joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b91b
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x48], 0x40
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._GlobalMemoryStatusEx_4
sub esp, 4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
cmp dword [ebp + 8], 1
jne 0x40ba31
mov dword [esp + 4], str.__meminfo_t
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x40b9a3
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
mov dword [esp], 0x414d95
call sym._printf
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
jmp 0x40ba38
mov dword [esp + 4], str.__meminfo_f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x40b9d7
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0x414db2
call sym._printf
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
jmp 0x40ba38
mov dword [esp + 4], str.__meminfo
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x40ba31
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 0x414dcd
call sym._printf
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
mov dword [esp], 0x414d95
call sym._printf
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0x414db2
call sym._printf
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
jmp 0x40ba38
mov dword [ebp - 0x64], 0xffffffff
mov eax, dword [ebp - 0x64]
leave
ret
Function at 0x40ddb8
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [ebp + 8]
mov byte [ebp - 9], al
movsx eax, byte [ebp - 9]
mov dword [esp + 8], eax
mov dword [esp + 4], str.._c:
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x40de35
mov dword [ebp - 0x6c], 0xffffffff
jmp 0x40df9f
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x50]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d1080
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
jne 0x40de89
mov dword [ebp - 0x6c], 0xffffffff
jmp 0x40df9f
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], 0x13
jg 0x40df98
mov eax, dword [ebp - 0x54]
mov dword [esp + 8], eax
mov dword [esp + 4], str..PhysicalDrive_d
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xa0000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
cmp dword [ebp + 0xc], 0
je 0x40def9
mov dword [ebp - 0x70], 0xc0000000
jmp 0x40df00
mov dword [ebp - 0x70], 0x80000000
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x40df20
jmp 0x40df8e
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x50]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
lea eax, [ebp - 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d1080
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
je 0x40df80
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x68]
jne 0x40df80
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x64]
jne 0x40df80
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
jmp 0x40df9f
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
lea eax, [ebp - 0x54]
inc dword [eax]
jmp 0x40de9e
mov dword [ebp - 0x6c], 0xffffffff
mov eax, dword [ebp - 0x6c]
leave
ret
Function at 0x40e7b6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
shl eax, 9
mov dword [ebp - 4], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
je 0x40e801
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x40e801
jmp 0x40e80a
mov dword [ebp - 0xc], 1
jmp 0x40e820
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
add eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x40e825
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
shl eax, 9
mov dword [ebp - 4], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
test eax, eax
je 0x40e870
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x40e870
jmp 0x40e879
mov dword [ebp - 0xc], 1
jmp 0x40e88f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
add eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40e8c4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 2
test eax, eax
je 0x40ea2b
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x6c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x28
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x700a0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
je 0x40e940
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
shrd eax, edx, 9
sar edx, 9
mov dword [ebp - 0x74], eax
jmp 0x40ea65
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x6c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x18
lea eax, [ebp - 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x70000
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
je 0x40ea22
mov eax, dword [ebp - 0x5c]
mov edx, 0
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], edx
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x90]
mul dword [ebp - 0x94]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
mov ebx, dword [ebp - 0x90]
imul ebx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x7c]
add eax, ebx
mov ebx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x8c]
imul edx, ebx
add eax, edx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x58]
mov edx, 0
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0x80]
mul dword [ebp - 0xa0]
mov ebx, eax
mov esi, edx
mov edi, dword [ebp - 0x80]
imul edi, dword [ebp - 0x9c]
mov ecx, esi
add ecx, edi
mov eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x7c]
add ecx, eax
mov esi, ecx
mov eax, ebx
mov dword [ebp - 0x74], eax
jmp 0x40ea65
mov dword [ebp - 0x74], 0xffffffff
jmp 0x40ea65
lea eax, [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffff
jne 0x40ea54
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
jmp 0x40ea65
mov eax, dword [ebp - 0x6c]
shr eax, 9
mov edx, dword [ebp - 0x70]
shl edx, 0x17
or eax, edx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ea70
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 2
test eax, eax
jne 0x40ea8e
mov dword [ebp - 0x4c], 0
jmp 0x40ec34
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d1080
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
jne 0x40eae5
mov dword [ebp - 0x4c], 0
jmp 0x40ec34
mov dword [esp + 4], str..A:
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._strcpy
mov byte [ebp - 0x29], 0x43
cmp byte [ebp - 0x29], 0x59
jg 0x40ec2d
movzx eax, byte [ebp - 0x29]
mov byte [ebp - 0x24], al
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x40eb59
jmp 0x40ec23
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d1080
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
je 0x40ebb3
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x48]
jne 0x40ebb3
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x44]
jne 0x40ebb3
jmp 0x40ebc3
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x40ec23
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x90018
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._DeviceIoControl_32
sub esp, 0x20
test eax, eax
jne 0x40ec15
mov dword [ebp - 0x4c], 1
jmp 0x40ec34
movsx edx, byte [ebp - 0x29]
mov eax, dword [ebp - 0x30]
mov dword [edx*4 + 0x41693c], eax
lea eax, [ebp - 0x29]
inc byte [eax]
jmp 0x40eafc
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
leave
ret
Function at 0x40f100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x40f126
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40f1ba
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x40f175
cmp eax, 0x40
je 0x40f175
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x40f119
cmp eax, 0x40
je 0x40f119
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x40f119
mov dword [esp + 8], 0x34
mov dword [esp + 4], 0x415508
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x40faa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
xor eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x192a1310
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0xb1353af
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401230
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x4c0
push esi
push 0
push 0x20
push 3
push 0
push 0
push 0x80000000
push str.global.dat
mov dword [esp + 0x20], ecx
call dword [0x47a0f0]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401266
xor eax, eax
pop esi
add esp, 0x4c0
ret
push ebx
push ebp
push edi
mov edi, dword [0x47a0f4]
push 0
lea eax, [esp + 0x18]
push eax
push 8
lea ecx, [esp + 0x24]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x18]
push edx
push 0x4b0
lea eax, [esp + 0x2c]
push eax
push esi
call edi
push esi
call dword [0x47a0f8]
mov ebx, dword [esp + 0x18]
xor eax, eax
xor dword [esp + eax*4 + 0x20], ebx
inc eax
cmp eax, 0x12c
jb 0x4012a1
xor ecx, ecx
xor eax, eax
xor edi, edi
xor esi, esi
xor edx, edx
jmp 0x4012c0
movzx ebp, byte [esp + eax*4 + 0x20]
add ecx, ebp
movzx ebp, byte [esp + eax*4 + 0x24]
add edx, ebp
movzx ebp, byte [esp + eax*4 + 0x28]
add esi, ebp
movzx ebp, byte [esp + eax*4 + 0x2c]
add eax, 4
add edi, ebp
cmp eax, 0x12c
jb 0x4012c0
add edi, esi
add edi, edx
add ecx, edi
cmp ebx, 0x4d55fb7a
jne 0x4012fa
cmp dword [esp + 0x1c], ecx
je 0x401307
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x4c0
ret
mov edi, dword [esp + 0x10]
add edi, 0x268
mov ecx, 0x12c
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x4c0
ret

Function at 0x401330
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x4bc
push esi
push edi
xor edx, edx
lea eax, [ecx + 0x278]
lea esi, [edx + 0x32]
push ebx
movzx ebx, byte [eax - 0xc]
movzx edi, byte [eax - 0x10]
add edi, ebx
movzx ebx, byte [eax - 8]
add edi, ebx
movzx ebx, byte [eax - 4]
add edi, ebx
movzx ebx, byte [eax + 4]
add edi, ebx
movzx ebx, byte [eax]
add ebx, edx
add eax, 0x18
sub esi, 1
lea edx, [ebx + edi]
jne 0x401344
xor eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x4d55fb7a
add ecx, 0x268
pop ebx
jmp 0x401390
mov edx, dword [ecx]
xor edx, 0x4d55fb7a
mov dword [esp + eax*4 + 0x14], edx
inc eax
add ecx, 4
cmp eax, 0x12c
jb 0x401390
push 0x20
push str.global.dat
call dword [0x47a0e8]
