joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51f460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004ba480
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004ba500
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004ba500
lea ecx, [esi + 0xc]
call fcn.0050ff30
lea ecx, [esi + 0x10]
call fcn.0050ff30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004bcd30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004bcd30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004bcd30
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0050ffa5
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0050ffa5
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4bb578
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51f688
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4bb588
call fcn.004bbaa0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4bb66b
cmp byte [edi], 0
je 0x4bb66b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4bb5ad
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004ba2a0
test eax, eax
jne 0x4bb5cd
push 0x5b4b24
lea ecx, [esi + 0x38]
call fcn.005100e2
jmp 0x4bb66b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004ba2f0
test eax, eax
jne 0x4bb5fc
mov ecx, esi
call fcn.004ba3f0
push edi
add esi, 0x38
push 0x5b4b00
push esi
call fcn.0050de64
add esp, 0xc
jmp 0x4bb66b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004bc320
test eax, eax
je 0x4bb664
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004bb740
test eax, eax
jne 0x4bb680
push edi
lea eax, [esi + 0x38]
push 0x5b4adc
push eax
call fcn.0050de64
add esp, 0xc
mov ecx, esi
call fcn.004bbaa0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4bb728
mov ecx, dword [0x5bb42c]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0050de64
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004ba3a0
test eax, eax
jne 0x4bb6ea
push 0x5b4ac0
lea ecx, [esi + 0x38]
call fcn.005100e2
jmp 0x4bb6fa
push 0xfa
mov ecx, esi
call fcn.004bc320
test eax, eax
jne 0x4bb717
mov ecx, esi
call fcn.004bbaa0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0050ffa5
jmp 0x4bb66b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0050ffa5
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4be6d0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.004ff390
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.00500899
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4be87d
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x4be87d
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.004be890
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.004be890
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.004be890
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.004be890
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x4be87d
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret
Function at 0x4c06d0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4c071a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x4c0749
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x4c078b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x4c4550
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5b53c4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4c4563
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4c45a4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5b546c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4c45d6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4c45da
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4c45cb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4c45f8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4c45fc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4c45ed
xor ecx, ecx
mov eax, 0x5b53d4
xor ebx, ebx
mov bl, byte [ecx + 0x5b547c]
cmp byte [esp + ebx + 0x14], 0
je 0x4c4627
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5b5494]
cmp byte [esp + ebx + 0x14], 0
je 0x4c463e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4c460e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4c4597
lea edx, [esp + 0x84]
push edx
call fcn.004c4680
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4ca350
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004ca150
pop edi
add esp, 0x104
ret 4

Function at 0x4cab60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4cab93
push esi
call fcn.004cf790
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4cab8c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4cac19
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4cac02
mov eax, dword [esi + 8]
test eax, eax
je 0x4cabb7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4cabfe
cmp eax, 2
je 0x4cac02
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4cabaa
cmp eax, 3
je 0x4cabdd
cmp eax, 1
jne 0x4cabaa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4cabaa
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4cabaa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004cac50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4cac39
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004cac50
add esp, 4
pop esi
ret

Function at 0x512373
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5123ab
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00510400
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005103d8
jmp 0x5123b7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x513a61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x513aa3
call fcn.00519684
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x513aa3
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x513a9a
xor eax, eax
jmp 0x513aab
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00513ab1
pop edi
pop esi
pop ebx
ret 4
Function at 0x519bb4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x519be2
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x519c00
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00519b1a
jmp 0x519c00
mov eax, dword [esi + 0x14]
test eax, eax
je 0x519c00
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00519b1a
test edi, edi
mov eax, edi
jne 0x519bea
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40a561
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040a5e0
jae 0x40a56d
xor ecx, ecx
call fcn.0040a5e0
jae 0x40a597
xor eax, eax
call fcn.0040a5e0
jae 0x40a5a8
mov al, 0x10
call fcn.0040a5e0
adc al, al
jae 0x40a589
jne 0x40a5d5
stosb byte es:[edi], al
jmp 0x40a56e
call fcn.0040a5ec
dec ecx
loop 0x40a5b4
mov eax, ebp
call fcn.0040a5ea
jmp 0x40a5d6
lodsb al, byte [esi]
shr eax, 1
je 0x40a5fc
adc ecx, 2
mov ebp, eax
jmp 0x40a5d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040a5ea
cmp eax, 0x7d00
jae 0x40a5d4
cmp eax, 0x500
jae 0x40a5d5
cmp eax, 0x7f
ja 0x40a5d6
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40a56e
pop ebp
ret 8

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x401510
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [0xc6e474]
push ebx
push esi
push edi
cmp eax, dword [0xc0db54]
jae 0x4016c7
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0xc0db4c]
push 0x49cb00
push str.kav.exe
mov dword [0xc79cb4], eax
call fcn.0047174a
mov ecx, dword [0xc79cb4]
mov esi, eax
add esp, 8
mov dword [ecx + 0x2c], esi
test esi, esi
jne 0x401582
push str.kav.exe
push str._nUnable_to_open_resource:_s
call fcn.004014d0
push 1
call fcn.00471829
add esp, 0xc
jmp 0x4016be
push esi
xor bl, bl
call fcn.004751aa
add esp, 4
test eax, eax
jne 0x40168d
test bl, bl
jne 0x4015a7
lea eax, [esp + 0x14]
push eax
push esi
call fcn.0047514f
add esp, 8
push esi
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call fcn.004753ea
add esp, 0x10
movzx ecx, bl
shl ecx, 3
mov eax, 0xcfcfdfdf
mov edx, 0x7a7abfbf
call fcn.0048cc20
movzx ecx, al
xor edi, edi
movzx eax, byte [esp + 0x13]
cdq
cmp eax, ecx
jne 0x40167a
cmp edx, edi
jne 0x40167a
inc bl
cmp bl, 8
jne 0x40167c
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004751d6
push esi
call fcn.00471658
mov esi, eax
add esp, 0xc
test esi, esi
js 0x40168d
mov eax, dword [0xc79cb4]
mov edi, dword [eax + 0x2c]
mov ebx, dword [eax + 0x10]
push edi
push 1
mov dword [eax + 0x14], esi
add eax, 4
push 0x10
push eax
call fcn.004753ea
mov ecx, dword [0xc79cb4]
add esp, 0x10
mov eax, dword [ecx + 0xc]
cmp eax, 0x103
je 0x401644
cmp eax, 0x102
jne 0x40164f
mov eax, dword [ecx + 0x10]
cmp ebx, eax
jae 0x4016db
mov ecx, dword [ecx + 0x2c]
call fcn.004024d0
mov eax, dword [0xc79cb4]
push esi
push str._ncant_load_resource_infos:_x
mov dword [eax + 0x2c], 0
call fcn.004014d0
push 1
call fcn.00471829
add esp, 0xc
jmp 0x4016be
xor bl, bl
push esi
call fcn.004751aa
add esp, 4
test eax, eax
je 0x401595
mov ecx, dword [0xc79cb4]
mov ecx, dword [ecx + 0x2c]
call fcn.004024d0
mov eax, dword [0xc79cb4]
push str._ncant_find_resource_magic
mov dword [eax + 0x2c], 0
call fcn.004014d0
add esp, 4
push 1
call fcn.00471829
add esp, 4
push eax
call fcn.00471c03
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x18
ret
push edi
lea eax, [eax + eax*2]
push 1
shl eax, 2
push eax
push dword [ecx]
call fcn.004753ea
mov eax, dword [0xc79cb4]
add esp, 0x10
mov ecx, dword [esp + 0x20]
inc dword [0xc6e474]
pop edi
pop esi
pop ebx
mov dword [eax + 0x20], 0
xor ecx, esp
mov eax, 1
call fcn.0046ad4d
add esp, 0x18
ret
Function at 0x4022f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5b4
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x5b0], eax
cmp dword [0xc6e474], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
je 0x40247c
lea esi, [esp + 0x1b8]
mov edx, eax
sub esi, eax
nop dword [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x402330
lea eax, [esp + 0x1b8]
push 0x2f
push eax
call fcn.0046d510
add esp, 8
test eax, eax
jne 0x402370
lea eax, [esp + 0x1b8]
push 0x5c
push eax
call fcn.0046d510
add esp, 8
lea ecx, [esp + 0x1b8]
test eax, eax
je 0x402373
lea ecx, [eax + 1]
mov edx, ecx
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x402378
sub edx, esi
lea esi, [esp + 0x158]
sub esi, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x402390
mov eax, 0x5f
sub eax, edx
push eax
lea eax, [esp + 0x15c]
add eax, edx
push 0
push eax
call fcn.0046e200
add esp, 0xc
lea esi, [esp + 0x15a]
xor edx, edx
lea edi, [edx + 0x13]
movsx ecx, byte [esi - 2]
lea esi, [esi + 5]
mov eax, edx
shl edx, 8
shr eax, 0x18
xor ecx, eax
movzx eax, cl
movsx ecx, byte [esi - 6]
xor edx, dword [eax*4 + 0x793bb8]
mov eax, edx
shl edx, 8
shr eax, 0x18
xor ecx, eax
movzx eax, cl
xor edx, dword [eax*4 + 0x793bb8]
movsx eax, byte [esi - 5]
mov ecx, edx
shr ecx, 0x18
xor ecx, eax
shl edx, 8
movzx eax, cl
movsx ecx, byte [esi - 4]
xor edx, dword [eax*4 + 0x793bb8]
mov eax, edx
shl edx, 8
shr eax, 0x18
xor ecx, eax
movzx eax, cl
movsx ecx, byte [esi - 3]
xor edx, dword [eax*4 + 0x793bb8]
mov eax, edx
shl edx, 8
shr eax, 0x18
xor ecx, eax
movzx eax, cl
xor edx, dword [eax*4 + 0x793bb8]
sub edi, 1
jne 0x4023c5
xor ebx, ebx
cmp dword [0xc6e474], ebx
jbe 0x402478
mov edi, dword [0xc0db4c]
mov esi, dword [edi + 0x10]
xor eax, eax
test esi, esi
je 0x40246c
mov ecx, dword [edi]
cmp dword [ecx], edx
je 0x4024ab
inc eax
add ecx, 0xc
cmp eax, esi
jb 0x402460
inc ebx
add edi, 0x30
cmp ebx, dword [0xc6e474]
jb 0x402455
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp + 0x38]
xor edx, edx
cmp eax, 0xffffffff
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.0046ad4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
lea eax, [eax + eax*2]
pop edi
pop esi
pop ebx
mov eax, dword [ecx + eax*4 + 4]
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.0046ad4d
mov esp, ebp
pop ebp
ret
Function at 0x4025e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, edx
mov dword [esp], ecx
imul eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
mov dword [esp + 0x14], eax
mov ebp, eax
mov eax, dword [0xc79cbc]
push edi
cmp dword [eax*4 + 0xc65b80], 0
je 0x40265e
mov edi, dword [0xc79cbc]
mov esi, 0x8000
mov eax, dword [edi*4 + 0xc65b80]
sub esi, eax
mov dword [esp + 0x14], eax
lea eax, [eax + 0xc6e480]
cmp ebp, esi
jbe 0x402778
push esi
push eax
push ecx
call fcn.0046e410
add dword [esp + 0x1c], esi
add esp, 0xc
add dword [edi*4 + 0xc6e400], esi
sub ebp, esi
mov dword [edi*4 + 0xc65b80], 0
cmp dword [0xc65b7c], 0x4d2
lea eax, [esp + 0x1c]
push ebx
je 0x4026fc
push 4
push 1
push eax
call fcn.004753ea
add esp, 0x10
cmp eax, 4
jne 0x4027b8
mov ecx, dword [esp + 0x1c]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
push ebx
shl eax, 8
or edx, eax
lea eax, [esp + 0x24]
push 4
push 1
push eax
mov dword [esp + 0x2c], edx
call fcn.004753ea
add esp, 0x10
cmp eax, 4
jne 0x4027b8
mov ecx, dword [esp + 0x20]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [esp + 0x20], edx
jmp 0x402712
push 8
push 1
push eax
call fcn.004753ea
add esp, 0x10
cmp eax, 8
jne 0x4027b8
push ebx
push dword [esp + 0x20]
push 1
push 0xc65c00
call fcn.004753ea
mov ecx, dword [esp + 0x2c]
add esp, 0x10
cmp eax, ecx
jne 0x4027b8
mov esi, dword [esp + 0x20]
push ecx
cmp esi, ecx
je 0x40274e
lea eax, [esp + 0x18]
mov edx, ecx
push eax
push ecx
call fcn.0040e800
mov esi, dword [esp + 0x2c]
jmp 0x40275d
push 0xc65c00
push 0xc6e480
call fcn.0046e410
mov eax, dword [0xc6e470]
add esp, 0xc
test eax, eax
je 0x40276f
push esi
call eax
add esp, 4
mov ecx, dword [esp + 0x10]
jmp 0x402615
push ebp
push eax
push ecx
call fcn.0046e410
mov ecx, dword [0xc79cbc]
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, ebp
add dword [ecx*4 + 0xc6e400], ebp
mov dword [ecx*4 + 0xc65b80], eax
mov eax, dword [ecx*4 + 0xc6e400]
cmp eax, dword [ecx*4 + 0xc79cc0]
jle 0x4027cd
mov dword [ecx*4 + 0xc6e440], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0046ad4d
add esp, 0x1c
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ad4d
add esp, 0x1c
ret
Function at 0x4027f0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, edx
imul eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov ebx, eax
mov eax, dword [0xc79cbc]
mov ebp, ecx
cmp dword [eax*4 + 0xc65b80], 0
je 0x402852
mov edi, dword [0xc79cbc]
mov esi, 0x8000
mov eax, dword [edi*4 + 0xc65b80]
sub esi, eax
lea eax, [eax + 0xc6e480]
cmp ebx, esi
jbe 0x40287f
push esi
push eax
push ebp
call fcn.0046e410
add dword [edi*4 + 0xc6e400], esi
add esp, 0xc
add ebp, esi
mov dword [edi*4 + 0xc65b80], 0
sub ebx, esi
push dword [esp + 0x1c]
push 0x8000
push 1
push 0xc6e480
call fcn.004753ea
mov eax, dword [0xc6e470]
add esp, 0x10
test eax, eax
je 0x402813
push 0x8000
call eax
add esp, 4
jmp 0x402813
push ebx
push eax
push ebp
call fcn.0046e410
mov ecx, dword [0xc79cbc]
add esp, 0xc
mov eax, dword [edi*4 + 0xc65b80]
add eax, ebx
add dword [ecx*4 + 0xc6e400], ebx
pop edi
pop esi
mov dword [ecx*4 + 0xc65b80], eax
mov eax, dword [ecx*4 + 0xc6e400]
pop ebp
pop ebx
cmp eax, dword [ecx*4 + 0xc79cc0]
jle 0x4028ca
mov dword [ecx*4 + 0xc6e440], 0
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret

Function at 0x403500
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
mov eax, dword [0x4b000c]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp esi, eax
je 0x4035cd
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 8
push eax
push edi
push 0x48
call ebp
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
test eax, eax
je 0x403567
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edi
push eax
push edi
push 0x49
call ebp
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
nop dword [eax]
push 0
push esi
call ebx
push 2
push esi
call ebx
push 1
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
inc edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, eax
je 0x40359d
cmp edi, 3
jle 0x403570
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 8
push eax
push 0
push 0x48
call ebp
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x18], eax
je 0x4035cd
push 2
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x49
call ebp
push 2
push 0
push 0
push 0x2001
call ebp
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ad4d
add esp, 0x14
ret