joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4052e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x408150]
cmp ax, 0xcb
je 0x4053dc
cmp ax, 0xcc
je 0x4053dc
mov edx, dword [0x4466a0]
test edx, edx
je 0x405312
mov eax, dword [0x446540]
call edx
mov ebx, eax
jmp 0x405317
mov ebx, 0x446544
cmp word [0x446530], 0
jle 0x40533a
mov eax, 0x446510
call fcn.00405550
mov eax, ebx
call fcn.00404ec0
mov eax, ebx
call fcn.00404f30
mov edi, dword [ebx]
jmp 0x40535a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x405355
mov edx, edi
mov eax, ebx
call fcn.00404390
jmp 0x405358
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x405340
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x446530], 0
jle 0x4053dc
mov edx, 0x446450
mov eax, ebx
call fcn.004044c0
mov edi, eax
test edi, edi
je 0x4053af
mov eax, dword [0x4464e4]
mov dword [edi + 0xc], eax
cmp dword [0x4464e4], 0
je 0x4053a4
mov eax, dword [0x4464e4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x4464e4], eax
sub word [0x446530], 1
cmp word [0x446530], 0
sete bl
mov eax, 0x446510
call fcn.00405560
test bl, bl
je 0x4053dc
mov eax, 0x446510
call fcn.00405540
pop edi
pop esi
pop ebx
ret
Function at 0x406e20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x446350], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.00407000
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x446350]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004020d0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4081c0], eax
mov esi, dword [0x4081c0]
jmp 0x406fc0
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x406eb0
cmp byte [esi], 0
je 0x406fc9
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x406f25
mov al, byte [esi]
cmp al, 1
jb 0x406f1b
sub al, 0x20
jbe 0x406eec
sub al, 2
je 0x406eff
jmp 0x406f1b
mov al, byte [ebp - 0x10c]
test al, al
je 0x406f2a
add dword [ebp - 0x110], 1
jmp 0x406f22
cmp byte [esi + 1], 0x22
je 0x406f16
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x406f22
add esi, 1
jmp 0x406f22
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x406edc
test dword [ebp - 0x114], 0xffffffff
je 0x406fb9
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.00407000
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x446350]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x406fb1
mov al, byte [esi]
cmp al, 1
jb 0x406fa7
sub al, 0x20
jbe 0x406f78
sub al, 2
je 0x406f8b
jmp 0x406fa7
mov al, byte [ebp - 0x10c]
test al, al
je 0x406fb6
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x406fae
cmp byte [esi + 1], 0x22
je 0x406fa2
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x406fae
add esi, 1
jmp 0x406fae
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x406f68
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x406eb3
mov ebx, dword [ebp - 0x114]
mov dword [0x446340], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x446350
call fcn.00405140
mov eax, dword [0x446350]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x420ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x420ee4
pop dword [ebp - 0x30]
mov eax, 0xf9cb82b9
add eax, 0x6768c2b
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x709ca752
add dword [ebp - 0x40], 0xddb59df9
mov dword [ebp - 0x3c], 0x667e5434
add dword [ebp - 0x3c], 0xcbb4f811
mov dword [ebp - 0x38], 0x37985dd5
sub dword [ebp - 0x38], 0xeb4c19a7
mov dword [ebp - 0x34], 0x8e00188c
sub dword [ebp - 0x34], 0x8e00188c
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x33c0a44b
add dword [ebp - 0x40], 0x40b1c50b
mov dword [ebp - 0x3c], 0xf6234020
add dword [ebp - 0x3c], 0x4b492155
mov dword [ebp - 0x38], 0x90621904
add dword [ebp - 0x38], 0xd30d5368
mov dword [ebp - 0x34], 0x637898ce
add dword [ebp - 0x34], 0x9c876732
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xbf1faad1
add eax, 0x41228653
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3caa0
push 0
call eax
mov ecx, 0x62059b6a
add ecx, 0x9dfaa83b
mov edx, eax
mov ebx, 0xe960f18c
sub ebx, 0xe91dad8c
add ebx, dword [ebp - 0x30]
mov edi, 0xa95935ca
add edi, 0xb7bf04e7
add dword [ebp - 0x18], 0x9dc88c85
mov esi, dword [ebx]
add dword [ebp - 0x2c], esi
add esi, edi
xor dword [ebp - 0x28], edi
mov dword [edx], esi
add dword [ebp - 0x20], esi
add edx, 0x4a8d69b5
add edx, 0xb572964f
add ebx, 0xc2c60643
add ebx, 0x3d39f9c1
loop 0x421001
add eax, 0x10167
mov ebx, eax
add eax, 0x298855a7
sub eax, 0x298855a2
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438b39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x438b48
pop dword [ebp - 0x14]
mov eax, 0xea68dee3
sub eax, 0xea25539b
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x513ef
push 0
mov eax, 0xd40ba483
add eax, 0x2c3ac355
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5668
xor ebx, ebx
add ebx, eax
mov esi, 0x2e3ad5e2
sub esi, 0x2df1f5e2
add esi, dword [ebp - 0x14]
mov edi, 0x6ef65c64
mov dword [ebp - 8], 0x70350899
mov edx, dword [esi]
xor dword [ebp - 4], esi
sub edx, edi
add dword [ebp - 8], 0x20b73d28
mov dword [ebx], edx
sub dword [ebp - 0xc], 0x31061b8e
add ebx, 0x31e12886
sub ebx, 0x31e12882
add esi, 0x65e6b8a8
add esi, 0x9a19475c
loop 0x438b9d
add eax, 0x14c73
mov ebx, eax
add eax, 0x7616c539
sub eax, 0x7616c534
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x402c00
pop dword [ebp - 0x28]
mov eax, 0x402c00
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x901fb6d0
add dword [ebp - 0x38], 0xbe328e7b
mov dword [ebp - 0x34], 0x56360c3
add dword [ebp - 0x34], 0x2ccfeb82
mov dword [ebp - 0x30], 0x41ebf494
sub dword [ebp - 0x30], 0xf59fb066
mov dword [ebp - 0x2c], 0x517c378
add dword [ebp - 0x2c], 0xfae83c88
lea eax, [ebp - 0x38]
push eax
mov eax, 0x49925655
add eax, 0xb6ae2a37
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x5158b51
sub dword [ebp - 0x38], 0x90a321fb
mov dword [ebp - 0x34], 0xf5b16969
add dword [ebp - 0x34], 0x4bbaf80c
mov dword [ebp - 0x30], 0xe6012664
sub dword [ebp - 0x30], 0x8291b9f8
mov dword [ebp - 0x2c], 0x427c2625
add dword [ebp - 0x2c], 0xbd83d9db
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x5dd4fedd
add eax, 0xa26b81f7
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35f02
push 0
call eax
mov ecx, 0x886b8352
sub ecx, 0x886b3e53
mov edx, eax
mov esi, 0x6df280d7
sub esi, 0x6db170d7
add esi, dword [ebp - 0x28]
mov ebx, 0xf0e1eac
sub dword [ebp - 8], 0xa6b429f4
mov edi, dword [esi]
xor dword [ebp - 0x24], edx
xor edi, ebx
add dword [ebp - 0x10], 0xa0652af8
mov dword [edx], edi
mov dword [ebp - 8], 0x51f55a3e
add edx, 0x80f7b47d
sub edx, 0x80f7b479
add esi, 0xa7907ad2
sub esi, 0xa7907ace
loop 0x402d17
add eax, 0x106cf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8ac19635
sub ecx, 0x8a819635
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401310
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x40133e
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x401346
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x401375
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x40139b
mov eax, 0x402020
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x4013c4
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x4013c4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4013c4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.004011a7
leave
ret
Function at 0x1004805d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1004806c
pop dword [ebp - 0x10]
mov eax, 0xf878e69f
add eax, 0x178b99cd
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb8a9ecd6
add dword [ebp - 0x20], 0x95a85875
mov dword [ebp - 0x1c], 0x95a0c1eb
sub dword [ebp - 0x1c], 0x636d75a6
mov dword [ebp - 0x18], 0x820de0d5
sub dword [ebp - 0x18], 0x35c19ca7
mov dword [ebp - 0x14], 0xc64c39d4
sub dword [ebp - 0x14], 0xc64c39d4
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xeed9f37
add dword [ebp - 0x20], 0x6584ca1f
mov dword [ebp - 0x1c], 0xe0083482
sub dword [ebp - 0x1c], 0x9e9bd30d
mov dword [ebp - 0x18], 0xc30ab716
add dword [ebp - 0x18], 0xa064b556
mov dword [ebp - 0x14], 0xbb120caf
sub dword [ebp - 0x14], 0xbb120caf
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x29549504
add eax, 0xe6b16b10
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x52019
push 0
call eax
mov ecx, 0x1fd296aa
sub ecx, 0x1fd25db9
mov ebx, eax
mov esi, 0x7f672dd0
add esi, 0x90a18e30
add esi, dword [ebp - 0x10]
mov edi, 0x3c73b50e
xor dword [ebp - 8], 0x4eb8cee
mov edx, dword [esi]
xor dword [ebp - 4], 0xf3b7a0e6
add edx, edi
xor dword [ebp - 8], ecx
mov dword [ebx], edx
xor dword [ebp - 4], esi
add ebx, 4
add esi, 0x4d22851a
sub esi, 0x4d228516
loop 0x10048183
add eax, 0x2101cbf1
add eax, 0xdeff0aa6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbf2f6956
add ecx, 0x50d096aa
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403203
pop dword [ebp - 0x4c]
mov eax, 0x2d421f50
add eax, 0xd2fe12b3
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xa10ee8bd
sub dword [ebp - 0x5c], 0x52bca372
mov dword [ebp - 0x58], 0x7a3b82
add dword [ebp - 0x58], 0x31b910c3
mov dword [ebp - 0x54], 0xcb1c20a1
sub dword [ebp - 0x54], 0x7ecfdc73
mov dword [ebp - 0x50], 0x78fc3380
add dword [ebp - 0x50], 0x8703cc80
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xcbfec46a
add dword [ebp - 0x5c], 0xa873a4ec
mov dword [ebp - 0x58], 0x64f6c291
sub dword [ebp - 0x58], 0x238a611c
mov dword [ebp - 0x54], 0x8f1aa2e1
add dword [ebp - 0x54], 0xd454c98b
mov dword [ebp - 0x50], 0xbdc2b2c3
sub dword [ebp - 0x50], 0xbdc2b2c3
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xfe1e0add
sub eax, 0xfddd8a09
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x34995
push 0
call eax
mov ecx, 0x4005
mov ebx, eax
mov edi, 0xc8bf34cd
add edi, 0x3781db33
add edi, dword [ebp - 0x4c]
mov edx, 0x99bd8d76
sub edx, 0x7a2d958
sub dword [ebp - 0x40], esi
mov esi, dword [edi]
add dword [ebp - 0x30], edi
sub esi, edx
xor dword [ebp - 0x2c], edx
mov dword [ebx], esi
add ebx, 4
add edi, 0xf5974b8f
add edi, 0xa68b475
loop 0x40331a
add eax, 0x78f44014
sub eax, 0x78f34d2d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd58ac6e8
sub ecx, 0xd54ac6e8
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00408150
mov eax, dword [eax]
mov dword [ebp - 4], eax
push 1
call fcn.00408460
add esp, 4
push eax
call fcn.00409160
add esp, 4
push 1
call fcn.00408460
add esp, 4
push eax
call fcn.00408780
add esp, 4
mov ecx, dword [str.vile_manfilt]
push ecx
push str._s:
push 2
call fcn.00408460
add esp, 4
push eax
call fcn.00402cb0
add esp, 0xc
call fcn.00408150
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00409ca0
add esp, 4
push 1
call fcn.00412bd0
mov esp, ebp
pop ebp
ret
Function at 0x402a70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
mov dword [str.vile_manfilt], eax
mov dword [0x4589f8], 0x401280
mov dword [0x4589fc], 0x4012a0
push str.LC_ALL
call fcn.00412de7
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402abd
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
jne 0x402afd
push str.LC_CTYPE
call fcn.00412de7
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402add
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x402afd
push str.LANG
call fcn.00412de7
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402b65
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x402b65
push str..UTF_8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404110
add esp, 8
test eax, eax
jne 0x402b51
push str..utf_8
mov edx, dword [ebp - 4]
push edx
call fcn.00404110
add esp, 8
test eax, eax
jne 0x402b51
push str..UTF8
mov eax, dword [ebp - 4]
push eax
call fcn.00404110
add esp, 8
test eax, eax
jne 0x402b51
push str..utf8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404110
add esp, 8
test eax, eax
je 0x402b65
mov dword [0x4589f8], 0x4012c0
mov dword [0x4589fc], 0x4014c0
push 0x458a00
push 2
call fcn.00413340
add esp, 8
cmp dword [ebp + 8], 1
jle 0x402c25
mov dword [ebp - 8], 1
jmp 0x402b90
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jge 0x402c23
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ecx]
cmp edx, 0x2d
jne 0x402bd4
push 0x458090
mov eax, dword [ebp - 0x10]
push eax
call fcn.00408180
add esp, 8
test eax, eax
jne 0x402bd2
mov dword [0x4589f4], 1
jmp 0x402c1e
push 0x458094
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00409480
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402c06
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00401200
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00402670
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.00408780
add esp, 4
jmp 0x402b87
jmp 0x402c38
push 0
call fcn.00408460
add esp, 4
push eax
call fcn.00402670
add esp, 4
push 1
call fcn.00408460
add esp, 4
push eax
call fcn.00409160
add esp, 4
push 1
call fcn.00408460
add esp, 4
push eax
call fcn.00408780
add esp, 4
push 0
call fcn.00412bd0
mov esp, ebp
pop ebp
ret

Function at 0x405730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00405350
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405762
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x44213c]
call dword [ebp - 8]
jmp 0x40576c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x42bd33
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x441be0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x458d60], 1
jge 0x441c4f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x441c25
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x441c25
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x441c02
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x441c3b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x441c42
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x441d3f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x441d10
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x441d05
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x441cf9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x441d00
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x441d3f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x441d3a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x441d23
mov eax, dword [ebx + 8]
jmp 0x441d3f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x441d31
xor eax, eax
jmp 0x441d3f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x441c6f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x2a80c4de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a80c4ea
pop esi
ret

Function at 0x2a80d252
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a84c785
call fcn.2a8015aa
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a80d393
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a853564
mov ecx, edi
call fcn.2a809584
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a8523cc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a801558
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8492f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a803838
lea ecx, [ebp - 0x4c]
call fcn.2a80385d
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a808c68
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a849b38
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a84a405
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a80d358
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a80d358
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a80d3af
cmp eax, 0xe7
jne 0x2a80d399
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a80d3be
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a80d2fe
cmp dword [ebx + 4], 0xffffffff
je 0x2a80d374
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a80d383
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a803838
lea ecx, [ebp - 0x34]
call fcn.2a80385d
call fcn.2a80187a
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d3d2
lea ecx, [ebp - 0x70]
call fcn.2a80cfd1
push 0x2a85afe8
jmp 0x2a80d3e3
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a809584
push 0x2a85b040
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3