joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f750
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f783
push esi
call fcn.00442840
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f77c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f809
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f7f2
mov eax, dword [esi + 8]
test eax, eax
je 0x43f7a7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f7ee
cmp eax, 2
je 0x43f7f2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f79a
cmp eax, 3
je 0x43f7cd
cmp eax, 1
jne 0x43f79a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f79a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f79a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f830
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f818
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f830
add esp, 4
pop esi
ret

Function at 0x44b8d0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44b973
test eax, eax
jbe 0x44b973
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44b973
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44b91e
xor esi, esi
jmp 0x44b924
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44b94f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004041c0
add esi, eax
push esi
mov ebx, esi
call fcn.004041c0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44b930
pop ebp
test edi, edi
pop edi
jne 0x44b973
test ebx, ebx
je 0x44b973
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00454bd0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44ba95
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44bbad
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44bbad
mov eax, dword [esi + 0x3c]
push eax
call fcn.00465b50
mov esi, eax
test esi, esi
je 0x44bbad
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44bbad
mov ecx, esi
call fcn.0044ba20
cmp edi, eax
jge 0x44bbad
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44bb33
mov dword [esp + 0x34], 1
jmp 0x44bb8e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44bbad
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044af90
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4664f4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46652c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004645ab
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464583
jmp 0x466538
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x467be5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x467c27
call fcn.0046d699
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x467c27
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x467c1e
xor eax, eax
jmp 0x467c2f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00467c35
pop edi
pop esi
pop ebx
ret 4
Function at 0x46dbc9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46dbf7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46dc15
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046db2f
jmp 0x46dc15
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46dc15
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046db2f
test edi, edi
mov eax, edi
jne 0x46dbff
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010cc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010de
mov eax, dword [0x40f08b]
shl eax, 2
mov dword [0x40f08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405804
pop edx
call fcn.00404ba0
call fcn.00405808
push 0
call fcn.00406af4
pop ecx
push 0x40f034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40f093], eax
push 0
jmp fcn.0040a8c8

Function at 0x401430
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x44f37c]
mov edx, dword [0x44f384]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x44f380]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x44f388]
mov dword [0x453668], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401574
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4014df
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401576
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00405cbc
add esp, 0xc
test eax, eax
je 0x4014f9
xor eax, eax
jmp 0x401576
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401522
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401576
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x44f378], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x44f378]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40156d
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401576
mov eax, 1
jmp 0x401576
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov ax, word [0x44f38c]
lea edx, [ebp - 0x210]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov word [ebp - 6], ax
push 0x208
push edx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x2e
lea ecx, [ebp - 0x210]
push ecx
call fcn.00405cb5
add esp, 8
mov byte [eax], 0
push str._useid_
lea eax, [ebp - 0x210]
push eax
call fcn.00405ba8
add esp, 8
push esi
lea edx, [ebp - 0x210]
push edx
call fcn.00405ba8
add esp, 8
push str..txt
lea ecx, [ebp - 0x210]
push ecx
call fcn.00405ba8
add esp, 8
lea eax, [ebp - 0x210]
push 0
push 0
push 2
push 0
push 3
push 0x40000000
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40168d
push 0
lea eax, [ebp - 4]
push eax
push 0x44f483
call sub.KERNEL32.DLL_lstrlenA
push eax
push 0x44f47a
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call sub.KERNEL32.DLL_lstrlenA
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebp - 4]
push 0
push ecx
lea eax, [ebp - 6]
push 2
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_lstrlenA
push eax
mov eax, dword [ebp + 8]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
lea edx, [ebp - 4]
push 0
push edx
lea ecx, [ebp - 6]
Function at 0x40341c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x403450
mov edx, dword [eax + 8]
test edx, edx
jne 0x40343f
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x40344c
add edx, esi
cmp ebx, edx
jb 0x40345d
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x403435
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x403498
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x4034b2
xor eax, eax
jmp 0x403632
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x4034c6
xor eax, eax
jmp 0x403632
cmp word [ebx + 0x14], 0xe0
jne 0x4034d6
cmp word [ebx + 0x18], 0x10b
je 0x4034dd
xor eax, eax
jmp 0x403632
mov dword [0x453468], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0040341c
add esp, 8
test eax, eax
jne 0x403508
xor eax, eax
jmp 0x403632
mov edx, dword [0x453468]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00403464
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x40353a
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x403632
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x403604
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x4035f6
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x4035f1
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x4035e8
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4035dd
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4035dd
test cl, cl
je 0x4035d2
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4035dd
add eax, 2
add edx, 2
test cl, cl
jne 0x4035b6
jne 0x4035dd
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x403632
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x40359c
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x403574
jmp 0x403630
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x403628
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x403624
cmp dword [eax], 0
je 0x403624
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x403632
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x40360b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403744
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
push 0xf003f
push str.ServicesActive
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
test eax, eax
jne 0x403761
xor eax, eax
jmp 0x40379e
push 0xf01ff
push str.NTice
push eax
call sub.ADVAPI32.DLL_OpenServiceA
mov ebx, eax
push esp
push ebx
call sub.ADVAPI32.DLL_QueryServiceStatus
test eax, eax
jne 0x403788
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x40379e
cmp dword [esp + 4], 4
jne 0x40379c
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, 1
jmp 0x40379e
xor eax, eax
add esp, 0x1c
pop ebx
ret

Function at 0x403800
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x403819
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebp
ret
Function at 0x403840
Capabilities:
Enumerate process modules
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
mov ecx, 0x4a
push eax
add esp, 0xfffffc30
push ebx
push esi
push edi
lea edi, [ebp - 0x238]
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x44f9b0
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
call fcn.004037d8
pop ecx
test eax, eax
je 0x40387c
push ebx
call fcn.00403820
pop ecx
mov dword [ebp - 0x2cc], 0x94
lea eax, [ebp - 0x2cc]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x2bc], 1
jne 0x4038ba
push ebx
call fcn.004036b4
pop ecx
test eax, eax
jne 0x4038b1
push ebx
call fcn.004036ec
pop ecx
test eax, eax
je 0x4038d7
push ebx
call fcn.00403820
pop ecx
jmp 0x4038d7
push ebx
call fcn.00403800
pop ecx
test eax, eax
jne 0x4038d0
push ebx
call fcn.004037a4
pop ecx
test eax, eax
je 0x4038d7
push ebx
call fcn.00403820
pop ecx
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.DLL_GetCurrentProcessId
mov edi, eax
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403943
jmp 0x403932
push str.explorer.exe
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403924
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
cmp edi, dword [ebp - 0x230]
jne 0x403932
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x238]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403906
cmp esi, dword [ebp - 4]
je 0x403968
cmp dword [ebp - 4], 0
je 0x403968
push esi
push 1
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x403a46
xor edx, edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], edx
push 0x105
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x44fb55
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcatA
push str.EXPLORER.EXE
lea edx, [ebp - 0x110]
push edx
call sub.KERNEL32.DLL_lstrcatA
push esi
push 0
push 0x410
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x403a46
lea eax, [ebp - 8]
lea edx, [ebp - 0x12cc]
push eax
push 0x1000
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x403a22
xor esi, esi
lea ebx, [ebp - 0x12cc]
jmp 0x403a18
push 0x104
lea eax, [ebp - 0x13d0]
push eax
mov edx, dword [ebx]
push edx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x403a14
lea ecx, [ebp - 0x13d0]
push ecx
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x403a14
mov dword [ebp - 0xc], 1
jmp 0x403a22
inc esi
add ebx, 4
mov edx, dword [ebp - 8]
shr edx, 2
cmp esi, edx
jb 0x4039db
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x403a46
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0fff
dec dword [edi]
pop ds
add al, ch
sal byte [edx + 0x6a0000], 1
Function at 0x403aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
je 0x403ab1
jne 0x403ab1
jmp fcn.00403a35
cmp esi, 8
jb 0x403aef
xor ebx, ebx
jmp 0x403ae6
mov eax, dword [ebp + 0x10]
mov edx, ebx
add edx, edi
push eax
push edx
call fcn.00403af4
add esp, 8
movsx ecx, word [ebp + 0xc]
mov eax, 0x64
sub eax, ecx
imul esi
mov ecx, 0x64
xor edx, edx
div ecx
add ebx, eax
add ebx, 8
mov eax, esi
sub eax, 8
cmp ebx, eax
jbe 0x403aba
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403af4
Capabilities:
Check for software breakpoints
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403ba7
mov eax, fcn.00401694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403ba7
mov eax, fcn.00403d50
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403ba7
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x20
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403ba7
add ebx, 0x9e3779b9
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
add edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
add ecx, eax
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403b6f
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403bc4
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c7a
mov eax, fcn.00401694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c7a
mov eax, fcn.00403bc4
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403c7a
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403c7a
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403c42
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403da0
Capabilities:
Check for software breakpoints
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, fcn.004019fc
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov al, byte [esi]
cmp al, 0xcc
je 0x403e56
mov eax, fcn.00401694
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
mov al, byte [esi]
cmp al, 0xcc
je 0x403e56
mov eax, fcn.00403d50
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0xcc
je 0x403e56
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ebx, 0xc6ef3720
mov edi, 0x20
mov ecx, dword [edx]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
jmp 0x403e56
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x18]
lea esi, [ebx + ecx]
xor eax, esi
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 0x1c]
xor eax, esi
sub edx, eax
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x10]
lea esi, [ebx + edx]
xor eax, esi
mov esi, edx
shr esi, 5
add esi, dword [ebp - 0x14]
xor eax, esi
sub ecx, eax
sub ebx, 0x9e3779b9
mov eax, edi
add edi, 0xffffffff
test eax, eax
jg 0x403e1e
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret