joyce8/EMBER2024-capa huggingface dataset:
Function at 0x743fc8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x744087
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x74406a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040e1e0
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x744049
lea eax, [ebp - 8]
push eax
push 2
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, ebx
mov edx, 0x104
call fcn.0040afb8
mov eax, dword [ebx]
call fcn.0040ae24
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebx]
call fcn.0040ae24
push eax
call sub.kernel32.dll_lstrlenW_1
mov edx, eax
mov eax, ebx
call fcn.0040afb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x744071
cmp dword [ebp - 8], 0
je 0x744069
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
Function at 0x745390
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x74566b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00409fc0
xor eax, eax
push ebp
push 0x745632
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00745ee4
cmp al, 0xb
jne 0x74548f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00741138
xor eax, eax
push ebp
push 0x745467
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x50ad00]
call fcn.0050c3c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x745453
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0050c4a8
mov cl, 1
mov edx, 0x745688
mov eax, dword [ebp - 0xc]
call fcn.0050c600
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0050cae8
mov eax, dword [ebp - 0xc]
call fcn.0050c478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74545a
mov eax, dword [ebp - 0xc]
call fcn.00408198
ret
call fcn.00739418
test al, al
je 0x74561d
call fcn.007427a0
test al, al
je 0x745577
xor eax, eax
push ebp
push 0x74554f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x50ad00]
call fcn.0050c3c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x74553b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0050c4a8
mov cl, 1
mov edx, 0x7456f0
mov eax, dword [ebp - 0xc]
call fcn.0050c600
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0050cae8
mov eax, dword [ebp - 0xc]
call fcn.0050c478
mov cl, 1
mov edx, 0x74577c
mov eax, dword [ebp - 0xc]
call fcn.0050c600
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0050cae8
mov eax, dword [ebp - 0xc]
call fcn.0050c478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745542
mov eax, dword [ebp - 0xc]
call fcn.00408198
ret
xor eax, eax
push ebp
push 0x7455f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x50ad00]
call fcn.0050c3c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x7455e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0050c4a8
mov cl, 1
mov edx, 0x74577c
mov eax, dword [ebp - 0xc]
call fcn.0050c600
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0050cae8
mov eax, dword [ebp - 0xc]
call fcn.0050c478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7455ee
mov eax, dword [ebp - 0xc]
call fcn.00408198
ret
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00741138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x745655
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745672
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x745ad0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x745c78
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0042682c
test al, al
je 0x745c4d
xor ecx, ecx
push ebp
push 0x745c43
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea edx, [ebp - 0x24]
mov eax, 0x745c94
call fcn.00747870
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040ab3c
xor edx, edx
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + edx]
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x10
jne 0x745b45
lea eax, [ebp - 0x28]
mov ecx, 0x745ccc
mov edx, dword [ebp - 4]
call fcn.0040b090
mov eax, dword [ebp - 0x28]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
push 0x22
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4962e4]
call fcn.004bba30
mov dword [ebp - 0xc], eax
push 0xff22
lea eax, [ebp - 0x2c]
mov ecx, 0x745ccc
mov edx, dword [ebp - 4]
call fcn.0040b090
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x4962e4]
call fcn.004bba30
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x745bf7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004b9240
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.006da3a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745bfe
mov eax, dword [ebp - 0xc]
call fcn.00408198
mov eax, dword [ebp - 0x10]
call fcn.00408198
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745c7f
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.0040a020
lea eax, [ebp - 8]
call fcn.00409fe4
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x745cd8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x745e84
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0042682c
test al, al
je 0x745e59
xor ecx, ecx
push ebp
push 0x745e4f
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea edx, [ebp - 0x24]
mov eax, 0x745ea0
call fcn.00747870
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040ab3c
xor edx, edx
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + edx]
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x10
jne 0x745d4d
lea eax, [ebp - 0x28]
mov ecx, 0x745ed8
mov edx, dword [ebp - 4]
call fcn.0040b090
mov eax, dword [ebp - 0x28]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
push 0x22
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4962e4]
call fcn.004bba30
mov dword [ebp - 0xc], eax
push 0xff22
lea eax, [ebp - 0x2c]
mov ecx, 0x745ed8
mov edx, dword [ebp - 4]
call fcn.0040b090
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x4962e4]
call fcn.004bba30
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x745e03
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004b9240
mov eax, dword [ebp - 0x10]
push eax
push 1
push 1
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.006da174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745e0a
mov eax, dword [ebp - 0xc]
call fcn.00408198
mov eax, dword [ebp - 0x10]
call fcn.00408198
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x745e8b
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.0040a020
lea eax, [ebp - 8]
call fcn.00409fe4
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x746004
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, eax
push 0x202
lea eax, [ebp - 0x202]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov ecx, eax
lea edx, [ebp - 0x202]
mov eax, ebx
call fcn.0040a148
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x746038
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, eax
push 0x202
lea eax, [ebp - 0x202]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov ecx, eax
lea edx, [ebp - 0x202]
mov eax, ebx
call fcn.0040a148
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x747678
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
lea eax, [ebp - 0x280]
mov edx, dword [0x41d7c0]
call fcn.0040b530
xor eax, eax
push ebp
push 0x74781b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004268c4
test al, al
je 0x7477e4
lea eax, [ebp - 0xc]
mov ecx, 0x747834
mov edx, dword [ebp - 4]
call fcn.0040b090
lea ecx, [ebp - 0x280]
mov edx, 0x1ff
mov eax, dword [ebp - 0xc]
call fcn.00426cdc
mov ebx, eax
test ebx, ebx
jne 0x7477cb
push dword [ebp - 4]
push 0x747848
push dword [ebp - 0x26c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040b118
mov esi, dword [ebp - 0x270]
mov eax, esi
and eax, 0x10
cmp eax, 0x10
jne 0x747782
mov eax, dword [ebp - 0x26c]
mov edx, 0x747858
call fcn.0040b1c8
je 0x747782
mov eax, dword [ebp - 0x26c]
mov edx, 0x747868
call fcn.0040b1c8
je 0x747782
push dword [ebp - 4]
push 0x747848
push dword [ebp - 0x26c]
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.0040b118
mov eax, dword [ebp - 0x284]
mov dl, 1
call fcn.004268c4
test al, al
je 0x7477b6
mov eax, dword [ebp - 8]
call fcn.00747678
jmp 0x7477b6
cmp esi, 0x20
je 0x7477a0
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00426aa8
mov edx, eax
and edx, 0xfffffffe
mov cl, 1
mov eax, dword [ebp - 8]
call fcn.00426b60
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0042682c
test al, al
je 0x7477b6
mov eax, dword [ebp - 8]
call fcn.00426d6c
lea eax, [ebp - 0x280]
call fcn.00426d2c
mov ebx, eax
test ebx, ebx
je 0x7476fa
lea eax, [ebp - 0x280]
call fcn.00426d50
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x747822
lea eax, [ebp - 0x284]
call fcn.00409fc0
lea eax, [ebp - 0x280]
mov edx, dword [0x41d7c0]
call fcn.0040b60c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a020
ret
Function at 0x77f6ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x77f85f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x77f83a
push dword fs:[edx]
mov dword fs:[edx], esp
mov word [ebp - 0x216], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.0040ae4c
lea eax, [ebp - 0x21c]
mov edx, 0x77f878
call fcn.0040b038
mov eax, dword [ebp - 0x21c]
call fcn.0040ae24
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x77f7ab
lea eax, [ebp - 0x216]
call fcn.0040a4e4
lea edx, [ebp - 0x216]
mov ecx, ebx
xchg ecx, eax
call fcn.0040a148
jmp 0x77f7b2
mov eax, ebx
call fcn.00409fc0
cmp si, 0x61
jae 0x77f7d4
lea edx, [ebp - 0x220]
mov eax, dword [ebx]
call fcn.0042deec
mov edx, dword [ebp - 0x220]
mov eax, ebx
call fcn.0040a3a0
jmp 0x77f7ee
lea edx, [ebp - 0x224]
mov eax, dword [ebx]
call fcn.0042ded8
mov edx, dword [ebp - 0x224]
mov eax, ebx
call fcn.0040a3a0
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x77f88c
call fcn.004278c0
mov edx, dword [ebp - 0x228]
mov eax, ebx
call fcn.0040a3a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77f841
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x7962d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x79634e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
test al, al
je 0x796338
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
call fcn.00796120
cmp dword [ebp - 0xc], 0
je 0x79632d
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
setne al
test al, al
je 0x796338
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x796338
mov eax, dword [ebp - 4]
call fcn.00796220
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x796355
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x7963fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x7964c4
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x796428
mov eax, ebx
call fcn.00409fc0
jmp 0x7964ae
mov ecx, ebx
lea edx, [ebp - 8]
call fcn.00796120
cmp dword [ebp - 8], 0
je 0x7964ae
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x7964a7
xor edx, edx
push ebp
push 0x7964a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0079635c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7964ae
lea eax, [ebp - 4]
call fcn.0040e1e0
push eax
call sub.shell32.dll_SHGetMalloc
test eax, 0x80000000
sete al
test al, al
je 0x79649f
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
mov eax, ebx
call fcn.00409fc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7964cb
lea eax, [ebp - 4]
call fcn.0040e1e0
ret

Function at 0x7a47d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x4c], 0
je 0x7a4849
mov byte [ebx + 0x4c], 0
mov eax, ebx
call fcn.007a4ea8
mov eax, ebx
call fcn.007a4ecc
mov eax, dword [ebx + 0x48]
call fcn.0055010c
mov esi, eax
call sub.user32.dll_GetCapture
cmp esi, eax
jne 0x7a4804
call sub.user32.dll_ReleaseCapture
mov eax, dword [ebx + 0x48]
call fcn.005472d0
mov esi, dword [ebx + 0x48]
cmp dword [esi + 0x1f4], 0
jne 0x7a4827
push 0
mov eax, esi
call fcn.0055010c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x48]
xor edx, edx
call fcn.0054c640
cmp word [ebx + 0xaa], 0
je 0x7a4849
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
pop esi
pop ebx
ret
Function at 0x7a5af4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov dword [esi + 0x33c], 0x4000
mov edx, edi
mov eax, esi
call fcn.007a3794
mov eax, esi
call fcn.005504e0
test al, al
je 0x7a5b4d
mov eax, esi
call fcn.0055010c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x7a5b4d
mov eax, esi
call fcn.005472d0
cmp dword [esi + 0x1f4], 0
jne 0x7a5b4d
push 0
mov eax, esi
call fcn.0055010c
push eax
call sub.user32.dll_ShowWindow
cmp byte [esi + 0x34d], 0
je 0x7a5b6c
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov edx, dword [eax + 0x188]
mov eax, esi
call fcn.0054c640
jmp 0x7a5b75
xor edx, edx
mov eax, esi
call fcn.0054c640
mov eax, esi
call fcn.005500e8
mov eax, esp
call fcn.007a24e8
mov edx, esp
mov eax, edi
call fcn.007a5aa0
mov eax, dword [edi + 8]
mov ebp, dword [edi]
sub eax, ebp
push eax
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
push eax
mov ecx, dword [edi + 4]
mov edx, ebp
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc0]
mov eax, esi
call fcn.007a41f0
mov eax, dword [esi + 0x338]
cmp dword [eax + 0x60], 0
je 0x7a5bfe
mov eax, dword [esi + 0x338]
mov eax, dword [eax + 0x60]
call fcn.0055010c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x7a5cca
mov eax, dword [esi + 0x338]
mov eax, dword [eax + 0x60]
call fcn.0055010c
push eax
call sub.user32.dll_IsIconic
test eax, eax
jne 0x7a5cca
mov eax, esi
call fcn.007a5878
jmp 0x7a5c05
mov eax, esi
call fcn.007a5ef8
call fcn.007a2538
test al, al
je 0x7a5c2a
call fcn.005823ac
cmp eax, 0x60000
jl 0x7a5c2a
cmp byte [esi + 0x34c], 0
je 0x7a5c2a
mov byte [esi + 0x34c], 0xc
cmp byte [esi + 0x34c], 0
je 0x7a5ca1
call fcn.007a2514
test al, al
je 0x7a5ca1
call fcn.005823ac
cmp eax, 0x60000
jl 0x7a5ca1
mov eax, dword [0x90ddc0]
cmp dword [eax], 0
je 0x7a5ca1
movzx eax, byte [esi + 0x34c]
dec eax
sub al, 2
jae 0x7a5c78
movzx eax, byte [esi + 0x2b0]
dec eax
sub al, 2
jae 0x7a5c71
mov ebx, 4
jmp 0x7a5c7a
mov ebx, 8
jmp 0x7a5c7a
xor ebx, ebx
movzx eax, byte [esi + 0x34c]
or ebx, dword [eax*4 + 0x909298]
push ebx
mov eax, dword [esi + 0x348]
push eax
mov eax, esi
call fcn.0055010c
push eax
mov eax, dword [0x90ddc0]
mov eax, dword [eax]
call eax
mov eax, esi
call fcn.005472d8
cmp dword [esi + 0x1f4], 0
jne 0x7a5cc0
push 4
mov eax, esi
call fcn.0055010c
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xb8]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7c1ab4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x99f798], 0
jne 0x7c1acb
call fcn.007c1a70
mov eax, edi
dec eax
test eax, eax
jl 0x7c1af3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x99f398]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x7c1ad5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x7c4848
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x7c48e2.0
jmp dword [ecx*4 + 0x7c487b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x7c48ad
sub dl, 8
je 0x7c48bc
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c4514
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c4568
jmp case.0x7c48e2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x7c48e2.0
movzx ecx, byte [ecx + 0x7c48e9]
jmp dword [ecx*4 + 0x7c48fa]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c4608
jmp case.0x7c48e2.0
cmp dl, 3
jne 0x7c4927
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c4660
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c461c
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c46a4
jmp case.0x7c48e2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x7c4952
sub dl, 8
je 0x7c495e
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c46d0
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c4734
jmp case.0x7c48e2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x7c497d
sub dl, 8
je 0x7c4989
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c47e4
jmp case.0x7c48e2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7c480c
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x7c4a2b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.007c3a70
test eax, eax
je 0x7c4a2b
mov eax, ebx
call fcn.007c4a34
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x7c49c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x7c4a34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x7c4a65
dec al
je 0x7c4aa0
dec al
je 0x7c4ae4
dec al
je 0x7c4b56
jmp 0x7c4bf1
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x7c4bf1
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x7c4a75
jmp 0x7c4bf1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7c4bf1
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x7c4ab0
jmp 0x7c4bf1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7c4bf1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x7c4b17
xor edx, edx
mov dword [esp + 4], edx
jmp 0x7c4b2c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x7c4b44
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x7c4af4
jmp 0x7c4bf1
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x7c4bf1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x7c4bbd
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.007c1afc
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x7c4b72
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret