joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ed1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404914
mov edi, dword [ebp + 8]
add edi, 0xffffff00
xor eax, eax
push ebp
push 0x44ee2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x83
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00404724
test eax, eax
jle 0x44edfd
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
add eax, 0x7d
xor edx, edx
push edx
push eax
lea eax, [ebx + 1]
cdq
call fcn.00405250
mov ebx, eax
mov eax, dword [ebp - 0x18]
add eax, 0x7d
xor edx, edx
push edx
push eax
xor eax, eax
mov al, byte [edi + ebx]
add eax, esi
cdq
call fcn.00405250
mov esi, eax
mov al, byte [edi + ebx]
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
mov byte [edi + esi], al
xor eax, eax
mov al, byte [edi + ebx]
xor edx, edx
mov dl, byte [edi + esi]
add eax, edx
mov edx, dword [ebp - 0x18]
add edx, 0x7d
mov ecx, edx
xor edx, edx
div ecx
mov al, byte [edi + edx]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx - 1]
mov cl, byte [ebp - 0xd]
xor dl, cl
call fcn.0040464c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
call fcn.0040472c
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x44ed77
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004044b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ee35
lea eax, [ebp - 0x20]
call fcn.00404464
lea eax, [ebp - 0x14]
call fcn.00404464
lea eax, [ebp - 4]
call fcn.00404464
ret

Function at 0x44fc20
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404b44
test esi, esi
jne 0x44fc57
push 0x20a
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404c30
jmp 0x44fc7e
call sub.kernel32.dll_GetCommandLineW
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0044f9f0
mov dword [esp], eax
test esi, esi
je 0x44fc7e
mov eax, dword [ebx]
xor edx, edx
call fcn.00404cbc
je 0x44fc7e
dec esi
jmp 0x44fc5f
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x19f460b6
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5cac42dc
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Check for time delay via gettickcount
Check for unmoving mouse cursor
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403008]
cmp eax, 0
jne 0x401021
mov eax, dword [0x40300c]
cmp eax, 0
jne 0x401021
jmp 0x4010b6
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401021
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jl 0x401021
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401021
mov eax, dword [0x403008]
cmp eax, 0
je 0x401093
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401067
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
je 0x401021
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
je 0x401067
mov eax, dword [0x40300c]
cmp eax, 0
je 0x4010b6
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401093
cmp eax, dword [ebp - 0x14]
je 0x401093
push dword [section.data]
mov eax, 0x40301a
mov ebx, 0x40322a
sub ebx, eax
push ebx
push 0x40301a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
push dword [0x403004]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push dword [eax]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
cmp al, 0x2d
int 0
add byte [esp + ecx - 0x43ffff30], bh
invalid
Function at 0x4012a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403df4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403df0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], str.cognomen
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403df0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.invocatory
push str.cognomen
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403df8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40136d
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401354
mov eax, dword [0x403df4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10

Function at 0x430002
Capabilities:
Check for vm using instruction vpcext
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x578f5a79
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x4ccf504b
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401a20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402cb0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402cb0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x77a39c]
test esi, esi
jle 0x401b80
mov eax, dword [0x77a3a0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401ab0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401b2f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401aa0
mov dword [esp], ebx
call fcn.004023f0
mov edi, eax
test eax, eax
je 0x401ba7
mov eax, dword [0x77a3a0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402500
mov edx, dword [0x77a3a0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b87
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401b28
sub eax, 4
and eax, 0xfffffffb
jne 0x401b36
add dword [0x77a39c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x77a3a0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401b28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401a20
xor esi, esi
jmp 0x401aba
mov eax, dword [0x77a3a0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401a20
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401a20
lea esi, [esi]
nop
Function at 0x402060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x77a3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x77a3b0]
sub esp, 4
test ebx, ebx
je 0x4020b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020ae
test esi, esi
je 0x4020ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402090
mov dword [esp], 0x77a3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x217223e8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1842550d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4010bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010d2
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4010e4
xor eax, eax
jmp 0x401116
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401108
cmp esi, eax
jae 0x4010e0
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010fa
cmp esi, eax
jae 0x4010e0
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x401235
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push 0x481814
push 1
xor ebx, ebx
push ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401260
mov bl, 1
jmp 0x401266
mov dword [edi + 0xf4], esi
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x402ee5
Capabilities:
Check if file exists
Delete file
Get file size
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], 0xfeff
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
test eax, eax
push esi
push 0x80
jne 0x402f3b
push 1
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push esi
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402f84
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 3
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402f84
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, esi
push esi
jne 0x402f88
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
leave
ret
lea eax, [ebp - 0x20]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [ebp - 0x1c]
cmp ax, word [ebp - 8]
je 0x402f7a
push dword [ebp + 8]
lea eax, [ebp - 0x22c]
push eax
call fcn.0044da22
lea eax, [ebp - 0x22c]
push 0x483184
push eax
call fcn.0044d9f8
add esp, 0x10
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x22c]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0xc]
push ecx
push 2
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x18], eax
call edi
push ebx
call fcn.004637f6
mov dword [ebp - 0x14], eax
lea eax, [ebx + ebx]
push eax
mov dword [ebp - 0x24], eax
call fcn.004637f6
pop ecx
pop ecx
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp + 8]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp - 0x14]
call fcn.004637fb
push dword [ebp - 0x10]
call fcn.004637fb
pop ecx
pop ecx
jmp 0x402f83
Function at 0x4032b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax]
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], 0x10
mov eax, dword [ebp + 0xc]
xor ecx, dword [eax]
mov dword [ebp - 4], ecx
call fcn.00403271
add dword [ebp + 0xc], 4
xor eax, edi
dec dword [ebp + 8]
mov edi, dword [ebp - 4]
mov ecx, eax
jne 0x4032d5
mov eax, dword [esi + 0x40]
xor eax, ecx
mov ecx, dword [esi + 0x44]
xor ecx, edi
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
leave
ret

