joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100153b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.1002adf4
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100153f1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.10015009
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1001544f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x10015473
cmp dword [edi + 0x54], 0
jne 0x10015473
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1002adf4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.10015410
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1001b293
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1001b2da
call fcn.1002adf4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001b2da
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1001b2f6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1001ae0d
mov esi, eax
test edi, edi
je 0x1001b2f4
test ebx, ebx
je 0x1001b2f4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001bb39
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10061141
call fcn.10046bd3
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1001bb5e
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001bba4
lea ecx, [ebp - 0x10]
call fcn.10004470
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001b2fd
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10001b30
mov eax, esi
call fcn.10046cab
ret 8
Function at 0x1001cf93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1001cfdb
call fcn.1002adf4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001cfdb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1001d01e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x1001d007
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1001d007
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1001d01b
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1003c3d7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x10061f98
call fcn.10046bd3
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10012e78
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1003c439
call fcn.1002a6ce
cmp eax, 1
jne 0x1003c439
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.100140ee
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10014047
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001b30
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10001b30
mov eax, esi
call fcn.10046cab
ret 0x10

Function at 0x1003c462
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x10061f98
call fcn.10046bd3
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10012e78
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1003c4c4
call fcn.1002a6ce
cmp eax, 1
jne 0x1003c4c4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.100140ee
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10014047
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001b30
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10001b30
mov eax, esi
call fcn.10046cab
ret 0x14

Function at 0x10044e70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a33c8]
jne 0x10044e7a
repz ret
jmp fcn.1004bebc
Function at 0x10059838
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1004b833
and dword [ebp - 4], 0
cmp dword [0x100a7464], 0
mov ebx, eax
jne 0x100598e9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1005999a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10072bf8
push edi
call esi
test eax, eax
je 0x1005999a
push eax
call fcn.1004b7c1
mov dword [esp], 0x10072be8
push edi
mov dword [0x100a7464], eax
call esi
push eax
call fcn.1004b7c1
mov dword [esp], 0x10072bd4
push edi
mov dword [0x100a7468], eax
call esi
push eax
call fcn.1004b7c1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100a746c], eax
call esi
push eax
call fcn.1004b7c1
pop ecx
mov dword [0x100a7474], eax
