joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, 4
mov ecx, dword [ebx]
xor dword [eax], ecx
add eax, edi
add ebx, edi
mov ecx, dword [ebx]
xor dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
xor edx, edx
xor edi, edi
mov esi, 7
mov dl, byte [ebx + edi]
xor byte [eax], dl
inc eax
inc edi
and edi, esi
dec ecx
jne 0x40d22f
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40de67
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x480a8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.0044ce10
xor ebx, ebx
lea ecx, [esi + 0x34c]
mov dword [esp + 0x18], ebx
call fcn.004010d0
mov dword [esi], 0x484a90
mov al, byte [0x4ccaf8]
mov byte [esi + 4], al
lea edi, [esi + 0x80]
mov ecx, 0x80
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x334]
mov dword [esi + 0x280], ebx
mov al, 0xff
mov dword [esi + 0x284], ebx
push ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov dword [esi + 0x28c], 0x10
mov byte [esi + 0x28a], al
mov byte [esi + 0x289], al
mov byte [esi + 0x288], al
mov dword [esi + 0x290], 1
mov dword [esi + 0x294], ebx
mov byte [esi + 0x348], bl
mov byte [esi + 0x349], bl
mov byte [esi + 0x298], bl
mov byte [esi + 0x299], bl
mov dword [esi + 0x344], ebx
call dword [0x483514]
lea edi, [esi + 0x3a0]
mov ecx, 0x10
mov eax, str.TEST.GSF
mov byte [esi + 0x39c], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x3e0], ebx
mov byte [esi + 0x3e4], bl
mov dword [esi + 0x3e8], ebx
mov dword [esi + 0x3ec], ebx
mov dword [esi + 0x3f0], ebx
mov dword [esi + 0x3f4], ebx
mov dword [esi + 0x3f8], ebx
mov dword [esi + 0x400], ebx
mov dword [esi + 0x3fc], ebx
mov dword [esi + 0x404], 0x1e
mov dword [esi + 0x40c], 1
mov dword [esi + 0x408], 2
mov dword [esi + 0x410], 0x50
mov byte [esi + 0x414], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x414150
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x480ce0
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
xor esi, esi
cmp eax, esi
mov ebp, ecx
je 0x4142a4
cmp dword [esp + 0x30], esi
je 0x4142a4
mov ebx, dword [esp + 0x38]
cmp ebx, esi
je 0x4142a4
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x484a94
mov al, byte [esp + 0x50]
mov ecx, 0x4cca20
neg al
sbb eax, eax
mov dword [esp + 0x20], esi
and eax, 0x1f4
add eax, 0x190
mov edi, eax
call fcn.0044f6f0
cmp eax, esi
mov esi, dword [esp + 0x40]
je 0x414213
mov cl, byte [eax + 0x3c]
mov dl, byte [ebp + 0x294]
mov byte [esp + 0x50], cl
push eax
mov eax, dword [esp + 0x54]
push 1
mov byte [esp + 0x44], dl
push 0
mov ecx, dword [esp + 0x48]
push 0
and eax, 0xff
push 0
push eax
push 0
and ecx, 0xff
push 0
push ecx
push edi
push 0
push 0
push 0
push esi
call dword [0x4830a4]
push eax
lea ecx, [esp + 0x14]
call fcn.0047da84
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push edx
push eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x51]
lea edx, [esp + 0x1c]
push esi
push edx
mov edx, dword [esp + 0x5a]
push eax
push ecx
mov ecx, dword [esp + 0x44]
push edx
push ebp
push edi
call fcn.0040ba40
mov dword [ebx], edi
mov edi, dword [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 4], ebp
mov edx, dword [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [esp + 0x4c]
imul ecx, esi
add ebp, esi
add ecx, edx
add ebp, eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ebp
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0047dadb
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x2c
mov ecx, dword [esp + 0x14]
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x2c
Function at 0x43e320
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0043e5d0
mov al, byte [esp + 0xc]
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x14]
mov byte [0x4c69c4], al
mov eax, dword [0x4ccd64]
push 0x4c69c0
push 0
mov dword [0x4c69c0], esi
mov byte [0x4c69c5], cl
mov byte [0x4c69c6], dl
push 0x43e380
mov byte [eax + 0xa62], 1
call fcn.0046c707
add esp, 0xc
pop esi
ret 0x10
Function at 0x45f5aa
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 0x120
cmp dword [esp + 0x10], esi
mov eax, dword [edi]
jae 0x45f5ce
push eax
call fcn.00461426
push 2
call fcn.004613ac
pop ecx
mov dword [edi], eax
pop ecx
push esi
push 0
push eax
call fcn.0046e440
add esp, 0xc
pop edi
pop esi
ret

Function at 0x45fa3b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push 1
call fcn.004613bd
mov esi, eax
add esp, 0xc
test esi, esi
mov dword [ebp - 8], esi
je 0x45fa93
push esi
call fcn.0045fa03
push 0
push esi
call fcn.0046e498
add esp, 0xc
test eax, eax
je 0x45fa9a
mov edi, dword [ebp - 8]
push dword [edi + 0xac]
lea esi, [edi + 0xac]
push edi
call fcn.004614e0
and dword [esi], 0
push edi
call fcn.00461426
add esp, 0xc
xor eax, eax
jmp 0x45fbf8
push dword [ebp + 0x20]
mov esi, dword [ebp - 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
call fcn.0046154d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00461392
mov ecx, dword [ebp + 8]
mov edi, 0x487918
mov dword [ebp - 4], ecx
add esp, 0x20
sub dword [ebp - 4], edi
mov eax, edi
mov edx, 0x20000
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + eax]
cmp bl, byte [eax]
je 0x45fae0
or dword [esi + 0x6c], edx
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x45fad3
test dword [esi + 0x6c], edx
je 0x45fb5e
test ecx, ecx
je 0x45fb33
mov al, byte [ecx]
cmp al, byte [0x487918]
jne 0x45fb13
cmp al, 0x31
jne 0x45fb09
mov dl, byte [ecx + 2]
cmp dl, byte [0x48791a]
jne 0x45fb13
cmp al, 0x30
jne 0x45fb5e
cmp byte [ecx + 2], 0x39
jge 0x45fb5e
test ecx, ecx
je 0x45fb33
push ecx
lea eax, [ebp - 0x58]
push str.Application_was_compiled_with_png.h_from_libpng__.20s
push eax
call fcn.0046bf08
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.0046118d
add esp, 0x14
push edi
lea eax, [ebp - 0x58]
push str.Application__is_running_with_png.c_from_libpng__.20s
push eax
call fcn.0046bf08
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.0046118d
and dword [esi + 0x6c], 0
push str.Incompatible_libpng_version_in_application_and_library
push esi
call fcn.00461101
add esp, 0x1c
mov eax, 0x2000
push eax
push esi
mov dword [esi + 0xb0], eax
call fcn.0046146d
mov dword [esi + 0xac], eax
push 0x38
lea eax, [esi + 0x74]
mov dword [esi + 0x94], fcn.0045f4af
push str.1.1.3
mov dword [esi + 0x98], fcn.0045f505
push eax
mov dword [esi + 0x9c], esi
call fcn.004617ed
add esp, 0x14
cmp eax, 0xfffffffa
je 0x45fbc4
cmp eax, 0xfffffffc
je 0x45fbbd
cmp eax, 0xfffffffe
je 0x45fbbd
test eax, eax
je 0x45fbd1
push str.Unknown_zlib_error
jmp 0x45fbc9
push str.zlib_memory_error
jmp 0x45fbc9
push 0x49f394
push esi
call fcn.00461101
pop ecx
pop ecx
mov eax, dword [esi + 0xac]
push 0
mov dword [esi + 0x80], eax
mov eax, dword [esi + 0xb0]
push 0
push esi
mov dword [esi + 0x84], eax
call fcn.00461086
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x46157e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x46165f
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x487ac4]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x487ac4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x487ac4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x487ac4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x487ac4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x487ac4]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x487ac4]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x487ac4]
xor eax, esi
inc edx
dec edi
jne 0x46159b
pop ebx
cmp dword [ebp + 0x10], 0
je 0x461680
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x487ac4]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x461665
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x46a6e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x46a780
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x46a732
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a1cdc]
xor eax, edx
inc esi
cmp esi, edi
jl 0x46a713
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x46a75b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a1cdc]
xor eax, edx
inc esi
cmp esi, edi
jl 0x46a73e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49e7008], 0x8088405
inc edx
mov dword [ebx + 0x49e7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d254
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d285
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d26d
add dl, dl
jne 0x41d290
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2e1
xor eax, eax
add dl, dl
jne 0x41d29d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d37e
add dl, dl
jne 0x41d2ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d2d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d27c
mov eax, 1
add dl, dl
jne 0x41d2ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2e6
sub eax, ebx
mov ebx, 1
jne 0x41d32d
mov ecx, 1
add dl, dl
jne 0x41d313
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d31e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d30a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d33b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d39f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d27c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x49ca89e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f3ff
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
jmp 0x41f41e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f490
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f479
test esi, esi
jbe 0x41f490
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f46b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f490
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f448
jmp 0x41f490
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f490
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ca8a5
ret
Function at 0x4205fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x49cbc17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420637
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420650
lea eax, [ebp - 0x10]
mov edx, dword [0x49e95f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420663
lea eax, [ebp - 0x10]
mov edx, dword [0x49e95f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42066f
adc edx, 0
mov edx, dword [edx*4 + 0x49e83fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4207e9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4207dc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4207dc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42077a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42077a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42077a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42077a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4207dc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4207dc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420801
inc ebx
cmp ebx, 0x19
jne 0x420629
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cbc1e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476004]
jne 0x401010
repz ret
jmp fcn.00401788

Function at 0x405655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030b9
and dword [ebp - 4], 0
cmp dword [0x477db0], 0
mov ebx, eax
jne 0x405706
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057b7
push eax
call fcn.00403047
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x477db0], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x477db4], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x477db8], eax
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x477dc0], eax
test eax, eax
je 0x405706
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x477dbc], eax
mov eax, dword [0x477dbc]
cmp eax, ebx
je 0x40575e
cmp dword [0x477dc0], ebx
je 0x40575e
push eax
call fcn.004030c2
push dword [0x477dc0]
mov esi, eax
call fcn.004030c2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40575e
test edi, edi
je 0x40575e
call esi
test eax, eax
je 0x405755
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405755
test byte [ebp - 0xc], 1
jne 0x40575e
or dword [ebp + 0x10], 0x200000
jmp 0x405797
mov eax, dword [0x477db4]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405797
mov eax, dword [0x477db8]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x477db0]
call fcn.004030c2
pop ecx
test eax, eax
je 0x4057b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x473665
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x485d24]
push dword [0x485a40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x4736f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x47371e
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.004736e9
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x473701
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
jne 0x473736
or dword [0x485d34], 0xffffffff
mov dword [0x485d30], 0xa62e7790
leave
ret
Function at 0x401064
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x40c0b0]
push esi
push dword [0x40cc2c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
xor esi, esi
call fcn.00401020
test al, al
pop ecx
pop ecx
je 0x401096
lea esi, [ebp - 0x108]
push 0xa
push esi
push dword [0x40cc34]
push dword [0x40cc2c]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004019ec
leave
ret

Function at 0x4011d7
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, ebx
je 0x401202
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x401350
Capabilities:
Create process on windows
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x334]
sub esp, 0x3b4
mov eax, dword [0x40c0b0]
mov dword [ebp + 0x330], eax
mov eax, dword [0x40cc20]
push ebx
xor ebx, ebx
sub eax, ebx
push edi
je 0x4014fd
dec eax
je 0x401439
dec eax
je 0x4013f2
dec eax
je 0x401395
dec eax
jne 0x401530
xor eax, eax
jmp 0x401533
push str.updateconf
push dword [0x40cc24]
call fcn.004021c0
cmp eax, ebx
pop ecx
pop ecx
je 0x4013ad
mov byte [eax], bl
push 0xa
push ebx
push dword [0x40cc24]
push dword [0x40cc2c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jge 0x4013e3
push 0x50040
push str.Update_error
push str.Unable_to_start_mainclient_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x40cc20], 4
jmp 0x401530
cmp byte [0x40cc28], bl
je 0x401416
push str.The_software_has_been_updated_and_will_be_restarted._n_nIf_you_receive_this_message_again__please_try_to_download_the_complete_software_package_from_our_web_site.
call fcn.004010bd
pop ecx
call fcn.00401064
mov dword [0x40cc20], 4
jmp 0x401420
mov dword [0x40cc20], 3
mov eax, dword [0x40cc38]
cmp eax, ebx
je 0x401530
push eax
call fcn.004010bd
pop ecx
jmp 0x401530
lea eax, [ebp + 0xec]
push eax
push str..____
mov byte [ebp - 0x7d], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4014f1
push esi
lea esi, [ebp + 0x22c]
dec esi
lea eax, [ebp + 0x118]
push eax
lea eax, [ebp + 0x22c]
push eax
call fcn.004020c0
lea eax, [ebp + 0x22c]
push eax
call fcn.00401930
mov byte [eax + esi], bl
lea eax, [ebp + 0x22c]
push eax
lea eax, [ebp + 0x118]
push eax
call fcn.00401270
add esp, 0x14
test eax, eax
jne 0x4014ce
lea eax, [ebp + 0x22c]
push eax
lea eax, [ebp - 0x7c]
push str.Unable_to_update_file__s__Is_file_readonly__
push eax
call fcn.00402066
add esp, 0xc
push 0x50040
push str.Update_error
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 0x7d], bl
lea eax, [ebp + 0xec]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401462
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp - 0x7d], bl
pop esi
je 0x40138e
mov dword [0x40cc20], 2
jmp 0x401530
call fcn.00401207
test al, al
jne 0x401525
cmp byte [0x40c0ac], bl
je 0x401519
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x40cc20], 1
jmp 0x401530
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x330]
pop edi
pop ebx
call fcn.004019ec
add ebp, 0x334
leave
ret