Function at 0x403308
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x44]
mov dword [ebp + 8], 0x10
xor ecx, dword [edi]
mov dword [ebp - 4], ecx
call fcn.00403271
xor eax, ebx
mov ebx, dword [ebp - 4]
sub edi, 4
dec dword [ebp + 8]
mov ecx, eax
jne 0x403326
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
xor eax, ecx
mov ecx, dword [esi]
xor ecx, ebx
pop edi
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
pop esi
mov dword [ecx], eax
pop ebx
leave
ret

Function at 0x403357
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov eax, 0x481eb8
lea ecx, [edi + 0x48]
pop ebx
mov edx, 0x100
mov esi, dword [eax]
mov dword [ecx], esi
add eax, ebx
add ecx, ebx
dec edx
jne 0x403373
cmp eax, 0x482eb8
jl 0x40336e
mov edx, 0x481e70
xor ecx, ecx
mov eax, edi
sub edx, edi
mov dword [ebp - 4], 0x12
xor esi, esi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
movzx ebx, byte [ecx + ebx]
shl esi, 8
or esi, ebx
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x4033b0
xor ecx, ecx
dec dword [ebp - 8]
jne 0x40339c
mov ebx, dword [edx + eax]
xor ebx, esi
mov dword [eax], ebx
push 4
pop ebx
add eax, ebx
dec dword [ebp - 4]
jne 0x403397
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.004032b7
mov eax, dword [ebp - 4]
mov dword [edi + esi*4], eax
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [edi + esi*4 + 4], eax
inc esi
inc esi
cmp esi, 0x12
jl 0x4033ce
lea esi, [edi + 0x4c]
mov dword [ebp - 0xc], ebx
mov ebx, 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.004032b7
mov eax, dword [ebp - 4]
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esp, 0xc
add esi, 8
dec ebx
jne 0x4033fe
dec dword [ebp - 0xc]
jne 0x4033f9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039e1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [ebp + 0x18]
push ebx
push esi
xor esi, esi
add eax, eax
push edi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.004637f6
mov ebx, dword [ebp + 8]
cmp ebx, esi
pop ecx
mov dword [ebp - 0x10], eax
je 0x403a44
push ebx
call fcn.0044d870
lea eax, [eax + eax + 2]
push eax
call fcn.004637f6
push ebx
mov dword [ebp - 4], eax
xor edi, edi
call fcn.0044d870
add esp, 0xc
movsx ax, byte [edi + ebx]
mov ecx, dword [ebp - 4]
mov word [ecx + edi*2], ax
push ebx
inc edi
call fcn.0044d870
cmp edi, eax
pop ecx
jbe 0x403a2c
mov ebx, dword [ebp + 0xc]
cmp ebx, esi
je 0x403a81
push ebx
call fcn.0044d870
lea eax, [eax + eax + 2]
push eax
call fcn.004637f6
push ebx
mov dword [ebp - 8], eax
xor edi, edi
call fcn.0044d870
add esp, 0xc
movsx ax, byte [edi + ebx]
mov ecx, dword [ebp - 8]
mov word [ecx + edi*2], ax
push ebx
inc edi
call fcn.0044d870
cmp edi, eax
pop ecx
jbe 0x403a69
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004014a9
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], esi
je 0x403ae2
push dword [ebp + 0x10]
lea ecx, [ebp - 0x64]
call fcn.00403846
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004047e4
pop ecx
pop ecx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401a50
push esi
push ebx
lea ecx, [ebp - 0x80]
call fcn.0040155a
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040155a
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x403adf
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x64]
call fcn.00403846
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004047e4
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040155a
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x403b12
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [ebp - 4], esi
mov edi, eax
je 0x403b38
push dword [ebp - 4]
call fcn.004637fb
pop ecx
cmp dword [ebp - 8], esi
je 0x403b46
push dword [ebp - 8]
call fcn.004637fb
pop ecx
push esi
push esi
push dword [ebp + 0x18]
lea eax, [edi + 1]
push dword [ebp + 0x14]
push eax
push dword [ebp - 0x10]
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x10]
call fcn.004637fb
pop ecx
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040155a
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040155a
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c74
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
cmp byte [0x4a174c], 0
push ebx
push esi
mov esi, 0x4a1540
mov ebx, 0x4a1330
jne 0x403dac
push edi
lea eax, [ebp - 4]
push eax
push 0x1a
xor edi, edi
push edi
mov byte [0x4a174c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
lea eax, [ebp - 0x248]
jne 0x403d09
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x403d15
push edi
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x403d15
lea eax, [ebp - 0x248]
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402bb5
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004046ef
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0040287e
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x403d4a
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0040d5c1
push dword [0x49e1f0]
push esi
call fcn.0040d5cb
push esi
push ebx
call fcn.0040d5c1
push esi
mov edi, 0x4a1438
push edi
call fcn.0040d5c1
push esi
push 0x4a1648
call fcn.0040d5c1
push 0x483470
push esi
call fcn.0040d5cb
push 0x48345c
push ebx
call fcn.0040d5cb
push 0x483454
push edi
call fcn.0040d5cb
add esp, 0x40
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.0040155a
pop edi
cmp byte [ebp + 8], 0
mov eax, esi
jne 0x403db6
mov eax, ebx
pop esi
pop ebx
leave
ret