joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e4b
Capabilities:
Reference http user-agent string

Disassembly:
push 0xc58
mov eax, 0x430439
call fcn.0041be96
mov esi, edx
mov ebx, ecx
xor eax, eax
push 0xc2f
push eax
mov dword [ebp - 0xc58], eax
mov byte [ebp - 0xc40], al
lea eax, [ebp - 0xc3f]
push eax
call fcn.004188f0
add esp, 0xc
mov dword [ebp - 0xc54], 0xc30
lea eax, [ebp - 0xc54]
xor edi, edi
push eax
lea eax, [ebp - 0xc40]
push eax
push edi
call dword [sym.imp.urlmon.dll_ObtainUserAgentString]
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], edi
call fcn.00412f7e
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040f3c2
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc50], edi
jge 0x403f2c
cmp dword [ebp - 0xc4c], edi
mov edi, dword [ebp - 0xc48]
push 0x60
pop eax
cmovne eax, dword [ebp - 0xc4c]
push eax
push dword [ebp - 0xc50]
push ecx
lea ecx, [edi - 0x10]
mov esi, esp
call fcn.00413040
add eax, 0x10
lea ecx, [ebp - 0xc64]
mov dword [esi], eax
call fcn.004130db
lea eax, [ebp - 0xc64]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00402691
mov ecx, dword [ebp - 0xc5c]
add ecx, 0xfffffff0
call fcn.004130bf
lea ecx, [edi - 0x10]
call fcn.004130bf
jmp 0x403f84
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc48]
lea ecx, [ecx - 0x10]
call fcn.004130bf
lea eax, [ebp - 0xc40]
push eax
lea ecx, [ebp - 0xc44]
call fcn.00412310
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00412862
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc44]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov dword [ebx], edi
mov dword [ebx + 4], edi
call fcn.00412f7e
push eax
lea ecx, [ebx + 8]
call fcn.0040f3c2
mov eax, ebx
call fcn.0041be45
ret
Function at 0x406cbc
Capabilities:
Get hostname

Disassembly:
push 0x54
mov eax, 0x430a32
call fcn.0041be96
mov dword [ebp - 0x44], edx
mov ebx, ecx
and dword [ebp - 0x60], 0
call fcn.00412f7e
push eax
lea ecx, [ebp - 0x34]
call fcn.0040f3c2
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push 1
push eax
push str.MachineGuid
push str.SOFTWAREMicrosoftCryptography
mov edx, 0x80000002
lea ecx, [ebp - 0x40]
call fcn.004036a9
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x40], 0
jge 0x406d64
cmp dword [ebp - 0x3c], 0
mov edi, dword [ebp - 0x38]
push 0x15
pop eax
cmovne eax, dword [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
push ecx
lea ecx, [edi - 0x10]
mov esi, esp
call fcn.00413040
add eax, 0x10
lea ecx, [ebp - 0x54]
mov dword [esi], eax
call fcn.004130db
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.00402691
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.004130bf
lea ecx, [edi - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
jmp 0x406eb2
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.004130bf
xor eax, eax
mov dword [ebp - 0x5c], 0x10
push 7
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
setne al
test al, al
jne 0x406df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x18
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412f7e
push eax
mov ecx, esi
call fcn.0040f3c2
lea ecx, [ebp - 0x54]
call fcn.004130db
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call fcn.00402691
mov ecx, dword [ebp - 0x4c]
jmp 0x406ea4
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x48]
call fcn.0040e5b7
mov byte [ebp - 4], 4
mov esi, esp
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00413040
mov edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
add eax, 0x10
mov dword [esi], eax
call fcn.00406aed
pop ecx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x40], 0
jge 0x406e7d
cmp dword [ebp - 0x3c], 0
push 0x1a
pop eax
cmovne eax, dword [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x38]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00413040
add eax, 0x10
lea ecx, [ebp - 0x54]
mov dword [esi], eax
call fcn.004130db
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 6
push eax
mov ecx, ebx
call fcn.00402691
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.004130bf
jmp 0x406ea1
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.004130bf
and dword [ebx], 0
and dword [ebx + 4], 0
call fcn.00412f7e
push eax
