joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe6fb0ce
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
lea eax, [ebp - 0x18]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
call dword [0xe6b156c]
test al, al
jne 0xe6fb0fc
mov eax, 0x80070003
jmp 0xe6fb1bf
mov eax, dword [ebp - 0x18]
push esi
xor ecx, ecx
push edi
mov edi, dword [ebp - 4]
cmp cx, ax
je 0xe6fb116
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0xe6fb119
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [0xe6b1578]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [0xe6b1568]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [fcn.0e6b1530]
cmp esi, ebx
jge 0xe6fb16f
mov eax, esi
jmp 0xe6fb1bd
mov eax, dword [ebp + 8]
sub eax, 4
je 0xe6fb189
dec eax
dec eax
je 0xe6fb184
dec eax
dec eax
jne 0xe6fb18e
lea eax, [ebp - 0x68]
jmp 0xe6fb191
lea eax, [ebp - 0x60]
jmp 0xe6fb191
lea eax, [ebp - 0x58]
jmp 0xe6fb191
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0e6fa667
neg eax
sbb eax, eax
and eax, 0x10
push eax
call fcn.0e6fa35e
cmp eax, ebx
jge 0xe6fb1bd
cmp eax, 0x8007000d
jne 0xe6fb1bd
cmp dword [ebp + 8], 4
jne 0xe6fb1bd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0xe6fec64
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [str._sm_a]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
pop esi
lea eax, [ebp - 0x10]
push eax
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xe6b43a8
push 0x80000002
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
call dword [section..text]
test eax, eax
jne 0xe6fed08
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0xe6b4394
push dword [ebp - 0x10]
call dword [0xe6b100c]
test eax, eax
jne 0xe6fecff
cmp dword [ebp - 0x14], esi
je 0xe6fece0
push 0xe6b438c
push esi
push 0xe75e648
call fcn.0e6ba32c
add esp, 0xc
jmp 0xe6fecfc
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0xe75e648
call fcn.0e6bb4ab
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov byte [eax + 0xe75e647], bl
mov dword [ebp - 0x18], edi
push dword [ebp - 0x10]
call dword [0xe6b1008]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0e6b57d5
leave
ret
Function at 0xe6ffa43
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, 0xe6b45ac
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], eax
je 0xe6ffad5
cmp dword [ebp + 0x10], 1
je 0xe6ffadc
cmp dword [ebp + 0x10], 2
jne 0xe6ffb8a
lea ecx, [ebp + 0x10]
push ecx
push 1
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionTerminal_Server
push 0x80000002
call dword [section..text]
test eax, eax
jne 0xe6ffaed
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push 0
push str.RootDrive
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
call dword [0xe6b100c]
push dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
call dword [0xe6b1008]
cmp dword [ebp + 0xc], 0
jne 0xe6ffb8a
cmp dword [ebp + 8], 1
jne 0xe6ffb8a
dec dword [ebp - 4]
jmp 0xe6ffaed
mov eax, 0xe6b45a0
jmp 0xe6ffae1
mov eax, 0xe6b4594
push edi
push ebx
push eax
call dword [0xe6b1304]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xe6ffb8a
cmp dword [ebp - 4], edi
jae 0xe6ffb8a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xe6ffb05
mov ecx, dword [ebp - 4]
sub eax, edx
add eax, ecx
cmp eax, edi
jae 0xe6ffb8a
cmp byte [ecx + ebx - 1], 0x5c
jne 0xe6ffb25
mov dword [ebp - 0xc], 0xe6b45ad
push dword [ebp - 0xc]
push edi
push ebx
call 0xe6ba2b3
add esp, 0xc
push edi
push ebx
push ebx
call dword [0xe6b130c]
mov esi, dword [0xe6b1268]
mov dword [ebp - 4], eax
test eax, eax
jbe 0xe6ffb54
cmp eax, edi
jae 0xe6ffb54
push ebx
call esi
cmp eax, 0xffffffff
jne 0xe6ffb7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0xe6ffb64
cmp eax, 2
jne 0xe6ffb85
push 0
push ebx
call dword [0xe6b1308]
mov dword [ebp - 8], eax
test eax, eax
je 0xe6ffb85
push ebx
call esi
cmp eax, 0xffffffff
je 0xe6ffb85
shr eax, 4
and eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0xe6ffb8c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0xe7008e4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [str._sm_a]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0e6b60e0
add esp, 0xc
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xe700941
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x10c], eax
je 0xe700972
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [0xe6b1320]
push 0x21
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x152
mov byte [ebp - 0xc9], bl
call fcn.0e6dc9f5
call fcn.0e6dd021
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0e6b57d5
leave
ret 0xc
Function at 0xe701fb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], esi
cmp dword [0xe7399bc], esi
je 0xe701fdd
xor eax, eax
inc eax
jmp 0xe702035
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0xe6b46e4
push 0x80000002
call dword [section..text]
test eax, eax
jne 0xe702016
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xe6b46dc
push dword [ebp - 4]
call dword [0xe6b100c]
cmp dword [ebp - 4], esi
je 0xe702024
push dword [ebp - 4]
call dword [0xe6b1008]
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
jne 0xe702033
mov dword [0xe7399bc], eax
jmp 0xe702035
xor eax, eax
pop esi
leave
ret

Function at 0xe7066b0
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push edi
add ecx, ecx
push ecx
push 0
push dword [eax + 0x18]
call dword [fcn.0e6b1548]
mov edi, eax
test edi, edi
jne 0xe7066ec
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 8
mov ax, word [esi]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
call dword [fcn.0e6b1354]
test eax, eax
jne 0xe706726
xor esi, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [fcn.0e6b1530]
mov eax, esi
jmp 0xe7066e6
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [fcn.0e6b149c]
movzx eax, word [ebp - 8]
mov dword [esi], eax
xor esi, esi
inc esi
jmp 0xe70670d

Function at 0xe7076e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ax, word [0xe7399f4]
mov word [ebp - 4], ax
jmp 0xe707768
movzx edx, word [ebp - 4]
mov eax, dword [0xe75e83c]
shr edx, 3
shl edx, 3
add eax, edx
cmp byte [eax + 5], 0
jne 0xe707713
cmp byte [eax + 7], 0x80
je 0xe707760
xor eax, eax
xor ecx, ecx
mov ax, word [ebp - 4]
or eax, 7
lsl ecx, eax
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffff
jne 0xe707760
mov eax, dword [0xe75e83c]
add eax, edx
movzx ecx, byte [eax + 7]
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
movzx edx, word [eax + 2]
shl ecx, 0x10
or ecx, edx
cmp dword [ebp + 8], ecx
jne 0xe707760
movzx eax, byte [eax + 5]
movzx ecx, byte [ebp + 0xc]
xor eax, ecx
test eax, 0xfffffffe
je 0xe707777
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
cmp ax, word [0xe7399f0]
jb 0xe7076f6
xor eax, eax
leave
ret 8
mov eax, dword [ebp - 4]
or eax, 7
jmp 0xe707773
Function at 0x10001000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001027
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10001030
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop ebp
ret 0xc

Function at 0x1000f040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f06d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f06d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4024f5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402534
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402534
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402534
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402534
cmp dword [ecx + 0x74], 0xe
jbe 0x402534
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x408113
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4081b0
push ebx
push esi
call fcn.004080dc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408070
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40815d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4081af
push edi
push eax
call fcn.00408d30
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40817d
call fcn.00406bd1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4081ae
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408070
add esp, 0x20
test eax, eax
jne 0x40819c
push edi
call fcn.00406bd1
jmp 0x4081a4
push ebx
call fcn.00406bd1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4094ad
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142b8
push 0x4142b0
push str.FlsAlloc
push 0x1f
call fcn.0040936c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4094e1
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
jmp 0x4094e7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40952b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142c8
push 0x4142c0
push str.FlsGetValue
push 0x21
call fcn.0040936c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409562
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40956a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142d0
push 0x4142c8
push str.FlsSetValue
push 0x22
call fcn.0040936c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4095a4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40ea00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ea2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ea2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40673a
pop dword [ebp - 0x24]
mov eax, 0x624d245f
sub eax, 0x620cbd25
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x47f32ca1
sub dword [ebp - 0x34], 0xf9a0e756
mov dword [ebp - 0x30], 0xb8dfe81d
sub dword [ebp - 0x30], 0x86ac9bd8
mov dword [ebp - 0x2c], 0x31edce34
sub dword [ebp - 0x2c], 0xe5a18a06
mov dword [ebp - 0x28], 0xa825f68e
sub dword [ebp - 0x28], 0xa825f68e
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe9a35f2d
add dword [ebp - 0x34], 0x8acf0a29
mov dword [ebp - 0x30], 0xa90f50ca
sub dword [ebp - 0x30], 0x67a2ef55
mov dword [ebp - 0x2c], 0x9675bf0
add dword [ebp - 0x2c], 0x5a08107c
mov dword [ebp - 0x28], 0x577fcc6d
sub dword [ebp - 0x28], 0x577fcc6d
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x83e81524
sub eax, 0x83a79424
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x34085
push 0
call eax
mov ecx, 0x3a11
mov ebx, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x24]
mov edi, 0xf40ec358
mov esi, dword [edx]
sub dword [ebp - 0x20], 0x38ec4a47
xor esi, edi
sub dword [ebp - 0xc], esi
mov dword [ebx], esi
add ebx, 0x93d6f5e6
sub ebx, 0x93d6f5e2
add edx, 0xa90ba534
add edx, 0x56f45ad0
loop 0x406845
add eax, 0xe03d689c
add eax, 0x1fc3727b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa0ed8b08
sub ecx, 0xa0ad8b08
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401dc0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e30
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401350
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x401bbf
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
mov edi, eax
push str.PyImport_ImportModule
push edi
call esi
push str.PyObject_SetAttrString
push edi
mov ebx, eax
call esi
push str.PyObject_GetAttrString
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 8], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x10], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyLong_FromVoidPtr
push edi
mov dword [ebp - 0x18], eax
call esi
xor esi, esi
mov dword [ebp - 0x1c], eax
cmp ebx, esi
je 0x401cc6
cmp dword [ebp - 4], esi
je 0x401cc6
cmp dword [ebp - 0xc], esi
je 0x401cc6
cmp dword [ebp - 8], esi
je 0x401cc6
cmp dword [ebp - 0x10], esi
je 0x401cc6
cmp dword [ebp - 0x14], esi
je 0x401cc6
cmp dword [ebp - 0x18], esi
je 0x401cc6
push str.builtins
call ebx
mov edi, eax
pop ecx
cmp edi, esi
je 0x401ca2
push str.ValueError
push edi
call dword [ebp - 4]
push str.OSError
push edi
mov dword [0x43259c], eax
call dword [ebp - 4]
add esp, 0x10
push 6
mov dword [0x432924], eax
mov esi, 0x42f0e8
pop ebx
push 0
push esi
call dword [ebp - 8]
push eax
push dword [esi]
push edi
call dword [ebp - 0xc]
add esp, 0x14
add esi, 0x10
dec ebx
jne 0x401c8c
mov eax, dword [ebp - 0x10]
mov dword [0x432810], eax
mov eax, dword [ebp - 0x14]
mov dword [0x431544], eax
mov eax, dword [ebp - 0x18]
mov dword [0x431548], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x43258c], eax
xor eax, eax
jmp 0x401cc9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401cce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401cdd
pop dword [ebp - 0x14]
mov eax, 0x401cdd
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3a1ef
push 0
mov eax, 0x410c4f1b
add eax, 0xbf3602fd
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x20fcce1a
add ecx, 0xdf036b43
xor ebx, ebx
add ebx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x14]
mov edi, 0xd184722
sub dword [ebp - 4], eax
mov edx, dword [esi]
add dword [ebp - 0xc], ebx
add edx, edi
sub dword [ebp - 0xc], 0x4a743fcb
mov dword [ebx], edx
xor dword [ebp - 8], ecx
add ebx, 0x66b34eaf
sub ebx, 0x66b34eab
add esi, 0x55d49170
sub esi, 0x55d4916c
loop 0x401d2d
add eax, 0xd847
mov ebx, eax
add eax, 5
mov ecx, 0xfc7c4158
add ecx, 0x3c3bea8
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40adb0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
push ebx
movzx ebx, byte [ebp + 8]
imul ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x40add3
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4811f4]
test eax, eax
je 0x40ade3
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push dword [0x483aa4]
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebx + 1]
mov esi, eax
imul ecx, dword [0x482ff0]
push 0x90
mov dword [ebp + 8], esi
add ecx, dword [0x480198]
push ecx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [0x4811f4], eax
test eax, eax
jne 0x40ae30
push esi
push dword [0x483aa4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call esi
push dword [ebp + 8]
mov edi, eax
call esi
push dword [0x4811f4]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push edi
call esi
push dword [0x4810f0]
mov dword [ebp - 8], eax
push ebx
call esi
mov dword [ebp - 0xc], eax
xor esi, esi
mov eax, dword [0x480198]
cdq
idiv dword [0x482ff0]
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x482ff0]
inc edx
add edx, eax
test edx, edx
jle 0x40aedd
nop
mov eax, esi
cdq
idiv dword [ebp + 0xc]
push 0xcc0020
mov eax, esi
push 0
test edx, edx
jne 0x40ae97
push 0x40
jmp 0x40aeb0
cdq
idiv dword [ebp - 4]
test edx, edx
jne 0x40aea3
push 0x50
jmp 0x40aeae
cmp ecx, 8
jl 0x40aeac
push 0x60
jmp 0x40aeae
push 0x61
mov eax, esi
push ebx
push 0x90
push ecx
imul eax, ecx
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [0x480198]
inc esi
mov ecx, dword [0x482ff0]
cdq
idiv ecx
mov edx, dword [ebp + 0xc]
inc edx
add eax, edx
cmp esi, eax
jl 0x40ae80
push dword [ebp - 8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call esi
push dword [ebp - 0xc]
push ebx
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call esi
push ebx
call esi
push dword [ebp + 8]
push dword [0x483aa4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40af20
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4811f8]
sub esp, 0xc
test eax, eax
je 0x40af36
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push dword [0x483aa4]
call dword [sym.imp.USER32.dll_GetDC]
movzx ecx, byte [ebp + 0xc]
mov ebx, eax
movzx eax, byte [ebp + 8]
imul eax, ecx
mov dword [ebp - 4], ecx
push 0xa0
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0xc], eax
lea ecx, [eax + 1]
imul ecx, dword [0x482ff0]
add ecx, dword [0x480198]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [0x4811f8], eax
test eax, eax
jne 0x40af91
push ebx
push dword [0x483aa4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
push ebx
call esi
push ebx
mov edi, eax
call esi
push dword [0x4811f8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push edi
call esi
push dword [0x4810fc]
mov dword [ebp + 8], eax
push ebx
call esi
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [0x480198]
cdq
idiv dword [0x482ff0]
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x482ff0]
inc edx
add edx, eax
test edx, edx
jle 0x40b03d
nop
mov eax, esi
cdq
idiv dword [ebp + 0xc]
push 0xcc0020
mov eax, esi
push 0
test edx, edx
jne 0x40aff7
push 0x40
jmp 0x40b010
cdq
idiv dword [ebp - 4]
test edx, edx
jne 0x40b003
push 0x50
jmp 0x40b00e
cmp ecx, 8
jl 0x40b00c
push 0x60
jmp 0x40b00e
push 0x61
mov eax, esi
push ebx
push 0xa0
push ecx
imul eax, ecx
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [0x480198]
inc esi
mov ecx, dword [0x482ff0]
cdq
idiv ecx
mov edx, dword [ebp + 0xc]
inc edx
add eax, edx
cmp esi, eax
jl 0x40afe0
push dword [ebp + 8]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call esi
push dword [ebp - 8]
push ebx
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call esi
push ebx
call esi
push dword [ebp - 0xc]
push dword [0x483aa4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ff20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x480230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x46e5e8
push eax
xor bl, bl
call fcn.00426e25
mov esi, eax
add esp, 8
test esi, esi
je 0x40ffb5
push esi
push 6
lea eax, [ebp - 0xc]
push 1
push eax
call fcn.00446671
mov edx, str.Org_01
lea ecx, [ebp - 0xc]
mov eax, dword [ecx]
add esp, 0x10
cmp eax, dword [edx]
jne 0x40ff76
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
jne 0x40ff76
mov bl, 1
mov edx, str.Org_02
lea ecx, [ebp - 0xc]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40ff90
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
jne 0x40ff90
mov bl, 2
mov edx, str.Org_03
lea ecx, [ebp - 0xc]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40ffa8
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
je 0x40ffcc
test bl, bl
jne 0x40ffcc
push esi
call fcn.00426ae3
add esp, 4
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004192c7
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.00426ae3
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.004192c7
mov esp, ebp
pop ebp
ret 4
Function at 0x412d60
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
mov edi, 0x480010
mov esi, 0x4825c8
push 0x483c28
push 0x100
push esi
push 0x46f2e8
push dword [edi]
mov word [esi], 0x40
push 0x46f2ec
call ebx
add esi, 0x104
lea edi, [edi + 4]
cmp esi, 0x482ff0
jl 0x412d73
xor edi, edi
mov esi, 0x4825c8
nop dword [eax]
cmp byte [esi], 0x40
je 0x412dba
push 0
push esi
jmp 0x412dc2
push 1
push dword [0x4816e8]
push edi
call fcn.004134d0
add esi, 0x104
add esp, 0xc
inc edi
cmp esi, 0x482ff0
jl 0x412db0
pop edi
pop esi
pop ebx
ret

Function at 0x413cb0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SetScrollInfo]
push edi
mov edi, ecx
push 1
lea ebx, [edi + 8]
mov dword [ebx], 0x1c
push ebx
mov dword [edi + 0xc], 3
mov dword [edi + 0x10], 0
mov eax, dword [0x4801a0]
push 0
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 4
push dword [0x483aa4]
call esi
push 1
push ebx
push 1
mov dword [ebx], 0x1c
mov dword [edi + 0xc], 3
mov dword [edi + 0x14], 0x3c
mov dword [edi + 0x18], 4
push dword [0x483aa4]
call esi
push 0x483c28
push 0x21
push str.VPOS
push str.WINDOW
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push ebx
push 1
mov dword [edi + 4], eax
mov dword [edi + 0xc], 4
mov dword [edi + 0x1c], eax
push dword [0x483aa4]
call esi
pop edi
pop esi
mov eax, 1
pop ebx
ret