joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.VERSION.DLL_GetFileVersionInfoA
lea edx, [ebp - 8]
lea ecx, [ebp - 0xc]
push edx
push ecx
lea eax, [ebp - 0x818]
push 0x42b3c6
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x401d9a
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [edx + 2]
xor edx, edx
push ecx
mov eax, dword [ebp - 0xc]
mov dl, byte [eax + 3]
xor eax, eax
push edx
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx]
xor ecx, ecx
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov cl, byte [edx + 1]
push ecx
push 0x42b3df
push eax
call sub.USER32.DLL_wsprintfA
add esp, 0x18
cmp dword [ebp - 8], 0
je 0x401d9a
lea edx, [ebp - 0x18]
push edx
push str.StringFileInfo_sFileVersion
push ebx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
lea ecx, [ebp - 8]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x818]
push ecx
push eax
push ebx
push edx
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x401d9a
mov ecx, dword [ebp - 0xc]
push ecx
push 0x42b414
mov eax, dword [ebp + 0xc]
push eax
call sub.USER32.DLL_wsprintfA
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
mov esi, eax
mov eax, 0x42c76c
call fcn.0042875c
mov eax, dword [esi + 0x42c]
call sub.vcl60.bpl__Comctrls_TCustomTreeView_GetSelected_qqrv
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x404c50
cmp dword [ebx], 1
jne 0x404c50
mov eax, dword [ebx + 4]
push eax
push esi
call fcn.004065c4
add esp, 8
mov edx, dword [0x433798]
push edx
call fcn.00419388
pop ecx
push 0
push 0x42b8fd
call sub.USER32.DLL_FindWindowA
mov esi, eax
test eax, eax
jne 0x404c3c
push 0x44
push 0
lea edx, [ebp - 0x6c]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x6c], 0x44
push 0x100
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea eax, [ebp - 0x17c]
push eax
call fcn.004286a9
add esp, 8
mov byte [eax], 0
push str.devtest.exe
lea edx, [ebp - 0x17c]
push edx
call sub.CC3260MT.DLL__strcat
add esp, 8
lea ecx, [ebp - 0x7c]
lea eax, [ebp - 0x6c]
lea edx, [ebp - 0x17c]
push ecx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x42b919
push edx
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x404c2a
call sub.KERNEL32.DLL_GetLastError
mov word [ebp - 0x18], 8
xor ecx, ecx
mov dword [ebp - 4], ecx
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x14
push eax
push str.Failed_to_create_device_test_process___d_
lea eax, [ebp - 4]
push eax
call fcn.00428aa0
add esp, 0xc
push 0x10
mov ecx, 0x42b944
cmp dword [ebp - 4], 0
je 0x404bee
mov edx, dword [ebp - 4]
jmp 0x404bf3
mov edx, 0x42b94d
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.0042880c
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00428908
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
jmp 0x404c59
push 0
call sub.KERNEL32.DLL_Sleep
push 0
push str.HYDevTestFrame
call sub.USER32.DLL_FindWindowA
mov esi, eax
test eax, eax
je 0x404c23
mov edx, dword [ebx + 4]
mov ecx, dword [0x433798]
push edx
push esi
push ecx
call fcn.0041c154
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f18c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffee8
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push eax
push ebx
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f1be
cmp dword [ebp - 8], 0x1000
jb 0x40f1c5
xor eax, eax
jmp 0x40f29f
lea edx, [ebp - 0x1018]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.VERSION.DLL_GetFileVersionInfoA
lea edx, [ebp - 8]
lea ecx, [ebp - 0xc]
push edx
push ecx
lea eax, [ebp - 0x1018]
push str.VarFileInfoTranslation
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40f29d
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [eax + 2]
xor eax, eax
push edx
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx + 3]
xor ecx, ecx
push eax
mov edx, dword [ebp - 0xc]
mov cl, byte [edx]
xor edx, edx
push ecx
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov dl, byte [eax + 1]
push edx
push str._0.2x_0.2x_0.2x_0.2x
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0x18
lea eax, [ebp - 0x18]
push eax
push str.StringFileInfo_sFileDescription
lea edx, [ebp - 0x1118]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
lea ecx, [ebp - 8]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x1118]
push ecx
push eax
push edx
lea ecx, [ebp - 0x1018]
push ecx
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40f29d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov esi, eax
xor eax, eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f2a8
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov byte [ebp - 0x18], dl
test dl, dl
jle 0x40f2bd
call fcn.00428edc
mov ebx, edx
mov dword [ebp - 4], eax
lea esi, [ebp - 0x38]
mov eax, 0x42f540
call fcn.0042875c
mov word [esi + 0x10], 8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Classes_TThread__bctr_qqro
add dword [esi + 0x1c], 2
mov word [esi + 0x10], 0x14
inc dword [esi + 0x1c]
xor eax, eax
mov edi, dword [ebp - 4]
xor edx, edx
add edi, 0x30
xor ecx, ecx
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
xor eax, eax
mov dword [edi + 0xc], eax
lea eax, [edi + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], ecx
xor ecx, ecx
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov word [esi + 0x10], 0x38
inc dword [esi + 0x1c]
inc dword [esi + 0x1c]
lea eax, [edi + 0x20]
xor edx, edx
xor ecx, ecx
mov dword [eax + 8], edx
lea eax, [edi + 0x30]
inc dword [esi + 0x1c]
dec dword [esi + 0x1c]
mov word [esi + 0x10], 0x14
inc dword [esi + 0x1c]
mov dword [eax + 8], ecx
inc dword [esi + 0x1c]
push 0
push edi
call fcn.0040f44c
add esp, 8
inc dword [esi + 0x1c]
inc dword [esi + 0x1c]
dec dword [esi + 0x1c]
mov eax, dword [esi]
mov dword fs:[0], eax
mov eax, dword [ebp - 4]
test bl, bl
je 0x40f373
call fcn.00428ee9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f44c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x42f5b0
push ebx
push esi
push edi
call fcn.0042875c
mov ebx, dword [ebp + 0xc]
inc ebx
lea eax, [ebx + 2]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 8
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x28]
jae 0x40f47d
lea ecx, [ebp - 0x28]
jmp 0x40f480
lea ecx, [ebp - 0x2c]
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x38]
test edi, edi
je 0x40f4b1
mov esi, edi
shl esi, 2
cmp esi, 0x80
jbe 0x40f4a8
push esi
call sub.CC3260MT.DLL___bnew_qui
pop ecx
jmp 0x40f4b3
push esi
call sub.STLPMT45.DLL_Ordinal_524
pop ecx
jmp 0x40f4b3
xor eax, eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x28]
mov ecx, dword [edx + 0x38]
sub ecx, ebx
shr ecx, 1
shl ecx, 2
add eax, ecx
shl ebx, 2
mov dword [ebp - 0x30], eax
add ebx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x34]
push eax
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040f5b0
mov word [ebp - 0x14], 0
add esp, 0xc
jmp 0x40f553
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx + 4], edx
add edx, 0x30
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x34]
add eax, 0x10
add edx, 0xfffffffc
mov dword [eax + 0xc], edx
mov ecx, dword [edx]
mov dword [eax + 4], ecx
add ecx, 0x30
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4225d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 0x18], dl
test dl, dl
jle 0x4225ed
call fcn.00428edc
mov ebx, ecx
mov byte [ebp - 0x39], dl
mov dword [ebp - 4], eax
mov eax, 0x432120
call fcn.0042875c
mov word [ebp - 0x28], 8
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00402d18
add dword [ebp - 0x1c], 0x10
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 4]
add ebx, 0x330
mov ecx, esi
lea eax, [esi + 0x10]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov edx, dword [ebp - 0x40]
sub eax, dword [edx + 4]
mov edi, 0x38
cdq
idiv edi
mov edi, eax
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 0xc]
test edx, edx
jns 0x42264e
add edx, 3
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
mov ecx, 0x38
sar edx, 2
mov word [ebp - 0x28], 0x20
add edi, edx
cdq
idiv ecx
inc dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
add edi, eax
xor eax, eax
xor ecx, ecx
mov dword [ebx], eax
mov dword [ebx + 4], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebx + 8], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0xc], ecx
xor ecx, ecx
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
xor ecx, ecx
mov dword [eax + 0xc], ecx
lea eax, [ebx + 0x20]
mov word [ebp - 0x28], 0x44
inc dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [ebx + 0x30]
inc dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
xor ecx, ecx
mov word [ebp - 0x28], 0x20
inc dword [ebp - 0x1c]
mov edx, edi
dec edx
mov dword [eax + 8], ecx
inc dword [ebp - 0x1c]
push edx
push ebx
call fcn.00412490
inc dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x48]
mov edi, ebx
push edx
add esp, 0xfffffff0
mov edx, dword [edi]
lea eax, [esi + 0x10]
mov dword [esp], edx
mov ecx, dword [edi + 4]
mov dword [esp + 4], ecx
mov edx, dword [edi + 8]
mov dword [esp + 8], edx
mov ecx, dword [edi + 0xc]
mov dword [esp + 0xc], ecx
add esp, 0xfffffff0
mov edx, dword [eax]
mov dword [esp], edx
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
mov edx, dword [eax + 8]
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
add esp, 0xfffffff0
mov ecx, dword [esi]
mov dword [esp], ecx
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x58]
mov edx, dword [esi + 8]
mov dword [esp + 8], edx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0xc], ecx
push eax
call fcn.004137a4
add esp, 0x38
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x14
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x39], 0
je 0x422765
call fcn.00428ee9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x428f88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, 0x4336e0
call fcn.0042875c
mov word [ebp - 0x14], 8
mov edx, 0x433700
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
push 0xff
call sub.CC3260MT.DLL___bnwa_qui
pop ecx
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
lea eax, [ebp - 0x124]
push eax
push 0xff
call sub.KERNEL32.DLL_GetTempPathA
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push 0
push 0x433639
lea eax, [ebp - 0x124]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov edx, dword [ebp + 8]
mov byte [edx + 8], 1
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x429228
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
test esi, esi
jne 0x429241
mov esi, dword [ebp + 0x10]
push dword [edi + 4]
push 0
push 0
push esi
call sub.KERNEL32.DLL_WritePrivateProfileStringA
push 0x800
call sub.CC3260MT.DLL___bnwa_qui
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0x800
push dword [ebp - 4]
push 0x4336a5
push 0
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov ebx, dword [ebp - 4]
jmp 0x4292b9
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push 0x100
lea edx, [ebp - 0x104]
push edx
push 0x4336a6
push ebx
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_GetPrivateProfileStringA
push dword [edi + 4]
lea ecx, [ebp - 0x104]
push ecx
push ebx
push esi
call sub.KERNEL32.DLL_WritePrivateProfileStringA
push ebx
call sub.CC3260MT.DLL__strlen
pop ecx
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x42927e
push dword [ebp - 4]
call sub.CC3260MT.DLL___bdla_qpv
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7ba6be
Capabilities:
Encode data using xor

Disassembly:
iretd
jle 0x7ba682
das
cmp al, 0xf1
pop eax
inc edx
cmp eax, 0x8eba62e
add al, ah
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0x7ba6c4
pop ebp
sub ebp, 0x10
sub ebp, 0x3ba6b4
jmp 0x7ba6da
mov eax, 0x3ba6b4
add eax, ebp
add eax, 0x4c
mov ecx, 0x60e
push cs
push es
add byte [eax], al
mov edx, 0x9bffbd69
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ba6f1
jmp 0x7ba704
loop 0x7ba6aa
loop 0x7ba6e8
push ebp
imul ebp, dword [ecx + 0x69], 0x6991a8e8
imul ebp, dword [ecx + 0x6a], 0x696dd1a4
imul ebp, dword [ecx - 0x2d], 0x69696941
call 0x69e538b9
imul ebp, dword [edx - 0x5c], 0x69696dd1
imul edx, ebx, 0x69696941
sahf
mov ebp, dword [edx - 0x5f]
loop 0x7ba70c
imul ebp, dword gs:[ecx + 0x69], 0x3939ac6a
add dword [ecx + 0x1696712], edi
lea eax, [ebx + 0x44]
imul ebp, dword [eax + 0x45], 0x54eb014d
inc edi
iretd
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401443
pop dword [ebp - 0x14]
mov eax, 0x368f0510
add eax, 0xc9b10f33
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x27bf4ed2
add dword [ebp - 0x24], 0x2692f679
mov dword [ebp - 0x20], 0xd40a1f73
sub dword [ebp - 0x20], 0xa1d6d32e
mov dword [ebp - 0x1c], 0xb3e3dfac
sub dword [ebp - 0x1c], 0x67979b7e
mov dword [ebp - 0x18], 0x9123f692
sub dword [ebp - 0x18], 0x9123f692
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xdc560633
sub dword [ebp - 0x24], 0x67e39cdd
mov dword [ebp - 0x20], 0x1cad100c
sub dword [ebp - 0x20], 0xdb40ae97
mov dword [ebp - 0x1c], 0x6f8d48cb
sub dword [ebp - 0x1c], 0xc1ddc5f
mov dword [ebp - 0x18], 0x4d01a307
sub dword [ebp - 0x18], 0x4d01a307
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39b9d
push 0
call eax
mov ecx, 0x98e50ecd
add ecx, 0x671b3e99
xor esi, esi
add esi, eax
mov edi, 0x63b03cc1
sub edi, 0x636abac1
add edi, dword [ebp - 0x14]
mov ebx, 0x887b0392
sub ebx, 0x576c6b54
xor dword [ebp - 4], 0x5291137a
mov edx, dword [edi]
sub edx, ebx
mov dword [ebp - 4], 0x5fd8e7fa
mov dword [esi], edx
add dword [ebp - 8], eax
add esi, 0x725ab012
add esi, 0x8da54ff2
add edi, 0x3c46b9cb
add edi, 0xc3b94639
loop 0x40155d
add eax, 0xbf547138
add eax, 0x40acb733
mov ebx, eax
add eax, 5
mov ecx, 0x56972686
add ecx, 0xa9a8d97a
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b62f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
sub edx, 1
inc edx
call fcn.0043b66e
and edi, edi
and edi, edi
mov edx, 0x1c0a3c16
xor dword [eax], ecx
sub edx, edi
inc eax
push 0xda16eeb3
pop edi
and edx, edi
cmp eax, esi
jne fcn.0043b62f
mov edi, 0x7cb7aa89
push 0xf511c4c3
pop edi
ret

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
sub esp, 0x40
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
add esp, 0x40
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
loop 0x4019da
push esp
mov eax, 0x400000
mov dword [0x403160], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x401719
mov dword [ebp - 4], str.risiliency
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x403160]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.ebsement
push str.risiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403168], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a78
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a5f
pop ebp
ret 0x10
Function at 0x401e2e
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0xa8807c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x368], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401e6e
cmp dword [ebp - 0x364], 6
jne 0x401e6e
cmp dword [ebp - 0x360], 0
je 0x401e98
push str.SetDefaultDllDirectories
push 0xa51598
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401e98
push 0xc00
call eax
test eax, eax
jne 0x401f2d
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x401f2d
cmp eax, 0x104
ja 0x401f2d
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x401ed8
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.UXTHEME], 0
push esi
mov esi, str.UXTHEME
je 0x401f2c
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov edx, edi
mov cl, byte [esi]
inc esi
movzx eax, cl
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x401ef3
push str..dll
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x401ef1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009d62f9
leave
ret
Function at 0x4055b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x405663
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], edx
je 0x405644
push edi
call fcn.0040558e
xor edx, edx
add edi, 0x28
sub ebx, 1
jne 0x405637
cmp dword [esi + 0x5c], ebx
je 0x40565e
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.00405a92
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
push ebx
call fcn.00405550
mov edi, eax
test edi, edi
jne 0x4056df
lea eax, [ebx + 0x20]
push eax
call fcn.004065d7
mov edi, eax
test edi, edi
jne 0x4056df
lea eax, [ebx + 0x1c]
push eax
call fcn.004065d7
mov edi, eax
test edi, edi
jne 0x4056df
push ebx
call fcn.00406490
mov edi, eax
test edi, edi
je 0x4056df
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
push ebx
call fcn.004054d2
add ebx, 0x28
sub esi, 1
jne 0x4056ce
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x4056f3
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x405707
cmp dword [esi + 0x40], edx
jne 0x405707
cmp dword [esi + 0x3c], edx
jne 0x405707
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x4066e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.00a2c046
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x406710
call fcn.004065f6
mov esi, eax
mov eax, esi
pop esi
leave
ret 0xc