joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453290
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4532ae
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4532a3
pop esi
ret

Function at 0x463a27
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x463a69
call fcn.00466d76
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x463a69
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x463a60
xor eax, eax
jmp 0x463a71
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00463a77
pop edi
pop esi
pop ebx
ret 4

Function at 0x464a07
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x468628
call fcn.00456850
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00466d76
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x464a46
call fcn.00466d76
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x464a54
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x464a62
or eax, 0xffffffff
jmp 0x464b4a
mov ecx, esi
call fcn.0046497d
mov dword [ebp - 0x14], eax
call fcn.0046206b
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x464a99
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x464a99
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0046201f
push dword [ebp - 0x14]
call fcn.00461b50
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00464715
cmp eax, edi
je 0x464b0c
test byte [esi + 0x24], 0x10
je 0x464ada
push 4
mov ecx, esi
pop ebx
call fcn.00461550
test ah, 1
je 0x464ad2
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00463b79
cmp dword [esi + 0x1c], edi
je 0x464b0c
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00461584
jmp 0x464b0c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x464b20
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x464b39
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x464b39
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.004649b7
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4668ed
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46691b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x466939
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00466853
jmp 0x466939
mov eax, dword [esi + 0x14]
test eax, eax
je 0x466939
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00466853
test edi, edi
mov eax, edi
jne 0x466923
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401200
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4294e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4340c0
lea ecx, [ebp - 0x28]
call fcn.004034a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00402c20
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401277
mov byte [ebp - 0x2b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x2b]
jmp 0x4012b1
call fcn.00403990
movzx eax, al
test eax, eax
je 0x40129b
mov byte [ebp - 0x2a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x2a]
jmp 0x4012b1
mov byte [ebp - 0x29], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a9af
mov esp, ebp
pop ebp
ret

Function at 0x403600
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 0
push 0
mov esi, 1
mov dword [ebp - 0x408], 0
push str.Mozilla_4.0__compatible_
mov edi, ecx
mov dword [ebp - 0x40c], esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x410], eax
test eax, eax
jne 0x40365b
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a9af
mov esp, ebp
pop ebp
ret
push 0
push SysReAllocString
push 0
push 0
push edi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
je 0x403649
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x403680
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0040e590
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call ebx
test esi, esi
je 0x4036be
mov eax, 0x5a4d
cmp word [ebp - 0x404], ax
jne 0x4036ca
xor esi, esi
cmp dword [ebp - 0x408], esi
ja 0x403680
jmp 0x4036d4
mov dword [ebp - 0x40c], 0
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 0x410]
call esi
cmp dword [ebp - 0x40c], 0
mov ecx, dword [ebp - 4]
pop ebx
setne al
xor ecx, ebp
pop edi
pop esi
call fcn.0040a9af
mov esp, ebp
pop ebp
ret
Function at 0x403700
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x2b4], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x2b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ecx, ecx
mov dword [ebp - 0x4c], 0x510051
xor bl, bl
mov dword [ebp - 0x48], 0x430050
mov dword [ebp - 0x44], 0x540052
mov dword [ebp - 0x40], 0x2e0050
mov dword [ebp - 0x3c], 0x780065
mov dword [ebp - 0x38], 0x65
mov dword [ebp - 0x34], 0x360033
mov dword [ebp - 0x30], 0x740030
mov dword [ebp - 0x2c], 0x610072
mov dword [ebp - 0x28], 0x2e0079
mov dword [ebp - 0x24], 0x780065
mov dword [ebp - 0x20], 0x65
mov dword [ebp - 0x88], 0x610042
mov dword [ebp - 0x84], 0x640069
mov dword [ebp - 0x80], 0x530075
mov dword [ebp - 0x7c], 0x530064
mov dword [ebp - 0x78], 0x630076
mov dword [ebp - 0x74], 0x65002e
mov dword [ebp - 0x70], 0x650078
mov word [ebp - 0x6c], cx
mov dword [ebp - 0x68], 0x78006b
mov dword [ebp - 0x64], 0x730065
mov dword [ebp - 0x60], 0x6f0063
mov dword [ebp - 0x5c], 0x650072
mov dword [ebp - 0x58], 0x65002e
mov dword [ebp - 0x54], 0x650078
mov word [ebp - 0x50], cx
mov dword [ebp - 0x1c], 0x610072
mov dword [ebp - 0x18], 0x6d0076
mov dword [ebp - 0x14], 0x6e006f
mov dword [ebp - 0x10], 0x2e0064
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
test eax, eax
je 0x4038bf
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0040b57e
add esp, 8
test eax, eax
je 0x4038bd
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0040b57e
add esp, 8
test eax, eax
je 0x4038bd
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0040b57e
add esp, 8
test eax, eax
je 0x4038bd
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0040b57e
add esp, 8
test eax, eax
je 0x4038bd
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0040b57e
add esp, 8
test eax, eax
je 0x4038bd
lea eax, [ebp - 0x2b4]
push eax
push esi
call edi
test eax, eax
jne 0x403833
jmp 0x4038bf
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a9af
mov esp, ebp
pop ebp
ret
Function at 0x406c20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, ecx
lea esi, [ecx + 1]
jmp 0x406c40
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c40
sub ecx, esi
mov dword [ebp - 0x7c], 0
push ecx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x90], 0x67452301
mov dword [ebp - 0x8c], 0xefcdab89
mov dword [ebp - 0x88], 0x98badcfe
mov dword [ebp - 0x84], 0x10325476
call fcn.00406350
add esp, 4
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x14]
call fcn.00406420
xor esi, esi
lea edi, [ebp - 0x37]
mov bl, byte [ebp + esi - 0x14]
movzx eax, bl
push eax
lea eax, [edi - 1]
push str._02x
push eax
call fcn.0040c24e
shl bl, 4
movzx eax, bl
push eax
push str._02x
push edi
call fcn.0040c24e
inc esi
add esp, 0x18
add edi, 2
cmp esi, 0x10
jl 0x406ca1
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x43ad40
call fcn.0040cc30
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 0x43ad40
pop edi
pop esi
pop ebx
call fcn.0040a9af
mov esp, ebp
pop ebp
ret
Function at 0x4087e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x434f14
push ecx
lea eax, [ebp - 0x14]
mov edi, edx
push eax
xor esi, esi
call fcn.004278a4
mov eax, dword [ebp - 0x14]
add esp, 0xc
test eax, eax
je 0x40888c
push esi
push 0x64
push eax
call fcn.00427978
add esp, 0xc
cmp eax, 0xffffffff
je 0x40886f
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 1
push 0xa
push eax
call fcn.00427bc0
add esp, 0x10
cmp eax, 1
jne 0x40886f
lea eax, [ebp - 0x10]
push eax
call fcn.0041f6e0
push 0
push 0x73
push dword [ebp - 0x14]
mov esi, eax
call fcn.00427978
add esp, 0x10
cmp eax, 0xffffffff
je 0x40886f
push dword [ebp - 0x14]
push 1
push 0x4f
push edi
call fcn.00427bc0
xor ecx, ecx
add esp, 0x10
cmp eax, 1
cmovne esi, ecx
push dword [ebp - 0x14]
call fcn.0040da75
add esp, 4
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a9af
mov esp, ebp
pop ebp
ret
push str.fopen_error
call fcn.0040c5f8
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.0040a9af
mov esp, ebp
pop ebp
ret

Function at 0x408ab0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x1c], eax
mov bl, 1
mov eax, dword [ebp + 0xc]
push 0x434f38
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], ecx
push eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.004278a4
add esp, 0xc
test eax, eax
je 0x408b09
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a9af
mov esp, ebp
pop ebp
ret 0xc
push esi
push edi
push dword [ebp - 8]
call fcn.00427ffd
push 2
push 0
push dword [ebp - 8]
mov esi, eax
call fcn.00427978
push dword [ebp - 8]
call fcn.00427ffd
push 0
push esi
push dword [ebp - 8]
mov edi, eax
call fcn.00427978
push edi
call fcn.0040a1ec
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 1
push edi
push eax
call fcn.00427bc0
lea eax, [edi + edi*2]
push eax
mov dword [ebp - 0x10], eax
call fcn.0040a1ec
mov esi, eax
mov eax, dword [ebp - 0x18]
sub edi, eax
push edi
mov edi, dword [ebp - 0x14]
add eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00422610
add esp, 0x48
test eax, eax
je 0x408b7a
xor bl, bl
jmp 0x408ba7
push 0x434f3c
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
call fcn.004278a4
add esp, 0xc
test eax, eax
je 0x408b96
xor bl, bl
jmp 0x408ba7
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
push esi
call fcn.0040e1f4
add esp, 0x10
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x408bb7
push eax
call fcn.0040da75
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x408bc7
push eax
call fcn.0040da75
add esp, 4
test edi, edi
je 0x408bd4
push edi
call fcn.0040a9be
add esp, 4
test esi, esi
je 0x408be1
push esi
call fcn.0040a9be
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a9af
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ac78
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4385dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040fe3c
mov dword [ebp - 0x14], eax
cmp dword [0x43acec], esi
jne 0x41ad6b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41acf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41ae4b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41ae4b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41ae4b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43acec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43acf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43acf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43acfc], eax
test eax, eax
je 0x41ad68
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43acf8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41ad90
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ad83
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41ada5
push 4
pop eax
jmp 0x41ae4d
cmp dword [ebp - 0x14], esi
je 0x41ada5
push dword [0x43acec]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41ad8a
mov eax, dword [0x43acf8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41ae03
cmp dword [0x43acfc], edi
je 0x41ae03
push eax
call ebx
push dword [0x43acfc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41ae03
test eax, eax
je 0x41ae03
call ecx
test eax, eax
je 0x41adf8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41adf8
test byte [ebp - 8], 1
jne 0x41ae03
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41ae33
mov eax, dword [0x43acf0]
cmp eax, edi
je 0x41ae30
push eax
call ebx
test eax, eax
je 0x41ae30
call eax
mov esi, eax
test esi, esi
je 0x41ae30
mov eax, dword [0x43acf4]
cmp eax, edi
je 0x41ae30
push eax
call ebx
test eax, eax
je 0x41ae30
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43acec]
call ebx
test eax, eax
je 0x41ae4b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41ae4d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a9af
mov esp, ebp
pop ebp
ret
Function at 0x424f70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x424f7c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00424f90

Function at 0x426a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x426ab5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x426acd
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x426afc
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x426b3e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x426c12
sub edx, 0x10000
js 0x426c12
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x426b24
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x426b24
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x426b95
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x426b92
add edx, 8
jne 0x426b79
jmp 0x426c03
add edx, 4
test eax, 0xffff
jne 0x426ba2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x426c03
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x426bd6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x426b24
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x426c12
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x426b24
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x426c23
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x427c82
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
cmp ecx, dword [ebx + 0x55]
push esp
inc esi
aaa
not esp
or esp, ecx
or al, 0x52
idiv byte [ebx]
mov esp, 0x34ad3c6c
adc al, 0x44
push esi
push esp
dec edx
pop esp
or al, 0x35
inc ebp
inc ecx
xor al, 0x36
outsd dx, dword [esi]
ror dword ss:[ecx + 0x243437c4], 1
dec esp
and al, 0x47
bound esi, qword [esp + esi*4]
aas
dec ebp
mov ecx, 0xccb4b444
aaa
cmp byte [esi + edx*8], dh
aaa
dec ebp
js 0x427cbb
in eax, dx
cmp byte [edx + ecx*2 + 0x3684347e], al
xor al, 0xf5
cmp eax, 0xf4372550
stc
cmp dword [ebx], esi
jl 0x427ce8
jl 0x427d3f
xor al, 0xc4
insb byte es:[edi], dx
aam 0x2c
inc ebp
cmp dh, byte [esi]
hlt
insb byte es:[edi], dx
pop es
xor al, 0x3a
cmp dword [esp + edi*4], esi
push eax
xor eax, 0x5e3c46d4
xor eax, 0x3ac4134
xor al, 0x34
pop eax
fadd qword [ebx + 0x37]
lodsb al, byte [esi]
cmp eax, 0x404a358c
cmp al, 0x35
xor al, 0x64
and dh, byte [edi + esi]
inc esi
cmp al, 0xf
cmp al, 0x54
mov ah, 0x34
mov dl, 0x4d
inc esp
push esp
cmp dword [esp + esi*4 - 0x4c], eax
pop ecx
adc al, 0x34
xor al, 0xf4
outsb dx, byte [esi]
mov esp, 0xa4f40750
cmp byte [esi], ch
cmp esi, dword [esp + ecx*4]
invalid
xor al, 0x3c
cmp ebx, esp
cmp dword [esp + esi], esi
jne 0x427d7d
cmp esi, dword [esp + eax]
pop esi
aam 0x36
pop esi
dec esp
aas
xor al, 0xf8
mov ah, 0x34
clc
cmp ah, byte [edi + 0x34]
xchg ebp, eax
cmp esi, dword [esp + eax*2]
cmp al, 0x64
xor al, 0xb6
add al, 0x45
insb byte es:[edi], dx
dec edx
xor al, 0xb4
aaa
hlt
push eax
mov ah, 0x46
xor eax, 0xf4357934
outsb dx, byte [esi]
xor al, 0xb8
mov ch, 0x4c
xor al, 0x5c
je 0x427e02
cmp al, 0x88
scasb al, byte es:[edi]
adc eax, dword [edx + edx]
lodsb al, byte [esi]
aaa
aaa
push ebp
aas
inc ecx
dec esp
xor al, 0x74
and dl, byte [ebp + edi + 0x36]
jbe 0x427dd8
xor eax, 0x4d7636c0
jbe 0x427df6
xor al, 0x62
push esp
xor al, 0x20
push esp
div byte [esi]
xor al, 0xc
dec esp
xor al, 0x35
aaa
xor al, 0x13
salc
inc ecx
aaa
xor al, 0xe4
mov ecx, 0xcc443794
dec eax
dec esp
xor al, 0x74
cmp dword [esi + 0x343634d0], eax
xor eax, 0xce35c440
arpl word [esp + esi], di
dec edx
xor al, 0x34
pop eax
xor al, 0x58
jne 0x427da6
sbb al, 0xfe
push ebp
aas
cmp byte [esp + esi - 0xb], cl
pop ss
add al, 0x34
add al, 0x22
xor al, 0xc4
add al, 0x4e
dec ebx
inc esp
inc eax
mov esp, 0x42453849
xor al, 0xd4
cmp dword [0x4f5f38e4], esi
push esi
xor al, 0x60
jnp 0x427e3c
aaa
les esi, [esi]
push eax
or al, 0x39
sub al, 0x39
hlt
leave
Function at 0x404684
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x4b9e7a
call fcn.00431cbe
mov ebx, ecx
push 0
call fcn.004050c2
push 1
mov ecx, ebx
call fcn.00405617
lea eax, [ebp - 0x1c]
push 0x198
push eax
call fcn.004039a3
pop ecx
pop ecx
push dword [eax]
push 2
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x1c]
call fcn.00431d9a
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0xa4]
call fcn.00403c0f
and dword [ebp - 4], 0
lea esi, [ebx + 0x280]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebx + 0x1d4]
lea eax, [ebx + 0x1e0]
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 1
call fcn.00403db5
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x94], 0
je 0x404792
cmp dword [ebp - 0xa0], 0
mov byte [ebx + 0x29b], 1
jne 0x404782
push str.FeiSuZip
lea ecx, [ebp - 0xa4]
call fcn.0040e79d
push 0x10
push dword [ebp - 0xa4]
push dword [ebp - 0x98]
jmp 0x4047bc
test edi, edi
jne 0x4047c9
mov byte [ebx + 0x29b], 1
cmp dword [ebp - 0x70], edi
je 0x4047c5
cmp dword [ebp - 0x7c], edi
jne 0x4047b4
push str.FeiSuZip
lea ecx, [ebp - 0x80]
call fcn.0040e79d
push 0
push dword [ebp - 0x80]
push dword [ebp - 0x74]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
je 0x4047e2
cmp byte [ebx + 0x136], 0
jne 0x4047e2
mov ecx, ebx
mov byte [ebx + 0x135], 1
call fcn.004054d2
jmp 0x4047ed
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x80]
call fcn.00402bc9
lea ecx, [ebp - 0xa4]
call fcn.00402bc9
mov al, 1
call fcn.00431c87
ret