je 0x402ec7
jmp ebx
pop ecx
jmp 0x4028b4
Function at 0x402ed0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402e88
mov eax, ebx
pop ebx
jne 0x402ee5
pop ecx
jmp 0x4028b4
ret

Function at 0x40374c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4474a0
mov esi, 0x447034
mov edi, 0x447038
cmp byte [ebx + 0x24], 0
jne 0x40377b
cmp dword [edi], 0
je 0x40377b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x40376a
cmp dword [0x44703c], 0
je 0x4037c2
call fcn.004036c8
cmp byte [0x447044], 0
je 0x4037a8
mov edx, 0x446020
mov eax, 0x447218
call fcn.004054a8
call fcn.0040542b
jmp 0x4037bb
push 0
push 0x446040
push 0x446020
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x44703c], eax
cmp byte [ebx + 0x24], 2
jne 0x4037d2
cmp dword [esi], 0
jne 0x4037d2
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.0040359c
cmp byte [ebx + 0x24], 1
jbe 0x4037e2
cmp dword [esi], 0
je 0x4037ff
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4037ff
call fcn.00404eac
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4037ff
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403574
cmp byte [ebx + 0x24], 1
jne 0x40380d
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403818
call fcn.00403718
cmp dword [ebx], 0
jne 0x403825
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4037c2

Function at 0x403e84
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403e48
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403e48
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403e30
ret

Function at 0x403f2c
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.0040270c
test ecx, ecx
je fcn.00403e48
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403e30
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x403ff4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x404033
cmp al, 0xb
je 0x404033
cmp al, 0xc
je 0x40403d
cmp al, 0xd
je 0x404050
cmp al, 0xe
je 0x40406e
cmp al, 0xf
je 0x404033
cmp al, 0x11
je 0x404033
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040270c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x404033
jmp 0x404082
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x40403d
jmp 0x404082
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x403ff4
dec edi
jg 0x404053
pop ebp
jmp 0x404082
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403fc8
dec edi
jg 0x404071
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x403ff4
Function at 0x404088
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x404033
cmp al, 0xb
je 0x404033
cmp al, 0xc
je 0x40403d
cmp al, 0xd
je 0x404050
cmp al, 0xe
je 0x40406e
cmp al, 0xf
je 0x404033
cmp al, 0x11
je 0x404033
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040270c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x404033
jmp 0x404082
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x40403d
jmp 0x404082
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x403ff4
dec edi
jg 0x404053
pop ebp
jmp 0x404082
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00403fc8
dec edi
jg 0x404071
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x403ff4

Function at 0x4040c0
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404107
cmp al, 0xb
je 0x404121
cmp al, 0xc
je 0x404138
cmp al, 0xd
je 0x404147
cmp al, 0xe
je 0x404165
cmp al, 0xf
je 0x40417b
cmp al, 0x11
je 0x40418a
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0040270c
cmp ecx, 1
mov eax, ebx
jg 0x404118
call fcn.0040387c
jmp 0x404199
mov edx, ecx
call fcn.004038a0
jmp 0x404199
cmp ecx, 1
mov eax, ebx
jg 0x40412f
call fcn.00403e48
jmp 0x404199
mov edx, ecx
call fcn.00403e60
jmp 0x404199
mov eax, ebx
add ebx, 0x10
call fcn.0040491c
dec edi
jg 0x404138
jmp 0x404199
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004040c0
dec edi
jg 0x40414a
pop ebp
jmp 0x404199
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404094
dec edi
jg 0x404168
pop ebp
jmp 0x404199
mov eax, ebx
add ebx, 4
call fcn.00404f74
dec edi
jg 0x40417b
jmp 0x404199
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404b10
dec edi
jg 0x40418a
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4041a0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004040c0
Function at 0x4041ac
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4041d8
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402798
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404217
cmp cl, 0xb
je 0x404228
cmp cl, 0xc
je 0x404239
cmp cl, 0xd
je 0x40424a
cmp cl, 0xe
je 0x40426a
cmp cl, 0xf
je 0x404283
cmp cl, 0x11
je 0x404294
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040270c
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004038d0
mov eax, 4
jmp 0x4042a5
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403e84
mov eax, 4
jmp 0x4042a5
lea edx, [esi + eax]
add eax, ebx
call fcn.00404568
mov eax, 0x10
jmp 0x4042a5
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004042c8
pop eax
jmp 0x4042a5
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004041ac
pop eax
jmp 0x4042a5
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404f8c
mov eax, 4
jmp 0x4042a5
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404b4c
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4041c6
pop ecx
sub ecx, eax
jle 0x4042c1
lea edx, [ebx + eax]
add eax, esi
call fcn.00402798
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4042c8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x40430e
cmp cl, 0xb
je 0x404325
cmp cl, 0xc
je 0x404339
cmp cl, 0xd
je 0x40434d
cmp cl, 0xe
je 0x40436e
cmp cl, 0xf
je 0x40438b
cmp cl, 0x11
je 0x40439f
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040270c
mov eax, ebx
mov edx, dword [esi]
call fcn.004038d0
add ebx, 4
add esi, 4
dec ebp
jne 0x40430e
jmp 0x4043b3
mov eax, ebx
mov edx, dword [esi]
call fcn.00403e84
add ebx, 4
add esi, 4
dec ebp
jne 0x404325
jmp 0x4043b3
mov eax, ebx
mov edx, esi
call fcn.00404568
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404339
jmp 0x4043b3
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004042c8
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404356
jmp 0x4043b3
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004041ac
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x40436e
jmp 0x4043b3
mov eax, ebx
mov edx, dword [esi]
call fcn.00404f8c
add ebx, 4
add esi, 4
dec ebp
jne 0x40438b
jmp 0x4043b3
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404b4c
add ebx, 4
add esi, 4
dec ebp
jne 0x40439f
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x404568
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.0040270c
cmp eax, edx
je 0x4045ff
cmp word [eax], 8
jb 0x4045a0
push eax
push edx
cmp word [eax], 0x100
je 0x404596
cmp word [eax], 0x101
je 0x40458e
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x40459e
call dword [0x4473e4]
jmp 0x40459e
add eax, 8
call fcn.0040387c
pop edx
pop eax
cmp word [edx], 8
jae 0x4045b7
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x4045d2
cmp word [edx], 0x101
jne 0x4045eb
push eax
call 0x4045a6
pop eax
jmp dword [0x4473ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x4045e2
mov ecx, dword [edx - 8]
inc ecx
jle 0x4045e2
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x40451c
ret