joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53e270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ebx
dec edi
mov dword [ebp - 4], ecx
mov eax, edi
mov dword [ebp - 0x18], edi
sar eax, 1
mov dword [ebp - 0x14], eax
cmp ebx, eax
jge 0x53e36a
nop dword [eax]
mov edi, dword [ebp + 0x18]
lea ebx, [esi + esi]
mov ecx, dword [edx + ebx*4 + 8]
mov esi, dword [edx + ebx*4 + 4]
call fcn.0043e770
mov ecx, esi
movss xmm0, dword [eax]
subss xmm0, dword [edi]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, dword [edi + 4]
movss dword [ebp - 8], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, dword [edi + 8]
movss dword [ebp - 0x10], xmm0
call fcn.0043e770
movss xmm2, dword [ebp - 0xc]
movss xmm4, dword [ebp - 8]
mulss xmm2, xmm2
mov edx, dword [ebp + 8]
movss xmm1, dword [eax]
movss xmm3, dword [eax + 4]
subss xmm3, dword [edi + 4]
movss xmm0, dword [eax + 8]
xor eax, eax
subss xmm1, dword [edi]
subss xmm0, dword [edi + 8]
mulss xmm4, xmm4
mov ecx, dword [ebp + 0xc]
mulss xmm3, xmm3
mulss xmm1, xmm1
addss xmm4, xmm2
movss xmm2, dword [ebp - 0x10]
mulss xmm2, xmm2
addss xmm3, xmm1
mulss xmm0, xmm0
addss xmm4, xmm2
addss xmm3, xmm0
comiss xmm4, xmm3
seta al
xor eax, 1
lea esi, [eax + 1]
add esi, ebx
mov ebx, esi
mov dword [ebp + 0xc], ebx
mov eax, dword [edx + esi*4]
mov dword [edx + ecx*4], eax
mov eax, dword [ebp - 0x14]
cmp esi, eax
jl 0x53e2a0
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x18]
cmp esi, eax
jne 0x53e37e
mov eax, dword [ebp + 0x10]
test al, 1
jne 0x53e37e
mov eax, dword [edx + eax*4 - 4]
mov dword [edx + ebx*4], eax
mov ebx, edi
mov esi, dword [ebp + 0x18]
cmp ecx, ebx
jge 0x53e446
nop dword [eax]
mov ecx, dword [ebp + 0x14]
lea eax, [ebx - 1]
sar eax, 1
mov dword [ebp - 0x14], eax
mov edi, dword [ecx]
mov ecx, dword [edx + eax*4]
call fcn.0043e770
mov ecx, edi
movss xmm0, dword [eax]
subss xmm0, dword [esi]
movss dword [ebp + 0x10], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, dword [esi + 4]
movss dword [ebp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, dword [esi + 8]
movss dword [ebp - 0x18], xmm0
call fcn.0043e770
movss xmm2, dword [ebp + 0x10]
movss xmm4, dword [ebp + 0xc]
mulss xmm2, xmm2
movss xmm1, dword [eax]
movss xmm3, dword [eax + 4]
subss xmm3, dword [esi + 4]
subss xmm1, dword [esi]
movss xmm0, dword [eax + 8]
subss xmm0, dword [esi + 8]
mulss xmm4, xmm4
mulss xmm3, xmm3
mulss xmm1, xmm1
addss xmm4, xmm2
movss xmm2, dword [ebp - 0x18]
mulss xmm2, xmm2
addss xmm3, xmm1
mulss xmm0, xmm0
addss xmm4, xmm2
addss xmm3, xmm0
comiss xmm4, xmm3
jbe 0x53e455
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx*4]
mov dword [edx + ebx*4], eax
mov ebx, ecx
cmp dword [ebp - 4], ecx
jl 0x53e390
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov eax, dword [eax]
mov dword [edx + ebx*4], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov eax, dword [eax]
mov dword [ecx + ebx*4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x540340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee49f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x653ea8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
sub edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
inc edi
sub esi, ebx
add esi, 1
je 0x54040f
test edi, edi
je 0x54040f
push 0x40
call fcn.00553657
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x5403ac
mov ecx, eax
call fcn.005447c0
mov ecx, eax
jmp 0x5403ae
xor ecx, ecx
mov eax, dword [ebp + 0x10]
cmp edi, esi
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
cmovg esi, edi
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], ebx
mov dword [ecx + 8], edx
mov dword [ecx + 0x24], esi
movzx eax, word [eax + 0x8c]
imul eax, edx
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
add eax, ebx
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x544dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee5f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x653ea8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x6dc16c], edi
lea esi, [edi + 0x6c]
mov dword [edi], 0x5fef1c
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004161f0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x43480000
mov dword [edi + 0x1c], 0x447a0000
mov dword [edi + 0x20], 0x3f800000
mov dword [edi + 0x24], 0x3f800000
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x68], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x576a50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor dl, dl
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], ecx
push ebp
push esi
push edi
test bl, 3
jne 0x576b87
test cl, 3
jne 0x576b87
test eax, eax
je 0x576b87
mov edi, eax
xor ecx, ecx
shr edi, 2
xor esi, esi
mov dword [esp + 0x10], ecx
test edi, edi
je 0x576b4e
mov ebp, dword [esp + 0x20]
cmp edi, 8
jb 0x576b17
mov edx, edi
lea ecx, [ebp + 0x10]
mov eax, ebx
and edx, 0xfffffff8
sub eax, ebp
xorps xmm3, xmm3
mov dword [esp + 0x14], eax
xorps xmm2, xmm2
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
nop
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [ecx + ebp - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x576ac0
mov ebp, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ecx, xmm2
mov dword [esp + 0x10], ecx
cmp esi, edi
jae 0x576b52
mov ecx, ebx
lea edx, [esi*4]
sub ecx, ebp
mov ebx, edi
add edx, ebp
mov dword [esp + 0x14], ecx
sub ebx, esi
mov ebp, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edx + ebp]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
or edi, ecx
sub ebx, 1
jne 0x576b34
mov ebx, dword [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x20]
shl esi, 2
sub eax, esi
jne 0x576b66
pop edi
pop esi
test ecx, ecx
pop ebp
sete al
pop ebx
add esp, 8
ret
mov edx, ecx
add ebp, esi
shr ecx, 0x10
add ebx, esi
shr edx, 0x18
or dl, cl
mov dword [esp + 0x14], ebp
mov ecx, dword [esp + 0x10]
shr ecx, 8
or dl, cl
mov ecx, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test eax, eax
je 0x576c50
cmp eax, 0x20
jb 0x576c2f
mov esi, eax
add ecx, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [ecx + ebp - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x576bc0
por xmm2, xmm3
mov ebp, dword [esp + 0x14]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ecx, xmm2
or dl, cl
cmp edi, eax
jae 0x576c50
jmp 0x576c33
mov ebp, dword [esp + 0x14]
sub ebx, ebp
lea esi, [edi + ebp]
sub eax, edi
nop word [eax + eax]
mov cl, byte [ebx + esi]
lea esi, [esi + 1]
xor cl, byte [esi - 1]
or dl, cl
sub eax, 1
jne 0x576c40
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret

Function at 0x599efa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00599bab

Function at 0x599f05
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00599d35
Function at 0xfa732c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfa7336
pushal
call 0xfa733c
pop ebp
sub ebp, 0x10
sub ebp, 0xba732c
jmp 0xfa7352
mov eax, 0xba732c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c9
mov edx, 0xc030b6a0
xor byte [eax], dl
inc eax
dec ecx
jne 0xfa7369
jmp 0xfa737c
sub ebp, dword [ebp + 0x2b]
sub dword [eax + 0x6121a0a0], ebx
pop eax
mov al, byte [0x6da3a0a0]
sbb byte [ebp + 0x1aa0a0a0], ah
mov byte [eax + 0x4257a0a0], ah
mov dword [0xac212b68], eax
mov al, byte [0x65a3a0a0]
sub eax, 0x295c84c4
movsb byte es:[edi], byte [esi]
test byte [0x295c84c4], ch
