joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4567d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x456803
push esi
call fcn.00464b20
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4567fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x456889
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x456872
mov eax, dword [esi + 8]
test eax, eax
je 0x456827
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45686e
cmp eax, 2
je 0x456872
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45681a
cmp eax, 3
je 0x45684d
cmp eax, 1
jne 0x45681a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45681a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45681a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004568b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x456898
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004568b0
add esp, 4
pop esi
ret

Function at 0x457120
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x457141
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x457141
mov eax, dword [eax + 0x44]
test eax, eax
je 0x457141
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4715c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x471626
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x471626
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x471607
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4719b0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4719e8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x472710
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x472759
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x472bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x494700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00472780
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00472800
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00472800
lea ecx, [esi + 0xc]
call fcn.00485c83
lea ecx, [esi + 0x10]
call fcn.00485c83
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00473d90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00473d90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00473d90
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00485cf8
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00485cf8
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4880c9
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x488101
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00486153
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048612b
jmp 0x48810d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4897bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4897fd
call fcn.0048f531
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4897fd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4897f4
xor eax, eax
jmp 0x489805
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048980b
pop edi
pop esi
pop ebx
ret 4

Function at 0x48fa61
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48fa8f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48faad
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048f9c7
jmp 0x48faad
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48faad
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048f9c7
test edi, edi
mov eax, edi
jne 0x48fa97
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10010080
Capabilities:
Accept command line arguments
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1002f004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x410
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], ecx
push 0
push eax
call fcn.10012940
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push str.__type
push edi
call fcn.1001225b
push str.extension
push edi
mov esi, eax
call fcn.1001225b
push str.ppapi
push edi
mov dword [ebp - 0x418], eax
call fcn.1001225b
push str.gpu_process
push edi
mov ebx, eax
call fcn.1001225b
add esp, 0x20
test esi, esi
je 0x10010124
cmp dword [ebp - 0x418], 0
je 0x10010110
test ebx, ebx
je 0x10010124
mov dword [0x10054adc], 1
jmp 0x10010124
mov eax, dword [0x10054adc]
test ebx, ebx
mov ecx, 1
cmovne eax, ecx
mov dword [0x10054adc], eax
push 0x208
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10010190
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.optimize.ini
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [0x10054adc], 0
mov ecx, str.chrome_optimize_level
mov eax, str.flash_optimize_level
cmove eax, ecx
lea ecx, [ebp - 0x414]
push ecx
push 0
push eax
push str.FLASH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x10053fb0], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010f86
mov esp, ebp
pop ebp
ret
Function at 0x10010260
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x1002f004]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
push 0x410
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0
push 0
push eax
mov ebx, ecx
mov dword [esp + 0x20], 0
call fcn.10012940
add esp, 0xc
cmp dword [0x10054b44], 0
jne 0x1001032b
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1002d800
push str.Kernel32
mov dword [0x10054b44], 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ExitWindowsEx
push str.user32
call esi
push eax
call edi
push str.Winmm
call esi
test eax, eax
jne 0x100102f6
push str.Winmm.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.timeBeginPeriod
push eax
call edi
push 0x1002d830
push str.Kernel32
mov dword [0x10054b00], eax
call esi
push eax
call edi
push str.timeGetTime
push str.Winmm
mov dword [0x10054b04], eax
call esi
push eax
call edi
mov dword [0x10054ad0], eax
push 0x208
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x18]
push 0x5c
push eax
call fcn.100124de
add esp, 8
mov ecx, str.chrome.exe
add eax, 2
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001037a
test dx, dx
je 0x10010376
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001037a
add eax, 4
add ecx, 4
test dx, dx
jne 0x10010354
xor eax, eax
jmp 0x1001037f
sbb eax, eax
or eax, 1
test eax, eax
mov edx, 0x10010250
mov ecx, 0x10054b00
sete byte [0x10054ae8]
call fcn.10010cb0
cmp byte [0x10054ae8], 0
je 0x1001040f
mov ecx, ebx
call fcn.10010080
cmp dword [0x10053fb0], 0
je 0x1001040f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x100103ee
push 0
push dword [0x10053fb0]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10023a40
mov dword [0x10054ae4], edx
mov ecx, 0x10054b04
mov edx, 0x100101a0
mov dword [0x10054ae0], eax
call fcn.10010cb0
xor edx, edx
mov eax, 0x3e8
div dword [0x10053fb0]
mov edx, 0x10010220
mov ecx, 0x10054ad0
mov dword [0x10054aec], eax
call fcn.10010cb0
mov ecx, dword [esp + 0x42c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010f86
mov esp, ebp
pop ebp
ret 4
Function at 0x100108d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1002f004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 0
push 0x1fffff
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001097b
test esi, esi
je 0x1001097b
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x100109a5
push edi
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], 0x10001
push eax
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10010978
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x218]
cmp ecx, ebx
jb 0x10010978
mov eax, dword [ebp + 8]
add eax, ebx
cmp ecx, eax
jae 0x10010978
push esi
call edx
cmp edi, 3
jge 0x1001098b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d0]
inc edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x10010935
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010f86
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010f86
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10010f86
mov esp, ebp
pop ebp
ret

Function at 0x100109c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10054b10], esi
jbe 0x10010a16
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10054b08]
push dword [eax + esi*4]
call ebx
mov eax, dword [0x10054b08]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x10054b10]
jb 0x100109f4
pop ebx
push dword [0x10054b08]
call fcn.10017b04
add esp, 4
mov dword [0x10054b08], 0
mov dword [0x10054b10], 0
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100192cf
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100191d4
Function at 0x401c60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004029a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004029a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40639c]
test esi, esi
jle 0x401dc0
mov eax, dword [0x4063a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401cf0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401d6f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401ce0
mov dword [esp], ebx
call fcn.00402630
mov edi, eax
test eax, eax
je 0x401de7
mov eax, dword [0x4063a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402740
mov edx, dword [0x4063a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401dc7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401d68
sub eax, 4
and eax, 0xfffffffb
jne 0x401d76
add dword [0x40639c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4063a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401d68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401c60
xor esi, esi
jmp 0x401cfa
mov eax, dword [0x4063a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401c60
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401c60
lea esi, [esi]
nop
Function at 0x4022a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x4022f5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4022ee
test esi, esi
je 0x4022ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4022d0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x418200
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x418262
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x41822f
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x418267
test ecx, ecx
je 0x418260
test esi, esi
ja 0x418220
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x418280
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x4182e2
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x4182af
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4182e7
test ecx, ecx
je 0x4182e0
test esi, esi
ja 0x4182a0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x418650
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x547fc0], ecx
add edx, 1
cmp edx, 0x100
jl 0x418652
cmp edx, 0x800
jae 0x41873b
mov edi, edi
mov eax, dword [edx*4 + 0x547bc0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x547fc0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x547fbc], eax
jb 0x418710
mov dword [0x544960], 0x41ac80
call fcn.0041ae50
test eax, eax
jne 0x418758
mov dword [0x544960], 0x41ad30
ret
Function at 0x41ecd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x41ece9
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x41ed10
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x41ed2f
jmp 0x41ed20
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41ed2f
add edi, 1
cmp edi, edx
jb 0x41ed20
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x41ee45
cmp ecx, 3
jbe 0x41ed65
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x41eda3
cmp cl, 0xff
je 0x41eda3
and ebp, 3
add ebp, ebp
or ebp, 1
add eax, 1
jmp 0x41ed10
add ecx, 0xffffffff
shl ebp, cl
and ebp, 7
je 0x41ed48
movzx ecx, byte [ebp + 0x4fd9c4]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x4fd9bc], 0
mov cl, byte [ebx + 4]
je 0x41ed8f
test cl, cl
je 0x41ed8f
cmp cl, 0xff
jne 0x41ed48
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
add eax, 1
jmp 0x41ed10
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x41edce
lea ebx, [edx + eax]
add ebx, esi
jmp 0x41edd4
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x41ee16
movzx esi, byte [ebp + 0x4fd9c4]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x41edf9
cmp dl, 0xff
jne 0x41ee12
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, ebx
jmp 0x41edc0
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
sub dl, 1
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x41ed10
cmp ecx, 3
pop edi
pop esi
pop ebx
jbe 0x41ee58
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
add ecx, 0xffffffff
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret

Function at 0x425d80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x425d9d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call fcn.00425d60
add esp, 4
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x425dbd
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x425dbd
push str.Comments_must_start_with__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425de0
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x425de0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0xffffffff
jne 0x425df9
mov eax, dword [ebp + 8]
push eax
call fcn.004b6330
add esp, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
push ecx
call fcn.004b8522
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425e1c
push str.Failed_to_allocate_string_value_buffer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b6960
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x426e30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 7
ja case.default.0x426e5c
mov edx, dword [ebp - 0xc]
jmp dword [edx*4 + 0x426f14]
push 0x4fde57
mov ecx, dword [ebp + 8]
call fcn.004023b0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x426f0c
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x426e93
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x426e9a
mov dword [ebp - 0x10], 0x4fde58
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004023b0
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x426f0c
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x426ec7
mov dword [ebp - 0x14], 0x4fde5c
jmp 0x426ece
mov dword [ebp - 0x14], 0x4fde64
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.004023b0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x426f0c
push str.Type_is_not_convertible_to_string
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fde59
mov ecx, dword [ebp + 8]
call fcn.004023b0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4