joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425685
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e6cf
and dword [ebp - 4], 0
cmp dword [0x4501f0], 0
mov ebx, eax
jne 0x425736
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4257e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4257e7
push eax
call fcn.0041e65d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4501f0], eax
call esi
push eax
call fcn.0041e65d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4501f4], eax
call esi
push eax
call fcn.0041e65d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4501f8], eax
call esi
push eax
call fcn.0041e65d
pop ecx
mov dword [0x450200], eax
test eax, eax
je 0x425736
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e65d
pop ecx
mov dword [0x4501fc], eax
mov eax, dword [0x4501fc]
cmp eax, ebx
je 0x42578e
cmp dword [0x450200], ebx
je 0x42578e
push eax
call fcn.0041e6d8
push dword [0x450200]
mov esi, eax
call fcn.0041e6d8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42578e
test edi, edi
je 0x42578e
call esi
test eax, eax
je 0x425785
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425785
test byte [ebp - 0xc], 1
jne 0x42578e
or dword [ebp + 0x10], 0x200000
jmp 0x4257c7
mov eax, dword [0x4501f4]
cmp eax, ebx
je 0x4257c7
push eax
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4257c7
mov eax, dword [0x4501f8]
cmp eax, ebx
je 0x4257c7
push eax
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4501f0]
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4257e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1fd17d4c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xaeb4826
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401b8d
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401ad4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b86
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401ac0
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401bca
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401baa
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b7f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401b7f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401b94
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401ade
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402090
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4020e5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020de
test esi, esi
je 0x4020de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020c0
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402300
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402338
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40232e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40233a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402320
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x463008], 0x8088405
inc edx
mov dword [ebx + 0x463008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d254
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d285
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d26d
add dl, dl
jne 0x41d290
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d2e1
xor eax, eax
add dl, dl
jne 0x41d29d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d37e
add dl, dl
jne 0x41d2ac
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2b7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2cd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d2d7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d27c
mov eax, 1
add dl, dl
jne 0x41d2ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d2fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d2e6
sub eax, ebx
mov ebx, 1
jne 0x41d32d
mov ecx, 1
add dl, dl
jne 0x41d313
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d31e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d30a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d33b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d27c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d39f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d27c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x44689e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f3ff
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
jmp 0x41f41e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f41e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f490
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f479
test esi, esi
jbe 0x41f490
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f46b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f490
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f448
jmp 0x41f490
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f490
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4468a5
ret
Function at 0x4205fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x447c17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420637
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420650
lea eax, [ebp - 0x10]
mov edx, dword [0x4655f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420663
lea eax, [ebp - 0x10]
mov edx, dword [0x4655f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42066f
adc edx, 0
mov edx, dword [edx*4 + 0x4643fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4207e9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4207dc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4207dc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42077a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42077a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42077a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42077a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4207dc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4207dc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4207dc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4207dc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420801
inc ebx
cmp ebx, 0x19
jne 0x420629
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447c1e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x405591
Capabilities:
Get file system object information

Disassembly:
push 0x720
mov eax, 0x408830
call fcn.004084e7
mov eax, dword [ebp + 8]
lea esi, [eax + 0x1d4]
xor eax, eax
mov edi, 0x206
mov dword [ebp - 4], 1
push edi
mov word [ebp - 0x21c], ax
xor ebx, ebx
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call sub.MSVCR90.dll_memset
push 0x2b0
lea eax, [ebp - 0x6d8]
push ebx
push eax
mov dword [ebp - 0x6dc], ebx
call sub.MSVCR90.dll_memset
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x728], eax
xor eax, eax
mov dword [ebp - 0x72c], 2
lea edi, [ebp - 0x724]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x30
stosd dword es:[edi], eax
lea eax, [ebp - 0x710]
push ebx
push eax
mov dword [ebp - 0x714], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x30
push ebx
push ebx
push 0x1004
push dword [esi + 0x20]
call edi
push dword [ebp + 0x10]
mov dword [ebp - 0x6e0], eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy]
push dword [ebp + 0xc]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy]
add esp, 0x10
lea eax, [ebp - 0x72c]
push eax
push 0xffffffffffffffff
push 0x1053
push dword [esi + 0x20]
call edi
cmp eax, 0xffffffff
jne 0x40574c
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x4c00
push 0x2b4
lea eax, [ebp - 0x6dc]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
call dword [sym.imp.ole32.dll_OleUninitialize]
push 0x34
lea eax, [ebp - 0x714]
push ebx
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x710], eax
lea eax, [ebp - 0x424]
add esp, 0xc
push dword [ebp - 0x6dc]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x714], 3
mov dword [ebp - 0x6f8], eax
call dword [sym.imp.USER32.dll_DestroyIcon]
test dword [ebp - 0x6d4], 0x8000
je 0x405728
or dword [ebp - 0x714], 8
push 4
pop eax
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x708], eax
lea eax, [ebp - 0x714]
push eax
push ebx
push 0x104d
push dword [esi + 0x20]
call edi
push dword [ebp + 0x10]
mov ecx, esi
push 1
push dword [ebp - 0x6e0]
call sub.mfc90u.dll_CListCtrl::SetItemText
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
call fcn.00408531
ret 0xc
Function at 0x407ddc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411028]
jne 0x407de6
repz ret
jmp fcn.0040830e
Function at 0x420fe0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1d0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
mov dword [esp + 0x4c], 0xc3d2e1f0
xorps xmm0, xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0x90], 0
movaps xmm0, xmmword [esp + 0xd0]
movaps xmmword [esp + 0x80], xmm0
movaps xmm0, xmmword [esp + 0xc0]
movaps xmmword [esp + 0x70], xmm0
movaps xmm0, xmmword [esp + 0xa0]
movaps xmm1, xmmword [esp + 0xb0]
movaps xmmword [esp + 0x60], xmm1
movaps xmmword [esp + 0x50], xmm0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1a8], eax
movsd xmm0, qword [esp + 0x3c]
movsd xmm1, qword [esp + 0x44]
movsd qword [esp + 0x1a0], xmm1
movsd qword [esp + 0x198], xmm0
mov eax, esp
lea edx, [esp + 0x198]
mov dword [eax + 0x14], edx
mov dword [eax + 8], ecx
lea ecx, [esp + 0x50]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x138]
mov dword [eax], ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
call fcn.004214f0
lea esi, [esp + 0x140]
mov ecx, 0x11
lea edi, [esp + 0xe0]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x138]
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x13c]
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1b0], eax
lea eax, [esp + 0x138]
add eax, 0x4c
lea ecx, [esp + 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call sub.msvcrt.dll_memcpy
lea ecx, [esp + 0x1bc]
lea eax, [esp + 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x14
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov eax, esp
lea edi, [esp + 0xe0]
mov dword [eax + 0x10], edi
mov dword [eax + 0xc], esi
mov dword [eax + 8], edx
lea edx, [esp + 0x1bc]
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.00424f10
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x44cce0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x420
call fcn.0044ccf4
Function at 0x45ba50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x45bab0
jmp 0x45ba9e
jbe 0x45bb20
cmp esi, 0x201
jae 0x45bab0
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x45bada
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x45bace
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call fcn.00446fa0
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x45baf7
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x45bb70
cmp esi, ebx
jne 0x45ba90
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x45bb8e
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x45ba9e
jmp 0x45bab0
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x45bba4
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call fcn.00468850
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45bb62
add eax, eax
push 2
push eax
push dword [ebp - 0x14]
call fcn.004016f0
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x45bb52
jmp 0x45bb62
push 0x4e47d0
push 0x28
push str.internal_error:_entered_unreachable_code
call fcn.004b3aa0
add esp, 0xc
jmp 0x45bbb3
push 0x4e47c0
push eax
push esi
call fcn.004b9430
add esp, 0xc
ud2
Function at 0x4698c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov edi, edx
call fcn.00469330
mov ecx, dword [edi + 4]
cmp eax, ecx
ja 0x4699db
mov edx, dword [edi]
mov ebx, edx
lea esi, [edx + eax]
movzx edx, byte [edi + 8]
mov edi, eax
sub edi, ecx
mov byte [ebp - 0xd], dl
jne 0x469907
mov ebx, dword [ebp - 0x14]
xor edi, edi
movzx edx, byte [ebp - 0xd]
sub ecx, eax
jne 0x469983
jmp 0x469961
cmp dl, 3
mov dword [ebp - 0x18], esi
jae 0x46992f
mov edx, ebx
lea esi, [ecx + ebx - 1]
mov ebx, dword [ebp - 0x14]
mov edi, eax
sub edi, ecx
nop dword [eax]
cmp byte [esi], 0x5c
je 0x4699c5
dec esi
inc edi
jne 0x469920
jmp 0x469954
mov edx, ebx
lea esi, [ecx + ebx - 1]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
cmp ebx, 0x2f
je 0x469965
cmp ebx, 0x5c
je 0x469965
dec esi
inc edi
jne 0x469940
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
xor edi, edi
movzx edx, byte [ebp - 0xd]
sub ecx, eax
jne 0x469983
mov al, 0xa
jmp 0x4699b0
mov ebx, dword [ebp - 0x14]
not edi
lea eax, [eax + edi + 1]
cmp eax, ecx
ja 0x4699cf
add edx, eax
mov edi, 1
mov esi, edx
movzx edx, byte [ebp - 0xd]
sub ecx, eax
je 0x469961
mov al, 9
cmp ecx, 2
je 0x4699a2
cmp ecx, 1
jne 0x4699b0
cmp byte [esi], 0x2e
jne 0x4699b0
xor eax, eax
cmp dl, 3
setae al
lea eax, [eax + eax*2 + 7]
jmp 0x4699b0
cmp byte [esi], 0x2e
jne 0x4699b0
cmp byte [esi + 1], 0x2e
sete al
xor al, 9
add edi, ecx
mov dword [ebx], edi
mov byte [ebx + 4], al
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
not edi
lea eax, [eax + edi + 1]
cmp eax, ecx
jbe 0x469972
push 0x4e29f8
push ecx
push eax
call fcn.004b93d0
push 0x4e29e8
push ecx
push eax
call fcn.004b93d0
nop word [eax + eax]
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x1c]
push 4
push str.Iter
push dword [ebp + 0xc]
push esi
call fcn.004b7dc0
add esp, 0x10
push edi
call fcn.00469480
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x10]
push 0x4e2a2c
push eax
push esi
call fcn.004b44a0
add esp, 0xc
push eax
call fcn.004b45a0
add esp, 0x18
pop esi
pop edi
pop ebp
ret