lea ecx, [ebx + 8]
call fcn.0040f3c2
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov eax, ebx
call fcn.0041be45
ret
Function at 0x4079cb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x430bac
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x44435c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor edi, edi
cmp dword [ecx + 8], 0xffffffff
mov dword [esp + 0x14], edi
je 0x407af7
cmp dword [ecx + 8], edi
je 0x407af7
mov esi, dword [ebp + 0x18]
lea eax, [esp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
mov dword [esp + 0x20], edi
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
test al, al
jne 0x407a94
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x113
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412f7e
push eax
mov ecx, esi
call fcn.0040f3c2
lea ecx, [esp + 0x28]
call fcn.004130db
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x44], edi
call fcn.00402691
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.004130bf
mov eax, dword [ebp + 8]
jmp 0x407b1e
cmp dword [esp + 0x10], esi
sete al
test al, al
jne 0x407b06
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x114
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412f7e
push eax
mov ecx, esi
call fcn.0040f3c2
lea ecx, [esp + 0x34]
call fcn.004130db
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x44], 1
call fcn.00402691
mov ecx, dword [esp + 0x30]
jmp 0x407a84
push edi
push dword [ebp + 0x18]
add ecx, 0x10
push dword [ebp + 0x14]
call fcn.0040e709
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.00412f7e
push eax
lea ecx, [esi + 8]
call fcn.0040f3c2
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40bd3c
Capabilities:
Access the windows event log

Disassembly:
push 0x18
mov eax, 0x43160d
call fcn.0041be63
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00412f7e
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f3c2
mov byte [ebp - 4], 1
mov eax, dword [0x447020]
cmp dword [eax - 0xc], ebx
je 0x40bdb5
push 0x447020
mov edx, str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x14]
call fcn.0040e61c
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
push ecx
push str.DisplayName
push dword [eax]
mov edx, 0x80000002
lea ecx, [ebp - 0x24]
call fcn.004036a9
mov ecx, dword [ebp - 0x1c]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004130bf
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
jne 0x40bdcd
push str.Ninite_Service
lea ecx, [ebp - 0x10]
call fcn.00412bd1
mov esi, dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
test edi, edi
je 0x40bdfc
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea ecx, [esi - 0x10]
call fcn.004130bf
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004130bf
call fcn.0041be31
ret

Function at 0x40c804
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea ebx, [ecx + 0x25]
mov dword [ebp - 4], ecx
push 0
mov dword [ebx], 0x3a8
mov dword [ecx + 0x2d], 1
mov dword [ecx + 0x31], 7
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
push 0
push 0x32
call esi
push eax
push 0x31
call esi
push eax
push 1
push 1
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, dword [ebp - 4]
mov dword [esi + 0x39], eax
lea ecx, [esi + 0x3d]
mov eax, dword [esi + 4]
mov dword [esi + 0x29], eax
push dword [0x447018]
call fcn.00411f91
push ebx
xor ebx, ebx
mov dword [esi + 0x35], 0x401
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push ebx
push ebx
push dword [esi + 4]
push 0x40c51f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x44700c], eax
test eax, eax
jne 0x40c8ce
call fcn.004128b0
push ebx
push ebx
mov edx, eax
lea ecx, [ebp - 4]
call fcn.004123c8
pop ecx
pop ecx
push ebx
push str.Error
push dword [eax]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004130bf
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c989
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp edi, 1
jne 0x40c9c7
push ecx
mov ecx, esi
mov dword [esi + 0x3e4], 1
call fcn.0040c804
mov dword [ebx], eax
cmp dword [esi + 0x3e4], 0
je 0x40ca1e
xor eax, eax
inc eax
jmp 0x40ca91
cmp edi, 0x111
jne 0x40ca1e
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esi + 0x3e4], 1
cmp eax, 6
je 0x40ca0d
cmp eax, 0x8004
jne 0x40ca19
cmp byte [0x446fc4], 0
jne 0x40ca19
lea eax, [esi + 0x25]
push eax
push 2
call ecx
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40ca19
lea eax, [esi + 0x25]
push eax
push 2
call ecx
mov byte [esi + 0x24], 1
and dword [ebx], 0
jmp 0x40c9b6
cmp edi, dword [esi + 0x3e0]
jne 0x40ca52
cmp byte [esi + 0x24], 0
mov dword [esi + 0x3e4], 1
jne 0x40ca42
lea eax, [esi + 0x25]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
and dword [ebx], 0
cmp dword [esi + 0x3e4], 0
jne 0x40c9bf
cmp edi, 0x401
jne 0x40ca98
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x3e4], 1
sub eax, 0x7b
je 0x40ca78
sub eax, 0x186
je 0x40ca78
sub eax, 3
jne 0x40ca7f
mov ecx, esi
call fcn.0040c8d9
and dword [ebx], 0
cmp dword [esi + 0x3e4], 0
jne 0x40c9bf
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
cmp edi, 0x400
jne 0x40cac6
mov dword [esi + 0x3e4], 1
lea ecx, [esi + 0x3d]
push dword [0x447018]
call fcn.00411f91
lea eax, [esi + 0x25]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x40ca7f
cmp edi, 2
jne 0x40ca8f
lea eax, [esi + 0x25]
mov dword [esi + 0x3e4], 1
push eax
push edi
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40ca7f
Function at 0x4129aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412a03
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4129f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4129f0
cmp esi, ecx
jae 0x4129f4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x4129e0
cmp esi, ecx
jb 0x4129f8
xor eax, eax
jmp 0x412a02
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41310f
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], vtable.SHA1.0
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x60], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov word [ecx + 0x64], ax
mov eax, ecx
ret
Function at 0x4131cc
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x44435c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x154], esi
xor edi, edi
lea edx, [esi + 0x21]
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
lea edx, [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + edi*4 - 0x144], ecx
inc edi
cmp edi, 0x10
jl 0x4131ef
push 0x40
lea ecx, [ebp - 0x13c]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
dec edx
jne 0x413226
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
and dword [ebp - 0x158], edx
mov dword [ebp - 0x150], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x148], eax
mov eax, dword [esi + 0x14]
mov esi, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x150]
mov ecx, ebx
not ecx
rol edx, 5
and ecx, esi
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x158]
add edx, ecx
mov ecx, dword [ebp - 0x14c]
add ecx, 0x5a827999
mov dword [ebp - 0x14c], esi
mov esi, edi
mov edi, ebx
add edx, dword [ebp + eax*4 - 0x144]
mov ebx, dword [ebp - 0x150]
add edx, ecx
ror edi, 2
inc eax
push 0x14
pop ecx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x158], eax
cmp eax, ecx
jl 0x413269
mov dword [ebp - 0x148], esi
mov eax, esi
xor eax, edi
rol edx, 5
xor eax, ebx
add edx, eax
mov eax, dword [ebp - 0x14c]
add edx, dword [ebp + ecx*4 - 0x144]
add eax, 0x6ed9eba1
add edx, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc ecx
mov dword [ebp - 0x150], edx
cmp ecx, 0x28
jl 0x4132ca
push 0x28
pop esi
mov ecx, edi
rol edx, 5
or ecx, ebx
add edx, 0x8f1bbcdc
add edx, dword [ebp - 0x14c]
and ecx, eax
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x148]
add ecx, dword [ebp + esi*4 - 0x144]
mov dword [ebp - 0x14c], eax
add edx, ecx
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc esi
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x150], edx
cmp esi, 0x3c
jl 0x413315
mov esi, dword [ebp - 0x154]
push 0x3c
pop ecx
xor eax, edi
rol edx, 5
add edx, dword [ebp - 0x14c]
xor eax, ebx
add eax, 0xca62c1d6
add eax, dword [ebp + ecx*4 - 0x144]
add edx, eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 0x148], eax
mov ebx, dword [ebp - 0x150]
ror edi, 2
inc ecx
mov dword [ebp - 0x150], edx
cmp ecx, 0x50
jl 0x41336d
add dword [esi + 0xc], edi
add dword [esi + 0x10], eax
add dword [esi + 8], ebx
add dword [esi + 4], edx
mov eax, dword [ebp - 0x14c]
