joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1109b000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 8], eax
sub eax, ecx
mov dword [ebp - 4], eax
or eax, 0xffffffff
cmp dword [0x1121dacc], 0
jne 0x1109b0f9
xor ebx, ebx
nop dword [eax + eax]
mov ecx, ebx
and cl, 1
movzx edx, cl
mov ecx, ebx
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
and cl, 1
movzx esi, cl
neg esi
sbb esi, esi
shr edx, 1
and esi, 0xedb88320
xor esi, edx
mov ecx, esi
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
shr esi, 1
and edx, 0xedb88320
xor edx, esi
mov ecx, edx
and cl, 1
movzx esi, cl
neg esi
sbb esi, esi
shr edx, 1
and esi, 0xedb88320
xor esi, edx
mov ecx, esi
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
shr esi, 1
and edx, 0xedb88320
xor edx, esi
mov ecx, edx
and cl, 1
movzx esi, cl
neg esi
sbb esi, esi
shr edx, 1
and esi, 0xedb88320
xor esi, edx
mov ecx, esi
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
shr esi, 1
and edx, 0xedb88320
xor edx, esi
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov dword [ebx*4 + 0x1121dac8], ecx
inc ebx
cmp ebx, 0x100
jl 0x1109b030
mov ecx, dword [ebp + 0xc]
lea ebx, [ecx + 4]
xor esi, esi
test ebx, ebx
jle 0x1109b121
mov edi, dword [ebp - 4]
movzx edx, byte [edi + esi - 4]
inc esi
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1121dac8]
cmp esi, ebx
jl 0x1109b105
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
not eax
mov ecx, eax
shr ecx, 0x18
mov byte [edx], cl
mov edx, eax
mov ecx, dword [edi]
shr edx, 0x10
mov byte [ecx + 1], dl
mov edx, eax
mov ecx, dword [edi]
shr edx, 8
mov byte [ecx + 2], dl
mov ecx, dword [edi]
mov byte [ecx + 3], al
add dword [edi], 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1109c860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], 0
test eax, eax
jle 0x1109ca53
mov edx, dword [ebp + 0x10]
xor ecx, ecx
test edx, edx
push edi
lea edi, [eax - 1]
cmovns edi, ecx
or ecx, 0xffffffff
test edx, edx
mov dword [ebp - 0x18], edi
cmovns ecx, eax
mov dword [ebp - 0x2c], ecx
cmp edi, ecx
je 0x1109ca52
mov eax, dword [ebp + 0x20]
mov ecx, edx
imul ecx, dword [ebp + 0x14]
add eax, 3
mov edx, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
imul ecx, esi
mov dword [ebp - 0x28], ecx
mov ecx, edi
imul ecx, dword [ebp + 0x14]
imul ecx, esi
add eax, ecx
mov dword [ebp - 0x1c], eax
nop word [eax + eax]
cmp dword [ebp + 0x14], 0
jle 0x1109ca23
mov edi, eax
lea ecx, [esi - 1]
mov eax, 0xfffffffe
mov dword [ebp - 0x14], ecx
sub eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea esi, [edi - 3]
add esi, ecx
test edx, edx
jns 0x1109c910
push ebx
push 1
push 1
push esi
call fcn.11147d5e
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov edx, dword [ebp + 0x24]
mov eax, esi
cmp ecx, 3
ja case.default.0x1109c91b
jmp dword [ecx*4 + 0x1109ca58]
mov al, byte [edi - 3]
mov byte [ebp - 4], al
mov byte [ebp - 3], al
mov byte [ebp - 2], al
lea eax, [ebp - 4]
jmp 0x1109c9e6
test edx, edx
jne case.0x1109c91b.2
movzx esi, byte [edi]
mov eax, 0x80808081
movzx ecx, byte [edi - 3]
sub ecx, 0xff
imul ecx, esi
imul ecx
add edx, ecx
movzx ecx, byte [edi - 2]
sar edx, 7
mov eax, edx
imul ecx, esi
shr eax, 0x1f
add eax, edx
dec al
mov byte [ebp + 0x18], al
mov eax, 0x80808081
mul ecx
movzx ecx, byte [edi - 1]
mov eax, 0x80808081
sub ecx, 0xff
mov ebx, edx
imul ecx, esi
shr ebx, 7
mov byte [ebp + 0x19], bl
mov byte [ebp - 7], bl
mov ebx, dword [ebp + 8]
imul ecx
push ebx
add edx, ecx
mov ecx, dword [ebp + 0xc]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
dec al
mov byte [ebp + 0x1a], al
lea eax, [ebp + 0x19]
sub eax, ecx
push 1
push 3
movzx eax, byte [eax]
mov byte [ebp - 8], al
movzx eax, byte [ebp + ecx + 0x19]
mov byte [ebp - 6], al
lea eax, [ebp - 8]
jmp 0x1109ca02
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax + edi]
mov byte [ebp - 0xc], al
movzx eax, byte [edi - 2]
mov byte [ebp - 0xb], al
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
lea eax, [ebp - 0xc]
push ebx
push 1
push 3
push eax
call fcn.11147d5e
mov edx, dword [ebp + 0x24]
mov eax, esi
add esp, 0x10
test edx, edx
jle 0x1109ca0e
push ebx
push 1
push 1
push eax
call fcn.11147d5e
mov edx, dword [ebp + 0x24]
add esp, 0x10
mov esi, dword [ebp + 0x1c]
add edi, esi
sub dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x14]
jne 0x1109c8f3
mov edi, dword [ebp - 0x18]
push ebx
push 1
push dword [ebp + 0x28]
lea eax, [ebp - 0x24]
push eax
call fcn.11147d5e
mov eax, dword [ebp - 0x1c]
add esp, 0x10
add edi, dword [ebp + 0x10]
add eax, dword [ebp - 0x28]
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], eax
cmp edi, dword [ebp - 0x2c]
jne 0x1109c8d0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x110b54f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov eax, dword [eax + 0x148]
call eax
mov edi, dword [ebp + 8]
test al, al
jne 0x110b552c
mov eax, dword [edi]
sub eax, 9
cmp eax, 0x10
ja 0x110b552c
mov ecx, dword [esi + 0x2b4]
push edi
test ecx, ecx
je 0x110b5629
mov eax, dword [ecx]
call dword [eax + 0x40]
pop edi
pop esi
pop ebp
ret 4
mov ecx, dword [esi + 0x2b4]
test ecx, ecx
je 0x110b559e
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [eax + 0x2bd], 0
je 0x110b559e
cmp dword [edi], 0xf
jne 0x110b559e
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x140]
call eax
test al, al
je 0x110b5630
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [esi + 0x288]
lea esi, [esi + 0x288]
mov ecx, 0x8000
and ax, cx
mov ecx, esi
je 0x110b5593
mov eax, dword [edi + 0x18]
call eax
test al, al
mov ecx, esi
sete al
push eax
call dword [edi + 0x20]
pop edi
pop esi
pop ebp
ret 4
push 1
call dword [edi + 0x1c]
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [edi]
cmp eax, 0xd
je 0x110b5549
cmp eax, 0xe
jne 0x110b55e1
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x140]
call eax
test al, al
je 0x110b5630
mov ecx, dword [esi + 0x68]
push 0
push 0
push 0
sub esp, 8
mov eax, esp
push esi
mov dword [eax], str.itemclick
mov dword [eax + 4], 9
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___class_std::basic_string_view_wchar_t__struct_std::char_traits_wchar_t____unsigned_int__long_int__bool_
pop edi
pop esi
pop ebp
ret 4
cmp eax, 9
je 0x110b5630
cmp eax, 0xb
jne 0x110b5609
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x140]
call eax
test al, al
je 0x110b5609
or dword [esi + 0x294], 8
mov ecx, esi
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CListElementUI::Invalidate_void_
cmp dword [edi], 0xa
jne 0x110b5628
mov eax, dword [esi + 0x294]
test al, 8
je 0x110b5628
and eax, 0xfffffff7
mov ecx, esi
mov dword [esi + 0x294], eax
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CListElementUI::Invalidate_void_
push edi
mov ecx, esi
call sym.DuiLib.dll_public_virtual:_void___thiscall_DuiLib::CListElementUI::DoEvent_struct_DuiLib::tagTEventUI__
pop edi
pop esi
pop ebp
ret 4
Function at 0x110c5d30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x364], 0
je 0x110c5de4
cmp dword [ebp + 8], 0x100
mov edi, dword [ebp + 0xc]
jne 0x110c5dc6
cmp di, 0xd
jne 0x110c5da2
cmp byte [esi + 0x36a], 0
je 0x110c5d75
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x110c5dc6
cmp byte [esi + 0x36b], 0
jne 0x110c5dc6
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x110c5d9a
push 0
push 0
push 0
sub esp, 8
mov eax, esp
push esi
mov dword [eax], str.return
mov dword [eax + 4], 6
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___class_std::basic_string_view_wchar_t__struct_std::char_traits_wchar_t____unsigned_int__long_int__bool_
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x110c5dc6
push 0
push 0
push edi
sub esp, 8
mov eax, esp
push esi
mov dword [eax], str.keydown
mov dword [eax + 4], 7
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___class_std::basic_string_view_wchar_t__struct_std::char_traits_wchar_t____unsigned_int__long_int__bool_
mov eax, dword [esi + 0x364]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push edi
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
pop ebp
ret 0x10
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x110eac70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebx - 4]
test ebp, ebp
jle 0x110eacda
mov ecx, dword [esp + 0xc]
sub ecx, ebx
push esi
mov dword [esp + 0x10], ecx
push edi
nop dword [eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [esp + 0x14]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
mov dword [ebx - 4], eax
sub ebp, 1
jne 0x110eac90
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x110eace0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jle 0x110ead54
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
sub ecx, eax
sub dword [esp + 0x14], eax
push ebx
push esi
mov dword [esp + 0x14], ecx
push edi
nop
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [esp + 0x20]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
mov dword [ecx + eax - 4], edi
mov ecx, dword [esp + 0x18]
sub ebp, 1
jne 0x110ead00
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x110f51b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x112194bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x110f5251
cmp byte [esi + 0x3d], 0
je 0x110f5251
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x110f5207
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x110f5219
sub eax, 1
je 0x110f521d
sub eax, 2
je 0x110f5251
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x110f523a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.11147d5e
add esp, 0x10
cmp edi, eax
jne 0x110f5207
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.110d0a88
mov esp, ebp
pop ebp
ret
Function at 0x110f6750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x112194bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x110f6780
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x110f67bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x110f67bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x110f68a1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x110f67e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x110f6817
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.11146cb7
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x110f68a1
cmp eax, 1
jle 0x110f6874
cmp eax, 3
jne 0x110f68a1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.110f3800
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x110f6891
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.11147d5e
add esp, 0x10
cmp edi, eax
jne 0x110f68a1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x110f67a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.110d0a88
mov esp, ebp
pop ebp
ret 4
Function at 0x110f77e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x110f7804
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.110f78d0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x110f7825
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x110f7827
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x110f78af
jg 0x110f783a
test esi, esi
je 0x110f78af
test ecx, ecx
jl 0x110f787c
jg 0x110f7844
test eax, eax
je 0x110f787c
cmp ebx, ecx
jg 0x110f7856
jl 0x110f784e
cmp esi, eax
jae 0x110f7856
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.11121300
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x110f7882
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x110f78af
jg 0x110f788c
test esi, esi
je 0x110f78af
cmp dword [edi + 0x4c], 0
je 0x110f78af
mov ecx, edi
call fcn.110f5730
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.11146ff2
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110f79a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x110f79c4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.110f7a80
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x110f79e5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x110f79e7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x110f7a64
jg 0x110f79fa
test esi, esi
je 0x110f7a64
test ecx, ecx
jl 0x110f7a3e
jg 0x110f7a04
test eax, eax
je 0x110f7a3e
cmp edi, ecx
jg 0x110f7a16
jl 0x110f7a0e
cmp esi, eax
jae 0x110f7a16
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.11121300
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x110f7a41
mov edx, dword [ebp + 8]
test edi, edi
jl 0x110f7a64
jg 0x110f7a4b
test esi, esi
je 0x110f7a64
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x110f7a64
push eax
push esi
push 1
push edx
call fcn.11147d5e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x11154be1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.111547e6

Function at 0x11157f8e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.11157768

Function at 0x11157f99
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.111579a3

Function at 0x11165861
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.111655e8
Function at 0x406260
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40d07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403dae
and dword [ebp - 0x14], 0
cmp dword [0x40e920], 0
mov dword [ebp - 0x18], eax
jne 0x406313
push 0x40a7f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4063bb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a7e4
push ebx
call edi
test eax, eax
je 0x4063bb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40a7d4
push ebx
mov dword [0x40e920], eax
call edi
push eax
call esi
push 0x40a7c0
push ebx
mov dword [0x40e924], eax
call edi
push eax
call esi
push 0x40a7a4
push ebx
mov dword [0x40e928], eax
call edi
push eax
call esi
mov dword [0x40e930], eax
test eax, eax
je 0x406313
push 0x40a78c
push ebx
call edi
push eax
call esi
mov dword [0x40e92c], eax
mov eax, dword [0x40e92c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40636c
cmp dword [0x40e930], ecx
je 0x40636c
push eax
call esi
push dword [0x40e930]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40636c
test ebx, ebx
je 0x40636c
call edi
test eax, eax
je 0x406363
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406363
test byte [ebp - 8], 1
jne 0x40636c
or dword [ebp + 0x10], 0x200000
jmp 0x40639f
mov eax, dword [0x40e924]
cmp eax, dword [ebp - 0x18]
je 0x40639f
push eax
call esi
test eax, eax
je 0x40639f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40639f
mov eax, dword [0x40e928]
cmp eax, dword [ebp - 0x18]
je 0x40639f
push eax
call esi
test eax, eax
je 0x40639f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40e920]
call esi
test eax, eax
je 0x4063bb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4063bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402701
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x15e45587
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
mov ecx, 0x6f23676d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x428546
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x438860]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push edi
mov eax, dword [0x438860]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
lea edi, [esp + 0x28]
mov dword [esp + 0x1c], vtable.t_reg.0
call fcn.00402c90
mov eax, str.MACHINE
mov edx, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
call fcn.00402240
xor ebx, ebx
mov dword [esp + 0x160], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push 1
push ebx
push ebx
push str.SoftwareSogouInput
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x174], 1
call fcn.00402420
lea ecx, [esp + 0xc]
test al, al
jne 0x401115
call fcn.00402920
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.t_reg.0
cmp eax, ebx
je 0x4010e7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], vtable.t_str.0
cmp byte [esp + 0x144], bl
jne 0x401111
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x401111
push eax
call fcn.00411ae3
add esp, 4
mov al, 1
jmp 0x40116d
push 4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov eax, str.NoCheckSignature
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call fcn.00402580
lea ecx, [esp + 0xc]
test al, al
jne 0x401156
call fcn.00402920
lea ecx, [esp + 0x1c]
call fcn.004023d0
mov al, 1
jmp 0x40116d
cmp dword [esp + 0x14], ebx
sete bl
call fcn.00402920
lea ecx, [esp + 0x1c]
call fcn.004023d0
mov al, bl
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.00411e9c
mov esp, ebp
pop ebp
ret

Function at 0x401e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42881b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x438860]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
mov eax, dword [0x438860]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
cmp byte [0x43c1a6], 0
mov esi, ecx
je 0x401e8a
xor eax, eax
jmp 0x401f2b
call fcn.00404a50
test al, al
jne 0x401e83
call fcn.00401030
test al, al
je 0x401e83
push str.CheckSig1
call fcn.00405fe0
add esp, 4
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [esp + 0x24]
call fcn.00403810
mov dword [esp + 0x140], 0
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x401eda
mov eax, dword [esp + 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401ef2
shr eax, 4
not al
and al, 1
jne 0x401f02
lea eax, [esp + 0xc]
call fcn.004039d0
mov eax, 1
jmp 0x401f2b
call fcn.00406010
call fcn.004016d0
mov ecx, esi
test al, al
je 0x401f19
call fcn.00401bd0
jmp 0x401f1e
call fcn.004017a0
mov esi, eax
lea eax, [esp + 0xc]
call fcn.004039d0
mov eax, esi
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00411e9c
add esp, 0x13c
ret