joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x420740]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
xor esi, esi
cmp dword [0x4202d0], esi
jne 0x402f44
call fcn.00402e0f
cmp dword [0x4202d0], esi
jne 0x402f44
xor al, al
jmp 0x403097
push ebx
push edi
push str.To_read_n_fill_CLSID
push 0x186
push str.readAndFillCLSID
push str..IEOOP.cpp
push 0x1f4
call sub.IEOOPDLL.dll_loggingL
push dword [0x4202d0]
lea eax, [ebp - 0x6c]
push str.IEOOP.Registry_wsCLSID
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x20
lea eax, [ebp - 0x70]
push eax
mov ebx, 0x20019
push ebx
push esi
lea eax, [ebp - 0x6c]
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x403005
push 0x100
call fcn.00409eba
pop ecx
mov ebx, eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push esi
push 0x4199ce
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
call fcn.0040bad0
pop ecx
push esi
push esi
mov edi, eax
inc edi
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
call ebx
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x78], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00409eba
pop ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
push edi
push dword [ebp - 0x74]
push esi
push esi
call ebx
mov eax, dword [ebp - 0x7c]
jmp 0x403081
lea eax, [ebp - 0x70]
push eax
push ebx
push esi
lea eax, [ebp - 0x6c]
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x403093
push 0x100
call fcn.00409eba
pop ecx
mov ebx, eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push esi
push 0x4199ce
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
call fcn.0040bad0
pop ecx
push esi
push esi
mov edi, eax
inc edi
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
call ebx
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x7c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00409eba
pop ecx
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
push eax
push edi
push dword [ebp - 0x74]
push esi
push esi
call ebx
mov eax, dword [ebp - 0x78]
push dword [ebp - 0x70]
mov dword [0x4202c8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x403095
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
pop esi
call fcn.0040b97a
add ebp, 0x198
leave
ret

Function at 0x4030ad
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x403112
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x403128
push 0x80004005
call fcn.0040275b
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40312b
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x40417f
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [esi + 0x34], eax
jne 0x40419b
xor al, al
jmp 0x4041dd
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x404150
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
jne 0x4041d6
push str.monitor_thread_creation_failed
push 0xe3
push str.CExeModule::StartMonitor
push str..IEOOP.cpp
push 0x3e8
call sub.IEOOPDLL.dll_loggingL
add esp, 0x14
xor eax, eax
cmp esi, edi
setne al
pop edi
pop esi
pop ecx
ret

Function at 0x4043f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x420740]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.00402bab
mov edi, eax
cmp edi, esi
je 0x404458
lea ecx, [ebp - 0x70]
call fcn.00402a5a
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b97a
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x404470
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.004043f0
cmp eax, esi
jne 0x4044a3
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x404460
lea ecx, [ebp - 0x70]
call fcn.00402a5a
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00402a5a
mov eax, esi
jmp 0x40443e
Function at 0x4061f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x420740]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x4188a4
call fcn.0040b9bc
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x4206fc]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x4062af
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402616
add esp, 0xc
test eax, eax
jl 0x4062af
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x406297
push edi
call fcn.00404034
test al, al
pop ecx
je 0x406297
mov eax, edi
call fcn.0040d1b0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x4062a0
push edi
lea ecx, [ebp - 0x20]
call fcn.00404701
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.004026f7
cmp eax, ebx
jne 0x4062f4
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4062bf
lea ecx, [ebp]
call fcn.00403f9e
lea ecx, [ebp - 0x20]
call fcn.00403ed8
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0040b97a
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x406313
call fcn.0040287f
mov esi, eax
jmp 0x4063dd
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x406330
call fcn.0040287f
jmp 0x4063d2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x406326
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x406377
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x406363
lea ecx, [ebp]
call fcn.00403f9e
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.00403ed8
mov eax, esi
jmp 0x4062cc
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00405327
mov dword [ebp - 4], 1
jmp 0x40639f
cmp dword [ebp], ebx
jne 0x4063ab
mov esi, 0x8007000e
jmp 0x4063d4
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.004027a8
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.00405f69
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x406368
lea ecx, [ebp]
call fcn.00403f9e
jmp 0x406368
Function at 0x4074bb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x280
lea ebp, [esp - 4]
mov eax, dword [0x420740]
xor eax, ebp
mov dword [ebp + 0x280], eax
push 0xc
mov eax, 0x4189ec
call fcn.0040b989
mov esi, ecx
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [ebp - 0x18], esi
mov dword [esi + 4], ebx
call fcn.00405f44
push 0x10
mov edi, 0x4357d0
push edi
push 0x41a8e4
mov dword [ebp - 4], ebx
call fcn.00409f33
add esp, 0xc
test eax, eax
jne 0x407519
push edi
push str.Shell.Explorer
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov eax, dword [0x4357e0]
cmp eax, ebx
je 0x407537
mov eax, dword [eax + 4]
cmp eax, ebx
jl 0x407537
cmp eax, 0xff
jg 0x407537
cmp eax, 0xdddddddd
jne 0x407541
push 0x4357e0
call fcn.0040469e
push 0x400
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
call fcn.00409eba
mov dword [esi + 0x2c], eax
mov word [esi + 0x14], bx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x18], ebx
mov eax, dword [0x4357e8]
inc dword [0x4357e4]
cmp eax, ebx
pop ecx
jg 0x4075ff
lea eax, [ebp]
push str.SOFTWAREMicrosoftInternet_Explorer
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
lea eax, [ebp]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4075f7
push 0x100
call fcn.00409eba
pop ecx
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push ebx
push str.Version
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsx eax, byte [edi]
sub eax, 0x30
mov dword [0x4357e8], eax
mov cl, byte [edi + 1]
cmp cl, 0x2e
je 0x4075ff
cmp byte [edi + 2], 0x2e
jne 0x4075ff
imul eax, eax, 0xa
movsx ecx, cl
add eax, ecx
jmp 0x4075fa
push 7
pop eax
mov dword [0x4357e8], eax
push eax
push dword [0x4357e4]
lea eax, [ebp + 0x200]
push esi
push str.this_p__instanceCount_d__IEVersion_d
push eax
call fcn.0040cbe9
lea eax, [ebp + 0x200]
push eax
push 0x99
push 0x41a454
push str.e:_b_xpd6.2.3xpd.04xpd.uilwp_buildxpd_uipdeeclipsepluginscom.ibm.rcp.swt.browser.dom.ielibrariesieoopBrowser.h
push 0x1f4
call sub.IEOOPDLL.dll_loggingL
add esp, 0x28
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x280]
xor ecx, ebp
call fcn.0040b97a
add ebp, 0x284
leave
ret
Function at 0x407c72
Capabilities:
Check http status code
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], 4
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x407e45
cmp dword [ebp + 0x18], ebx
je 0x407e45
mov esi, dword [ebp + 0x14]
cmp esi, 1
je 0x407cae
cmp esi, ebx
jne 0x407e45
push ebx
push ebx
push ebx
push 1
push str.XPD_IEOOP
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp esi, 1
mov dword [ebp + 0x14], eax
jne 0x407ce4
push ebx
push 0x80c00000
jmp 0x407cee
cmp esi, ebx
jne 0x407d09
push ebx
push 0x80400000
push ebx
mov eax, 0x4199ce
push eax
push eax
push dword [ebp + 0x10]
push 0x41a5cc
push dword [ebp + 0x14]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
push dword [ebp + 0x18]
call fcn.0040bad0
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
pop ecx
inc eax
push eax
push dword [ebp + 0x18]
push 0x1c
push edi
call esi
push dword [ebp + 0x1c]
call fcn.0040bad0
pop ecx
inc eax
push eax
push dword [ebp + 0x1c]
push 0x1d
push edi
call esi
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
cmp eax, 1
mov dword [ebp + 8], eax
je 0x407d51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
add eax, 0xffffd0fb
cmp eax, 0x14
ja 0x407d93
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x10]
push eax
push 0x1f
push edi
mov dword [ebp + 0xc], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
or dword [ebp + 0x10], 0x3100
push 4
lea eax, [ebp + 0x10]
push eax
push 0x1f
push edi
call esi
cmp dword [ebp - 8], 3
jge 0x407d93
inc dword [ebp - 8]
jmp 0x407d35
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [ebp - 0x14]
sub eax, 0x191
je 0x407dd8
sub eax, 0x63
jne 0x407e07
push 0xa0000000
push 0xffffffffffffffff
push str.Accept_Encoding:_____gzip______deflate_r_n
push edi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
cmp dword [ebp - 4], 3
jge 0x407e00
inc dword [ebp - 4]
jmp 0x407d35
push dword [ebp + 0x18]
call fcn.0040bad0
pop ecx
inc eax
push eax
push dword [ebp + 0x18]
push 0x1c
push edi
call esi
push dword [ebp + 0x1c]
call fcn.0040bad0
pop ecx
inc eax
push eax
push dword [ebp + 0x1c]
push 0x1d
push edi
call esi
jmp 0x407dca
mov dword [ebp + 8], 0x191
cmp edi, ebx
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x407e14
push edi
call esi
cmp dword [ebp + 0x14], ebx
je 0x407e1e
push dword [ebp + 0x14]
call esi
cmp dword [ebp - 0xc], ebx
je 0x407e28
push dword [ebp - 0xc]
call esi
cmp dword [ebp + 8], 1
je 0x407e40
cmp dword [ebp + 8], 0x191
je 0x407e40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x407e48
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x407e4f
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
xor esi, esi
inc esi
push esi
push str.Web_Browser
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, edi
mov dword [ebp - 0x3c], esi
je 0x407e8f
push 2
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], eax
pop esi
jmp 0x407eba
mov eax, dword [ebp + 0xc]
cmp eax, edi
push 3
pop ecx
mov dword [ebp - 0x38], ecx
je 0x407ea5
push 2
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp + 0x10]
cmp edx, edi
je 0x407eba
mov eax, esi
imul eax, eax, 0xc
mov dword [ebp + eax - 0x3c], ecx
mov dword [ebp + eax - 0x38], edx
inc esi
push 0x14
pop eax
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x4b
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x3c]
mov ebx, esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ecx
call esi
test eax, eax
jne 0x407eea
or ebx, 0xffffffff
push edi
push edi
push 0x27
push dword [ebp - 4]
call esi
push edi
push edi
push 0x25
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x409d8a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x420740]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00409d1f
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0040c700
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x409dd9
cmp dword [ebp - 0x1c], 5
jb 0x409df1
jmp 0x409ded
cmp dword [ebp - 0x10], 1
jne 0x409df1
cmp dword [ebp - 0x1c], 4
ja 0x409ded
jne 0x409df1
cmp dword [ebp - 0x18], 0
jbe 0x409df1
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x41a914
call fcn.00402834
test eax, eax
jge 0x409e12
mov byte [0x435ad4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040b97a
add ebp, 0x78
leave
ret

Function at 0x40b97a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420740]
jne 0x40b984
repz ret
jmp fcn.0040fb4c
Function at 0x40e63a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x420760]
je 0x40e655
inc edi
cmp edi, 0x17
jb 0x40e646
cmp edi, 0x17
jae 0x40e7d5
push ebp
push 3
call fcn.004155e1
cmp eax, 1
pop ecx
je 0x40e7a1
push 3
call fcn.004155e1
test eax, eax
pop ecx
jne 0x40e689
cmp dword [0x420754], 1
je 0x40e7a1
cmp ebx, 0xfc
je 0x40e7d4
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x435c30
push ebp
call fcn.0040c561
add esp, 0xc
test eax, eax
je 0x40e6bf
push esi
push esi
push esi
push esi
push esi
call fcn.0040bd49
add esp, 0x14
push 0x104
mov esi, 0x435c49
push esi
push 0
mov byte [0x435d4d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40e703
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040c561
add esp, 0xc
test eax, eax
je 0x40e703
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040bd49
add esp, 0x14
push esi
call fcn.0040bad0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40e748
push esi
call fcn.0040bad0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x435f44
push 0x41af64
sub ecx, eax
push ecx
push eax
call fcn.0040d470
add esp, 0x14
test eax, eax
je 0x40e748
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040bd49
add esp, 0x14
jmp 0x40e74a
xor esi, esi
push 0x41af60
push ebx
push ebp
call fcn.0040c68f
add esp, 0xc
test eax, eax
je 0x40e76a
push esi
push esi
push esi
push esi
push esi
call fcn.0040bd49
add esp, 0x14
push dword [edi*8 + 0x420764]
push ebx
push ebp
call fcn.0040c68f
add esp, 0xc
test eax, eax
je 0x40e78c
push esi
push esi
push esi
push esi
push esi
call fcn.0040bd49
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00415424
add esp, 0xc
jmp 0x40e7d4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40e7d4
cmp ebp, 0xffffffff
je 0x40e7d4
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x420764]
push dword [esi]
call fcn.0040bad0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x415424
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040e8ed
xor ebx, ebx
cmp dword [0x436588], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4154fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4155da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41b920
push edi
call esi
cmp eax, ebx
je 0x4155da
push eax
call fcn.0040e87f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x436588], eax
call esi
push eax
call fcn.0040e87f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43658c], eax
call esi
push eax
call fcn.0040e87f
mov dword [0x436590], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040d8f1
test eax, eax
pop ecx
pop ecx
je 0x4154c8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040bd49
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4154fa
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040e87f
cmp eax, ebx
pop ecx
mov dword [0x436598], eax
je 0x4154fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040e87f
pop ecx
mov dword [0x436594], eax
mov eax, dword [0x436594]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41557f
cmp dword [0x436598], ecx
je 0x41557f
push eax
call fcn.0040e8f6
push dword [0x436598]
mov esi, eax
call fcn.0040e8f6
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41557f
cmp edi, ebx
je 0x41557f
call esi
cmp eax, ebx
je 0x41554c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41554c
test byte [ebp - 0x18], 1
jne 0x41557f
lea eax, [ebp - 0x10]
push eax
call fcn.0040d928
test eax, eax
pop ecx
je 0x415567
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040bd49
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x415576
or dword [ebp + 0x10], 0x200000
jmp 0x4155ba
or dword [ebp + 0x10], 0x40000
jmp 0x4155ba
mov eax, dword [0x43658c]
cmp eax, dword [ebp - 8]
je 0x4155ba
push eax
call fcn.0040e8f6
cmp eax, ebx
pop ecx
je 0x4155ba
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4155ba
mov eax, dword [0x436590]
cmp eax, dword [ebp - 8]
je 0x4155ba
push eax
call fcn.0040e8f6
cmp eax, ebx
pop ecx
je 0x4155ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436588]
call fcn.0040e8f6
cmp eax, ebx
pop ecx
je 0x4155da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4155dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x410790
cmp esi, edi
ja 0x4107f8
cmp edi, dword [esp + 0x1c]
ja 0x41080b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x410792
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x410780
jmp 0x4107ef
ja 0x410798
cmp eax, edx
mov esi, edi
jne 0x410753
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x4107d0
mov ebp, esi
sub ecx, edx
jns 0x4107e7
jmp 0x4107f1
cmp esi, edi
je 0x410820
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4107f1
xor al, 1
cmp ebp, edi
jne 0x4107b0
jmp 0x4107f1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x44b660
call fcn.00447000
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x44b660
call fcn.00446df0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x44b650
call fcn.00446e60
add esp, 4
ud2
Function at 0x411dae
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x411ed5
push 4
pop edi
sub edi, 1
jb 0x411dbd
cmp edx, 0xf
jbe 0x411ee5
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x44c454]
xor ebp, dword [esi*4 + 0x44c054]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x44c854]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x44cc54]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x44d054]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x44d454]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x44d854]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x44dc54]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x44e054]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x44e454]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x44e854]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x44ec54]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x44f054]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x44f454]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x44f854]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x44fc54]
push 0x44c044
call fcn.0041233c
pop ecx
mov ebx, ebp
jmp 0x411dc9
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x44c054]
test edx, edx
jne 0x411ec2
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x44c034
call fcn.00446d80
pop eax
ud2