movsb byte es:[edi], byte [esi]
test al, cl
or byte [ebx - 0x43], cl
mov al, byte [0x3c2723c8]
mov al, byte [0xc8848ca1]
jne 0xfa7415
pop ecx
sbb eax, 0xa0a0a548
mov al, byte [0xa0a09449]
mov al, byte [0x5c84c42d]
sub dword [esp + eax*4 + 0x252bfdf4], ecx
test al, 0xa0
mov al, byte [0xac352ba0]
mov al, byte [0x2d2ba0a0]
mov al, 0xa0
mov al, byte [0xa24961a0]
xchg ecx, eax
mov byte [0xe9a46223], al
scasd eax, dword es:[edi]
and eax, 0x5f5f5f54
sub ecx, dword [esp + eax*4 - 0x5b7b3bd3]
bound ebp, qword [eax - 0x5b7bd3d5]
mov al, byte [0x8c8a0a0]
dec ebx
mov ebp, 0x2723c8a0
cmp al, 0xa0
mov eax, dword [0xc42d848c]
test byte [ecx + ebp - 0x54], bl
test byte [eax - 0x5b], cl
les eax, [esp + ebx*2 + 0x4884ac29]
movsd dword es:[edi], dword [esi]
mov al, byte [0x9f49a0a0]
mov byte [0xc42da0a0], al
test byte [ecx + ebp - 0x74], bl
test ah, dh
std
pop edi
aad 0xac
pop edi
aad 0xa8
dec eax
int3
Function at 0x4265a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041f38f
and dword [ebp - 4], 0
cmp dword [0x4513b8], 0
mov ebx, eax
jne 0x426656
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x426707
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x426707
push eax
call fcn.0041f31d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4513b8], eax
call esi
push eax
call fcn.0041f31d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4513bc], eax
call esi
push eax
call fcn.0041f31d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4513c0], eax
call esi
push eax
call fcn.0041f31d
pop ecx
mov dword [0x4513c8], eax
test eax, eax
je 0x426656
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f31d
pop ecx
mov dword [0x4513c4], eax
mov eax, dword [0x4513c4]
cmp eax, ebx
je 0x4266ae
cmp dword [0x4513c8], ebx
je 0x4266ae
push eax
call fcn.0041f398
push dword [0x4513c8]
mov esi, eax
call fcn.0041f398
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4266ae
test edi, edi
je 0x4266ae
call esi
test eax, eax
je 0x4266a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4266a5
test byte [ebp - 0xc], 1
jne 0x4266ae
or dword [ebp + 0x10], 0x200000
jmp 0x4266e7
mov eax, dword [0x4513bc]
cmp eax, ebx
je 0x4266e7
push eax
call fcn.0041f398
pop ecx
test eax, eax
je 0x4266e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4266e7
mov eax, dword [0x4513c0]
cmp eax, ebx
je 0x4266e7
push eax
call fcn.0041f398
pop ecx
test eax, eax
je 0x4266e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4513b8]
call fcn.0041f398
pop ecx
test eax, eax
je 0x426707
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x426709
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x403340
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040cd90
mov eax, dword [0xa6c50c]
mov ecx, dword [0xa6c47c]
shr eax, 3
test eax, eax
jbe 0x403472
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403390
cmp dword [0xa6c50c], 0x959
jne 0x403454
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x820]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x1024]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402d40
push 0x402d50
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403160
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403390
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x403d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x1830
call fcn.0040cd90
cmp dword [0xa6c50c], 0xc
push ebx
push ebp
push esi
push edi
jne 0x403e22
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
lea eax, [esp + 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
lea ecx, [esp + 0xc48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
push 0x402e00
push 0x402e1c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x402e38
