joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408691
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x2c
mov eax, 0x439efa
call fcn.00421920
lea esi, [ecx + 0x12c]
mov edi, 0x104
push edi
mov ecx, esi
call main
push eax
push edi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
je 0x4087b0
push 0xffffffffffffffff
mov ecx, esi
call main
mov eax, dword [esi]
sub eax, 0x10
push eax
call main
add eax, 0x10
pop ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov ecx, esi
push edi
mov dword [ebp - 4], ebx
call main
push eax
push ebx
push 0x4403bc
lea ecx, [ebp - 0x10]
call fcn.00408e0a
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401856
push 0xffffffffffffffff
mov ecx, esi
call main
lea ecx, [ebp - 0x38]
call fcn.00414373
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 1
call fcn.004072b3
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
push 0x1001
push dword [esi]
lea ecx, [ebp - 0x38]
call main
test eax, eax
jne 0x408755
mov ecx, esi
call fcn.00401451
jmp 0x408792
push 0x4403c4
push 0x87
push ebx
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.kernel32.dll_SizeofResource]
push eax
push edi
call dword [sym.imp.kernel32.dll_LockResource]
push eax
lea ecx, [ebp - 0x38]
call main
push edi
call dword [sym.imp.kernel32.dll_FreeResource]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], vtable.CFileException.0
lea ecx, [ecx - 0x10]
call fcn.00401856
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0041439a
call fcn.004218ee
ret

Function at 0x4087cd
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x439f2d
call fcn.00421920
mov edi, dword [ebp + 8]
mov eax, dword [edi]
sub eax, 0x10
push eax
call main
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov ebx, 0x104
push ebx
mov ecx, edi
call main
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401856
push 0xffffffffffffffff
mov ecx, edi
call main
lea ecx, [ebp - 0x2c]
call fcn.0041557b
mov eax, dword [edi]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 0xc], 0
je 0x40887a
push 0
push eax
lea ecx, [ebp - 0x2c]
call main
test eax, eax
je 0x40887a
lea ecx, [ebp - 0x2c]
call fcn.004159c0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00415ad9
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call main
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00401856
lea ecx, [ebp - 0x2c]
call fcn.004157cc
jmp 0x40887c
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041572c
mov eax, ebx
call fcn.004218ee
ret 4
Function at 0x40894b
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
movzx eax, word [esi + 0x154]
test ax, ax
jne 0x408cf9
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov ax, cx
and ecx, 0x3ff
shr ax, 0xa
dec ecx
movzx eax, ax
cmp ecx, 0x2c
ja case.0x408981.9
jmp dword [ecx*4 + 0x408cfb]
push str.Arabic
lea ecx, [esi + 0x158]
call main
mov eax, 0x401
jmp 0x408cf2
push str.Basque
lea ecx, [esi + 0x158]
call main
mov eax, 0x42d
jmp 0x408cf2
push str.Bulgarian
lea ecx, [esi + 0x158]
call main
mov eax, 0x402
jmp 0x408cf2
push str.Catalan
lea ecx, [esi + 0x158]
call main
mov eax, 0x403
jmp 0x408cf2
cmp eax, 2
je 0x408a14
cmp eax, 4
je 0x408a14
push str.ChineseTraditional
lea ecx, [esi + 0x158]
call main
mov eax, 0x404
jmp 0x408cf2
push str.ChineseSimplified
lea ecx, [esi + 0x158]
call main
mov eax, 0x804
jmp 0x408cf2
push str.Croatian
lea ecx, [esi + 0x158]
call main
mov eax, 0x41a
jmp 0x408cf2
push str.Czech
lea ecx, [esi + 0x158]
call main
mov eax, 0x405
jmp 0x408cf2
push str.Danish
lea ecx, [esi + 0x158]
call main
mov eax, 0x406
jmp 0x408cf2
push str.Dutch
lea ecx, [esi + 0x158]
call main
mov eax, 0x413
jmp 0x408cf2
push str.Estonian
lea ecx, [esi + 0x158]
call main
mov eax, 0x425
jmp 0x408cf2
push str.Finnish
lea ecx, [esi + 0x158]
call main
mov eax, 0x40b
jmp 0x408cf2
push str.French
lea ecx, [esi + 0x158]
call main
mov eax, 0x40c
jmp 0x408cf2
push str.German
lea ecx, [esi + 0x158]
call main
mov eax, 0x407
jmp 0x408cf2
push str.Greek
lea ecx, [esi + 0x158]
call main
mov eax, 0x408
jmp 0x408cf2
push str.Hebrew
lea ecx, [esi + 0x158]
call main
mov eax, 0x40d
jmp 0x408cf2
push str.Hungarian
lea ecx, [esi + 0x158]
call main
mov eax, 0x40e
jmp 0x408cf2
push str.Italian
lea ecx, [esi + 0x158]
call main
mov eax, 0x410
jmp 0x408cf2
push str.Japanese
lea ecx, [esi + 0x158]
call main
mov eax, 0x411
jmp 0x408cf2
push str.Korean
lea ecx, [esi + 0x158]
call main
mov eax, 0x412
jmp 0x408cf2
push str.Latvian
lea ecx, [esi + 0x158]
call main
mov eax, 0x426
jmp 0x408cf2
push str.Lithuanian
lea ecx, [esi + 0x158]
call main
mov eax, 0x427
jmp 0x408cf2
push str.Norwegian
lea ecx, [esi + 0x158]
call main
mov eax, 0x414
jmp 0x408cf2
push str.Polish
lea ecx, [esi + 0x158]
call main
mov eax, 0x415
jmp 0x408cf2
push str.Portuguese
lea ecx, [esi + 0x158]
call main
mov eax, 0x416
jmp 0x408cf2
push str.Romanian
lea ecx, [esi + 0x158]
call main
mov eax, 0x418
jmp 0x408cf2
push str.Russian
lea ecx, [esi + 0x158]
call main
mov eax, 0x419
jmp 0x408cf2
push str.Slovak
lea ecx, [esi + 0x158]
call main
mov eax, 0x41b
jmp 0x408cf2
push str.Slovenian
lea ecx, [esi + 0x158]
call main
mov eax, 0x424
jmp 0x408cf2
push str.Spanish
lea ecx, [esi + 0x158]
call main
mov eax, 0x40a
jmp 0x408cf2
push str.Swedish
lea ecx, [esi + 0x158]
call main
mov eax, 0x41d
jmp 0x408cf2
push str.Turkish
lea ecx, [esi + 0x158]
call main
mov eax, 0x41f
jmp 0x408cf2
push str.Ukrainian
lea ecx, [esi + 0x158]
call main
mov eax, 0x422
jmp 0x408cf2
push str.English
lea ecx, [esi + 0x158]
call main
mov eax, 0x409
mov word [esi + 0x154], ax
pop esi
ret
Function at 0x408ff6
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x43b22b
call fcn.00421920
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.0040bac9
mov ecx, dword [ebp + 8]
push eax
call main
push 0x7d
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
pop ebx
mov eax, dword [ebp + 0x14]
add ebx, ebx
mov ecx, dword [ebp + 8]
push ebx
mov esi, dword [eax]
call main
push esi
push ebx
push eax
mov eax, dword [ebp + 0x10]
push 0x43c650
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0xffffffffffffffff
call main
lea ecx, [esi + 1]
cmp ebx, ecx
jbe 0x409025
mov eax, dword [ebp + 8]
call fcn.004218ee
ret 0x10
Function at 0x40a4d1
Capabilities:
Delete file
Shutdown system

Disassembly:
push 0x24
mov eax, 0x43a1de
call fcn.00421953
mov esi, ecx
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x2c], ebx
cmp dword [esi + 0xec], eax
jne 0x40a5f3
cmp dword [esi + 0xe4], eax
jne 0x40a5f3
cmp dword [esi + 0x160], eax
jne 0x40a540
cmp dword [esi + 0x15c], eax
je 0x40a53b
push 0x90
lea eax, [ebp - 0x30]
push eax
call fcn.0040906b
and dword [ebp - 4], ebx
inc ebx
push 0
push 0x10024
push dword [eax]
mov dword [ebp - 0x2c], ebx
call main
add esp, 0xc
cmp eax, 6
jne 0x40a540
xor eax, eax
mov byte [ebp - 0x21], al
jmp 0x40a544
mov byte [ebp - 0x21], 1
test bl, 1
je 0x40a554
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00401856
cmp byte [ebp - 0x21], 0
jne 0x40a5f3
lea edi, [esi + 0x12c]
xor ebx, ebx
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
je 0x40a57b
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov ecx, edi
call fcn.00401451
lea eax, [ebp - 0x28]
mov dword [esi + 0xe0], ebx
push eax
push 0x28
mov esi, ebx
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x40a5d3
lea eax, [ebp - 0x1c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
test esi, esi
je 0x40a5d3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp - 0x28]
call edi
mov esi, eax
push 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test esi, esi
je 0x40a5f3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push dword [ebp - 0x28]
call edi
call fcn.00421902
ret

Function at 0x40ac28
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x43a294
call fcn.00421920
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
xor esi, esi
call fcn.0040194d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], esi
mov ebx, dword [eax - 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40aca4
mov ecx, dword [ebp + 0x18]
cmp ecx, 1
je 0x40ac7b
cmp ecx, 2
je 0x40ac7b
push ebx
jmp 0x40ac7f
lea eax, [ebx + ebx]
push eax
push dword [ebp + 0x14]
push ecx
push esi
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40acc9
mov ebx, 0x453994
push 0x43ecfc
mov ecx, ebx
call main
push dword [ebp + 0x14]
mov ecx, ebx
call main
mov ecx, 0x4538c8
call fcn.0040a75f
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401856
mov eax, esi
call fcn.004218ee
ret
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x434b62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x434b71
pop dword [ebp - 0x2c]
mov eax, 0x434b71
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x3929ec9f
sub dword [ebp - 0x3c], 0xead7a754
mov dword [ebp - 0x38], 0xd8be41f4
add dword [ebp - 0x38], 0x59750a51
mov dword [ebp - 0x34], 0xe160a620
add dword [ebp - 0x34], 0x6aeb9e0e
mov dword [ebp - 0x30], 0xcc8e749e
add dword [ebp - 0x30], 0x33718b62
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4829cb04
add dword [ebp - 0x3c], 0x2c489e52
mov dword [ebp - 0x38], 0x43af960
sub dword [ebp - 0x38], 0xc2ce97eb
mov dword [ebp - 0x34], 0x8972b3a3
sub dword [ebp - 0x34], 0x26034737
mov dword [ebp - 0x30], 0xb46f407c
add dword [ebp - 0x30], 0x4b90bf84
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x39e2dba8
sub eax, 0x399f18b8
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x47055
push 0
call eax
mov ecx, 0x124056df
add ecx, 0xedbff586
mov ebx, eax
mov esi, 0x475600
add esi, dword [ebp - 0x2c]
mov edx, 0x4cefaf06
sub dword [ebp - 0x28], esi
mov edi, dword [esi]
add dword [ebp - 8], 0xd4e2a428
xor edi, edx
xor dword [ebp - 0x10], 0xd4999fc1
mov dword [ebx], edi
add dword [ebp - 0x18], edx
add ebx, 0x1ae01d09
sub ebx, 0x1ae01d05
add esi, 4
loop 0x434c7d
add eax, 0x8c59f916
add eax, 0x73a72b51
mov ebx, eax
add eax, 5
mov ecx, 0xd80e50aa
add ecx, 0x2831af56
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4e91c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x93000]
push edi
jmp 0x4e91da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e91e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e91d0
mov eax, 1
add ebx, ebx
jne 0x4e91f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e9204
jne 0x4e9223
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9223
dec eax
add ebx, ebx
jne 0x4e9210
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e91e8
add ebx, ebx
jne 0x4e921f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e9275
xor ecx, ecx
sub eax, 3
jb 0x4e923b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e92aa
sar eax, 1
mov ebp, eax
jmp 0x4e9246
add ebx, ebx
jne 0x4e9246
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9214
inc ecx
add ebx, ebx
jne 0x4e9254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9214
add ebx, ebx
jne 0x4e9261
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e9256
jne 0x4e9272
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e9256
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e9294
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e9286
jmp 0x4e91d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e9294
add edi, ecx
jmp 0x4e91d6
pop esi
mov edi, esi
mov ecx, 0x3ed3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e92b2
cmp byte [edi], 0x11
jne 0x4e92b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e92b7
lea edi, [esi + 0xe2000]
mov eax, dword [edi]
or eax, eax
je 0x4e932f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfd02c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfd1a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e92e4
mov ecx, edi
jns 0x4e9313
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfd1ac]
or eax, eax
je 0x4e9329
mov dword [ebx], eax
add ebx, 4
jmp 0x4e9301
call dword [esi + 0xfd1bc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e9360
cmp al, 0xef
ja 0x4e9353
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e9335
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e9342
mov ebp, dword [esi + 0xfd1b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e9394
sub esp, 0xffffff80
jmp 0x427dcd
Function at 0x40bfb0
Capabilities:
Encode data using xor

Disassembly:
aaa
jl 0x40c010
push ebp
mov ebx, 0xc9f59696
in al, 0x67
xchg esp, eax
or bl, byte [eax]
push ds
aam 0x8c
mov edx, 0x71c18cfa
add dword [ecx], edx
les esi, [ebx]
hlt
jnp 0x40bffd
jae 0x40c08c
aad 0x9b
or dword [esp + ecx*8 - 0x40], 0x5887191e
mov esp, 0x7de3a00
mov ch, 0x1b
pop edx
and ecx, dword [esp + ecx]
or dword [edi], 0xffffff8f
or dword [0x596028d], 0x6a
sbb eax, 0xfbb5bc3
idiv dword [ebx - 0xf011e31]
push edi
in eax, dx
cld
add edi, ecx
stosd dword es:[edi], eax
int1
mov dl, 0x6b
push esi
cdq
fxch st(3)
and eax, ebp
into
shr byte [edi], 1
iret

Function at 0x40c974
Capabilities:
Encode data using xor

Disassembly:
adc byte [esi], ah
fiadd word [edi + 0x62f4d690]
xchg ebx, eax
add al, byte [eax - 1]
mov cl, 0x2e
clc
mov bl, byte [edi + 0x74764d39]
jge 0x40c911
in al, dx
lodsb al, byte [esi]
inc esp
add al, 0x8b
xor edi, dword [esi]
or dword fs:[edx + ecx], ecx
jle 0x40c983
wait
push ebx
adc esi, dword [ecx]
add dword [eax - 0x21ec4142], esi
aas
pop ecx
aas
mov edx, 0x1e3635e9
jnp 0x40c96a
imul dword [0x3244f9af]
add dh, dl
cdq
sub al, 0xaa
jb 0x40ca27
pop edi
ficom word [edx - 0x23]
dec esp
jl 0x40ca36
sbb eax, dword [esi - 0x17945061]
sahf
salc
mov edx, dword [edx]
cmp ch, 0x4a
sbb dword [edi - 0x30c567d3], ebx
sahf
ret 0x2963
cmp eax, 0x49cbd26f
arpl word [ebx + 0x1bf8016], sp
add ah, bh
invalid
Function at 0x40eac7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebp
push edi
mov ebp, ecx
xor edi, edi
inc edi
mov dword [esp + 0x14], ebp
mov dword [esp + 8], edi
cmp dword [ebp + 4], edi
jle 0x40eb75
push ebx
lea ebx, [ebp + 0x28]
push esi
mov dword [esp + 0x14], ebx
lea eax, [ebx + 2]
xor esi, esi
mov dword [esp + 0x18], eax
lea edi, [esp + 0x20]
mov ebp, eax
push 4
add edi, esi
pop ebx
movzx eax, byte [ebp + 1]
movzx ecx, byte [ebp - 1]
mov dl, byte [esi + eax*4 + 0x447dc0]
movzx eax, byte [ebp - 2]
xor dl, byte [esi + ecx*4 + 0x4475c0]
xor dl, byte [esi + eax*4 + 0x4471c0]
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
xor dl, byte [esi + eax*4 + 0x4479c0]
mov byte [edi], dl
lea edi, [edi + 4]
sub ebx, 1
jne 0x40eaff
mov eax, dword [esp + 0x18]
inc esi
cmp esi, 4
jl 0x40eaf4
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push 0x10
push eax
push ebx
call fcn.0041f750
mov edi, dword [esp + 0x1c]
add esp, 0xc
mov ebp, dword [esp + 0x1c]
inc edi
add ebx, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
cmp edi, dword [ebp + 4]
jl 0x40eaeb
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x20
ret
Function at 0xbc03dde
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [edi + 0x3c]
add ecx, edi
movzx edx, word [ecx + 0x14]
push esi
lea esi, [edx + ecx + 0x18]
movzx edx, word [ecx + 6]
xor eax, eax
test edx, edx
jbe 0xbc03e0c
lea ecx, [esi + 0x10]
mov esi, dword [ecx]
test esi, esi
je 0xbc03e06
mov eax, dword [ecx + 4]
add eax, esi
add eax, edi
add ecx, 0x28
dec edx
jne 0xbc03df9
sub eax, edi
pop esi
ret
Function at 0x4043e0
Capabilities:
Get proxy
Set registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp]
test ecx, ecx
je 0x4044b2
test eax, eax
jne 0x4044b2
mov eax, dword [esp + 8]
push esi
test eax, eax
je 0x404466
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 4]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push str.ProxyServer
push ecx
call esi
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push str.ProxyEnable
push eax
mov dword [esp + 0x24], 1
call esi
jmp 0x404485
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push str.ProxyEnable
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 0
push 0
push 0x27
push 0
call esi
push 0
push 0
push 0x25
push 0
call esi
mov eax, 1
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x404cd0
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x50], edi
jne 0x404d6a
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + 0x54]
cmp eax, edi
je 0x404d0e
mov ebp, dword [esp + 0x14]
mov ecx, eax
mov eax, dword [eax]
cmp ebp, 0xffffffff
jne 0x404cfd
mov dword [ecx + 0x1c], edi
jmp 0x404d0a
mov ebx, dword [ecx + 0x18]
xor edx, edx
cmp ebx, ebp
setne dl
mov dword [ecx + 0x1c], edx
cmp eax, edi
jne 0x404cef
mov eax, dword [esi + 0x54]
mov dword [esi + 0x50], 1
cmp eax, edi
mov dword [esi + 0x58], edi
jle 0x404d6a
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
call fcn.0041d305
mov ecx, dword [esi + 0x1c]
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
mov edx, dword [esi + 0x3c]
add esp, 4
add edx, 0x50
mov dword [eax], edx
mov ecx, dword [esi + 0x3c]
push 0
push 0
push eax
push 0x4033b0
add ecx, 0x6c
push 0
push 0
mov dword [eax + 0xc], ecx
call ebx
push eax
call ebp
mov eax, dword [esi + 0x54]
inc edi
cmp edi, eax
jl 0x404d2b
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x412929
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x448fc0
cmp edx, dword [eax]
je 0x41294b
add eax, 8
inc ecx
cmp eax, 0x449050
jl 0x41293c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x448fc0]
jne 0x412a79
mov eax, dword [0x44da7c]
cmp eax, 1
je 0x412a53
test eax, eax
jne 0x41297c
cmp dword [0x448644], 1
je 0x412a53
cmp edx, 0xfc
je 0x412a79
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4129b3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00411030
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e120
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4129f6
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e120
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43e3cc
push edi
call fcn.004159b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00411030
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00411040
lea eax, [ebp - 0xa0]
push 0x43e3ac
push eax
call fcn.00411040
push dword [esi + 0x448fc4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00411040
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00415925
add esp, 0x2c
pop edi
jmp 0x412a79
lea eax, [ebp + 8]
lea esi, [esi + 0x448fc4]
push 0
push eax
push dword [esi]
call fcn.0040e120
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41aac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040e460
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41ab8b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41ab8b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41ab3e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41ab49
or bh, 8
and edi, 0x8000000
je 0x41ab64
mov eax, dword [0x44f23c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41ab8b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret