joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xd3f094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xd3f08c]
sub esp, 4
test ebx, ebx
je 0x402055
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40204e
test esi, esi
je 0x40204e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402030
mov dword [esp], 0xd3f094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402390
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4023b5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4023c0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4023b5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402408
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4023fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40240a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023f0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x49a4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov edx, dword [0xd3f044]
mov dword [esp + 0xc], edx
xor edx, edx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0xc]
sub edx, dword [0xd3f044]
jne 0x49a4eb
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp 0x49a450
call fcn.00401690
Function at 0x4b40c0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd3f044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xbc]
mov esi, dword [esp + 0xc0]
mov dword [esp + 0x3c], eax
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd3f044]
jne 0x4b4289
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x74], eax
mov eax, dword [esp]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004b26e0
call fcn.00401690
nop
nop
Function at 0x508190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd3f044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xbc]
mov esi, dword [esp + 0xc0]
mov dword [esp + 0x3c], eax
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd3f044]
jne 0x508359
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x74], eax
mov eax, dword [esp]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00507c30
call fcn.00401690
nop
nop
Function at 0x52ee50
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd3f044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xbc]
mov esi, dword [esp + 0xc0]
mov dword [esp + 0x3c], eax
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd3f044]
jne 0x52f019
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x74], eax
mov eax, dword [esp]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0052e6e0
call fcn.00401690
nop
nop
Function at 0x557680
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd3f044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xbc]
mov esi, dword [esp + 0xc0]
mov dword [esp + 0x3c], eax
mov edi, dword [esp + 0xc4]
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd3f044]
jne 0x557849
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc0], esi
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x74], eax
mov eax, dword [esp]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00557460
call fcn.00401690
nop
nop
Function at 0x58c150
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0xd3f044]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
not eax
cmp esi, 3
jbe 0x58c230
lea edx, [esi - 4]
shr edx, 2
lea ebx, [ecx + edx*4 + 4]
nop
mov edx, eax
xor al, byte [ecx]
add ecx, 4
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa87380]
mov eax, edx
xor dl, byte [ecx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa87380]
mov edx, eax
xor al, byte [ecx - 2]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa87380]
mov eax, edx
xor dl, byte [ecx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa87380]
cmp ecx, ebx
jne 0x58c180
and esi, 3
test esi, esi
je 0x58c216
mov edx, eax
xor al, byte [ebx]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa87380]
mov eax, edx
cmp esi, 1
je 0x58c216
xor al, byte [ebx + 1]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa87380]
mov eax, edx
cmp esi, 2
je 0x58c216
xor al, byte [ebx + 2]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa87380]
mov eax, edx
not eax
mov edx, dword [esp + 0xc]
sub edx, dword [0xd3f044]
jne 0x58c234
add esp, 0x14
pop ebx
pop esi
ret
mov ebx, ecx
jmp 0x58c1d1
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
Function at 0x5ab670
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x22c
movzx ebx, byte [esi]
mov eax, dword [0xd3f044]
mov dword [esp + 0x21c], eax
xor eax, eax
lea ebp, [esp + 0x1b]
cmp bl, 0x40
jg 0x5ab740
lea edi, [esp + 0x1c]
mov ecx, ebp
xor eax, eax
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
sub ecx, edi
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
test bl, bl
je 0x5ab720
xor edi, edi
jmp 0x5ab6fc
cmp bl, 0x5c
je 0x5ab701
mov dword [esp], edi
add esi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov byte [esp + eax + 0x1a], bl
mov edi, eax
movzx ebx, byte [esi]
cmp eax, 0x200
je 0x5ab720
test bl, bl
je 0x5ab720
cmp bl, 0x2f
jne 0x5ab6d0
test edi, edi
je 0x5ab6d5
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5ab840
movzx ebx, byte [esi]
jmp 0x5ab6d5
xor eax, eax
mov edx, dword [esp + 0x21c]
sub edx, dword [0xd3f044]
jne 0x5ab86d
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bl, 0x5a
jg 0x5ab780
cmp byte [esi + 1], 0x3a
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
je 0x5ab7a8
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x5ab6c6
lea eax, [ebx - 0x61]
cmp al, 0x19
jbe 0x5ab745
mov dword [esp + 0x1b], 0
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x218], 0
jmp 0x5ab764
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
lea edi, [esi + 2]
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0x3a
movzx esi, byte [esi + 2]
mov eax, esi
test al, al
je 0x5ab720
mov ebx, 2
jmp 0x5ab818
cmp al, 0x5c
je 0x5ab81e
mov dword [esp], ebx
add edi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov ebx, eax
mov eax, esi
movzx esi, byte [edi]
mov byte [esp + ebx + 0x1a], al
mov eax, esi
test al, al
je 0x5ab720
cmp ebx, 0x200
je 0x5ab720
mov eax, esi
cmp al, 0x2f
jne 0x5ab7e0
cmp ebx, 2
je 0x5ab7e4
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5ab860
movzx esi, byte [edi]
jmp 0x5ab7e4
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5ab717
mov eax, 0xffffffe9
jmp 0x5ab722
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5ab831
jmp 0x5ab84f
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422004]
jne 0x401010
repz ret
jmp fcn.004014f3

Function at 0x407a15
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c04
and dword [ebp - 4], 0
cmp dword [0x424c9c], 0
mov ebx, eax
jne 0x407ac6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407b77
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407b77
push eax
call fcn.00404b92
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x424c9c], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x424ca0], eax
call esi
push eax
call fcn.00404b92
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x424ca4], eax
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x424cac], eax
test eax, eax
je 0x407ac6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b92
pop ecx
mov dword [0x424ca8], eax
mov eax, dword [0x424ca8]
cmp eax, ebx
je 0x407b1e
cmp dword [0x424cac], ebx
je 0x407b1e
push eax
call fcn.00404c0d
push dword [0x424cac]
mov esi, eax
call fcn.00404c0d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407b1e
test edi, edi
je 0x407b1e
call esi
test eax, eax
je 0x407b15
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407b15
test byte [ebp - 0xc], 1
jne 0x407b1e
or dword [ebp + 0x10], 0x200000
jmp 0x407b57
mov eax, dword [0x424ca0]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407b57
mov eax, dword [0x424ca4]
cmp eax, ebx
je 0x407b57
push eax
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b57
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424c9c]
call fcn.00404c0d
pop ecx
test eax, eax
je 0x407b77
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407b79
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409ba0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x422004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x233c3b4], 0x930
jne 0x409bca
push 0x420658
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x233c3b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x233c1f8], eax
jne 0x409bfd
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameA
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret
Function at 0x434ea6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4baa28
push 0x40a640
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4bf2d4]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
test eax, eax
je 0x434f86
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
test eax, eax
je 0x434f86
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
test eax, eax
je 0x434f57
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
test eax, eax
je 0x434f57
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
push eax
call fcn.004047f2
pop ecx
movzx esi, ax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
push eax
call fcn.004047f2
pop ecx
movzx eax, ax
cmp esi, eax
jne 0x434f57
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
jmp 0x434f0d
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
test eax, eax
jne 0x434f73
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
jmp 0x434f9f
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
jmp 0x434eef
mov dword [ebp - 4], 0xfffffffe
jmp 0x434f9d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436551
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c5ff
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4bf2d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.00404169
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
call fcn.00404169
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
call fcn.00404169
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00404169
mov byte [ebp - 4], 3
push 0x18
push 0
mov eax, dword [ebp - 0x24]
add eax, 0x40
push eax
call fcn.004081e0
add esp, 0xc
push 0x2c00
push 0
mov eax, dword [ebp - 0x24]
add eax, 0x5c
push eax
call fcn.004081e0
add esp, 0xc
push 0x300
push 0
mov eax, dword [ebp - 0x24]
add eax, 0x2c74
push eax
call fcn.004081e0
add esp, 0xc
call dword [fcn.0044e2b4]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x58], eax
mov eax, dword [ebp - 0x24]
add eax, 0x2c5c
push eax
call dword [fcn.0044e290]
mov byte [ebp - 4], 4
call dword [fcn.0044e2b4]
push eax
call fcn.00408323
pop ecx
and dword [ebp - 0x1c], 0
jmp 0x436633
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x18
jge 0x436656
push 0x7f
push 0x21
mov ecx, dword [ebp - 0x24]
call fcn.00435578
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 0x1d]
mov byte [eax + 0x40], cl
jmp 0x43662c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
mov ecx, dword [0x4c3c94]
call fcn.0042c4ca
movzx eax, al
test eax, eax
je 0x4366f7
mov eax, dword [ebp - 0x14]
add eax, 0x10
push eax
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
add eax, 0x2c74
push eax
call fcn.00434a4f
add esp, 0x10
mov eax, dword [ebp - 0x18]
sub eax, 0x18
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x18
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x18
push eax
mov eax, dword [ebp - 0x24]
add eax, 0x2c74
push eax
call fcn.0043492d
add esp, 0x10
cmp dword [ebp + 0xc], 0x63
jge 0x4366de
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
sub eax, 0x18
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00435f49
push 0x400
push dword [ebp - 0x14]
push 0
call dword [fcn.0044e2c0]
push eax
call fcn.0042ee0b
add esp, 0xc
jmp 0x436706
mov dword [ebp - 4], 3
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8