add dword [esi + 0x14], eax
and dword [esi + 0x60], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004183eb
mov esp, ebp
pop ebp
ret
Function at 0x4133dd
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov byte [eax + esi + 0x20], 0x80
inc dword [esi + 0x60]
cmp eax, 0x37
mov eax, dword [esi + 0x60]
jle 0x41342a
jmp 0x413400
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x40
jl 0x4133f5
call fcn.004131cc
jmp 0x413417
mov eax, dword [esi + 0x60]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
cmp dword [esi + 0x60], 0x38
jl 0x41340c
jmp 0x41342f
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x38
jl 0x41341f
mov al, byte [esi + 0x1f]
mov ecx, esi
mov byte [esi + 0x58], al
mov al, byte [esi + 0x1e]
mov byte [esi + 0x59], al
mov al, byte [esi + 0x1d]
mov byte [esi + 0x5a], al
mov al, byte [esi + 0x1c]
mov byte [esi + 0x5b], al
mov al, byte [esi + 0x1b]
mov byte [esi + 0x5c], al
mov al, byte [esi + 0x1a]
mov byte [esi + 0x5d], al
mov al, byte [esi + 0x19]
mov byte [esi + 0x5e], al
mov al, byte [esi + 0x18]
mov byte [esi + 0x5f], al
pop esi
jmp fcn.004131cc
Function at 0x4159be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x415a59
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.00418b80
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
dec edi
jne 0x415a12
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
dec edi
jne 0x415a37
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x415b14
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x415a86
xor eax, eax
jmp 0x415ad7
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x415aa3
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00414a78
jmp 0x415abb
cmp eax, 2
jne 0x415abf
mov edx, dword [esi]
test edx, edx
jne 0x415ab2
xor eax, eax
jmp 0x415abc
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00415080
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.00418b80
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x415aff
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x415b14
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4159cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b62d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44435c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041e145
mov dword [ebp - 0x14], eax
cmp dword [0x446fa4], esi
jne 0x42b720
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x42b6ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42b800
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42b800
push 0x4397e8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42b800
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x446fa4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x446fa8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x446fac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x446fb4], eax
test eax, eax
je 0x42b71d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x446fb0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42b745
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42b738
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42b75a
push 4
pop eax
jmp 0x42b802
cmp dword [ebp - 0x14], esi
je 0x42b75a
push dword [0x446fa4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42b73f
mov eax, dword [0x446fb0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42b7b8
cmp dword [0x446fb4], edi
je 0x42b7b8
push eax
call ebx
push dword [0x446fb4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42b7b8
test eax, eax
je 0x42b7b8
call ecx
test eax, eax
je 0x42b7ad
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42b7ad
test byte [ebp - 8], 1
jne 0x42b7b8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42b7e8
mov eax, dword [0x446fa8]
cmp eax, edi
je 0x42b7e5
push eax
call ebx
test eax, eax
je 0x42b7e5
call eax
mov esi, eax
test esi, esi
je 0x42b7e5
mov eax, dword [0x446fac]
cmp eax, edi
je 0x42b7e5
push eax
call ebx
test eax, eax
je 0x42b7e5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x446fa4]
call ebx
test eax, eax
je 0x42b800
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42b802
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004183eb
mov esp, ebp
pop ebp
ret