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
lea eax, [esp + 0x1044]
push eax
push 0x402e6c
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x402e78
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
call fcn.00403f2d
push ecx
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004042fa
fstp st(0)
add esp, 8
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x9458
jge 0x403e54
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1044]
push ecx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x14ee8
jl 0x403e36
mov edx, dword [0x45f6c4]
mov eax, dword [0x45f698]
mov dword [0xa6c50c], edx
mov dword [0xa6de14], eax
call fcn.00403580
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407e23
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45ea94]
jne 0x407e2d
repz ret
jmp fcn.0040a5e7
Function at 0x4088de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004068d5
and dword [ebp - 4], 0
cmp dword [0x45ff74], 0
mov ebx, eax
jne 0x40898f
push 0x401a8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408a40
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a80
push edi
call esi
test eax, eax
je 0x408a40
push eax
call fcn.00406863
mov dword [esp], 0x401a70
push edi
mov dword [0x45ff74], eax
call esi
push eax
call fcn.00406863
mov dword [esp], 0x401a5c
push edi
mov dword [0x45ff78], eax
call esi
push eax
call fcn.00406863
mov dword [esp], 0x401a40
push edi
mov dword [0x45ff7c], eax
call esi
push eax
call fcn.00406863
pop ecx
mov dword [0x45ff84], eax
test eax, eax
je 0x40898f
push 0x401a28
push edi
call esi
push eax
call fcn.00406863
pop ecx
mov dword [0x45ff80], eax
mov eax, dword [0x45ff80]
cmp eax, ebx
je 0x4089e7
cmp dword [0x45ff84], ebx
je 0x4089e7
push eax
call fcn.004068de
push dword [0x45ff84]
mov esi, eax
call fcn.004068de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4089e7
test edi, edi
je 0x4089e7
call esi
test eax, eax
je 0x4089de
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4089de
test byte [ebp - 0xc], 1
jne 0x4089e7
or dword [ebp + 0x10], 0x200000
jmp 0x408a20
mov eax, dword [0x45ff78]
cmp eax, ebx
je 0x408a20
push eax
call fcn.004068de
pop ecx
test eax, eax
je 0x408a20
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408a20
mov eax, dword [0x45ff7c]
cmp eax, ebx
je 0x408a20
push eax
call fcn.004068de
pop ecx
test eax, eax
je 0x408a20
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45ff74]
call fcn.004068de
pop ecx
test eax, eax
je 0x408a40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408a42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4660d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4660fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4660fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408940
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop ebx
add ecx, 0x68b2a978
mov ecx, ecx
call fcn.0040897b
xor dword [eax], ebx
sub esi, esi
add ecx, 1
inc eax
add ecx, 0xd20ce1a9
sub ecx, 0xd91b60a6
cmp eax, edi
jne fcn.00408940
sub esp, 4
mov dword [esp], ecx
pop ecx
ret
Function at 0x4014be
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x128
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x424c78]
lea edi, [ebp - 0x115]
mov dword [ebp - 0x120], ecx
or eax, 8
push eax
push 0
push edx
push esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x40152a
jmp 0x401586
cmp dword [ebp - 0x120], 0
je 0x40151a
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
add esp, 0xc
jmp 0x401586
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, edi
call fcn.004014be
test eax, eax
jne 0x40153e
push 0x105
push edi
push 0
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x4014fc
