joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d0c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov eax, dword [eax]
cmp edx, 3
ja case.default.0x47d0d2
jmp dword [edx*4 + 0x47d128]
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0047cc10
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0047c9c0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0047d2d0
push str.TFTP_finished
push 0x4b2348
push eax
call fcn.0046a980
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x4b3558
push eax
call fcn.0046a8d0
add esp, 0xc
mov eax, 0x47
pop ebp
ret

Function at 0x47d2d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [edi + 0x10]
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 4]
cmp ecx, 3
ja case.default.0x47d2ef
jmp dword [ecx*4 + 0x47d5bc]
cmp eax, 4
jne 0x47d3d1
lea eax, [edi + 0x15c]
push eax
call fcn.0047c390
movzx ecx, word [edi + 0x40]
add esp, 4
movzx eax, ax
mov edx, ecx
cmp eax, edx
je 0x47d3bf
test cx, cx
jne 0x47d32f
cmp eax, 0xffff
je 0x47d3bf
push edx
push eax
push str.Received_ACK_for_block__d__expecting__d_n
push esi
call fcn.0046a980
inc dword [edi + 0x18]
add esp, 0x10
mov eax, dword [edi + 0x18]
cmp eax, dword [edi + 0x20]
jle 0x47d369
movzx eax, word [edi + 0x40]
push eax
push str.tftp_tx:_giving_up_waiting_for_block__d_ack
push esi
call fcn.0046a8d0
add esp, 0xc
mov ebx, 0x37
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
mov eax, dword [edi + 0x150]
push 0
add eax, 4
push eax
push dword [edi + 0x160]
push dword [edi + 0x14]
invalid
invalid
invalid
cwde
invalid
Function at 0x482fa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4c006c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push edi
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
mov eax, dword [esi + 0x194]
or edi, 0xffffffff
mov ebx, dword [esi]
push ecx
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_getsockname]
invalid
test eax, eax
jne 0x482ff8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push dword [ebp - 0x1c]
push esi
call fcn.0046b100
add esp, 8
cmp edi, 0xffffffff
jne 0x48302d
push str.Error_accept__ing_server_connect
push ebx
call fcn.0046a8d0
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434bd1
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.0046a980
push 1
mov byte [esi + 0x258], 0
push edi
mov dword [esi + 0x194], edi
call fcn.004899a0
mov byte [esi + 0x1a1], 1
add esp, 0x10
mov eax, dword [ebx + 0x198]
test eax, eax
je 0x483092
push 1
push edi
push dword [ebx + 0x19c]
call eax
add esp, 0xc
test eax, eax
je 0x483092
push esi
call fcn.00483510
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434bd1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434bd1
mov esp, ebp
pop ebp
ret

Function at 0x4854a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x4854cf
push str.Couldnt_set_desired_mode
push edx
call fcn.0046a8d0
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x4854e6
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.0046a980
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4854fd
push edi
call fcn.00485230
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x485511
push edi
call fcn.00484310
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x485525
push edi
call fcn.00485210
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x485535
push edi
call fcn.00485380
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x486fc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4c006c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00453020
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x487024
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x487024
lea eax, [ebp - 0x108]
push eax
call dword [0x4c09dc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434bd1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00434bd1
mov esp, ebp
pop ebp
ret

Function at 0x487040
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00486fc0
Function at 0x4899d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4899f0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push str.LoadLibraryExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x49f264
push esi
mov dword [ebp - 8], ebx
call fcn.0044f5c4
add esp, 8
test eax, eax
je 0x489a3c
test ebx, ebx
je 0x489a2c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x489a65
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x489a65
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x489b27
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x489a81
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x4c09d0]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x489b1d
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x489b1d
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x489ac0
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x489ae0
sub ecx, edx
sar ecx, 1
lea ecx, [ebx + ecx*2]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x489af4
mov eax, dword [ebp - 8]
test eax, eax
je 0x489b14
push 8
push 0
push ebx
call eax
jmp 0x489b1b
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x4c09d4]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x48a7f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x48a81c
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x48a80d
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x48a850
cmp dword [esi + 8], 0
jne 0x48a840
push 0x4b2538
push dword [eax + 8]
call fcn.00456db2
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x48a840
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00456feb
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x48a872
mov eax, dword [esi + 8]
test eax, eax
je 0x48a86c
push eax
call fcn.00455250
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x48ccd0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x48cce0
sub esi, ecx
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [0x4c09d0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x48cd08
lea eax, [edi + 0x1b]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 0xc]
push edi
call fcn.0048cf70
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x48cd87
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x48cd7c
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x10
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x4c09d4]
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48cfe0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c006c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x48d077
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.0048d0e0
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0048f700
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x48d089
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434bd1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00434bd1
mov esp, ebp
pop ebp
ret

Function at 0x48e440
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x48e472
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x48e5f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x48e623
push 0x2e
push edi
call fcn.004566d0
add esp, 8
test eax, eax
je 0x48e621
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x48f5f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x4c09d0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x48f61d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x48f664
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x48f66a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x48f6cb
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x48f690
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x48f6f7
mov eax, dword [esi + 4]
push 1
push str.6_s__02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x4ae4af
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x48f6d0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cbb80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4cbc8c
test eax, eax
je 0x4cbc8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x4e5fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4cbc73
lea edi, [eax + 4]
jmp 0x4cbbd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4cbbec
mov dword [ebp - 4], 2
jmp 0x4cbc0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4cbc03
mov dword [ebp - 4], 1
jmp 0x4cbc0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4cbc83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4cbc46
mov byte [ecx], 0x3d
jmp 0x4cbc52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4cbc5d
mov byte [ecx], 0x3d
jmp 0x4cbc63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4cbbd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4014ab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
push esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x228], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push eax
push eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
mov dword [esp], 0
call ebx
lea ebx, [ebp - 0x210]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push esi
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea esp, [ebp - 8]
lea eax, [ebx - 3]
pop ebx
pop esi
pop ebp
ret

Function at 0x4016af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.004014ab
test eax, eax
jne 0x401749
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4021b2
sub eax, 0x401750
mov dword [esp], 0x401750
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401749
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401423
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00401630
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ba00
mov dword [esp], 0x40300c
call fcn.00401eb5
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x430001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x702e7576
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x31c0315d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e83
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
add byte [esi + edi], 0x4f
call ebx
add byte [esi + edi], 0x85
call ebx
xor byte [esi + edi], 0x66
call ebx
add byte [esi + edi], 0x2b
call ebx
add byte [esi + edi], 6
call ebx
add byte [esi + edi], 0x76
call ebx
add byte [esi + edi], 0xdd
call ebx
xor byte [esi + edi], 0x77
call ebx
add byte [esi + edi], 0x39
call ebx
add byte [esi + edi], 0x83
call ebx
xor byte [esi + edi], 0xb0
call ebx
add byte [esi + edi], 0x66
call ebx
add byte [esi + edi], 0x8c
call ebx
add byte [esi + edi], 0x67
call ebx
add byte [esi + edi], 0x45
call ebx
inc byte [esi + edi]
call ebx
xor byte [esi + edi], 0xee
call ebx
add byte [esi + edi], 0xe
call ebx
add byte [esi + edi], 0x82
call ebx
add byte [esi + edi], 0x11
call ebx
add byte [esi + edi], 4
call ebx
add byte [esi + edi], 0x50
call ebx
add byte [esi + edi], 0xc2
call ebx
add byte [esi + edi], 0x76
call ebx
add byte [esi + edi], 0xb4
call ebx
xor byte [esi + edi], 0x88
call ebx
add byte [esi + edi], 0x19
call ebx
add byte [esi + edi], 0xa8
call ebx
add byte [esi + edi], 0xd0
call ebx
add byte [esi + edi], 0x54
call ebx
add byte [esi + edi], 0xa6
call ebx
xor byte [esi + edi], 0xb2
call ebx
xor byte [esi + edi], 0x54
call ebx
xor byte [esi + edi], 0x63
call ebx
add byte [esi + edi], 0xcc
call ebx
add byte [esi + edi], 0xfb
call ebx
xor byte [esi + edi], 0x3a
call ebx
add byte [esi + edi], 0xb1
call ebx
add byte [esi + edi], 0x22
call ebx
xor byte [esi + edi], 0x5f
call ebx
add byte [esi + edi], 0xe4
call ebx
xor byte [esi + edi], 0xe4
call ebx
add byte [esi + edi], 0xa7
call ebx
xor byte [esi + edi], 0xce
call ebx
inc byte [esi + edi]
call ebx
xor byte [esi + edi], 0xcb
call ebx
add byte [esi + edi], 0xe7
call ebx
add byte [esi + edi], 0xc3
call ebx
add byte [esi + edi], 0xcd
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x4460ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f76
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e4
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f8e
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f3e
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f4a
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f78