joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401410
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push str.TerminateProcess_Enter
call fcn.00401000
add esp, 4
push edi
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push edi
test esi, esi
je 0x401462
push str.TerminateProcess:_dwProcessId__d_open_process_success
call fcn.00401000
add esp, 8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.TerminateProcess_Exit
call fcn.00401000
add esp, 4
pop esi
mov eax, ebx
pop ebx
ret
push str.TerminateProcess:_dwProcessId__d_open_process_fail
call fcn.00401000
add esp, 8
push str.TerminateProcess_Exit
call fcn.00401000
add esp, 4
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x401490
Capabilities:
Create process on windows
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040bad0
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.ReplaceAndRunUSOClient_Enter
call fcn.00401000
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1002]
push ecx
xor edi, edi
mov word [ebp - 0x1004], ax
call fcn.00406420
add esp, 0x10
lea edx, [ebp - 0x1004]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40163a
push esi
lea eax, [ebp - 0x1004]
push eax
push str.ReplaceAndRunUSOClient:_currDir__s
call fcn.00401000
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x802]
push edx
mov word [ebp - 0x804], cx
call fcn.00406420
push str.usoclient.exe
lea eax, [ebp - 0x1004]
push eax
push str._s_s
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.00401b80
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1802]
push eax
mov word [ebp - 0x1804], dx
call fcn.00406420
push str.usoclient.exe
lea ecx, [ebp - 0x1004]
push ecx
push str._s_s.bak
lea edx, [ebp - 0x1804]
push 0x400
push edx
call fcn.00401b80
add esp, 0x48
lea eax, [ebp - 0x1804]
push eax
lea ecx, [ebp - 0x804]
push ecx
push str.ReplaceAndRunUSOClient:_usoClientExePath__s_usoClientBakPath__s
call fcn.00401000
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
push 1
lea edx, [ebp - 0x1804]
push edx
lea eax, [ebp - 0x804]
push eax
call esi
test eax, eax
je 0x401639
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x2002]
push edx
mov word [ebp - 0x2004], cx
call fcn.00406420
push str.usoclient2.exe
lea eax, [ebp - 0x1004]
push eax
push str._s_s
lea ecx, [ebp - 0x2004]
push 0x400
push ecx
call fcn.00401b80
lea edx, [ebp - 0x2004]
push edx
push str.ReplaceAndRunUSOClient:_usoClient2ExePath__s
call fcn.00401000
add esp, 0x28
push 1
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x2004]
push ecx
call esi
test eax, eax
je 0x401639
push 5
push edi
push edi
lea edx, [ebp - 0x804]
push edx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, 1
pop esi
push str.ReplaceAndRunUSOClient_Exit
call fcn.00401000
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00401b71
mov esp, ebp
pop ebp
ret
Function at 0x401660
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0040bad0
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
push str.RestartOnlyUSOClient_Enter
call fcn.00401000
movzx eax, bl
push eax
push str.RestartOnlyUSOClient:_isWebUI__d
call fcn.00401000
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x1002]
push edx
mov word [ebp - 0x1004], cx
call fcn.00406420
add esp, 0x18
lea eax, [ebp - 0x1004]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4016d1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b71
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1004]
push ecx
push str.RestartOnlyUSOClient:_currDir__s
call fcn.00401000
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1802]
push eax
mov word [ebp - 0x1804], dx
call fcn.00406420
push str.usoclient.exe
lea ecx, [ebp - 0x1004]
push ecx
push str._s_s
lea edx, [ebp - 0x1804]
push 0x400
push edx
call fcn.00401b80
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.00406420
add esp, 0x34
mov eax, str._WEB__WEBUI
test bl, bl
jne 0x40174b
mov eax, 0x412904
push eax
push str.usoAutoRestart__s
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.00401b80
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x1804]
push ecx
push str.RestartOnlyUSOClient:_usoClientExePath__s_usoParam__s
call fcn.00401000
add esp, 0x1c
push 5
push 0
lea edx, [ebp - 0x804]
push edx
lea eax, [ebp - 0x1804]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.RestartOnlyUSOClient_Exit
call fcn.00401000
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
mov eax, 1
call fcn.00401b71
mov esp, ebp
pop ebp
ret
Function at 0x401990
Capabilities:
Generate random numbers via winapi
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f6f8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x2a
lea ecx, [ebp - 0x3a]
xor eax, eax
push ebx
push ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov byte [esi], 1
mov word [ebp - 0x3c], ax
call fcn.00406420
add esp, 0xc
push 0xf0000000
push 1
push ebx
push ebx
lea edx, [ebp - 0x40]
push edx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea edi, [esi + 4]
push edi
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x40]
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, dword [edi]
push ecx
push 0x412a60
lea edx, [ebp - 0x3c]
push 0x16
push edx
call fcn.00401b80
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
push 0x3201c
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x401a55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401a55
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x401abd
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x10], eax
mov ecx, 0x3201c
mov byte [eax], bl
inc eax
dec ecx
jne 0x401a70
mov edx, dword [edi]
mov eax, dword [esi + 0x10]
push edx
push str.EV_u
push 0xe
push eax
call fcn.00401b80
push 8
call fcn.004024fe
add esp, 0x14
cmp eax, ebx
je 0x401aa3
mov ecx, dword [esi + 0x10]
push ecx
push eax
call fcn.004018c0
jmp 0x401aa5
xor eax, eax
mov dword [esi + 8], eax
cmp eax, ebx
je 0x401ab0
cmp byte [eax], bl
jne 0x401abd
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 0x40]
cmp eax, ebx
je 0x401acc
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401b71
mov esp, ebp
pop ebp
ret

Function at 0x401b71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41403c]
jne 0x401b7b
repz ret
jmp fcn.00402712
Function at 0x40b80d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004079ab
and dword [ebp - 0x14], 0
cmp dword [0x415e98], 0
mov dword [ebp - 0x18], eax
jne 0x40b8c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b968
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b968
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x415e98], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x415e9c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x415ea0], eax
call edi
push eax
call esi
mov dword [0x415ea8], eax
test eax, eax
je 0x40b8c0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x415ea4], eax
mov eax, dword [0x415ea4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b919
cmp dword [0x415ea8], ecx
je 0x40b919
push eax
call esi
push dword [0x415ea8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b919
test ebx, ebx
je 0x40b919
call edi
test eax, eax
je 0x40b910
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b910
test byte [ebp - 8], 1
jne 0x40b919
or dword [ebp + 0x10], 0x200000
jmp 0x40b94c
mov eax, dword [0x415e9c]
cmp eax, dword [ebp - 0x18]
je 0x40b94c
push eax
call esi
test eax, eax
je 0x40b94c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b94c
mov eax, dword [0x415ea0]
cmp eax, dword [ebp - 0x18]
je 0x40b94c
push eax
call esi
test eax, eax
je 0x40b94c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x415e98]
call esi
test eax, eax
je 0x40b968
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b96a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401b71
leave
ret
Function at 0x402f36
Capabilities:
Create process on windows

Disassembly:
movzx ecx, word [esp + 4]
push esi
mov esi, eax
mov eax, dword [esp + 8]
add ecx, 0xfffffc18
shr eax, 0x10
cmp ecx, 0xb
push edi
ja case.0x402f55.1002
jmp dword [ecx*4 + 0x403012]
mov byte [esi + 0x226b], 1
jmp case.0x402f55.1002
mov eax, dword [esi + 0x1e34]
xor ecx, ecx
cmp eax, ecx
je 0x402f79
cmp eax, 1
jne case.0x402f55.1000
push ecx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x402f55.1002
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.0x402f55.1002
mov edi, esi
call fcn.004030d8
jmp case.0x402f55.1002
push 1
xor ecx, ecx
push ecx
push ecx
add esi, 0x2478
push esi
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x402f55.1002
mov dword [esi + 0x1e34], 1
call fcn.004026a1
jmp case.0x402f55.1002
mov edi, esi
call fcn.0040308d
jmp case.0x402f55.1002
call fcn.00403119
jmp case.0x402f55.1002
lea edi, [esi + 0x2aec]
lea eax, [esi + 0x2bf0]
push edi
push eax
call sub.MSVCR80.dll_strcpy
pop ecx
pop ecx
push edi
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp case.0x402f55.1002
and dword [esi + 0x1e34], 0
jmp 0x402fbc
cmp eax, 0x300
jne case.0x402f55.1002
call fcn.004032d9
