joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4557d0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45597b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45595c
mov dl, 1
mov eax, dword [0x413574]
call fcn.004038c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404660
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45594b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00442f3c
test al, al
je 0x45593e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45598c
lea eax, [ebp - 0x254]
call fcn.00409664
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45593e
xor eax, eax
push ebp
push 0x455937
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4559c4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x455920
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048c8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x455920
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45593e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x455841
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00417a18
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455982
lea eax, [ebp - 0x260]
call fcn.00404660
ret

Function at 0x4562b0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x474c30]
cmp byte [eax + 0xa5], 0
jne 0x456321
cmp dword [0x474c48], 0
jne 0x4562e2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45626c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x474c48], eax
cmp dword [0x474c44], 0
jne 0x4562fd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x474c44], eax
cmp dword [0x474c4c], 0
jne 0x456321
push esp
push 0
push 0
push 0x456210
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x474c4c], eax
pop edx
ret
Function at 0x456418
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45642f
add esp, 0xfffffff0
call fcn.00403c58
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d380
mov eax, dword [0x4738b0]
cmp word [eax + 2], 0
jne 0x456457
mov eax, dword [0x4738b0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457a4c
mov eax, dword [0x473948]
cmp word [eax + 2], 0
jne 0x456471
mov eax, dword [0x473948]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457c44
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412fcc]
call fcn.004038c4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412fcc]
call fcn.004038c4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41f838]
call fcn.00426f04
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4565f8
mov eax, dword [0x4737e0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004272d4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4581c4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4737e0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c1f8
test eax, eax
je 0x456566
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408fac
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c220
test eax, eax
je 0x45657a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004048c8
mov eax, dword [0x4736d8]
cmp byte [eax], 0
jne 0x4565ae
mov eax, ebx
call fcn.00456720
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004583a0
mov eax, ebx
call fcn.00458ce0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4565ee
call fcn.00403cb0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456994
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x474c30]
cmp dword [eax + 0x30], 0
je 0x456a3e
cmp dword [ebx + 0x94], 0
jne 0x456a38
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x456924
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x456a38
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4569fe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x456a38
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00415724
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x456a0d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45751c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x457551
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404750
jmp 0x45755e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046b4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45857c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4585bd
mov eax, esi
call fcn.0043e674
test al, al
je 0x4585bd
mov eax, dword [ebx + 0x84]
call fcn.0043e370
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4585bd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e370
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46001c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x46004a
mov eax, ebx
call fcn.00460ad4
cmp dword [ebx + 0x3c], 0
je 0x460043
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4600bb
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4600ad
cmp dword [ebx + 8], 0
je 0x46006c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x46007e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4600ad
cmp dword [ebx + 8], 0
je 0x46005f
cmp eax, 3
je 0x460091
dec eax
jne 0x46005f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46005f
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x46005f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4600d9
cmp dword [ebx + 0x10], 0xcc
je 0x4600d9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004600e4
pop ebx
ret
Function at 0x404662
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x4bdc84
call fcn.00435ec9
mov ebx, ecx
push 0
call fcn.004050a0
push 1
mov ecx, ebx
call fcn.004055f5
lea eax, [ebp - 0x1c]
push 0x198
push eax
call fcn.00403a05
pop ecx
pop ecx
push dword [eax]
push 2
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x1c]
call fcn.00435fa5
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0xa4]
call fcn.00403c71
and dword [ebp - 4], 0
lea esi, [ebx + 0x280]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebx + 0x1d4]
lea eax, [ebx + 0x1e0]
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 1
call fcn.00403dd5
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x94], 0
je 0x404770
cmp dword [ebp - 0xa0], 0
mov byte [ebx + 0x29b], 1
jne 0x404760
push 0x4c5b64
lea ecx, [ebp - 0xa4]
call fcn.0040e78d
push 0x10
push dword [ebp - 0xa4]
push dword [ebp - 0x98]
jmp 0x40479a
test edi, edi
jne 0x4047a7
mov byte [ebx + 0x29b], 1
cmp dword [ebp - 0x70], edi
je 0x4047a3
cmp dword [ebp - 0x7c], edi
jne 0x404792
push 0x4c5b64
lea ecx, [ebp - 0x80]
call fcn.0040e78d
push 0
push dword [ebp - 0x80]
push dword [ebp - 0x74]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
je 0x4047c0
cmp byte [ebx + 0x136], 0
jne 0x4047c0
mov ecx, ebx
mov byte [ebx + 0x135], 1
call fcn.004054b0
jmp 0x4047cb
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x80]
call fcn.00402c2b
lea ecx, [ebp - 0xa4]
call fcn.00402c2b
mov al, 1
call fcn.00435e92
ret
Function at 0x40608f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x44
mov eax, 0x4bddd2
call fcn.00435f34
mov edi, ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], eax
call fcn.0040e708
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040e708
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 3
call dword [eax + 0x3c]
mov dword [edi + 0x3b8], eax
jmp 0x4060eb
mov eax, dword [edi + 0x3b8]
mov dword [ebp - 4], 2
cmp eax, 0x80004004
je 0x40613b
cmp dword [ebp - 0x34], 0
jne 0x40613b
test eax, eax
je 0x40613b
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0040601d
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.0040e72c
push dword [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00435fa5
pop ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040e72c
lea eax, [edi + 0x33c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00405f3c
xor esi, esi
pop ecx
pop ecx
cmp dword [edi + 0x324], esi
jbe 0x406179
cmp esi, 0x20
jae 0x406179
mov eax, dword [edi + 0x320]
push dword [eax + esi*4]
lea eax, [ebp - 0x38]
push eax
call fcn.00405f3c
inc esi
pop ecx
pop ecx
cmp esi, dword [edi + 0x324]
jb 0x406157
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp eax, 0x3e8
ja 0x4061a3
cmp byte [edi + 0x318], 0
jne 0x406198
cmp dword [ebp - 0x40], 0
je 0x4061a3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [edi + 0x280]
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x378]
mov byte [ebp - 4], 7
push eax
lea ecx, [edi + 0x1e0]
call fcn.00405f66
mov ecx, edi
call fcn.00402e38
cmp dword [ebp - 0x34], 0
jne 0x406279
cmp dword [edi + 0x364], 0
je 0x406338
lea eax, [edi + 0x354]
push eax
lea ecx, [edi + 0x204]
call fcn.00403e06
jmp 0x406338
lea ecx, [ebp - 0x50]
call fcn.0040e708
xor ebx, ebx
mov byte [ebp - 4], 8
cmp dword [edi + 0x1d4], ebx
jbe 0x4062a9
mov eax, dword [edi + 0x1d0]
lea ecx, [ebp - 0x50]
push dword [eax + ebx*4]
call fcn.0040e8d0
inc ebx
cmp ebx, dword [edi + 0x1d4]
jb 0x40628f
cmp dword [ebp - 0x4c], 0
lea ebx, [edi + 0x1ec]
mov ecx, ebx
lea eax, [ebp - 0x44]
je 0x4062bd
lea eax, [ebp - 0x50]
push eax
call fcn.0040e72c
cmp dword [edi + 0x324], 0
jbe 0x406308
lea eax, [edi + 0x33c]
mov ecx, ebx
push eax
call fcn.0040e8d0
push 0x4c5c60
mov ecx, ebx
call fcn.0040e95d
mov eax, dword [edi + 0x320]
mov ecx, ebx
push dword [eax]
call fcn.0040e8d0
mov eax, dword [edi + 0x320]
lea ecx, [edi + 0x1f8]
push dword [eax]
call fcn.0040e72c
cmp dword [edi + 0x1f0], 0
jne 0x40631c
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.0040e72c
cmp dword [edi + 0x3b8], 0
jne 0x40632f
mov dword [edi + 0x3b8], 0x80004005
push dword [ebp - 0x50]
call fcn.00435fa5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x38]
call fcn.00435fa5
pop ecx
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp - 4], 9
call dword [eax + 0x34]
push dword [ebp - 0x44]
call fcn.00435fa5
pop ecx
call fcn.00435e92
ret
Function at 0x406407
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x228
mov eax, 0x4bddf8
call fcn.00435efd
mov edi, ecx
mov dword [ebp - 0x224], edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], eax
call fcn.00406362
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0047a540
push esi
lea eax, [ebp - 0x218]
push str.LANG__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x4c5c88
push eax
push dword [0x4f8c68]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40647e
xor al, al
jmp 0x40656a
push esi
push dword [0x4f8c68]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [0x4f8c68]
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp dword [ebp - 0x220], ebx
je 0x406477
cmp esi, 0x100000
ja 0x406477
lea ecx, [ebp - 0x234]
call fcn.0040e540
push esi
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], ebx
call fcn.004063e3
push esi
push dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
push eax
call fcn.00479600
mov edx, dword [ebp - 0x21c]
add esp, 0xc
mov eax, edx
mov ecx, ebx
test esi, esi
je 0x406517
mov edi, eax
mov dl, byte [ecx + edi]
test dl, dl
je 0x40650b
cmp dl, 0xd
je 0x406506
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, esi
jb 0x4064f7
mov edi, dword [ebp - 0x224]
mov edx, dword [ebp - 0x21c]
mov byte [eax], bl
mov ecx, edi
sub eax, edx
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x234]
push eax
call fcn.00406572
test al, al
je 0x406555
push ebx
mov ecx, edi
call fcn.004063b3
test eax, eax
je 0x406555
push dword [ebp - 0x228]
push eax
call fcn.0040f1f7
pop ecx
pop ecx
test al, al
je 0x406555
mov bl, 1
jmp 0x40655c
mov ecx, edi
call fcn.00406362
push dword [ebp - 0x234]
call fcn.00435fa5
pop ecx
mov al, bl
call fcn.00435ea7
ret 8
Function at 0x406d5e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x406d94
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x406d87
cmp esi, ecx
jae 0x406e77
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x406e0d
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x4c5db0]
xor ecx, eax
or ecx, edx
jmp 0x406e5d
cmp edi, 6
jbe 0x406e5d
cmp edx, 4
jne 0x406e5d
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x406da6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4082b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x4082d3
xor eax, eax
jmp 0x4083f0
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [eax - 4]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x4082ee
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x4082f2
inc esi
cmp esi, ecx
jb 0x4082e5
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x4083dd
cmp ecx, 2
jbe 0x408348
xor edx, edx
movzx ebx, byte [esi + 4]
lea eax, [ebx + 1]
test al, 0xfe
jne 0x4083ce
movzx eax, byte [esi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x408374
add ebx, eax
jmp 0x408376
shr edx, cl
test edx, edx
je 0x40830c
cmp edx, 4
ja 0x408366
cmp edx, 3
je 0x408366
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x40830c
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x4082e0
sub ebx, eax
test edx, edx
je 0x4083ab
and edx, 6
mov eax, ebx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x4083a9
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x4083a7
add ebx, eax
jmp 0x4083a9
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
pop eax
jmp 0x4083d6
or edx, 8
xor eax, eax
shr edx, 1
inc eax
mov ebx, dword [ebp + 8]
add edi, eax
jmp 0x40836c
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
pop ebp
ret

Function at 0x4084df
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40853a
cmp dword [ebp - 0x114], 5
sbb eax, eax
add eax, 1
je 0x40853a
lea eax, [ebp - 0x13c]
push eax
call fcn.00408637
pop ecx
test eax, eax
je 0x40853a
mov eax, dword [ebp - 0x124]
shr eax, 0x19
and eax, 1
jmp 0x40853c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435e81
mov esp, ebp
pop ebp
ret
Function at 0x4087f3
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x4f230c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3e8]
mov dword [ebp - 0x3e8], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x408833
cmp dword [ebp - 0x3e4], 6
jne 0x408833
cmp dword [ebp - 0x3e0], 0
je 0x40885d
push str.SetDefaultDllDirectories
push 0x4c5c90
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40885d
push 0xc00
call eax
test eax, eax
jne 0x4088f2
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4088f2
cmp eax, 0x104
ja 0x4088f2
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x40889d
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [0x4c5e00], 0
push esi
mov esi, 0x4c5e00
je 0x4088f1
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x4088b8
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x4088b6
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435e81
mov esp, ebp
pop ebp
ret