sub esp, 0xc
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
push 2
call fcn.0040628e
add esp, 0xc
test eax, eax
je 0x401565
push 0
push dword [0x424c78]
push ebx
push esi
call eax
jmp 0x401586
cmp dword [0x424c78], 0
mov eax, 1
jne 0x401586
push edi
push edi
push ebx
push esi
call sub.ADVAPI32.DLL_RegDeleteKeyA
pop ebx
pop esi
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
push dword [0x409010]
call sub.KERNEL32.dll_ReadFile
xor edx, edx
add esp, 0xc
test eax, eax
je 0x403140
xor edx, edx
cmp dword [ebp - 8], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8

Function at 0x403149
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
cmp dword [ebp + 8], 0
je 0x40317a
mov eax, dword [0x414c60]
test eax, eax
je 0x40316b
sub esp, 0xc
push eax
call sub.USER32.dll_DestroyWindow
add esp, 0xc
mov dword [0x414c60], 0
jmp 0x403218
cmp dword [0x414c60], 0
je 0x403195
sub esp, 0xc
push 0
call fcn.00406253
add esp, 0xc
jmp 0x403218
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [0x424cf8]
jbe 0x403218
cmp dword [0x424d48], 0
je 0x4031ec
test byte [0x424c7c], 1
je 0x403218
mov edx, dword [0x414cb0]
push eax
mov eax, dword [0x414cc0]
push edx
cmp eax, edx
push 0x64
jle 0x4031c9
mov eax, edx
push eax
call sub.KERNEL32.dll_MulDiv
lea ebx, [ebp - 0x44]
push eax
push str....__d__
push ebx
call sub.USER32.dll_wsprintfA
pop ecx
pop eax
push ebx
push 0
call fcn.00403ef4
pop eax
pop edx
jmp 0x403218
sub esp, 0xc
push 0
push 0x403867
push 0
push 0x6f
push dword [0x424d58]
call sub.USER32.dll_CreateDialogParamA
sub esp, 0xc
push 5
push eax
mov dword [0x414c60], eax
call sub.USER32.dll_ShowWindow
add esp, 0x18
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40321d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
add ebx, dword [0x414c80]
sub ebx, dword [0x414c70]
call sub.KERNEL32.dll_GetTickCount
add eax, 0x1f4
test ebx, ebx
mov dword [0x424cf8], eax
jle 0x4033ad
push 0
push 0
push dword [0x414c90]
push dword [0x409010]
call sub.KERNEL32.dll_SetFilePointer
push 0
push 0
push dword [0x414c70]
push dword [0x409014]
call sub.KERNEL32.dll_SetFilePointer
mov dword [0x414cb0], ebx
mov dword [0x414cc0], 0
mov esi, dword [0x414ca0]
sub esi, dword [0x414c90]
cmp esi, 0x4000
jle 0x4032a0
mov esi, 0x4000
push ebx
push ebx
push esi
push 0x414d60
call fcn.00403110
pop edx
pop ecx
test eax, eax
jne 0x4032bb
or eax, 0xffffffff
jmp 0x4033ca
add dword [0x414c90], esi
mov dword [0x414ce8], 0x414d60
mov dword [0x414cec], esi
cmp dword [0x424ca8], 0
je 0x403308
cmp dword [0x424c68], 0
jne 0x403308
mov eax, dword [0x414c70]
sub esp, 0xc
add eax, dword [0x414cb0]
sub eax, dword [0x414c80]
push 0
sub eax, edi
mov dword [0x414cc0], eax
call fcn.00403149
add esp, 0x10
mov ecx, 0x414cd0
mov dword [0x414cf0], 0x418d60
mov dword [0x414cf4], 0x8000
call fcn.00407066
test eax, eax
js 0x4033be
mov eax, dword [0x414cf0]
mov ebx, eax
sub ebx, 0x418d60
je 0x403378
sub esp, 0xc
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x418d60
push dword [0x409014]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x4033c5
cmp ebx, dword [ebp - 0x10]
jne 0x4033c5
add dword [0x414c70], ebx
cmp dword [0x414cec], 0
jne 0x4032d1
jmp 0x403385
cmp dword [0x414cec], 0
jne 0x4033be
test esi, esi
je 0x4033be
mov edx, dword [0x414c80]
mov eax, edx
sub eax, dword [0x414c70]
add eax, edi
test eax, eax
jg 0x403287
push 0
push 0
push edx
push dword [0x409014]
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0xc
push 1
call fcn.00403149
xor eax, eax
add esp, 0x10
jmp 0x4033ca
mov eax, 0xfffffffd
jmp 0x4033ca
mov eax, 0xfffffffe
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret