joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ce7
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x418898]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x4027f0
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x412dd4
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x412dc8
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x412d76
xor edi, edi
jmp 0x412dbf
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x412d72
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::data_void_const]
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x412d72
push dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004140ce
leave
ret 8
Function at 0x4140ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418898]
jne 0x4140d7
ret
jmp 0x4140dc
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x418898]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x418a30]
test eax, eax
je 0x414100
call eax
cmp dword [0x418a34], 0
je 0x414147
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x418a34]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.004140ce
add ebp, 0x2a8
leave
ret
Function at 0x1000dea3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x1001702c]
test eax, eax
je 0x1000dee2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000dee2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000dee2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000dee2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000dee2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100165e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001660d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001660d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10013a33
pop dword [ebp - 0x28]
mov eax, 0x8e8d6cc2
sub eax, 0x7e8c328f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9aa06306
sub dword [ebp - 0x38], 0x4c4e1dbb
mov dword [ebp - 0x34], 0xe01437fc
add dword [ebp - 0x34], 0x521f1449
mov dword [ebp - 0x30], 0xb243956
sub dword [ebp - 0x30], 0xbed7f528
mov dword [ebp - 0x2c], 0x73a383b
sub dword [ebp - 0x2c], 0x73a383b
lea eax, [ebp - 0x38]
push eax
mov eax, 0xdced5ff6
sub eax, 0xcceb9f76
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xb0c839c5
sub dword [ebp - 0x38], 0x3c55d06f
mov dword [ebp - 0x34], 0xab6ec116
sub dword [ebp - 0x34], 0x6a025fa1
mov dword [ebp - 0x30], 0x989ec314
add dword [ebp - 0x30], 0xcad0a958
mov dword [ebp - 0x2c], 0xbb629850
sub dword [ebp - 0x2c], 0xbb629850
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xbd999c71
add eax, 0x5268238f
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x344fd
push 0
call eax
mov ecx, 0x3b9a
xor esi, esi
add esi, eax
mov edi, 0x35f2740a
add edi, 0xda0ff3f6
add edi, dword [ebp - 0x28]
mov edx, 0x5ea88e59
add edx, 0x45ef3529
sub dword [ebp - 0x20], edx
mov ebx, dword [edi]
mov dword [ebp - 4], 0xa5b668c5
xor ebx, edx
sub dword [ebp - 0xc], ebx
mov dword [esi], ebx
add dword [ebp - 0xc], 0x47675724
add esi, 0x888dd4a5
add esi, 0x77722b5f
add edi, 0x23cc50f1
add edi, 0xdc33af13
loop 0x10013b51
add eax, 0x7e353dfb
add eax, 0x81cba340
mov ebx, eax
add eax, 5
mov ecx, 0xbd0f2ffe
sub ecx, 0xad0f2ffe
add ecx, dword [ebp - 0x28]
Function at 0x16560b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1656200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x16560d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16560c2
add dl, dl
jne 0x16560e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1656134
xor eax, eax
add dl, dl
jne 0x16560ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16561d5
add dl, dl
jne 0x16560fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1656108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1656113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x165611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x165612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x16560cd
mov eax, 1
add dl, dl
jne 0x1656142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x165614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1656139
sub eax, ebx
mov ebx, 1
jne 0x1656180
mov ecx, 1
add dl, dl
jne 0x1656166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1656171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x165615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16560cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1656197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16561a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x165618e
cmp eax, 0x7d00
jae 0x16561c5
cmp eax, 0x500
jb 0x16561c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16560cd
cmp eax, 0x7f
ja 0x16561c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16560cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x16561f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x16560cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4016a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x270
mov eax, 1
push 0
mov dword [esp + 8], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 2
push eax
call fcn.00402080
add esp, 8
test ax, ax
je 0x4016d8
xor eax, eax
add esp, 0x270
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x280]
push edi
mov edi, dword [0x40d048]
lea ecx, [esp + 0x12]
push 2
push ecx
push esi
call edi
cmp word [esp + 0x12], 0
mov dword [esp + 0x1c], 0
jle 0x401898
mov ebx, dword [sym.imp.KERNEL32.dll_.QEg9d9GPmuqpkEbMt_vz.Kfwrgwa_bBk]
lea edx, [esp + 0x18]
push 1
push edx
push esi
call edi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x180]
and eax, 0xff
push eax
push ecx
push esi
call edi
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
and edx, 0xff
push 2
push eax
push esi
mov byte [esp + edx + 0x18c], 0
call edi
lea ecx, [esp + 0x28]
push 2
push ecx
push esi
call edi
lea edx, [esp + 0x70]
push 4
push edx
push esi
call edi
lea eax, [esp + 0x6c]
push 4
push eax
push esi
call edi
lea ecx, [esp + 0x7c]
push 0x40eeb4
push ecx
call dword [sym.imp.KERNEL32.dll___CL8YbMEY9.QEg9d9GPmuqpkEbMt_vz.Kfw]
lea edx, [esp + 0x7c]
push 0x40e080
push edx
call ebx
lea eax, [esp + 0x180]
lea ecx, [esp + 0x7c]
push eax
push ecx
call ebx
lea edx, [esp + 0x24]
push 4
push edx
push esi
call edi
lea eax, [esp + 0x7c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__Lcreat]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x401890
mov ecx, dword [esp + 0x24]
xor eax, eax
lea edx, [esp + 0x2c]
push eax
push edx
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov word [esp + 0x48], si
mov word [esp + 0x4a], bp
mov dword [esp + 0x4c], 9
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], pe_overlay
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.00402080
add esp, 8
test ax, ax
jne 0x40187f
push ebp
call dword [0x40d08c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x64]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDatTimeToFileTime]
lea eax, [esp + 0x74]
lea ecx, [esp + 0x64]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_6y7_ggeFt4_JYhQM3:_.Bcy_Q3nNoz]
push 0
lea edx, [esp + 0x78]
push 0
push edx
push 0
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.00401000
mov ebp, dword [esp + 0x34]
add esp, 0x18
test ebp, ebp
jne 0x40186b
lea ecx, [esp + 0x7c]
push ecx
push 0x40f0c0
call dword [sym.imp.KERNEL32.dll___CL8YbMEY9.QEg9d9GPmuqpkEbMt_vz.Kfw]
movsx edx, word [esp + 0x12]
inc ebp
cmp ebp, edx
mov dword [esp + 0x1c], ebp
jl 0x40170d
jmp 0x401898
push ebp
mov dword [esp + 0x18], 0
call dword [0x40d08c]
jmp 0x401898
mov dword [esp + 0x14], 0
lea eax, [esp + 0x2c]
push 0
push eax
mov dword [esp + 0x34], 4
call fcn.00402080
add esp, 8
test ax, ax
pop edi
pop esi
pop ebp
pop ebx
je 0x4018c0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
add esp, 0x270
ret
Function at 0x401f40
Capabilities:
Parse pe header

Disassembly:
sub esp, 0xfc
push 0x40000
push 0
call dword [0x40d070]
test eax, eax
mov dword [esp], eax
jne 0x401f67
mov eax, 1
add esp, 0xfc
ret
push ebx
mov ebx, dword [0x40d048]
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
lea eax, [esp + 0x14]
push 0x40
push eax
push ebp
call ebx
cmp eax, 0x40
je 0x401f91
mov esi, 3
jmp 0x40205b
mov edx, dword [esp + 0x50]
xor ecx, ecx
cmp word [esp + 0x14], 0x5a4d
mov edi, dword [0x40d060]
push 0
setne cl
dec ecx
and ecx, edx
mov esi, ecx
push esi
push ebp
call edi
lea edx, [esp + 0x14]
push pe_nt_image_headers32
push edx
push ebp
call ebx
cmp eax, 0xf8
je 0x401fd0
mov esi, 3
jmp 0x40205b
cmp dword [esp + 0x14], 0x4550
je 0x401fe1
mov esi, 5
jmp 0x40205b
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x1a]
and eax, 0xffff
push 0
and ebx, 0xffff
lea ecx, [eax + esi + 0x18]
push ecx
push ebp
call edi
mov edx, ebx
dec ebx
test edx, edx
je 0x402046
lea eax, [esp + 0x14]
push 0x28
push eax
push ebp
call dword [0x40d048]
cmp eax, 0x28
jne 0x401f87
mov ecx, 2
mov edi, str._mvdata
lea esi, [esp + 0x14]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40203e
mov eax, ebx
dec ebx
test eax, eax
jne 0x402005
mov esi, 6
jmp 0x40205b
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x40204d
mov esi, 6
jmp 0x40205b
mov ecx, dword [esp + 0x114]
add eax, 8
xor esi, esi
mov dword [ecx], eax
mov edx, dword [esp + 0x10]
push edx
call dword [0x40d06c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xfc
ret
Function at 0x48fbf1
Capabilities:
Check for software breakpoints

Disassembly:
xchg ecx, edx
cmp ecx, 0xff000000
jae 0x48fc0c
cmp ecx, 0xfe000000
jb 0x48fc0a
movsx ecx, cx
add ecx, dword [eax]
jmp dword [ecx]
jmp ecx
and ecx, 0xffffff
add ecx, eax
mov eax, edx
mov edx, dword [ecx]
jmp fcn.00494fb5
Function at 0x4ac9b5
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [esp + ebx*2 + 0x66607d9a]
in eax, 0x41

Function at 0x4bc605
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4438
cmp edx, dword [eax]
je 0x4bc627
add eax, 8
inc ecx
cmp eax, 0x4c44c8
jl 0x4bc618
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4438]
jne 0x4bc755
mov eax, dword [0x4c8e14]
cmp eax, 1
je 0x4bc72f
test eax, eax
jne 0x4bc658
cmp dword [0x4c4360], 1
je 0x4bc72f
cmp edx, 0xfc
je 0x4bc755
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc68f
lea eax, [ebp - 0x1a4]
push 0x4c19e0
push eax
call fcn.004bcff0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd480
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc6d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd480
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c19dc
push edi
call fcn.004bf350
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c19c0
push eax
call fcn.004bcff0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd000
lea eax, [ebp - 0xa0]
push 0x4c19bc
push eax
call fcn.004bd000
push dword [esi + 0x4c443c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd000
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1994
push eax
call fcn.004bf2c4
add esp, 0x2c
pop edi
jmp 0x4bc755
lea eax, [ebp + 8]
lea esi, [esi + 0x4c443c]
push 0
push eax
push dword [esi]
call fcn.004bd480
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40569c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, eax
test edx, edx
jne 0x4056a7
xor eax, eax
pop edi
ret
or eax, 0xffffffff
push esi
mov ecx, 0xff
cmp edi, 8
jb 0x40575a
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
sub edi, 8
dec esi
jne 0x4056bf
pop ebx
test edi, edi
je 0x405773
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4152e8]
inc edx
dec edi
jne 0x40575e
pop esi
not eax
pop edi
ret

Function at 0x4459dd
Capabilities:
Encode data using xor

Disassembly:
call fcn.00490472
mov ecx, eax
mov dword [esi], ebx
test edx, 0x53476f27
loope 0x445a6b
pop ecx
popal
push ds
mov ah, 0x53
invalid
stc
mov bl, 0x9e
sbb bh, byte [eax + 0x3d4535b9]
cmp eax, 0x49501ea8
mov ecx, 0x191118d4
push esp
add al, ah
pushfd
add eax, 0xc0b1c18c
cmp al, 0x7e
dec esp
les ebx, [esi + edi - 0x4e3e73fb]
sar byte [esi + edi*2], 0x4c
imul bp, word [edi + 0x70670387], 0xffce
inc eax
clc
in al, dx
xchg esi, eax
leave
and byte [edx - 0x39], al
pop es
aaa
xor byte [edx - 0x64280045], ah
mov byte [0xfd2e7cb1], al
push 0x27
inc edx
je 0x445a80
or al, 5
int 0x93
invalid

Function at 0x4a5d6d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x402497
call fcn.0049bb51
cmp byte [edi - 0x2a79c939], 0xe8
cdq
add dword [eax], 0

Function at 0x4bde25
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x44]
call fcn.0046950b
pushal
mov ebx, dword [ebp - 4]
mov byte [esp], 0xa5
pushfd
pushal
push 0xa9f2bdd0
lea esp, [esp + 0x48]
jmp 0x475754
Function at 0x40ac2f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x40ac8a
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40ac69
push 0
push 0x18f3
call fcn.0040d835
pop ecx
pop ecx
jmp 0x40ac85
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00419cc1
add esp, 0xc
jmp 0x40ad35
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x40ad23
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x40ad1b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x40acfc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x40ad19
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.0043454e
mov dword [eax], 0x9ddcef98
jmp 0x40acf1
jmp 0x40ad21
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x40ad35
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0
push dword [ebp - 0x48]
call fcn.0040965a
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b239
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x40b315
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40b2c0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x40b2a3
push 0x129d
push 0x23d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x40b2be
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40b2be
push 0x1fcd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x40b313
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40b2fe
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x40b2fc
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x40b313
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 5
jmp 0x40b350
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
push 0x6283
push 0x39cd
push 0x1b26
push 0x3641
push 0x5e33
push 0x7d7b
push 0x35dd
push 0x2834
call fcn.0040b354
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x40d267
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x40d2a0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
push 0x7d3d
push dword [ebp - 0xc]
push 0
push 0x27cd
push dword [ebp - 0x10]
call fcn.0041ab4f
add esp, 0x14
jmp 0x40d38a
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40d363
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40d359
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x40d30a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x40d357
mov byte [ebp - 1], 0
push 0
push 0x1579
push 0x122f
push 0x1552
push 0x1c40
push 0x31b4
push 0x319f
lea eax, [ebp - 1]
push eax
push 0x3e08
push 1
push 0x2fa8
push 1
push 0x1aa7
call fcn.0042e8cc
add esp, 0x34
jmp 0x40d2ff
jmp 0x40d361
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x40d38a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
call fcn.004099fb
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x412428
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4124fc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x412495
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x1783
push 0x4f9
push 0x3fed
push 0x70c9
push 0x61ec
push 0x52eb
push 0
call fcn.0042ce4c
add esp, 0x20
jmp 0x4124fa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4124d6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4124d4
push 0x551
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4124fa
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0
mov ecx, dword [ebp - 0x38]
call fcn.0043454e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x412514
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
push 0
push dword [ebp - 0x3c]
push 0x59ad
call fcn.0041f120
add esp, 0xc
mov esp, ebp
pop ebp
ret