joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ac46
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435220
push 0x43b048
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.0043af30
add esp, 4
test eax, eax
je 0x43ac91
mov ecx, eax
call fcn.0043abb0
mov dword [ebp - 0x1c], eax
jmp 0x43ac98
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.0043ab10
test eax, eax
je 0x43acd2
cmp dword [ebp - 0x1c], 0
je 0x43acc8
mov ecx, dword [ebp - 0x1c]
call fcn.0043ac20
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0043af40
add esp, 4
mov eax, 0x2a
jmp 0x43adfe
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.0043a120
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x43ad01
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0043a2a0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x43ad44
mov esi, eax
test esi, esi
je 0x43ad32
mov ecx, esi
call fcn.0043ac20
push esi
call fcn.0043af40
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x43adfe
mov ecx, dword [ebp - 0x20]
call fcn.0043a550
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x43ad8c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x43ad86
mov esi, eax
test esi, esi
je 0x43ad77
mov ecx, esi
call fcn.0043ac20
push esi
call fcn.0043af40
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x43adfe
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00439d00
mov ecx, dword [ebp - 0x20]
call fcn.0043a6b0
xor dword [ebp - 0x24], eax
wait
jmp 0x43adcd
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x43adee
mov ecx, dword [ebp - 0x1c]
call fcn.0043ac20
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0043af40
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x43adfb
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b7c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0x43b7ef
sub eax, 0x40
je 0x43b7e8
sub eax, 0x40
je 0x43b7e1
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0x43b7f4
mov edi, 6
jmp 0x43b7f4
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x43b7fe
mov eax, ecx
sub eax, 0x80
je 0x43b825
sub eax, 0x40
je 0x43b81e
sub eax, 0x40
je 0x43b817
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0x43b82a
mov ebp, 0xc
jmp 0x43b82a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.0043b8c0
add esp, 0xc
cmp ebp, 1
jle 0x43b887
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0x434cf8
push esi
call fcn.0043b9a0
push edi
push 0
push esi
call fcn.0043b910
push edi
push esi
call fcn.0043b9e0
push edi
push ebx
push esi
call fcn.0043b8c0
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0x43b84e
mov ebx, dword [esp + 0x20]
push edi
push 0x434cf8
push esi
call fcn.0043b9a0
push edi
push 0
push esi
call fcn.0043b910
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.0043b8c0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x43b8c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x43b8f3
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x43b8ea
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x43b8dc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x403ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ba39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 1
push eax
push 0x2706
call sub.MFC42.DLL_CDialog::CDialog
lea edi, [esi + 0x60]
mov byte [esp + 0x18], 2
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40db6c
lea edi, [esi + 0xa0]
mov byte [esp + 0x18], 3
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40daa8
lea edi, [esi + 0xe0]
mov byte [esp + 0x18], 4
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40d9e8
lea edi, [esi + 0x120]
mov byte [esp + 0x18], 5
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40d928
lea edi, [esi + 0x160]
mov byte [esp + 0x18], 6
mov ecx, edi
call fcn.0040aaae
lea ebx, [esi + 0x164]
mov byte [esp + 0x18], 7
mov ecx, ebx
call fcn.0040aaae
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 8
push ecx
mov ecx, edi
mov dword [esi], 0x40d850
call sub.MFC42.DLL_CString::operator_1
lea edx, [esp + 0x24]
mov ecx, ebx
push edx
call sub.MFC42.DLL_CString::operator_1
mov cl, byte [esp + 0x28]
mov dl, byte [esp + 0x2c]
mov byte [esi + 0x16c], cl
mov cl, byte [esp + 0x30]
xor eax, eax
mov byte [esi + 0x16e], cl
lea ecx, [esp + 0x20]
mov dword [esi + 0x168], eax
mov byte [esi + 0x16d], dl
mov byte [esi + 0x16f], al
mov byte [esp + 0x18], al
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x403cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40bb11
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 0
push eax
push 0x2706
call sub.MFC42.DLL_CDialog::CDialog
lea edi, [esi + 0x60]
mov byte [esp + 0x18], 1
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40db6c
lea edi, [esi + 0xa0]
mov byte [esp + 0x18], 2
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40daa8
lea edi, [esi + 0xe0]
mov byte [esp + 0x18], 3
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40d9e8
lea edi, [esi + 0x120]
mov byte [esp + 0x18], 4
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x40d928
lea edi, [esi + 0x160]
mov byte [esp + 0x18], 5
mov ecx, edi
call fcn.0040aaae
lea ebp, [esi + 0x164]
mov byte [esp + 0x18], 6
mov ecx, ebp
call fcn.0040aaae
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 7
push ecx
mov ecx, edi
mov dword [esi], 0x40d850
call sub.MFC42.DLL_CString::operator_1
push 0x4116fc
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 0x24]
mov cl, byte [esp + 0x2c]
mov al, byte [esp + 0x28]
mov dword [esi + 0x168], edx
mov dl, byte [esp + 0x30]
mov byte [esi + 0x16d], cl
lea ecx, [esp + 0x20]
mov byte [esi + 0x16c], al
mov byte [esi + 0x16e], dl
mov byte [esi + 0x16f], 0
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x404430
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x40bbb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x40445c
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi], 0
lea eax, [esp + 4]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4044be
mov eax, dword [esp + 0x18]
push 0
push 0
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x404482
push 0
push 0
jmp 0x404485
push eax
push 3
push str.MyDown
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
push ebx
lea ecx, [esp + 0x1c]
mov dword [esi], eax
mov dword [esp + 0x14], 0xffffffff
setne bl
call sub.MFC42.DLL_CString::CString
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x404d10
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x40bccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi]
mov dword [esp + 0x440], 1
test eax, eax
je 0x404ea9
mov ecx, dword [0x411420]
mov eax, dword [str.Accept:___r_n_r_n]
mov edx, dword [0x411424]
mov edi, dword [esp + 0x448]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov eax, dword [0x411428]
push 0
lea ecx, [esp + 0x2c]
push 0x84000100
push ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x30]
push eax
mov eax, dword [esi]
push edx
push edi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebp, eax
test ebp, ebp
je 0x404ea9
lea ecx, [esp + 0x10]
push 0
lea edx, [esp + 0x18]
push ecx
push edx
push 0x20000005
push ebp
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x404ef2
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFile::CFile
mov eax, dword [esp + 0x44c]
push 0
push 0x9001
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x44c], 2
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x404e98
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
stosw word es:[edi], ax
push ecx
push 0x400
push edx
push ebp
stosb byte es:[edi], al
xor esi, esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x404e98
mov edi, dword [esp + 0x450]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404ed8
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::Write
add esi, dword [esp + 0x10]
test edi, edi
je 0x404e7e
lea eax, [esi + esi*4]
xor edx, edx
mov ecx, dword [edi + 0x20]
push 0
lea eax, [eax + eax*4]
shl eax, 2
div dword [esp + 0x18]
push eax
push 0x402
push ecx
call ebx
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
push 0x400
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x404e3e
lea ecx, [esp + 0x18]
mov byte [esp + 0x440], 1
call fcn.0040ac10
lea ecx, [esp + 0x448]
mov byte [esp + 0x440], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44c]
mov dword [esp + 0x440], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x404f1f
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0x18]
mov byte [esp + 0x440], 1
call fcn.0040ac10
lea ecx, [esp + 0x448]
mov byte [esp + 0x440], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44c]
mov dword [esp + 0x440], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov al, 1
mov ecx, dword [esp + 0x438]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x434
ret 0xc
Function at 0x4052c0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x40bd89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x134], 0
call fcn.0040aaae
mov ebx, 1
push 0x2e
lea ecx, [esp + 0x140]
mov byte [esp + 0x138], bl
call sub.MFC42.DLL_CString::ReverseFind
test eax, eax
jle 0x405376
push 0x5c
lea ecx, [esp + 0x140]
call sub.MFC42.DLL_CString::ReverseFind
push 0x2e
lea ecx, [esp + 0x140]
mov esi, eax
call sub.MFC42.DLL_CString::ReverseFind
cmp eax, esi
jle 0x405376
push 0x5c
lea ecx, [esp + 0x140]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x144]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x138], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], bl
call sub.MFC42.DLL_CString::CString
jmp 0x405387
lea ecx, [esp + 0x13c]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x14]
push edx
push eax
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
je 0x4053a8
test byte [esp + 0x24], 0x10
jne 0x405476
push ebx
push 0x5c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find_2
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40542b
lea ecx, [esp + 0x10]
push esi
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Left
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x13c], 3
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
jne 0x405407
push 0x5c
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find_1
test eax, eax
jle 0x405407
mov ecx, dword [esp + 0x10]
push 0
push ecx
call edi
test eax, eax
je 0x405464
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], bl
call sub.MFC42.DLL_CString::CString
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call sub.MFC42.DLL_CString::Find_2
mov esi, eax
cmp esi, 0xffffffff
jne 0x4053c1
mov edx, dword [esp + 0xc]
push 0
push edx
call edi
test eax, eax
jne 0x405476
lea ecx, [esp + 0xc]
mov byte [esp + 0x134], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x13c]
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x4054a0
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], bl
call sub.MFC42.DLL_CString::CString
jmp 0x405438
lea ecx, [esp + 0xc]
mov byte [esp + 0x134], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x13c]
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov al, bl
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x12c
ret
Function at 0x405710
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x40be80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push edi
lea eax, [esp + 0x58]
mov dword [esp + 0x50], 3
push eax
call fcn.00405970
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call sub.MFC42.DLL_CString::CString_2
call fcn.004051f0
add esp, 4
test al, al
je 0x4057bf
mov bl, byte [esp + 0x5c]
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov al, bl
mov ecx, dword [esp + 0x6c]
neg al
sbb eax, eax
mov edx, dword [esp + 0x58]
and eax, 0x40
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x68]
or al, 0x80
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x64]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40580d
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x60]
mov byte [esp + 0x50], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x50], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x6c]
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop edi
pop ebx
add esp, 0x4c
ret
test bl, bl
je 0x405829
mov ecx, dword [esp + 0x44]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x60]
mov byte [esp + 0x50], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x68]
mov byte [esp + 0x50], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x6c]
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x48]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x4c
ret
Function at 0x405880
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40bebf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov dword [esp + 0x14], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 1
call fcn.0040aaae
push 0
push 0
push 0
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::GetBuffer
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
call ebp
mov edi, eax
test edi, edi
jbe 0x405922
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
lea ecx, [esp + 0x2c]
push edi
push esi
push 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call ebp
push esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x407150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40c3a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString_2
call fcn.00407670
mov esi, eax
add esp, 4
test esi, esi
je 0x407272
lea ecx, [esp + 0x34]
lea edx, [esp + 0xc]
push ecx
push 0x411444
push edx
call sub.MFC42.DLL_operator_2
push 0x411440
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x2c], 3
push eax
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 0x30]
lea edx, [esp + 4]
push ecx
push eax
push edx
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 4]
mov byte [esp + 0x24], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x30]
push 0
push 0x7530
push 0
mov ecx, dword [eax - 8]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
inc ecx
push eax
push esi
push 0x4a
push esi
mov dword [esp + 0x30], ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
xor al, al
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret
Function at 0x407b40
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x40c5a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x34], ebx
cmp dword [eax - 8], ebx
jne 0x407b78
push str.dexplorer
lea ecx, [esp + 0x44]
call sub.MFC42.DLL_CString::operator
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push eax
call fcn.00407a90
add esp, 8
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CByteArray::CByteArray
mov eax, dword [esp + 0x40]
xor esi, esi
mov byte [esp + 0x34], 2
cmp dword [eax - 8], ebx
jle 0x407bef
mov cl, byte [esi + eax]
mov eax, dword [esp + 0x20]
mov byte [esp + 0x14], cl
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x14]
push edx
push eax
call sub.MFC42.DLL_CByteArray::SetAtGrow
mov eax, dword [esp + 0x40]
inc esi
cmp esi, dword [eax - 8]
jl 0x407bcb
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], ebx
cmp word [esi], 0x2011
je 0x407c1a
push 0x2011
push ebx
push esi
push esi
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
cmp eax, ebx
jge 0x407c1a
push eax
call fcn.0040b298
mov edx, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov eax, dword [esi + 8]
xor ecx, ecx
cmp dword [eax + 0x10], ebx
jle 0x407c4f
mov eax, ecx
cdq
idiv edi
mov eax, dword [esp + 0x1c]
mov dl, byte [edx + eax]
mov eax, dword [esp + 0xc]
xor byte [ecx + eax], dl
mov edx, dword [esi + 8]
inc ecx
cmp ecx, dword [edx + 0x10]
jl 0x407c33
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], bl
call fcn.0040ace2
lea ecx, [esp + 0x40]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret

Function at 0x4082c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40c688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
lea ecx, [esp + 4]
mov dword [esp + 0x20], 1
call fcn.0040aaa8
mov eax, dword [esp + 0x30]
push 1
push 0
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov byte [esp + 0x34], 2
call fcn.00407f30
add esp, 0x14
lea eax, [esp + 4]
lea edx, [esp + 0x28]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call sub.MFC42.DLL_CString::CString_2
call fcn.00408220
add esp, 8
lea ecx, [esp + 4]
mov bl, al
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret