joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c4a60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e80f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x10142008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, 0x10146131
call fcn.100e3445
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], 4
lea eax, [esi + 0x18]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 8
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
lea eax, [esi + 0x30]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xa
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov byte [ebp - 4], 0xd
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xe
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], cl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c6590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100ab3
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x1014614a
mov edi, dword [ebp + 0xc]
call fcn.100e3445
push esi
lea eax, [ebp - 0x38]
push eax
call fcn.100c6c40
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.100cb510
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x1c], 0
test eax, eax
jne 0x100c6626
xor bl, bl
jmp 0x100c6644
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100c663e
cmp eax, 0x80
je 0x100c663e
xor bl, bl
jmp 0x100c6644
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x1c], bl
mov byte [ebp - 4], 4
lea eax, [ebp - 0x39]
push eax
push edi
push esi
mov byte [ebp - 0x39], 0
call fcn.100c66f0
test al, al
jne 0x100c6672
cmp byte [ebp - 0x39], al
je 0x100c6672
cmp dword [esi + 0x14], 8
jb 0x100c666b
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 5
test bl, bl
je 0x100c668c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c6688
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c66ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x38]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 8
Function at 0x100c98f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x10142008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov ecx, 0x1014614a
call fcn.100e3445
push 0x110
lea eax, [esp + 0xc]
mov dword [esi + 4], 0
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
mov dword [esp + 0x10], 0x114
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x100c9991
cmp dword [esp + 8], 6
jb 0x100c9991
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.100e0d24
add esp, 0x118
ret

Function at 0x100c99b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100fce
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x10142008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x1014614a
call fcn.100e3445
push str.wintrust.dll
lea ecx, [ebp - 0x2c]
call fcn.10003030
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.100a4310
mov ecx, eax
call fcn.100a4400
mov ebx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
push str.crypt32.dll
call fcn.10003030
mov dword [ebp - 4], 5
lea eax, [ebp - 0x44]
push eax
call fcn.100a4310
mov ecx, eax
call fcn.100a4400
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.10003460
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100c9aeb
test esi, esi
je 0x100c9aeb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cb510
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10101148
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0x1014614a
call fcn.100e3445
mov eax, dword [esi]
test eax, eax
je 0x100cb55d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
lea ecx, [ebp - 0x14]
mov word [esi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.100ba510
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x100cb586
add eax, 8
jmp 0x100cb588
xor eax, eax
cmp dword [edi + 0x10], 0
je 0x100cb598
cmp dword [edi + 0x14], 8
jb 0x100cb59a
mov edi, dword [edi]
jmp 0x100cb59a
xor edi, edi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x100cb5bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100cb5bb
mov byte [esi + 5], 1
cmp dword [esi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100ba5f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 4
Function at 0x100cd640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101015f0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10142008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0x1014614a
call fcn.100e3445
mov eax, dword [esi]
test eax, eax
je 0x100cd731
cmp byte [eax + 0x54], 0
je 0x100cd731
add eax, 0x1c
lea ecx, [ebp - 0x38]
push eax
call fcn.100c4b60
push 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1009fd20
add esp, 4
mov byte [ebp - 4], 1
lea edi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [esi]
cmovae edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 8
jb 0x100cd6cc
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100cd716
push 2
push 0
push 0
push esi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.10003190
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.100c4bf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100e0d24
mov esp, ebp
pop ebp
ret 4
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021eb
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073b7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f18
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016a9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x45
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x3b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x59
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xcf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x31
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x8e
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x26
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x3a
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x31
push ebp
push ebp
push ebp
call ebx
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xd5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe8
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x7a
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xdf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x89
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xee
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xfc
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x96
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x25
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x13
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x60
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x63
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xac
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xd
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9e
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe9
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4016b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x41d00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x401729
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.0040119d
test esi, esi
je 0x401716
cmp dword [esp + 0x38], 3
jbe 0x401716
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.0040179e
pop ecx
pop ecx
test eax, eax
je 0x401716
cmp eax, dword [esp + 0x38]
je 0x401741
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00401535
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4016e2
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004021f9
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00401535
jmp 0x40172b

Function at 0x40179e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [esi + 0x10]
mov edi, dword [eax]
mov ebp, edi
xor ebp, dword [esp + 0x24]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x18], eax
jb 0x4017c4
mov esi, dword [esi]
mov dword [esp + 0x20], esi
shr edi, 2
xor ebx, ebx
mov dword [esp + 0x14], edi
test edi, edi
je 0x401821
mov dword [esp + 0x24], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
push 4
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00402e40
imul ecx, dword [esp + 0x30], 0x5bd1e991
add esp, 0xc
imul ebp, ebp, 0x5bd1e991
add esi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov dword [esp + 0x24], eax
sub edi, 1
jne 0x4017d5
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
and eax, 3
sub eax, 1
je 0x401847
sub eax, 1
je 0x40183d
sub eax, 1
jne 0x401855
movsx ebx, byte [esi + edi*4 + 2]
shl ebx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ebx, eax
movsx eax, byte [esi + edi*4]
xor eax, ebx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov eax, ebp
shr eax, 0xd
xor eax, ebp
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret

Function at 0x402b05
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402b44
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402b44
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402b44
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402b44
cmp dword [ecx + 0x74], 0xe
jbe 0x402b44
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409384
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417924
push 0x41791c
push str.FlsAlloc
push 0x1e
call fcn.00409205
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4093b8
push dword [ebp + 8]
mov ecx, esi
call dword [0x415148]
call esi
jmp 0x4093be
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409402
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417934
push 0x41792c
push str.FlsGetValue
push 0x20
call fcn.00409205
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409439
push dword [ebp + 8]
mov ecx, esi
call dword [0x415148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x403748
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx edx, word [ecx + 6]
movzx eax, word [ecx + 0x14]
push ebx
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test edx, edx
je 0x40377e
mov ecx, dword [eax + 0xc]
lea ebx, [ecx + esi]
cmp dword [ebp + 8], ebx
jb 0x403776
mov ebx, dword [eax + 8]
add ebx, ecx
add ebx, esi
cmp dword [ebp + 8], ebx
jb 0x403780
add eax, 0x28
inc edi
cmp edi, edx
jb 0x40375f
xor eax, eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x403f6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push edi
mov edi, eax
mov eax, dword [edi + 0x1a8]
cmp dword [eax], 0
jne 0x403f86
xor eax, eax
jmp 0x4040b6
push 0x2c
push dword [ebp + 8]
call fcn.00403d51
mov edx, dword [edi + 0x1ac]
lea eax, [edi + 0x22]
mov dword [ebp - 0x4c], eax
lea eax, [edi + 0x44]
mov dword [ebp - 0x48], eax
lea eax, [edi + 0x66]
mov dword [ebp - 0x44], eax
lea eax, [edi + 0x88]
mov dword [ebp - 0x40], eax
lea eax, [edi + 0xaa]
mov dword [ebp - 0x3c], eax
lea eax, [edi + 0xcc]
mov dword [ebp - 0x38], eax
lea eax, [edi + 0xee]
mov dword [ebp - 0x34], eax
lea eax, [edi + 0x110]
mov dword [ebp - 0x30], eax
lea eax, [edi + 0x132]
mov dword [ebp - 0x2c], eax
lea eax, [edi + 0x154]
push edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x28], eax
call fcn.004040ea
push eax
mov eax, dword [edi + 0x1a8]
push dword [eax]
call fcn.00403dad
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4040b6
mov ecx, dword [eax + 0x3c]
push ebx
push esi
mov esi, dword [ecx + eax + 0x78]
add esi, eax
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
mov ebx, dword [esi + 0x18]
add edi, eax
mov dword [ebp - 0x20], edi
mov edi, dword [esi + 0x14]
add ecx, eax
add edx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], edi
cmp edi, ebx
ja 0x40403c
mov dword [ebp - 8], ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 8], ebx
jbe 0x4040b4
jmp 0x40404b
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
movzx edi, word [edi + ebx*2]
cmp ebx, dword [esi + 0x18]
jae 0x4040b4
cmp edi, dword [esi + 0x14]
jae 0x4040b4
mov ebx, dword [edx + ebx*4]
mov edx, dword [ebp + 8]
mov edi, dword [ecx + edi*4]
mov dword [ebp - 4], edx
lea edx, [ebp - 0x50]
add ebx, eax
add edi, eax
sub edx, dword [ebp + 8]
mov dword [ebp - 0x14], 0xb
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x40409f
mov eax, dword [ebp - 0x24]
push dword [eax + edx]
push ebx
call fcn.00403e86
mov ecx, dword [ebp - 0xc]
test eax, eax
je 0x40409c
mov eax, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
add dword [ebp - 4], 4
dec dword [ebp - 0x14]
jne 0x40407c
mov ebx, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, dword [ebp - 8]
jb 0x404048
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x404a1f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
xor esi, esi
mov dword [ebp - 0x44], 0xa3a2a1a0
mov dword [ebp - 0x40], 0xa7a6a5a4
mov dword [ebp - 0x3c], 0x9b9a9998
mov dword [ebp - 0x38], 0x9f9e9d9c
mov dword [ebp - 0x34], 0x93929190
mov dword [ebp - 0x30], 0x97969594
mov dword [ebp - 0x2c], 0x81808988
mov dword [ebp - 0x28], 0x85848382
mov dword [ebp - 0x24], 0x79788786
mov dword [ebp - 0x20], 0x7d7c7b7a
mov dword [ebp - 0x1c], 0x71707f7e
mov dword [ebp - 0x18], 0x75747372
mov dword [ebp - 0x14], 0x69687776
mov dword [ebp - 0x10], 0xb2b1b0bf
mov dword [ebp - 0xc], 0xb6b5b4b3
mov dword [ebp - 8], 0xbebaa8b7
xor eax, eax
movzx ecx, byte [ebp + eax - 0x44]
xor ecx, 0x78
add ecx, 0x69
mov byte [ebp - 1], cl
mov cl, byte [ebp - 1]
movzx ecx, cl
mov byte [ebp + ecx - 0xc8], al
inc eax
cmp eax, 0x40
jb 0x404a9d
xor ecx, ecx
cmp dword [ebp + 8], esi
jbe 0x404b72
push edi
mov al, byte [ecx + ebx]
cmp al, 0x3d
jne 0x404ad5
xor eax, eax
jmp 0x404ae0
movzx eax, al
movzx eax, byte [ebp + eax - 0xc8]
inc ecx
mov dl, byte [ecx + ebx]
cmp dl, 0x3d
jne 0x404aef
and dword [ebp - 0x48], 0
jmp 0x404afd
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc8]
mov dword [ebp - 0x48], edx
inc ecx
mov dl, byte [ecx + ebx]
cmp dl, 0x3d
jne 0x404b0a
xor edi, edi
jmp 0x404b15
movzx edx, dl
movzx edi, byte [ebp + edx - 0xc8]
inc ecx
mov dl, byte [ecx + ebx]
cmp dl, 0x3d
jne 0x404b22
xor edx, edx
jmp 0x404b2d
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc8]
shl eax, 6
add eax, dword [ebp - 0x48]
inc ecx
shl eax, 6
add eax, edi
shl eax, 6
add eax, edx
cmp esi, dword [ebp + 0x10]
jae 0x404b68
mov edi, dword [ebp + 0xc]
mov edx, eax
shr edx, 0x10
mov byte [esi + edi], dl
inc esi
cmp esi, dword [ebp + 0x10]
jae 0x404b68
mov edx, eax
shr edx, 8
mov byte [esi + edi], dl
inc esi
cmp esi, dword [ebp + 0x10]
jae 0x404b68
mov edx, edi
mov byte [esi + edx], al
inc esi
cmp ecx, dword [ebp + 8]
jb 0x404aca
pop edi
pop esi
leave
ret 0xc
Function at 0x438c88
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
push 0x8fd119f2
pop ecx
call fcn.00438cbb
or ecx, ecx
inc ecx
xor dword [eax], ebx
dec esi
or ecx, esi
mov esi, ecx
inc eax
and ecx, esi
push 0x51b8eff0
mov ecx, dword [esp]
add esp, 4
dec ecx
cmp eax, edi
jne fcn.00438c88
inc ecx
ret
Function at 0x401fd0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40358b
push eax
mov eax, dword [section.Shared]
mov dword fs:[0], esp
sub esp, 0x14
inc eax
mov dword [section.Shared], eax
mov eax, dword [section.Shared]
cmp eax, 1
jle 0x402016
push 0
push 0
push 0x4013f8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x4013e8]
mov edx, dword [0x4013ec]
mov eax, dword [0x4013f0]
push esi
mov dword [esp + 8], ecx
mov cl, byte [0x4013f4]
push edi
push 0x9b8d8
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x24], 0
je 0x402067
mov ecx, eax
call fcn.00402e80
mov esi, eax
jmp 0x402069
xor esi, esi
mov ecx, esi
mov dword [esp + 0x24], 0xffffffff
call fcn.00402fc0
test eax, eax
je 0x40208a
lea edx, [esp + 0xc]
push 0xd
push edx
mov ecx, esi
call fcn.004031b0
mov eax, dword [esi + 0x4dc74]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x4020a8
push 0x64
call edi
mov eax, dword [esi + 0x4dc74]
test eax, eax
je 0x40209a
push 0xffffffffffffffff
call edi
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x402e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1ac
push ebx
push esi
mov esi, ecx
mov al, 0x53
mov byte [esp + 9], al
mov byte [esp + 0xb], al
mov dword [esi], 0x401ce4
mov ecx, dword [0x403918]
lea eax, [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
push eax
push ecx
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], bl
call edi
lea edx, [esp + 0x28]
push edx
push 0x202
call eax
mov ecx, dword [0x403914]
mov al, 0x65
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
lea eax, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call edi
push ebx
push ebx
push 1
push ebx
call eax
mov dword [esi + 0xc], eax
mov ecx, 0x13718
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x4dc74], ebx
mov dword [esi + 4], ebx
rep stosd dword es:[edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1ac
ret