test eax, eax
je 0x100598e9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1004b7c1
pop ecx
mov dword [0x100a7470], eax
mov eax, dword [0x100a7470]
cmp eax, ebx
je 0x10059941
cmp dword [0x100a7474], ebx
je 0x10059941
push eax
call fcn.1004b83c
push dword [0x100a7474]
mov esi, eax
call fcn.1004b83c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10059941
test edi, edi
je 0x10059941
call esi
test eax, eax
je 0x10059938
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10059938
test byte [ebp - 0xc], 1
jne 0x10059941
or dword [ebp + 0x10], 0x200000
jmp 0x1005997a
mov eax, dword [0x100a7468]
cmp eax, ebx
je 0x1005997a
push eax
call fcn.1004b83c
pop ecx
test eax, eax
je 0x1005997a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1005997a
mov eax, dword [0x100a746c]
cmp eax, ebx
je 0x1005997a
push eax
call fcn.1004b83c
pop ecx
test eax, eax
je 0x1005997a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100a7464]
call fcn.1004b83c
pop ecx
test eax, eax
je 0x1005999a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1005999c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100020
call fcn.004053c0
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
push 0x406d28
push edx
mov ebx, ecx
movlpd qword [ebp - 0x100014], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
mov dword [ebp - 0x100018], edi
test edi, edi
jne 0x401f5a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [0x4094a0]
push str.fopen:__s:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040471b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x100014]
push eax
push 3
push esi
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_open]
add esp, 0x10
test eax, eax
jne 0x401f80
mov eax, dword [ebp - 0x100014]
or eax, dword [ebp - 0x100010]
jne 0x401fc6
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push esi
push str.afc_file_open_on__s_failed__n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040471b
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x100018]
push edi
push 0x100000
lea eax, [ebp - 0x10000c]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4020a2
xor esi, esi
nop word [eax + eax]
lea eax, [ebp - 0x10001c]
mov dword [ebp - 0x10001c], 0
push eax
push edi
lea eax, [ebp - 0x10000c]
push eax
push dword [ebp - 0x100010]
push dword [ebp - 0x100014]
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_write]
add esp, 0x18
test eax, eax
jne 0x40202f
add esi, dword [ebp - 0x10001c]
cmp esi, edi
jb 0x401ff0
jmp 0x402049
push eax
push str.AFC_Write_error:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
cmp esi, edi
je 0x401fc0
push edi
push esi
push str.Error:_wrote_only__u_of__u_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
push dword [ebp - 0x100010]
push dword [ebp - 0x100014]
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_close]
add esp, 0x1c
push dword [ebp - 0x100018]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040471b
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x100010]
push dword [ebp - 0x100014]
push ebx
call dword [sym.imp.imobiledevice.dll_afc_file_close]
add esp, 0xc
push dword [ebp - 0x100018]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0040471b
mov esp, ebp
pop ebp
ret
Function at 0x401740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x441a9c]
push esi
mov esi, dword [ebp + 8]
sub eax, 0x32d2bc04
mov word [0x438786], ax
cmp byte [esi], 0
je 0x401827
mov edx, dword [ebp + 0xc]
jmp 0x401770
mov ecx, dword [0x43b5d4]
mov eax, dword [0x441cfc]
shl ecx, 8
shl eax, 8
sub ecx, eax
cmp ecx, 0x30288585
jle 0x401797
and dword [0x4414f4], 0x5ffbc38d
jmp 0x4017b6
mov eax, dword [0x441194]
mov ecx, dword [0x43c168]
add eax, 0x72a97cd0
imul ecx, eax
mov dword [0x43c168], ecx
inc dword [0x441194]
movsx eax, byte [esi]
cmp eax, edx
je 0x401851
dec dword [0x43df64]
