joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
xor eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x401350
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x401366
mov esi, 0x100000
jmp 0x401372
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_VirtualQuery
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x4013af
mov edx, ebx
mov eax, 0x40a5e4
call fcn.00401204
test al, al
jne 0x4013af
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4013b4
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_VirtualQuery
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4013fe
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_VirtualQuery
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x401426
mov edx, ebx
mov eax, 0x40a5e4
call fcn.00401204
test al, al
jne 0x401426
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40142c
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x40a5e4]
jmp 0x4014ac
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x4014aa
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x4014aa
cmp esi, dword [esp + 8]
jae 0x401479
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x401488
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x4014a3
mov dword [0x40a5c0], 1
mov eax, ebx
call fcn.00401234
mov ebx, edi
cmp ebx, 0x40a5e4
jne 0x40145b
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x4014dc
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401578
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x40a5e4]
jmp 0x4015e7
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x4015bf
mov ebx, dword [esp]
cmp ebp, edi
jae 0x4015c5
mov edi, ebp
cmp edi, ebx
jbe 0x4015e5
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x4015e5
mov dword [0x40a5c0], 2
mov esi, dword [esi]
cmp esi, 0x40a5e4
jne 0x4015af
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401f24
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x40a5bc], 0
jne 0x401f41
call fcn.00401838
test al, al
je 0x401f49
cmp ebx, 0x7ffffff8
jle 0x401f53
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4020a7
xor ecx, ecx
push ebp
push 0x4020a0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x40a045], 0
je 0x401f74
push 0x40a5c4
call sub.KERNEL32.DLL_LocalAlloc
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f84
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402023
mov eax, ebx
test eax, eax
jns 0x401f99
add eax, 3
sar eax, 2
mov edx, dword [0x40a61c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402023
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401fd4
mov eax, ebx
test eax, eax
jns 0x401fc3
add eax, 3
sar eax, 2
mov ecx, dword [0x40a61c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401ffa
mov ecx, ebx
test ecx, ecx
jns 0x401fdd
add ecx, 3
sar ecx, 2
mov edi, dword [0x40a61c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40a5ac]
sub ebx, 4
add dword [0x40a5b0], ebx
call fcn.00403100
jmp 0x4020a7
cmp ebx, dword [0x40a614]
jg 0x402075
sub dword [0x40a614], ebx
cmp dword [0x40a614], 0xc
jge 0x402047
add ebx, dword [0x40a614]
xor eax, eax
mov dword [0x40a614], eax
mov eax, dword [0x40a618]
add dword [0x40a618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40a5ac]
sub ebx, 4
add dword [0x40a5b0], ebx
call fcn.00403100
jmp 0x4020a7
mov eax, ebx
call fcn.00401e30
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4020a7
cmp byte [0x40a045], 0
je 0x40209f
push 0x40a5c4
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4020b4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x40a5c0], eax
cmp byte [0x40a5bc], 0
jne 0x4020ec
call fcn.00401838
test al, al
jne 0x4020ec
mov dword [0x40a5c0], 8
mov dword [ebp - 4], 8
jmp 0x40224d
xor ecx, ecx
push ebp
push 0x402246
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x40a045], 0
je 0x40210d
push 0x40a5c4
call sub.KERNEL32.DLL_LocalAlloc
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402128
mov dword [0x40a5c0], 9
jmp 0x40221d
dec dword [0x40a5ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x40a5b0], eax
test bl, 1
je 0x402188
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402158
test edx, 0x80000003
je 0x402167
mov dword [0x40a5c0], 0xa
jmp 0x40221d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40217f
mov dword [0x40a5c0], 0xa
jmp 0x40221d
add ebx, edx
mov esi, eax
call fcn.004019dc
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x40a618]
jne 0x4021c8
sub dword [0x40a618], ebx
add dword [0x40a614], ebx
cmp dword [0x40a614], 0x3c00
jle 0x4021b9
call fcn.00401ccc
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403100
jmp 0x40224d
mov edx, dword [eax]
test dl, 2
je 0x4021eb
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4021e6
mov dword [0x40a5c0], 0xb
jmp 0x40221d
or dword [eax], 1
jmp 0x402214
mov eax, edi
cmp dword [eax + 4], 0
je 0x4021fe
cmp dword [eax], 0
je 0x4021fe
cmp dword [eax + 8], 0xc
jge 0x40220a
mov dword [0x40a5c0], 0xb
jmp 0x40221d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004019dc
mov edx, ebx
mov eax, esi
call fcn.00401c44
mov eax, dword [0x40a5c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40224d
cmp byte [0x40a045], 0
je 0x402245
push 0x40a5c4
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x403da0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x403f34
call sub.KERNEL32.DLL_EnumCalendarInfoA
mov esi, eax
test esi, esi
je 0x403e08
push 0x403f44
push esi
call sub.KERNEL32.DLL_GetACP
mov ebx, eax
test ebx, ebx
je 0x403e08
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x403e08
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
jmp 0x403f2a
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x403e48
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x403f2a
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00403d8c
mov esi, eax
cmp byte [esi], 0
je 0x403f2a
lea eax, [esi + 1]
call fcn.00403d8c
mov esi, eax
cmp byte [esi], 0
je 0x403f2a
jmp 0x403e4e
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
jmp 0x403f0d
lea eax, [esi + 1]
call fcn.00403d8c
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x403f2a
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_VirtualFree
mov esi, eax
cmp esi, 0xffffffff
je 0x403f2a
push esi
call sub.KERNEL32.DLL_VirtualAlloc
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x403f2a
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x403e6c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f58
Capabilities:
Get disk size
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_DeleteCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404188
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403fdb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404188
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403fdb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4041a4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404064
xor eax, eax
push ebp
push 0x40405d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403da0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x404042
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4041c4
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x404042
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404064
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetCommModemStatus
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40417e
cmp byte [ebp - 0xd], 0
jne 0x4040ab
cmp byte [ebp - 0x12], 0
je 0x40417e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4040c4
dec ebx
cmp byte [ebx], 0x2e
je 0x4040d3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4040c3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40417e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404110
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
test esi, esi
jne 0x40417e
cmp byte [ebp - 0xd], 0
je 0x40417e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
test esi, esi
jne 0x40417e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407f4c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
add esp, 0xffffffe0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp - 0x20]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp - 0x1c]
mov eax, dword [esi]
add eax, dword [ebp - 0x1c]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp - 0x1c]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword ds:[esi]
add eax, dword [ebp - 0x1c]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword ds:[esi]
add eax, dword [ebp - 0x1c]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
pop esi
mov dword ss:[ebp - 4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], eax
jne 0x407fbf
xor eax, eax
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
add esp, 0xc
ret
push esi
mov eax, dword [esi]
add eax, dword [ebp - 0x1c]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x407fcb
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte ds:[esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x407ffa
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x407fe9
xor ecx, eax
xor edx, ebx
dec edi
jne 0x407fd9
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x408021
pop esi
add esi, 4
add dword ss:[ebp - 4], 1
jmp 0x407fab
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp - 0x1c]
pop ecx
pop edx
pop edi
pop ebx
pop esi
add esp, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x408050
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x408074
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x4082ec
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0xffffffff
pop eax
ret
Function at 0x8787e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x878805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x878878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x87883a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x87886d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x87886b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x878831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x8787fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x402e30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
shr edi, 2
xor edx, edx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
add eax, 3
mov dword [ecx], eax
add ecx, 0x10
test edi, edi
je 0x402e6d
lea ebx, [ebx]
mov eax, dword [esi]
lea esi, [esi + 4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, edi
jb 0x402e60
mov ebx, dword [ecx + edi*4 - 4]
lea eax, [edi + 0xe]
lea eax, [edi + eax*2]
lea esi, [ecx + eax*4]
mov dword [ebp - 8], esi
xor esi, esi
mov eax, dword [ebp - 8]
test esi, esi
jne 0x402ee4
movzx eax, bl
movzx edx, byte [eax + 0x4658b0]
mov eax, ebx
shr eax, 0x18
shl edx, 8
movzx eax, byte [eax + 0x4658b0]
or edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 8
shl edx, 8
movzx eax, byte [eax + 0x4658b0]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x4658b0]
xor ebx, dword [ebp - 4]
mov eax, dword [ebp - 4]
or ebx, edx
add eax, eax
mov dword [ebp - 4], eax
test eax, 0x100
je 0x402ee0
mov dword [ebp - 4], 0x1b
mov esi, edi
jmp 0x402f31
cmp esi, 4
jne 0x402f34
cmp edi, 6
jbe 0x402f34
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x4658b0]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x4658b0]
shl eax, 8
or edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x4658b0]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + 0x4658b0]
or ebx, edx
mov eax, dword [ebp - 8]
xor ebx, dword [ecx]
dec esi
mov dword [ecx + edi*4], ebx
add ecx, 4
cmp ecx, eax
jne 0x402e82
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x403f26
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 4], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x403f4f
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x403f4f
inc eax
cmp eax, edx
jb 0x403f40
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x404045
cmp ecx, 2
jbe 0x403fa2
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x404031
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
cmp dword [ebp + 0x10], 0
je 0x403fcc
add ebx, ecx
jmp 0x403fce
shr esi, cl
test esi, esi
je 0x403f68
cmp esi, 4
ja 0x403fc1
cmp esi, 3
je 0x403fc1
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x403f68
or esi, 8
shr esi, 1
inc edi
jmp 0x403f32
sub ebx, ecx
test esi, esi
je 0x404004
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x403fff
mov edx, 0x100
shl edx, cl
mov ecx, dword [ebp + 8]
dec edx
xor ebx, edx
add ecx, edi
cmp dword [ebp + 0x10], 0
je 0x403ffd
add ebx, ecx
jmp 0x403fff
sub ebx, ecx
mov edx, dword [ebp - 4]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 8]
add edi, eax
jmp 0x403f32
mov ebx, dword [ebp - 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x403f32
shr esi, cl
mov eax, 2
cmp eax, ecx
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret