joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f8ee
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x457220]
xor eax, ebp
mov dword [ebp + 0x394], eax
push esi
push edi
xor edi, edi
push 0x40e
lea eax, [ebp - 0x7a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x7c], di
call fcn.00434f60
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x3a0]
mov dword [ebp - 0x80], edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x42f941
xor al, al
jmp 0x42f984
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x42f962
cmp dword [ebp - 0x80], edi
je 0x42f93d
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x42f93d
lea eax, [ebp - 0x7c]
push eax
call fcn.0043501f
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.004011a5
cmp dword [ebp - 0x80], edi
je 0x42f982
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp + 0x394]
pop edi
xor ecx, ebp
pop esi
call fcn.004350b5
add ebp, 0x398
leave
ret

Function at 0x42f99b
Capabilities:
Query environment variable

Disassembly:
push 0x2c
mov eax, 0x440f04
call fcn.00437192
push 1
lea eax, [ebp - 0x30]
mov esi, ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x30], ebx
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x25
call fcn.0040c030
cmp eax, 0xffffffff
mov eax, edi
jne 0x42f9da
call fcn.00403705
mov eax, esi
jmp 0x42fa7c
lea esi, [ebp - 0x2c]
call fcn.00403705
mov dword [ebp - 4], ebx
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [ebp - 0x38], eax
jb 0x42f9f3
mov eax, dword [eax]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x42fa08
mov eax, edi
jmp 0x42fa65
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00434d5d
cmp dword [edi + 0x18], 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
pop ecx
jb 0x42fa2e
mov eax, dword [eax]
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x30]
push eax
call ebx
test eax, eax
jbe 0x42fa59
cmp eax, esi
ja 0x42fa59
mov esi, dword [ebp - 0x30]
and word [esi + eax*2], 0
push esi
call fcn.0043501f
pop ecx
mov ecx, esi
lea esi, [ebp - 0x2c]
call fcn.004011a5
push dword [ebp - 0x30]
call fcn.004354a5
pop ecx
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
call fcn.00403705
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.0040115e
mov eax, dword [ebp - 0x34]
call fcn.00437215
ret
Function at 0x430122
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x430130
and dword [esi], 0
and dword [ebp + 0x10], 0
xor eax, eax
inc eax
cmp dword [ebp + 0xc], 0
jbe 0x43016c
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x43014a
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x43016c
mov ecx, dword [ebp + 0x10]
add dword [esi], ecx
test eax, eax
setne al
push eax
call fcn.0040df71
pop ecx
pop esi
pop ebp
ret 0xc

Function at 0x430835
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
push edi
mov edi, dword [ebp + 8]
jb 0x430981
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + ecx - 4]
push ebx
mov dword [ebp - 8], ecx
push esi
lea esi, [eax + edi]
jmp 0x430871
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x430876
inc esi
cmp esi, dword [ebp - 8]
jb 0x430868
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 8]
jae 0x430962
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x4308f5
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp - 4], eax
je 0x4308a2
cmp cl, 0xff
jne 0x430924
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
sub edi, eax
sub edi, dword [ebp + 0xc]
test edx, edx
mov ebx, edi
mov dword [ebp - 0xc], ebx
je 0x430935
movzx edi, byte [edx + 0x447250]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
shr ebx, cl
test bl, bl
je 0x4308e5
cmp bl, 0xff
jne 0x430932
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, dword [ebp - 0xc]
jmp 0x4308bd
dec ecx
shl edx, cl
and edx, 7
je 0x43088f
movzx ecx, byte [edx + 0x447250]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x447248], 0
mov cl, byte [ebx + 4]
je 0x430921
test cl, cl
je 0x430921
cmp cl, 0xff
jne 0x43088f
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x430863
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x430863
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
pop edi
leave
ret

Function at 0x4329cc
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x432cb3
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
movzx ecx, byte [eax + str.cw]
mov byte [ecx + 0x45df08], al
inc eax
cmp eax, 0x100
jb 0x432cbb
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov esi, 0xff
movzx ebx, byte [edi + str.cw]
mov eax, ebx
and al, 0x80
neg al
lea ecx, [ebx + ebx]
sbb eax, eax
and eax, 0x1b
xor eax, ecx
and eax, esi
mov ecx, eax
mov edx, ecx
xor edx, ebx
mov dword [ebp - 8], edx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ecx
mov eax, edi
shl eax, 2
mov dword [eax + 0x45bf08], edx
mov edx, ebx
shl edx, 8
mov edi, edx
or edi, ebx
or edx, ecx
shl edi, 8
or edi, ecx
shl edx, 8
or edx, dword [ebp - 8]
shl edi, 8
or edi, dword [ebp - 8]
shl ecx, 8
or ecx, dword [ebp - 8]
shl edx, 8
shl ecx, 8
mov dword [eax + 0x45c308], edi
mov edi, dword [ebp - 0x10]
movzx ebx, byte [edi + str.cw]
or edx, ebx
or ecx, ebx
mov dword [eax + 0x45c708], edx
shl ecx, 8
or ecx, ebx
mov dword [eax + 0x45cb08], ecx
movzx ecx, byte [edi + 0x45df08]
mov edx, ecx
and dl, 0x80
neg dl
lea ebx, [ecx + ecx]
mov dword [ebp - 0x18], ecx
sbb edx, edx
and edx, 0x1b
xor edx, ebx
and edx, esi
mov ebx, edx
and bl, 0x80
neg bl
mov dword [ebp - 0x10], edx
sbb ebx, ebx
and ebx, 0x1b
add edx, edx
xor ebx, edx
and ebx, esi
mov edx, ebx
and bl, 0x80
neg bl
mov dword [ebp - 0x14], edx
sbb ebx, ebx
add edx, edx
and ebx, 0x1b
xor ebx, edx
and ebx, esi
mov edx, ebx
xor edx, ecx
mov dword [ebp - 8], edx
mov edx, ebx
xor edx, dword [ebp - 0x10]
xor edx, ecx
mov dword [ebp - 0xc], edx
shl edx, 8
mov ecx, ebx
xor ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
xor ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
or edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
mov dword [eax + 0x45cf08], edx
mov edx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, dword [ebp - 0xc]
mov dword [eax + 0x45d308], edx
mov edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl ecx, 8
or ecx, dword [ebp - 0xc]
shl edx, 8
or edx, dword [ebp - 0xc]
shl ecx, 8
or ecx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 4]
shl ecx, 8
or ecx, dword [ebp - 8]
inc edi
cmp edi, 0x100
mov dword [eax + 0x45d708], edx
mov dword [eax + 0x45db08], ecx
mov dword [ebp - 0x10], edi
jb 0x432cdd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432e4a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
shr dword [ebp + 8], 2
mov eax, dword [ebp + 8]
shr eax, 1
add eax, 3
push esi
mov dword [ecx], eax
xor esi, esi
cmp dword [ebp + 8], esi
lea eax, [eax*8 + 4]
push edi
mov dword [ebp - 0xc], eax
jbe 0x432e80
mov edi, dword [edx]
mov dword [ecx + esi*4 + 4], edi
inc esi
add edx, 4
cmp esi, dword [ebp + 8]
jb 0x432e71
cmp esi, eax
jae 0x432f54
mov eax, esi
sub eax, dword [ebp + 8]
push ebx
lea eax, [ecx + eax*4 + 4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov ebx, dword [ecx + esi*4]
test edx, edx
mov dword [ebp - 8], eax
jne 0x432ef2
mov edi, 0xff
mov eax, ebx
and eax, edi
mov dh, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
mov dl, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x10
and eax, edi
movzx eax, byte [eax + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x4582a0]
shl edx, 8
or edx, eax
movzx eax, bh
movzx eax, byte [eax + str.cw]
shl edx, 8
xor eax, edi
or edx, eax
mov ebx, edx
jmp 0x432f3a
cmp dword [ebp + 8], 6
jbe 0x432f3a
cmp edx, 4
jne 0x432f3a
mov eax, ebx
shr eax, 0x10
mov edi, 0xff
and eax, edi
movzx eax, byte [eax + str.cw]
mov edx, ebx
shr edx, 0x18
mov ah, byte [edx + str.cw]
movzx edx, bh
movzx edx, byte [edx + str.cw]
shl eax, 8
and ebx, edi
or eax, edx
movzx edx, byte [ebx + str.cw]
shl eax, 8
or eax, edx
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, ebx
mov dword [ecx + esi*4 + 4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x432e95
pop ebx
pop edi
pop esi
leave
ret

Function at 0x432f58
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call fcn.00432e4a
mov eax, dword [ecx]
lea eax, [eax*8 - 4]
add esp, 4
xor esi, esi
test eax, eax
mov dword [ebp - 4], eax
jbe 0x432fda
push ebx
mov edx, 0xff
push edi
mov eax, dword [ecx + esi*4 + 0x14]
mov edi, eax
shr edi, 0x10
and edi, edx
movzx edi, byte [edi + str.cw]
mov edi, dword [edi*4 + 0x45d708]
movzx ebx, ah
movzx ebx, byte [ebx + str.cw]
xor edi, dword [ebx*4 + 0x45d308]
mov ebx, eax
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
xor edi, dword [ebx*4 + 0x45db08]
and eax, edx
movzx eax, byte [eax + str.cw]
xor edi, dword [eax*4 + 0x45cf08]
inc esi
cmp esi, dword [ebp - 4]
mov dword [ecx + esi*4 + 0x10], edi
jb 0x432f81
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4333e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, eax
test ebx, ebx
push edi
mov edi, ecx
je 0x433477
push 0x10
pop eax
cmp ebx, eax
jb 0x433477
sub ebx, eax
add ebx, eax
shr ebx, 4
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [edi]
push dword [esi + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x14]
lea eax, [ebp - 0x14]
call fcn.00432fdd
mov eax, dword [esi]
xor eax, dword [ebp - 0x24]
pop ecx
mov dword [edi], eax
mov eax, dword [esi + 4]
xor eax, dword [ebp - 0x20]
add edi, 0x10
mov dword [edi - 0xc], eax
mov eax, dword [esi + 8]
xor eax, dword [ebp - 0x1c]
pop ecx
mov dword [edi - 8], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebp - 0x18]
dec ebx
mov dword [edi - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
jne 0x43340a
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x4350b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457220]
jne 0x4350bf
repz ret
jmp fcn.00437498

Function at 0x4366f3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x436720
call fcn.00436243
mov dword [eax], esi
call fcn.00436230
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00435471
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4366fc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43674f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00436256
pop ecx
call fcn.00436230
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x436776
test al, 1
je 0x436776
test byte [esp + 0xc], 2
je 0x436776
call fcn.00436243
mov dword [eax], 5
call fcn.00436230
mov dword [eax], 0xd
jmp 0x436746
xor eax, eax
pop esi
ret
Function at 0x4383bf
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x457238]
je 0x4383da
inc edi
cmp edi, 0x17
jb 0x4383cb
cmp edi, 0x17
jae 0x43855a
push ebp
push 3
call fcn.0043dc45
cmp eax, 1
pop ecx
je 0x438526
push 3
call fcn.0043dc45
test eax, eax
pop ecx
jne 0x43840e
cmp dword [0x4570a0], 1
je 0x438526
cmp ebx, 0xfc
je 0x438559
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x45b2d0
push ebp
call fcn.00437233
add esp, 0xc
test eax, eax
je 0x438444
push esi
push esi
push esi
push esi
push esi
call fcn.00435375
add esp, 0x14
push 0x104
mov esi, 0x45b2e9
push esi
push 0
mov byte [0x45b3ed], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x438488
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00437233
add esp, 0xc
test eax, eax
je 0x438488
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00435375
add esp, 0x14
push esi
call fcn.004352e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4384cd
push esi
call fcn.004352e0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45b5e4
push 0x445a7c
sub ecx, eax
push ecx
push eax
call fcn.0043db92
add esp, 0x14
test eax, eax
je 0x4384cd
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00435375
add esp, 0x14
jmp 0x4384cf
xor esi, esi
push 0x445a78
push ebx
push ebp
call fcn.0043db21
add esp, 0xc
test eax, eax
je 0x4384ef
push esi
push esi
push esi
push esi
push esi
call fcn.00435375
add esp, 0x14
push dword [edi*8 + 0x45723c]
push ebx
push ebp
call fcn.0043db21
add esp, 0xc
test eax, eax
je 0x438511
push esi
push esi
push esi
push esi
push esi
call fcn.00435375
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043d964
add esp, 0xc
jmp 0x438559
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x438559
cmp ebp, 0xffffffff
je 0x438559
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x45723c]
push dword [esi]
call fcn.004352e0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43d964
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004376a2
xor ebx, ebx
cmp dword [0x45ba08], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43da3a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43db1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43db1a
push eax
call fcn.00437634
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45ba08], eax
call esi
push eax
call fcn.00437634
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45ba0c], eax
call esi
push eax
call fcn.00437634
mov dword [0x45ba10], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00437e40
test eax, eax
pop ecx
pop ecx
je 0x43da08
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00435375
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43da3a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00437634
cmp eax, ebx
pop ecx
mov dword [0x45ba18], eax
je 0x43da3a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00437634
pop ecx
mov dword [0x45ba14], eax
mov eax, dword [0x45ba14]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43dabf
cmp dword [0x45ba18], ecx
je 0x43dabf
push eax
call fcn.004376ab
push dword [0x45ba18]
mov esi, eax
call fcn.004376ab
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43dabf
cmp edi, ebx
je 0x43dabf
call esi
cmp eax, ebx
je 0x43da8c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43da8c
test byte [ebp - 0x18], 1
jne 0x43dabf
lea eax, [ebp - 0x10]
push eax
call fcn.00437e77
test eax, eax
pop ecx
je 0x43daa7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00435375
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43dab6
or dword [ebp + 0x10], 0x200000
jmp 0x43dafa
or dword [ebp + 0x10], 0x40000
jmp 0x43dafa
mov eax, dword [0x45ba0c]
cmp eax, dword [ebp - 8]
je 0x43dafa
push eax
call fcn.004376ab
cmp eax, ebx
pop ecx
je 0x43dafa
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43dafa
mov eax, dword [0x45ba10]
cmp eax, dword [ebp - 8]
je 0x43dafa
push eax
call fcn.004376ab
cmp eax, ebx
pop ecx
je 0x43dafa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45ba08]
call fcn.004376ab
cmp eax, ebx
pop ecx
je 0x43db1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43db1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xa97c70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x375000]
push edi
or ebp, 0xffffffff
jmp 0xa97c92
Function at 0x402990
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov byte [ebp - 1], 0
push esi
push edi
mov ecx, 0x40
mov esi, 0x4d5668
mov edi, ebx
mov dword [ebx + 0x200], 1
mov dword [ebx + 0x204], 1
mov word [ebx + 0x208], 0
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, edx
nop
xor edx, edx
mov cl, byte [esi + ebx]
mov eax, esi
div dword [ebp + 8]
movzx eax, byte [edx + edi]
mov dl, byte [ebp - 1]
add al, cl
add dl, al
mov byte [ebp - 1], dl
movzx edx, dl
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
inc esi
mov byte [edx + ebx], cl
cmp esi, 0x100
jb 0x4029d0
lea edi, [ebx + 0x100]
mov esi, ebx
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x200]
sub edx, eax
mov bh, byte [edi + 0x208]
add ecx, eax
sub esi, eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], esi
cmp eax, ecx
jae 0x402a85
sub edx, esi
mov dword [ebp + 0xc], edx
movzx esi, al
mov bl, byte [esi + edi]
add bh, bl
movzx edx, bh
movzx ecx, byte [edx + edi]
mov byte [esi + edi], cl
mov byte [edx + edi], bl
movzx ecx, byte [esi + edi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp + 0xc]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + edi]
xor cl, byte [esi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 4]
jb 0x402a50
mov byte [edi + 0x208], bh
mov dword [edi + 0x200], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402aa0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 0x204]
lea esi, [edi + 0x100]
sub dword [ebp + 8], eax
add ecx, eax
mov bh, byte [edi + 0x209]
sub edx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ecx
cmp eax, ecx
jae 0x402b1a
sub edx, dword [ebp + 8]
mov edi, edx
nop dword [eax]
mov edx, dword [ebp - 4]
movzx ecx, al
add esi, ecx
mov bl, byte [esi]
add bh, bl
movzx ecx, bh
add edx, ecx
movzx ecx, byte [edx]
mov byte [esi], cl
mov byte [edx], bl
movzx ecx, byte [esi]
mov edx, dword [ebp + 8]
add cl, bl
mov esi, dword [ebp - 4]
add edx, eax
movzx ecx, cl
inc eax
movzx ecx, byte [ecx + esi]
xor cl, byte [edi + edx]
mov byte [edx], cl
cmp eax, dword [ebp - 8]
jb 0x402ae0
mov edi, dword [ebp - 0xc]
mov byte [edi + 0x209], bh
mov dword [edi + 0x204], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x4e40d8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0x1c
call fcn.00451fa6
mov ecx, dword [ebp + 8]
mov edi, eax
mov eax, dword [ebp + 0x1c]
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [ebp + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 4], esi
mov dword [edi + 0x10], ecx
mov dword [edi + 0x18], eax
cmp byte [esi], 0
mov byte [esp + 0x18], 0
jne 0x404f7c
xor ecx, ecx
jmp 0x404f8a
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404f81
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00403be0
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], edi
push eax
push ecx
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.00408a20
mov eax, dword [esp + 0x2c]
cmp eax, 0x10
jb 0x404fc7
inc eax
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x1c]
call fcn.00402350
cmp byte [esp + 0x14], 0
jne 0x405073
cmp byte [esi], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jne 0x404ff0
xor ecx, ecx
jmp 0x404ffe
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404ff5
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00403be0
push 0x2e
push str.more_than_one_flags_defined_with_the_same_name
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.00403be0
lea edx, [esp + 0x18]
lea ecx, [esp + 0x34]
call fcn.00404e00
mov eax, dword [esp + 0x48]
cmp eax, 0x10
jb 0x405053
inc eax
lea ecx, [esp + 0x34]
push eax
push dword [esp + 0x38]
call fcn.00402350
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
cmp eax, 0x10
jb 0x405096
jmp 0x405087
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00451fe7
mov esp, ebp
pop ebp
ret 0x1c
inc eax
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x1c]
call fcn.00402350
push 0
call fcn.0045fc97
int3