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x4032d9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x411020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x200
lea eax, [ebp - 0x208]
push eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR80.dll_strlen
mov edi, eax
cmp edi, 0x104
pop ecx
jl 0x40332f
lea eax, [esi + 0x2bf0]
push eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x403422
lea eax, [ebp - 0x208]
call fcn.0040a084
test eax, eax
jge 0x40334a
mov byte [esi + 0x2aac], 1
jmp 0x403422
mov dword [esi + 0x1f4c], eax
mov al, byte [ebp + edi - 0x209]
cmp al, 0x5c
mov byte [esi + 0x2aac], 0
je 0x403379
cmp al, 0x2f
je 0x403379
lea eax, [ebp - 0x208]
push 0x40d6b8
push eax
call sub.MSVCR80.dll_strcat
pop ecx
pop ecx
lea ebx, [esi + 0x226c]
push ebx
lea edi, [ebp - 0x208]
call fcn.0040a0cb
test al, al
pop ecx
jne 0x4033d0
push ebx
call sub.MSVCR80.dll_strlen
mov edi, eax
pop ecx
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR80.dll_strlen
lea eax, [edi + eax + 1]
cmp eax, 0x103
pop ecx
jae 0x403400
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [esi + 0x2bf0]
push str._s_s_
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
jmp 0x403400
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR80.dll_strlen
cmp eax, 0x103
pop ecx
jae 0x403400
lea eax, [ebp - 0x208]
push eax
lea eax, [esi + 0x2bf0]
push 0x40d634
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
lea eax, [ebp - 0x218]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040aad0
leave
ret
Function at 0x4036d5
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2da8]
mov eax, 0x2e28
call fcn.0040b4a0
mov eax, dword [0x411020]
xor eax, ebp
mov dword [ebp + 0x2da4], eax
push ebx
mov ebx, dword [ebp + 0x2db0]
push esi
push edi
push str.DiMo92GameOnlineSetup
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40373c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x40d700
push 0x40d708
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40381e
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x411658
push 0x67
push ebx
call edi
push 0x64
push 0x4115f0
push 0x6d
push ebx
call edi
push ebx
lea eax, [ebp - 0x54]
push eax
call fcn.00401cea
push 0x40d720
lea eax, [ebp + 0x2ca0]
push 0x40d634
push eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0x1c7
mov dword [ebp - 0x58], 0x145
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
push esi
push esi
lea eax, [ebp - 0x64]
push eax
push 0x10cf0000
lea eax, [ebp + 0x2ca0]
push eax
push eax
lea ecx, [ebp - 0x54]
call fcn.00401f35
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
mov ebx, eax
jmp 0x4037e6
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x4037e6
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
jne 0x4037c0
mov eax, dword [0x414ee8]
cmp eax, esi
je 0x403810
mov edi, eax
call fcn.0040159e
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [0x414ee8], esi
mov esi, dword [ebp - 0x78]
lea eax, [ebp - 0x54]
push eax
call fcn.00401e37
mov eax, esi
mov ecx, dword [ebp + 0x2da4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aad0
add ebp, 0x2da8
leave
ret 0x10

Function at 0x40393a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
lea edi, [esi + 8]
push edi
mov dword [esi], eax
mov byte [esi + 0x317], 0
call sub.MSVCR80.dll_strcpy
mov ecx, edi
call fcn.004098f5
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x403920
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x20
mov dword [esi + 4], eax
pop edi
pop ebp
ret 4
Function at 0x404af3
Capabilities:
Create process on windows

Disassembly:
push esi
push 5
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jg 0x404b8d
sub eax, 0
push ebx
push edi
mov edi, dword [sym.imp.MSVCR80.dll_sprintf_s]
mov ebx, 0x105
je 0x404b61
dec eax
add esi, 0x212
dec eax
je 0x404b56
dec eax
je 0x404b4f
sub eax, 8
je 0x404b3d
push 0x40da54
push ebx
push esi
call edi
add esp, 0xc
jmp 0x404b73
push dword [esp + 0x10]
push 0x40da20
push ebx
push esi
call edi
add esp, 0x10
jmp 0x404b73
push 0x40da48
jmp 0x404b6c
push dword [esp + 0x10]
push 0x40da38
jmp 0x404b46
add esi, 0x212
push 0x40da10
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x40da60
push ebx
push esi
call edi
add esp, 0x14
pop edi
xor al, al
pop ebx
jmp 0x404b8f
mov al, 1
pop esi
ret 4
Function at 0x406660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40b61c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebp
push esi
mov eax, dword [0x411020]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov ecx, edi
mov dword [esp + 0x38], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov ebp, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 1
cmp esi, eax
jbe 0x4066bb
call ebp
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x58], 0x10
mov ecx, dword [esp + 0x44]
jae 0x4066ca
lea ecx, [esp + 0x44]
cmp byte [ecx + esi], 0x5c
je 0x4066d9
cmp esi, eax
jae 0x4066d9
add esi, 1
jmp 0x4066b1
sub eax, esi
push eax
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push eax
mov ecx, edi
mov byte [esp + 0x3c], 2
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x30
ret
Function at 0x406730
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x204
mov eax, dword [0x411020]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
push esi
xor ecx, ecx
mov al, 1
push edi
lea esp, [esp]
movzx edx, al
mov byte [esp + edx + 0x10], cl
mov dl, al
and dl, 0x80
mov byte [esp + ecx + 0x110], al
add ecx, 1
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x406750
mov al, 1
mov ecx, 0x4122c0
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
add al, al
and edx, 0x1b
xor al, dl
cmp ecx, 0x4122e8
jl 0x406784
mov dword [0x4116c0], 0x63
mov dword [0x414874], 0
mov edx, 1
movzx eax, byte [esp + edx + 0x10]
lea ecx, [esp + 0x20f]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [edx*4 + 0x4116c0], eax
mov dword [eax*4 + 0x4146e8], edx
add edx, 1
cmp edx, 0x100
jl 0x4067c0
xor ecx, ecx
mov dl, byte [ecx + 0x4116c0]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov bl, dl
add bl, bl
movzx edx, dl
and eax, 0x1b
xor al, bl
movzx esi, al
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx + 0x4142e8], eax
ror eax, 8
mov dword [ecx + 0x413ee8], eax
ror eax, 8
mov dword [ecx + 0x413ae8], eax
ror eax, 8
mov dword [ecx + 0x4136e8], eax
mov al, byte [ecx + 0x4146e8]
test al, al
je 0x4068b9
movzx edx, al
movzx esi, byte [esp + edx + 0x10]
movzx eax, byte [esp + 0x1b]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebp, byte [esp + edx + 0x110]
cdq
idiv edi
movzx eax, byte [esp + 0x19]
add eax, esi
movzx ebx, byte [esp + edx + 0x110]
cdq
idiv edi
movzx eax, byte [esp + 0x1e]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x110]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x110]
jmp 0x4068c1
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, ebp
mov dword [ecx + 0x4132e8], eax
ror eax, 8
mov dword [ecx + 0x412ee8], eax
ror eax, 8
mov dword [ecx + 0x411ec0], eax
ror eax, 8
mov dword [ecx + 0x411ac0], eax
add ecx, 4
cmp ecx, 0x400
jl 0x406802
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040aad0
add esp, 0x204
ret
Function at 0x407dc0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xa0
mov eax, dword [0x411020]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x40
lea eax, [esp + 0x64]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], vtable.MD5_CTX.0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0xb4]
add esp, 0xc
push esi
lea ecx, [esp + 8]
push ecx
mov byte [esp + 0x68], 0x80
call fcn.00407eb0
mov ecx, edi
lea esi, [esp + 4]
call fcn.00407f90
xor ecx, ecx
pop esi
cmp byte [edi + ecx], 0
jne 0x407e4e
mov byte [edi + ecx], cl
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ecx
sub eax, edx
jne 0x407e69
xor byte [edi + ecx], 0x11
add ecx, 1
cmp ecx, 0x10
jl 0x407e45
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0040aad0
add esp, 0xa0
ret

Function at 0x407f90
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x411020]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push edi
mov edi, ecx
xor ecx, ecx
lea eax, [esi + 0x16]
jmp 0x407fb0
movzx edx, byte [eax - 2]
mov byte [esp + ecx + 8], dl
movzx edx, byte [eax - 1]
mov byte [esp + ecx + 9], dl
movzx edx, byte [eax]
mov byte [esp + ecx + 0xa], dl
movzx edx, byte [eax + 1]
mov byte [esp + ecx + 0xb], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x407fb0
mov ecx, dword [esi + 0x14]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
mov eax, 0x38
jb 0x407ff2
mov eax, 0x78
lea ebp, [esi + 0x5c]
push ebp
sub eax, ecx
push esi
call fcn.00407eb0
lea eax, [esp + 8]
push eax
push esi
mov eax, 8
call fcn.00407eb0
lea ecx, [edi + 1]
lea eax, [esi + 6]
mov edi, 4
lea esp, [esp]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x408020
push 0x9c
push 0
push esi
call sub.MSVCR80.dll_memset
push 0x40
push 0
push ebp
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
mov byte [ebp], 0x80
pop ebp
xor ecx, esp
call fcn.0040aad0
add esp, 0xc
ret