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push str.global.dat
call dword [0x47a0f0]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4013e0
pop edi
xor eax, eax
pop esi
add esp, 0x4bc
ret
mov edi, dword [0x47a0ec]
push 0
lea eax, [esp + 0xc]
push eax
push 8
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0xc]
push edx
push 0x4b0
lea eax, [esp + 0x20]
push eax
push esi
call edi
push esi
call dword [0x47a0f8]
pop edi
mov eax, 1
pop esi
add esp, 0x4bc
ret
Function at 0x40db80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
mov eax, dword [0x49f864]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
mov ebx, ecx
call fcn.0040d8b0
push 0x47a860
lea ebp, [ebx + 0x38]
push esi
push ebp
call fcn.0044af20
mov eax, dword [ebp]
add esp, 0xc
test eax, eax
jne 0x40dbc9
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00449be0
add esp, 0x38
ret 4
push edi
push 0
push 0
lea edi, [ebx + 0x40]
push edi
push eax
call fcn.0043bf60
add esp, 0x10
test eax, eax
jge 0x40dc02
mov eax, dword [ebp]
push eax
call fcn.0044ab00
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00449be0
add esp, 0x38
ret 4
push 0xffffffffffffffff
push edi
call fcn.0043c770
mov esi, eax
add esp, 8
test esi, esi
jne 0x40dc3f
push edi
call fcn.0043b2c0
mov ecx, dword [ebp]
push ecx
call fcn.0044ab00
add esp, 8
pop edi
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00449be0
add esp, 0x38
ret 4
push 0xffffffffffffffff
push edi
call fcn.0043c070
mov edx, dword [esi + 8]
imul edx, dword [esi + 4]
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
fmulp st(1)
fadd st(0), st(0)
fstp qword [esp]
call fcn.0044afc0
add esp, 8
call fcn.0044a960
mov edi, dword [esi + 4]
lea edx, [eax + 0x2e]
lea ecx, [edx - 8]
mov dword [esp + 0x18], ecx
mov ecx, 0x12
mov word [esp + 0x38], cx
mov ecx, 1
mov word [esp + 0x28], cx
movzx ecx, word [esi + 4]
mov word [esp + 0x2a], cx
mov ecx, dword [esi + 8]
imul edi, ecx
mov dword [esp + 0x2c], ecx
movzx ecx, word [esi + 4]
add cx, cx
mov word [esp + 0x34], cx
add edi, edi
mov ecx, 0x10
mov word [esp + 0x36], cx
mov dword [esp + 0x30], edi
lea edi, [ebx + 8]
mov dword [esp + 0x40], eax
mov ecx, 0xc
lea esi, [esp + 0x14]
mov dword [esp + 0x14], 0x46464952
mov dword [esp + 0x1c], 0x45564157
mov dword [esp + 0x20], 0x20746d66
mov dword [esp + 0x24], 0x12
mov dword [esp + 0x3a], 0x61746164
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov dword [ebx + 4], edx
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00449be0
add esp, 0x38
ret 4
Function at 0x4115a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
xor byte [eax], bl
inc eax
ror ebx, 8
dec ecx
jne 0x4115c0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417b70
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.00417aa0
push 0
push 0
push 0
mov dword [esi], 1
call dword [0x47a050]
mov dword [0x4a34bc], eax
lea eax, [esi + 0x328]
push eax
lea ecx, [esi + 8]
push 0
push 0x417610
mov dword [eax], ecx
mov dword [esi + 0x32c], 1
mov dword [esi + 0x330], 0
call fcn.0044b710
add esp, 0xc
push 1
mov ecx, esi
mov dword [0x4a34c0], eax
call fcn.00417a40
neg eax
sbb eax, eax
neg eax
pop esi
ret 4
Function at 0x418dc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xca
jne 0x418e02
mov ecx, dword [ebp + 8]
push ecx
call fcn.00420030
add esp, 4
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x40]
test eax, eax
je 0x418df8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0xcf
mov al, 1
jmp 0x418f1e
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xcb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcb
jne 0x418edc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a0]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x418ecb
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x418e41
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
call edx
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1a0]
mov eax, dword [edx]
call eax
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x418e65
xor al, al
jmp 0x418f1e
cmp dword [ebp - 4], 2
jne 0x418e6d
jmp 0x418ecb
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x418ec6
cmp dword [ebp - 4], 3
je 0x418e82
cmp dword [ebp - 4], 1
jne 0x418ec6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
add ecx, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [edx + 4]
cmp edx, dword [ecx + 8]
jl 0x418ec6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
add edx, dword [eax + 0x120]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [eax + 8], edx
jmp 0x418e27
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x7c]
mov dword [ecx + 0x84], eax
jmp 0x418f12
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0xcc
je 0x418f12
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax + 0x14], 0x15
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
call edx
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.00418f30
add esp, 4
mov esp, ebp
pop ebp
ret