mov ecx, dword [0x43df64]
mov eax, dword [0x439bcc]
lea eax, [ecx + eax*4]
mov ecx, dword [0x439ff8]
inc dword [0x439ff8]
and ecx, eax
cmp ecx, 0x3bf30b46
jne 0x401804
mov ax, word [0x4377e6]
movzx ecx, word [0x437bbe]
cwde
sub ecx, eax
mov word [0x437bbe], cx
jmp 0x40180e
or dword [0x43ec6c], 0x2e1fb719
imul eax, dword [0x440a2c], 0x2f6a00b0
inc esi
mov dword [0x440a2c], eax
cmp byte [esi], 0
jne 0x401770
mov eax, dword [0x43d218]
not eax
or eax, 0xdbe15caa
cmp eax, 0xfff5f734
jg 0x4018a1
movzx eax, word [0x437d32]
xor eax, 0xe000420
mov word [0x437d32], ax
xor eax, eax
pop esi
pop ebp
ret
dec dword [0x43d010]
mov eax, dword [0x43d010]
cmp eax, 0x510fee4b
jl 0x40187a
movzx eax, word [0x436b1a]
xor eax, 0xd6250ea8
mov word [0x436b1a], ax
mov eax, esi
pop esi
pop ebp
ret
mov edx, dword [0x43a418]
mov eax, esi
movzx ecx, word [0x4367ec]
or edx, 0xe021f9d
xor ecx, edx
mov word [0x4367ec], cx
inc dword [0x43a418]
pop esi
pop ebp
ret
mov eax, dword [0x43c54c]
add eax, 0x6721ee1c
and dword [0x440550], eax
xor eax, eax
pop esi
pop ebp
ret
Function at 0x406190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsx eax, word [0x4370f0]
imul ecx, eax, 0x2f55be40
movsx eax, word [0x43759a]
sar eax, 2
add eax, ecx
movzx ecx, word [0x438564]
add ecx, eax
mov word [0x438564], cx
mov dword [0x43a0b8], 0xc177bdf
mov eax, dword [0x442188]
sub eax, 0x57c5ec5a
xor eax, 0xb33f77fe
cmp eax, 0x6334bf0f
jl 0x4061e6
add dword [0x44003c], 0xb3995f06
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jle 0x4062af
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov edi, edi
or dword [0x43e4f8], 0x29300eb6
cmp dword [eax], esi
sbb edx, edx
xor dword [0x439f7c], 0x65bfc690
sub dword [eax], esi
neg edx
or dword [0x43f04c], 0xf13dff0c
mov ecx, dword [eax]
cmp ecx, dword [ebx + eax]
sbb esi, esi
add dword [0x440464], 0xe322c72a
mov ecx, dword [ebx + eax]
neg esi
sub dword [eax], ecx
add esi, edx
movzx ecx, word [0x438848]
add eax, 4
imul ecx, ecx, 0xf6189bb2
mov word [0x438848], cx
dec edi
jne 0x406200
pop ebx
test esi, esi
je 0x4062af
nop
or dword [0x43d554], 0x1f370c27
lea eax, [eax + 4]
cmp dword [eax - 4], esi
sbb ecx, ecx
and dword [0x43aa6c], 0x40009023
sub dword [eax - 4], esi
neg ecx
add dword [0x440320], 0xdabd19f8
mov esi, ecx
add dword [0x43d840], 0xa8476d2b
and dword [0x43a8ac], 0xbba158a0
mov dword [0x43e47c], 0x73f2b19d
test ecx, ecx
jne 0x406260
movsx eax, word [0x436be4]
mov ecx, 0x214295ff
imul eax, eax, 0x792d4b67
pop edi
pop esi
sub ecx, eax
cmp ecx, 0xffede86c
je 0x4062e1
movzx eax, word [0x4368ce]
or eax, 0xb1ddb9dd
mov word [0x4368ce], ax
pop ebp
ret
mov eax, dword [0x441c48]
and eax, 0x1e1273a7
sub dword [0x43bdb4], eax
inc dword [0x441c48]
pop ebp
ret
Function at 0x416d30
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [0x43c814]
movzx eax, word [0x435304]
not edx
and edx, 0xbec5e3b9
or eax, edx
push esi
mov esi, ecx
or eax, 0x3e0561a9
mov word [0x435304], ax
mov dword [esi], 0
add dword [0x43fe60], 0xc4fd379
mov dword [esi + 4], 0
movzx eax, word [0x43519e]
mov ecx, dword [0x43e0d4]
cwde
add ecx, eax
and ecx, 0xb2d39e36
cmp ecx, 0x880bc834
jge 0x416d94
add dword [0x43cdec], 0x156f08df
mov dword [esi + 8], 0x67452301
mov dword [0x43cc48], 0x10c74e73
mov dword [esi + 0xc], 0xefcdab89
mov dword [0x4414f0], 0xcbf7de7b
mov dword [esi + 0x10], 0x98badcfe
mov ecx, dword [0x441008]
mov eax, dword [0x43b6dc]
or ecx, 0x82e48900
imul eax, ecx
mov dword [0x43b6dc], eax
mov dword [esi + 0x14], 0x10325476
add dword [0x441d0c], 0x8a0a2d58
pop esi
ret
Function at 0x420d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4417b0]
not eax
sub eax, 0x73ebd12b
cmp eax, 0xb8160ad0
jle 0x420dc7
dec word [0x437e22]
movzx ecx, word [0x437e22]
dec dword [0x43bfac]
mov eax, dword [0x43bfac]
movzx edx, word [0x4383b0]
sub edx, ecx
sub edx, eax
add edx, 0x14f0976b
mov word [0x4383b0], dx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [0x4398e0], 0xf6f7ff5f
mov edx, dword [edi + 4]
dec edx
js 0x420dee
mov eax, dword [edi + 8]
lea eax, [eax + edx*4]
cmp dword [eax], 0
jne 0x420dee
sub eax, 4
dec edx
jns 0x420de3
mov ebx, dword [ebp + 0xc]
or dword [0x4400f0], 0xfb4ff363
mov esi, dword [ebx + 4]
dec esi
js 0x420e12
mov eax, dword [ebx + 8]
lea eax, [eax + esi*4]
cmp dword [eax], 0
jne 0x420e12
sub eax, 4
dec esi
jns 0x420e07
movsx eax, word [0x435e34]
movzx ecx, word [0x438ffe]
imul eax, eax, 0x602da20a
add ecx, eax
mov word [0x438ffe], cx
test edx, edx
jns 0x420e3b
test esi, esi
js 0x420f75
or dword [0x43ae78], 0x7a1ffffb
cmp edx, esi
jle 0x420e50
mov eax, dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret
dec word [0x437990]
mov ax, word [0x437990]
cwde
add eax, dword [0x441988]
mov dword [0x441988], eax
cmp esi, edx
jle 0x420e76
mov eax, dword [edi]
pop edi
pop esi
neg eax
pop ebx
pop ebp
ret
mov ecx, dword [0x4410d4]
mov eax, dword [0x440f18]
shl ecx, 8
imul eax, ecx
and eax, 0x4390ff23
cmp eax, 0xa0a37e26
jne 0x420ea5
movzx eax, word [0x43849e]
xor eax, 0xf55954b
mov word [0x43849e], ax
cmp dword [edi], 0
jle 0x420eb9
cmp dword [ebx], 0
jge 0x420eb9
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
inc dword [0x43f084]
mov ecx, 0xd1bf2040
mov eax, dword [0x43f084]
imul eax, eax, 0x2ed1f2a5
sub ecx, eax
mov eax, dword [0x43fbb0]
not eax
cmp eax, ecx
jle 0x420eea
mov eax, dword [0x440964]
sar eax, 8
or dword [0x441eb0], eax
cmp dword [ebx], 0
jle 0x420efc
cmp dword [edi], 0
jge 0x420efc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
mov eax, dword [0x43ef18]
shl eax, 5
or eax, 0x232b6a2d
sub dword [0x43c098], eax
test edx, edx
js 0x420f6b
jmp 0x420f20
mov eax, dword [0x43a100]
sub eax, 0x7781c44a
mov word [0x43565e], ax
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
ja 0x420e49
and dword [0x4418a0], 0x600504
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jb 0x420e6d
or dword [0x441548], 0x3afe4149
dec edx
jns 0x420f20
add dword [0x4411f4], 0x1358c0b2
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x422d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and dword [0x4414cc], 0xd908ae14
mov ecx, dword [ebp + 0xc]
and dword [0x43a210], 0xe62a0f4e
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, byte [ecx]
movzx eax, bl
movzx edx, byte [esi]
sub edx, eax
jne 0x422d83
sub esi, ecx
lea ecx, [ecx]
test bl, bl
je 0x422d83
mov bl, byte [ecx + 1]
inc ecx
movzx eax, bl
movzx edx, byte [esi + ecx]
sub edx, eax
je 0x422d70
imul eax, dword [0x43bac0], 0x4cd57e34
pop esi
pop ebx
mov dword [0x43bac0], eax
test edx, edx
jns 0x422db1
and dword [0x43ba70], 0xd180418c
or edx, 0xffffffff
xor dword [0x43ca48], 0x392a453d
jmp 0x422de5
jle 0x422de5
movsx eax, word [0x4395ca]
cmp eax, 0x2858286b
je 0x422dcc
mov eax, 0xffffd763
mov word [0x43927a], ax
movzx ecx, word [0x436934]
mov edx, 1
imul ecx, ecx, 0xc1355049
mov word [0x436934], cx
movzx ecx, word [0x439574]
mov eax, edx
and ecx, 0x6e5edfe7
mov word [0x439574], cx
pop ebp
ret

Function at 0x423300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add dword [0x43e098], 0x7d5dad15
and dword [0x43fc18], 0x20e89a1e
mov eax, dword [0x441ad8]
push esi
mov esi, dword [ebp + 8]
or eax, 0x311becbe
sub dword [0x43e2f0], eax
push esi
call fcn.00408700
imul ecx, dword [0x43e604], 0xcd348888
add esp, 4
lea edx, [eax - 1]
mov dword [0x43e604], ecx
imul ecx, dword [0x43c1c8], 0xc2685c6a
mov dword [0x43b694], ecx
cmp byte [edx + esi], 0x22
jne 0x42345f
mov eax, dword [0x441cb4]
imul eax, dword [0x43a638]
push edi
mov edi, 0xfffffdbf
imul eax, eax, 0xbf8b1ba0
mov dword [0x441cb4], eax
mov byte [esi], 0x22
dec dword [0x441eb8]
mov eax, dword [0x441eb8]
xor eax, 0x57fbe8e8
sub dword [0x43aac8], eax
mov byte [edx + esi], 0
mov dword [0x43e284], 0xd3080681
jmp 0x4233b0
movzx eax, word [0x436ed4]
mov ecx, 0x931821c3
add eax, 0x44e51054
dec edx
mov word [0x437be8], ax
dec word [0x436ed4]
imul eax, dword [0x43f3d4], 0x77c0a63f
sub ecx, eax
cmp ecx, dword [0x43b200]
je 0x4233ea
mov word [0x43632e], di
cmp byte [edx + esi], 0x22
jne 0x4233b0
mov eax, dword [0x43c0c4]
inc dword [0x43c0c4]
add eax, 0x7f993967
pop edi
cmp eax, 0xb7db6fdd
je 0x42341b
movzx eax, word [0x4389ae]
imul eax, eax, 0xe6ead0bf
mov word [0x4389ae], ax
mov ecx, dword [0x43d800]
lea eax, [esi + 1]
inc dword [0x43d800]
add ecx, 0x9b7c039
add eax, edx
cmp ecx, 0x834cc30a
jge 0x4234e6
movzx ecx, word [0x436758]
sub ecx, 0xa0020
mov word [0x436758], cx
xor dword [0x43fb98], 0xaf499d7
pop esi
pop ebp
ret
movzx eax, word [0x437016]
mov ecx, 0x56514280
imul eax, eax, 0x4fbe6cf0
mov word [0x437016], ax
mov byte [esi], 0x20
movsx eax, word [0x436a26]
inc word [0x436a26]
imul eax, eax, 0x6dac38d
sub ecx, eax
cmp ecx, 0x9af57e34
jg 0x4234a2
add dword [0x43e464], 0xbf0aae58
mov eax, dword [0x439f04]
dec edx
and eax, 0x13843023
or eax, 0x8c32410c
mov dword [0x441cc8], eax
add dword [0x4413b0], 0x71f7fff9
cmp byte [edx + esi], 0x20
jne 0x4234a2
imul eax, dword [0x43e410], 0x3b90dabc
mov word [0x436cbe], ax
lea eax, [esi + 1]
add eax, edx
and dword [0x43ce08], 0x375708ae
xor dword [0x43fb98], 0xaf499d7
pop esi
pop ebp
ret
Function at 0x10056d38
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov edi, 0x10063694
mov ebp, 0x100636e0
push 0
call sub.user32.dll_GetDC
mov dword [0x100636b8], eax
mov eax, dword [0x100636b8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov ebx, eax
mov eax, dword [ebp]
push eax
mov eax, dword [0x100636d8]
push eax
mov eax, dword [0x100636b8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov esi, eax
push esi
push ebx
call sub.gdi32.dll_SelectObject
mov eax, dword [0x10063688]
push eax
push 0
push 0
mov eax, dword [0x100636b8]
push eax
mov eax, dword [ebp]
push eax
mov eax, dword [0x100636d8]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
test eax, eax
jne 0x10056dca
mov byte [esp], 0
push ebx
call sub.gdi32.dll_DeleteDC
push esi
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x100636b8]
push eax
push 0
call sub.user32.dll_ReleaseDC
jmp 0x10056ec2
push 0
mov eax, dword [0x100636bc]
push eax
mov eax, dword [0x100636c4]
push eax
mov eax, dword [ebp]
push eax
push 0
push esi
push ebx
call sub.gdi32.dll_GetDIBits
push ebx
call sub.gdi32.dll_DeleteDC
push esi
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x100636b8]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp]
push eax
mov eax, dword [0x100636d8]
push eax
push 0
push 0
lea eax, [esp + 0x11]
push eax
call sub.user32.dll_SetRect
cmp dword [edi], 0
je 0x10056e23
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
cmp dword [0x100636a0], 0
je 0x10056e37
mov eax, dword [0x100636a0]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov eax, dword [ebp]
imul dword [0x100636dc]
add eax, dword [0x100636d4]
mov dword [edi + 8], eax
mov ebx, eax
shl ebx, 2
mov dword [edi + 4], ebx
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [edi], eax
mov ebx, dword [edi + 8]
shl ebx, 2
mov dword [0x100636a4], ebx
push ebx
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [0x100636a0], eax
mov edx, dword [edi]
mov eax, dword [0x100636bc]
mov ecx, dword [0x100636d4]
call fcn.10002cd0
mov eax, dword [edi]
xor edx, edx
push edx
push eax
mov eax, dword [0x100636d4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
mov ecx, dword [ebp]
imul ecx, dword [0x100636dc]
mov eax, dword [0x100636c4]
call fcn.10002cd0
mov al, 1
call fcn.10056b14
xor eax, eax
mov dword [edi + 8], eax
mov byte [esp], 1
mov al, byte [esp]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret