joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429ab0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea ebx, [eax + 1]
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c71b1
mov edi, eax
add esp, 4
test edi, edi
je 0x429b01
push ebx
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, edi
call fcn.004299a0
push edi
mov esi, eax
call fcn.004c716b
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x429c40
Capabilities:
Enumerate gui resources
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.Shell_TrayWnd
mov byte [ebp - 1], 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x429c65
push 0x576b30
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 1]
push eax
push 0x429be0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x42a020
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x100
test eax, eax
jne 0x42a054
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42a068
lea ecx, [ebp - 0x204]
push ecx
push eax
push dword [0x576b48]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x1000
call fcn.004c71b1
mov esi, eax
add esp, 4
test esi, esi
je 0x42a0d3
lea eax, [ebp + 0x10]
push eax
push 0
lea eax, [ebp - 0x204]
push eax
push 0x7ff
push esi
call fcn.00407020
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004cde3d
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x42a0b9
cmp eax, 0x7ff
ja 0x42a0b9
jne 0x42a0c2
xor eax, eax
mov word [esi + 0xffe], ax
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.004c716b
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004c715a
mov esp, ebp
pop ebp
ret
Function at 0x42a170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x18c
mov dword [ebp - 0x194], eax
xor edi, edi
lea eax, [ebp - 0x190]
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0x198], ebx
call fcn.004ca440
add esp, 0xc
push 5
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x42a210
lea ebx, [ebp - 0x18c]
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x19c], eax
test eax, eax
je 0x42a201
push dword [ebp - 0x194]
push eax
push dword [ebp - 0x198]
call fcn.004210a0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x42a201
mov eax, dword [ebp - 0x19c]
inc edi
mov dword [ebx - 4], esi
mov dword [ebx], eax
mov dword [ebx + 4], ecx
add ebx, 0xc
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x42a1c3
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
je 0x42a25d
lea esi, [ebp - 0x190]
mov ebx, edi
cmp dword [esi + 8], 0xffffffff
jne 0x42a232
push 0
push dword [esi]
call eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
add esi, 0xc
sub ebx, 1
jne 0x42a221
test edi, edi
je 0x42a25d
lea esi, [ebp - 0x190]
cmp dword [esi + 8], 1
jne 0x42a250
push 5
push dword [esi]
call eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
add esi, 0xc
sub edi, 1
jne 0x42a244
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c715a
mov esp, ebp
pop ebp
ret

Function at 0x42a270
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov bx, word [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 4], ecx
mov edx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov dword [ebp - 8], esi
mov edi, esi
cmp word [esi], 0
je 0x42a2ee
mov esi, ecx
cmp word [edi + 2], bx
je 0x42a2b1
movzx eax, word [edi]
push eax
push esi
call edx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [sym.imp.USER32.dll_GetDlgItem]
add edi, 4
cmp word [edi], 0
jne 0x42a295
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [esi], 0
je 0x42a2ee
cmp word [esi + 2], bx
jne 0x42a2dc
movzx eax, word [esi]
push eax
push ecx
call edx
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
add esi, 4
mov edx, dword [sym.imp.USER32.dll_GetDlgItem]
cmp word [esi], 0
jne 0x42a2c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a440
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], edx
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x214], 0
call fcn.004ca440
add esp, 0xc
mov dword [ebp - 0x210], 0
test esi, esi
jne 0x42a4a4
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea esi, [ebp - 0x20c]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x42a536
push edi
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x42a523
push edi
push ebx
push dword [ebp - 0x210]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42a513
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x52e1dc
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0x218]
mov eax, dword [ecx + 8]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xc]
mov dword [edx], eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c715a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004c715a
mov esp, ebp
pop ebp
ret

Function at 0x42a550
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 1
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42a5b3
call edi
mov esi, eax
cmp esi, 0x3f0
jne 0x42a5af
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42a5b3
call edi
mov esi, eax
test esi, esi
jne 0x42a5eb
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call edi
mov esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42a5f9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004c715a
mov esp, ebp
pop ebp
ret
Function at 0x42a810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x576b48]
test esi, 0xffff0000
jne 0x42a85d
push str.RT_HELP_TEXT
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42a87e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42a87e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
jmp 0x42a862
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test esi, esi
je 0x42a87e
test eax, eax
je 0x42a87e
push ecx
mov edx, eax
mov ecx, esi
call fcn.0042a740
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x576b00]
mov dword [ebp - 4], ecx
push ebx
mov ebx, edx
push esi
test eax, eax
jne 0x42a8dd
push 0x7f8a
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x576b00], eax
test eax, eax
jne 0x42a8dd
push 0x533888
push 0x533808
push 0x20
push 0x20
push eax
push 5
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_CreateCursor]
mov dword [0x576b00], eax
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 1
push 0
push 0
push ebx
push str.open
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42a910
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x551764]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x470], 0x44
xorps xmm0, xmm0
mov esi, edx
push 0
push eax
movups xmmword [ebp - 0x428], xmm0
call fcn.004ca440
add esp, 0xc
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42a972
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c715a
mov esp, ebp
pop ebp
ret
push esi
push str.explorer.exe__select___s_
lea eax, [ebp - 0x418]
push 0x208
push eax
call fcn.00407130
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x470]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42a9eb
mov eax, dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42a9cc
push eax
call esi
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x42a9f3
push eax
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c715a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004c715a
mov esp, ebp
pop ebp
ret
Function at 0x42aa80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push edi
mov ebx, 0xc0000001
mov esi, 0x20
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.desktop.ini
push eax
call fcn.004ce01a
add esp, 8
mov ecx, 0x26
test eax, eax
mov eax, dword [ebp - 4]
cmove esi, ecx
push 0
push 0
push 3
push 0
push 0
push 0x100
push edi
mov dword [eax + 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42aaf5
push 4
push 0x28
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.Ntdll.dll_NtSetInformationFile]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test ebx, ebx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ac30
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov edi, ecx
mov dword [ebp - 4], 0
push eax
push edi
mov ebx, edx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x42ac98
mov eax, dword [ebp - 8]
mov esi, 0x576b20
or eax, dword [ebp - 4]
je 0x42ac98
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x42ac98
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x42aca7
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebx], ecx
mov dword [ebx + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ae30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
add edx, esi
lea eax, [esi + 0x40]
cmp eax, edx
jb 0x42ae47
mov eax, 0xb
pop esi
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x42ae3f
push edi
mov edi, dword [esi + 0x3c]
lea ecx, [edi + esi]
lea eax, [ecx + 0x18]
cmp eax, edx
jae 0x42aede
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, edi
add eax, esi
cmp eax, edx
jae 0x42aede
cmp dword [ecx], 0x4550
jne 0x42aede
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42aea6
mov eax, dword [ebp + 8]
test eax, eax
je 0x42ae8a
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42ae93
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42aea0
mov dword [eax], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
cmp dword [ecx], 0x4550
jne 0x42aede
mov eax, 0x20b
cmp word [ecx + 0x18], ax
jne 0x42aede
mov eax, dword [ebp + 8]
test eax, eax
je 0x42aec2
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42aecf
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42aed8
mov dword [eax], ecx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 0xb
pop esi
pop ebp
ret
Function at 0x42aef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
add edx, edi
lea eax, [edi + 0x40]
cmp eax, edx
jae 0x42afe6
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x42afe6
mov ebx, dword [edi + 0x3c]
lea ecx, [ebx + edi]
lea eax, [ecx + 0x18]
cmp eax, edx
jae 0x42afe6
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ebx
add eax, edi
cmp eax, edx
jae 0x42afe6
cmp dword [ecx], 0x4550
jne 0x42afe6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42af70
mov edx, dword [ecx + 0x54]
lea ebx, [ecx + 0x18]
movzx eax, word [ecx + 0x14]
add edx, edi
movzx edi, word [ecx + 6]
add ebx, eax
cmp dword [ecx + 0x74], 0xe
jbe 0x42afa4
lea esi, [ecx + 0xe8]
jmp 0x42afa4
cmp dword [ecx], 0x4550
jne 0x42afe6
mov eax, 0x20b
cmp word [ecx + 0x18], ax
jne 0x42afe6
mov edx, dword [ecx + 0x54]
lea ebx, [ecx + 0x18]
movzx eax, word [ecx + 0x14]
add edx, edi
movzx edi, word [ecx + 6]
add ebx, eax
cmp dword [ecx + 0x84], 0xe
jbe 0x42afa4
lea esi, [ecx + 0xf8]
movzx eax, di
lea eax, [eax + eax*4]
lea eax, [ebx + eax*8]
cmp eax, edx
jae 0x42afe6
test esi, esi
je 0x42afc3
lea eax, [esi + 8]
cmp eax, edx
jae 0x42afe6
xor eax, eax
cmp dword [esi], eax
cmove esi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42afcc
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x42afd6
mov word [eax], di
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x42afdf
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xb
pop ebx
pop ebp
ret

Function at 0x42b750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [ebp - 4], 0
cmp byte [0x576ade], al
mov ecx, 0x100
mov dword [ebp - 8], 0
cmovne eax, ecx
lea ecx, [ebp - 4]
push ecx
or eax, 1
push eax
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42b7b6
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push str.ProductId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42b9f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x576f80]
test esi, esi
jne 0x42ba38
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ebx, dword [ebp - 4]
inc ebx
push ebx
push 8
push dword [0x576b44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x42ba37
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
pop ebx
mov eax, dword [0x576b34]
mov dword [0x576f80], esi
test eax, eax
je 0x42ba4e
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x42ba50
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42bb10
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, ecx
mov dword [ecx + 0x9c0], ecx
mov ebx, 0xe3
mov dword [ecx + 0x9c4], 0x270
mov dword [ebp - 4], 0xe3
nop word [eax + eax]
mov esi, dword [eax]
mov edx, dword [eax + 4]
xor esi, edx
and esi, 0x7ffffffe
and dl, 1
xor esi, dword [eax]
shr esi, 1
movzx ecx, dl
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor esi, ecx
xor esi, dword [eax + 0x634]
mov dword [eax], esi
add eax, 4
sub ebx, 1
jne 0x42bb40
mov ebx, dword [ebp - 4]
mov esi, dword [eax]
lea eax, [eax + 4]
mov edx, dword [eax]
xor esi, edx
and esi, 0x7ffffffe
and dl, 1
xor esi, dword [eax - 4]
shr esi, 1
movzx ecx, dl
neg ecx
sbb ecx, ecx
inc ebx
and ecx, 0x9908b0df
xor esi, ecx
xor esi, dword [eax - 0x390]
mov dword [eax - 4], esi
cmp ebx, 0x26f
jb 0x42bb76
mov edx, dword [ebp - 8]
pop edi
mov edx, dword [edx]
mov esi, edx
xor esi, dword [eax]
and dl, 1
and esi, 0x7ffffffe
movzx ecx, dl
xor esi, dword [eax]
shr esi, 1
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor esi, ecx
xor esi, dword [eax - 0x38c]
mov dword [eax], esi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c0f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
xor edx, edx
and dword [ebp + 0xc], 1
mov dword [ebp + 8], edi
je 0x42c11f
cmp edi, 0x104
mov eax, 4
cmovae edx, eax
lea eax, [edx + edi]
lea eax, [eax*2 + 2]
push eax
push 8
push dword [0x576b44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x42c1fc
lea ecx, [edi + 1]
push ecx
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 0xc], 0
lea ecx, [edi + edi]
mov esi, ebx
lea edi, [ecx + ebx]
je 0x42c1ac
cmp dword [ebp + 8], 0x104
jb 0x42c1ac
cmp word [ebx], 0x5c
jne 0x42c18e
cmp word [ebx + 2], 0x5c
jne 0x42c18e
movzx eax, word [ebx + 4]
cmp eax, 0x2e
je 0x42c180
cmp eax, 0x3f
jne 0x42c18e
cmp word [ebx + 6], 0x5c
jne 0x42c18e
lea eax, [ebx + 8]
cmp eax, ebx
jne 0x42c1ac
push ecx
lea eax, [ebx + 8]
push ebx
push eax
call fcn.004c97a0
add esp, 0xc
mov dword [ebx], 0x5c005c
mov dword [ebx + 4], 0x5c003f
add edi, 8
cmp ebx, edi
jae 0x42c1d1
cmp word [esi], 0x20
jne 0x42c1bf
add esi, 2
cmp esi, edi
jb 0x42c1b0
jmp 0x42c1d1
cmp esi, edi
jae 0x42c1d1
cmp word [edi - 2], 0x20
jne 0x42c1d1
add edi, 0xfffffffe
cmp esi, edi
jb 0x42c1c3
mov ecx, dword [ebp - 4]
xor eax, eax
push eax
push esi
mov word [edi], ax
call fcn.00420fd0
push ebx
push 0
push dword [0x576b44]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42cdc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
movsx eax, bl
push esi
mov dword [ebp - 4], edx
xor esi, esi
mov edx, dword [ebp + 8]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
push edi
mov edi, ecx
test edx, edx
je 0x42ce62
mov ecx, dword [ebp - 4]
cmp edx, 0x20
jb 0x42ce47
lea eax, [edx - 1]
add eax, edi
cmp ecx, eax
ja 0x42ce08
lea eax, [ecx - 1]
add eax, edx
cmp eax, edi
jae 0x42ce47
mov eax, edx
mov edx, edi
and eax, 0xffffffe0
sub edx, ecx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, ecx
mov ecx, dword [ebp - 8]
nop
movups xmm0, xmmword [ecx + eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [edi + esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
cmp esi, dword [ebp - 0xc]
jb 0x42ce20
mov ecx, dword [ebp - 4]
cmp esi, edx
jae 0x42ce62
sub edi, ecx
lea eax, [esi + ecx]
sub edx, esi
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, bl
mov byte [eax - 1], cl
sub edx, 1
jne 0x42ce52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42ce70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
and edi, 0xfffffff8
mov dword [esp + 0x10], edx
mov esi, edi
mov dword [esp + 0x14], edi
shr esi, 3
xor ecx, ecx
mov dword [esp + 0x24], 0x31313131
mov dword [esp + 0x20], 0x31313131
test esi, esi
je 0x42cf55
cmp esi, 4
jb 0x42cf19
lea eax, [ebx - 8]
lea eax, [eax + esi*8]
cmp edx, eax
ja 0x42cec4
lea eax, [edx - 8]
lea eax, [eax + esi*8]
cmp eax, ebx
jae 0x42cf19
movq xmm1, qword [esp + 0x20]
mov eax, esi
and eax, 0xfffffffc
punpcklqdq xmm1, xmm1
mov edi, ebx
mov dword [esp + 0x1c], eax
sub edi, edx
lea eax, [edx + 0x10]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
nop word [eax + eax]
movups xmm0, xmmword [ebx + ecx*8]
add ecx, 4
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [edx + eax - 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp ecx, dword [esp + 0x1c]
jb 0x42cef0
mov edx, dword [esp + 0x10]
cmp ecx, esi
jae 0x42cf55
mov edi, ebx
lea edx, [edx + ecx*8]
sub edi, dword [esp + 0x10]
sub esi, ecx
nop dword [eax + eax]
mov ecx, dword [edx + edi]
lea edx, [edx + 8]
mov eax, dword [edx + edi - 4]
xor ecx, dword [esp + 0x20]
xor eax, dword [esp + 0x24]
mov dword [edx - 8], ecx
mov dword [edx - 4], eax
sub esi, 1
jne 0x42cf30
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 8]
lea ecx, [edi + ebx]
sub eax, edi
add edx, edi
push 0x31
push eax
call fcn.0042cdc0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret