joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411a7a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x411a8f
xor eax, eax
pop ebp
ret
movzx eax, al
shr eax, 4
and eax, 1
pop ebp
ret

Function at 0x411be9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp + 0x10]
xor esi, esi
push eax
push 0x20019
push esi
push 0x55d228
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411c41
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x400
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411c38
inc esi
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41225b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5b01a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x412366
test esi, esi
je 0x4122a3
lea eax, [ebp - 0x104]
mov ecx, esi
push eax
call fcn.0040a522
mov eax, dword [ebp - 0x108]
sub eax, 0
je 0x412361
dec eax
je 0x412322
dec eax
jne 0x41235c
mov eax, dword [ebp - 0x114]
cmp eax, 3
jne 0x4122ce
push 8
jmp 0x412363
cmp eax, 4
jne 0x4122da
push 9
jmp 0x412363
cmp eax, 5
jne 0x4122ff
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x4122ed
push 0xa
jmp 0x412363
cmp eax, 1
jne 0x4122f6
push 0xb
jmp 0x412363
cmp eax, 2
jne 0x41231e
push 0xc
jmp 0x412363
cmp eax, 6
jne 0x41231e
cmp dword [ebp - 0x110], 0
jne 0x412311
push 0xd
jmp 0x412363
cmp dword [ebp - 0x110], 1
jne 0x41231e
push 0xe
jmp 0x412363
push 0xf
jmp 0x412363
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x41233c
cmp word [ebp - 0x102], 0x43
sete al
add eax, 3
jmp 0x412368
cmp eax, 0xa
jne 0x412353
xor eax, eax
cmp word [ebp - 0x102], 0x41
sete al
add eax, 5
jmp 0x412368
cmp eax, 0x5a
jne 0x41235c
push 7
jmp 0x412363
xor eax, eax
inc eax
jmp 0x412368
push 2
pop eax
jmp 0x412368
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052cea9
mov esp, ebp
pop ebp
ret
Function at 0x412b84
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
push esi
mov dword [ebp - 8], eax
call fcn.00412740
xor ebx, ebx
push ebx
push 0x8000000
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x412bbb
xor eax, eax
jmp 0x412c27
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xf4240
jg 0x412c1d
lea eax, [edi + 2]
push eax
push 1
call fcn.00531b45
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x412c1d
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412c16
cmp dword [ebp - 4], edi
jne 0x412c16
mov ecx, dword [ebp - 8]
push edi
push ebx
call fcn.00412c2f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0052fbc1
xor eax, eax
pop ecx
inc eax
jmp 0x412c26
push ebx
call fcn.0052fbc1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415a21
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5b01a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp + 0x38]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0x18]
push edi
xor edi, edi
mov dword [ebp - 0x80c], ebx
neg eax
mov dword [ebp - 0x810], 0x400
push edi
sbb eax, eax
not eax
and dword [0x5b6834], eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
jne 0x415a94
xor eax, eax
jmp 0x415be4
push ebx
call fcn.0052ef4a
pop ecx
cmp eax, 0x200
jae 0x415a8d
mov ebx, dword [ebp + 0x24]
test ebx, ebx
je 0x415ad2
test esi, esi
je 0x415acf
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415ad2
jmp 0x415a8d
or edi, 0xffffffff
inc dword [0x5b684c]
mov ecx, SysReAllocString
mov eax, dword [0x5b684c]
cdq
idiv ecx
mov ecx, dword [ebp - 0x814]
mov dword [0x5b684c], edx
test ecx, ecx
je 0x415afc
mov eax, dword [0x5b684c]
mov dword [ecx], eax
push 0xc2c
call fcn.00418138
mov dword [esp], 0xc2c
mov esi, eax
push 0
push esi
call fcn.0052ee30
mov ecx, dword [ebp + 0x28]
add esp, 0xc
mov eax, dword [ebp + 0x2c]
mov dword [esi], ebx
mov dword [esi + 0x804], edi
mov dword [esi + 0xc14], ecx
mov dword [esi + 0xc18], eax
test ecx, ecx
je 0x415b3b
and dword [ecx], 0
mov eax, dword [esi + 0xc18]
test eax, eax
je 0x415b48
and dword [eax], 0
mov eax, dword [ebp + 0x30]
mov ebx, dword [ebp + 0x18]
mov dword [esi + 0xc1c], eax
mov eax, dword [ebp + 0x34]
mov dword [esi + 0xc20], eax
mov eax, dword [ebp - 0x808]
mov dword [esi + 0xc28], ebx
test eax, eax
je 0x415b7c
push eax
call fcn.00531b85
pop ecx
mov dword [esi + 0xc24], eax
jmp 0x415b83
and dword [esi + 0xc24], 0
lea eax, [ebp - 0x804]
push eax
lea eax, [esi + 4]
push eax
call fcn.00531e69
mov eax, dword [0x5b684c]
push dword [ebp - 0x80c]
mov dword [esi + 0x808], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x80c], eax
lea eax, [esi + 0x810]
push eax
call fcn.00531e69
mov eax, dword [ebp + 0x20]
add esp, 0x10
mov dword [esi + 0xc10], eax
push esi
test ebx, ebx
je 0x415bd2
call fcn.0041613e
pop ecx
jmp 0x415be4
push 0
push 0x415bf5
call fcn.00531bd8
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052cea9
mov esp, ebp
pop ebp
ret
Function at 0x41f50b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041f951
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41f547
call fcn.0041f72a
mov dword [esi + 0xc], 1
jmp 0x41f54c
call fcn.0041f72a
cmp dword [esi], 0
je 0x41f595
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41f56f
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00410f6a
jmp 0x41f580
push 0xff
mov ecx, esi
call fcn.00408570
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00411c48
jmp 0x41f5b9
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41f5b9
push dword [esi]
push dword [ebp - 4]
call fcn.0041f17f
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41f67f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041f72a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41f6c7
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00410f6a
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00411c48
jmp 0x41f6d2
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041f17f
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4223ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4223f0
call fcn.0041bad5
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4223f0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42240c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00428faa
mov ebx, eax
test edi, edi
je 0x42240a
test esi, esi
je 0x42240a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429521
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041bad5
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x429558
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00429579
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4cdeec
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x554441
call fcn.00530049
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004051bd
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x55adbc
call fcn.00405feb
cmp eax, 0xffffffff
jne 0x4cdfa0
push 0
push 0x55d160
lea ecx, [ebp - 0x4d0]
call fcn.00405feb
cmp eax, 0xffffffff
jne 0x4cdfa0
push 0
push 0x55ae60
lea ecx, [ebp - 0x4d0]
call fcn.00405feb
cmp eax, 0xffffffff
jne 0x4cdfa0
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004051bd
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4cdf7c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00409f91
jmp 0x4cdfcf
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0040a522
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00409f91
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4cdfc6
mov ebx, dword [ebp - 0x4cc]
jmp 0x4cdfcf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00409f91
mov eax, ebx
call fcn.0052fff8
ret
Function at 0x544098
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b01a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00535b33
mov dword [ebp - 0x14], eax
cmp dword [0x5bcddc], esi
jne 0x54418b
push 0x800
push esi
push 0x58ed70
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x544118
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x54426b
push esi
push esi
push 0x58ed70
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x54426b
push 0x58ed88
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x54426b
push eax
call ebx
push 0x58ed94
push edi
mov dword [0x5bcddc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x58eda4
push edi
mov dword [0x5bcde0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5bcde4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bcdec], eax
test eax, eax
je 0x544188
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bcde8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5441b0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5441a3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5441c5
push 4
pop eax
jmp 0x54426d
cmp dword [ebp - 0x14], esi
je 0x5441c5
push dword [0x5bcddc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5441aa
mov eax, dword [0x5bcde8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x544223
cmp dword [0x5bcdec], edi
je 0x544223
push eax
call ebx
push dword [0x5bcdec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x544223
test eax, eax
je 0x544223
call ecx
test eax, eax
je 0x544218
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x544218
test byte [ebp - 8], 1
jne 0x544223
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x544253
mov eax, dword [0x5bcde0]
cmp eax, edi
je 0x544250
push eax
call ebx
test eax, eax
je 0x544250
call eax
mov esi, eax
test esi, esi
je 0x544250
mov eax, dword [0x5bcde4]
cmp eax, edi
je 0x544250
push eax
call ebx
test eax, eax
je 0x544250
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5bcddc]
call ebx
test eax, eax
je 0x54426b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x54426d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052cea9
mov esp, ebp
pop ebp
ret
Function at 0x4a815239
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.4a8149d5
pop ecx
xor esi, esi
push esi
push 0x10000080
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4a815270
xor al, al
jmp 0x4a8152b1
push edi
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
je 0x4a8152a7
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebx + 4], eax
jne 0x4a8152ab
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4a8152b0
mov dword [ebx + 0x14], edi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a820812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a845210]
jne 0x4a82081c
repz ret
jmp fcn.4a820f54
Function at 0xf0600c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf06016
pushal
call 0xf0601c
pop ebp
sub ebp, 0x10
sub ebp, 0xb0600c
jmp 0xf06032
mov eax, 0xb0600c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a8
mov edx, 0x5c8c2356
xor byte [eax], dl
inc eax
dec ecx
jne 0xf06049
jmp 0xf0605c
fstp qword [ebx + 0x566adfdd]
push esi
push esi
xlatb
xchg edi, eax
scasb al, byte es:[edi]
push esi
push esi
push esi
push ebp
wait
out dx, al
push eax
push esi
push esi
push esi
in al, dx
jle 0xf060ca
push esi
push esi
mov eax, dword [0xdd9e55b4]
xlatb
pop edx
push esi
push esi
push esi
push ebp
xchg ebx, eax
push es
push es
lcall 0xd269, 0x3e56778d
fcom dword [esi + 0x57]
jp 0xf06103
nop
invalid
or edx, dword [edx + ebx*2 + 0x72dadd56]
push edx
push esi
push esi
push esi
lcall 0xd269, 0x3e56778d
fcom dword [esi + 0x57]
jp 0xf06154
pop es
mov esi, 0x56565653
mov edi, 0x56565413
add ebx, ebp
mov edx, 0xa95a23a9
and ebx, dword [esi - 0x42]
push esi
push esi
push esi
fucomp st(3)
pop esi
push esi
push esi
push esi
xlatb
cmpsd dword [esi], dword es:[edi]
sbb ah, byte [edx]
push eax
out 0xd7, eax
cmpsd dword [esi], dword es:[edi]
sbb ah, byte [edx]
push eax
out 0x65, eax
lahf
test ch, dl
mov esi, 0xd2591e53
sbb byte [esi + 0x56], dl
push esi
pop ecx
ficomp word [esi]
push esi
push esi
push esi
xor ch, bl
dec edx
outsd dx, dword [esi]
salc
lodsd eax, dword [esi]
mov esi, 0x564cd259
push esi
push esi
salc
lodsd eax, dword [esi]
mov edi, 0x5647d259
push esi
push esi
xor bh, dl
lodsd eax, dword [esi]
test eax, 0x43d25973
push esi
push esi
push esi
pop ss
mov edi, 0xa9a9a99a
jg 0xf06164
outsd dx, dword [esi]
push edi
aad 0x97
push ebx
aad 0xbe
push edx
mov edi, 0xa9a9a9eb
jg 0xf0615b
test eax, 0x27fa9a9
outsd dx, dword [esi]
push esp
aad 0x97
push eax
aad 0xbc
push edx
aad 0xbe
push ebx
mov edi, 0xa9a9a9fd
fnstsw word [edx + 0x72]
invalid
Function at 0x44a210
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, 0x190
push edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a2e2
lea ecx, [esp + 0x20]
push ebp
mov ebp, 4
push ecx
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a290
mov ebx, dword [esp + 0x1c]
xor esi, esi
test edi, edi
mov dword [esp + 0x14], ebp
je 0x44a2a9
mov eax, dword [0x65bb1c]
push 0x65b838
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop ebp
jne 0x44a2d7
or esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov edx, ebx
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4ea748
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [esi - 0x6e8e2514]
cmpsb byte [esi], byte es:[edi]
ljmp 0x9c81:0x87d6b504
insd dword es:[edi], dx
push ebx
pop edx
test eax, 0x1ae23f2e
mov ebp, 0xae5ea0ea
jecxz 0x4ea76d
xor al, 0x38
or al, 0xa4
cmp byte [esp], cl
leave
in eax, dx
jb 0x4ea738
xor eax, 0x83b58e4d
mov edx, 0xdfebde18
jmp 0x4ea729
xor eax, 0xc96f394a
imul ebx, dword [eax + 0x2686747b], 0xffffffac
fstp xword [esi - 0x3176dac6]
retf
jmp 0x4ea729
pushfd
jo 0x4ea7d1
jge 0x4ea701
jae 0x4ea708
cmp ecx, dword ss:[eax]
js 0x4ea7cf
push ebx
fdivp st(6)
fmulp st(6)
and al, 0xcb
retf
invalid
Function at 0x4f940b
Capabilities:
Encode data using xor

Disassembly:
pop ebp
add ah, byte [esi]
nop
sahf
out 0x52, eax
pushfd
aas
jge 0x4f944a
push ds
adc ebx, ebp
add dword [edx - 0x6c5c7aaf], 0x174d8efe
sbb bl, dh
xchg ebx, eax
dec byte [esi - 0x21e5e8b3]
sbb byte cs:[esi], bh
inc edi
dec eax
jg 0x4f9485
mov dword [edx], 0x2f63c6d2
jp 0x4f943e
jb 0x4f94a6
pop ebx
invalid
je 0x4f94a1
enter 0x1819, 0xffffffffffffffa3
sbb dword [eax], esi
into
cmp eax, 0x53a9120d
sbb al, 0xeb
xchg esp, eax
test eax, 0x94eb1c53
mov eax, dword [0x8b3ba12d]
movsb byte es:[edi], byte [esi]
mov cl, 0x59
sbb dword [edx], ebp
rcr ecx, 1
jb 0x4f941e
mov esi, 0x26ad2f1a
out 0xf8, al
push ecx
mov dword [0x4cb1e885], eax
and byte fs:[edi + eax*4 - 0x39d3a900], ch
imul edx, dword [ecx], 0x1b
out dx, eax
imul edi, dword [esi], 0xf91a35f1
sbb ecx, dword [ebx - 0x541079ed]
mov word [ebx + 0x4d97380c], gs
stosd dword es:[edi], eax
or al, 0x38
xchg edi, eax
dec ebp
aaa
bound ecx, qword [ebx]
salc
invalid
lea ecx, [edx + esi + 0xa]
xchg edx, eax
pop ecx
mov edi, 0xddb96d8a
push ecx
mov bh, 0x23
pop esi
mov dl, 0x8a
in al, dx
test byte [ebx - 0x4dcdf4c2], ah
sar dword [esp + ebp*2 + 0x1a], 0x48
inc ebp
mov ebp, 0x4a518585
and eax, 0xbebe5f3e
cwde
mov eax, dword [esi + 0x1b]
cmc
xchg ebx, eax
xor al, 0xac
test al, 0x49
scasb al, byte es:[edi]
dec edi
jl 0x4f94cc
inc esp
out dx, al
add eax, dword [ecx]
retf 0xc275

Function at 0x60aa8c
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
push 0xffffffffffffffe3
inc edx
xor bh, byte [ecx]
xor al, 0x8a
arpl word [edx + 0x56], sp
popal
and byte [ebx + 6], 0x49
jb 0x60aa8d
lodsb al, byte [esi]
inc edx
les edi, [ebx + edx*4 - 0x134a2a46]
dec ebx
sub dl, dl
insb byte es:[edi], dx
fisttp word [eax - 0x126ddde7]
and ah, bl
add dword [edi + 0x26], ebx
mov bh, 0x16
push eax
in al, dx
jmp 0x17f71cf0
Function at 0x401000
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x570470]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x44]
push eax
push 0x55077c
mov dword [ebp - 0x4c], ecx
call fcn.004012a4
lea eax, [ebp - 0x44]
push 0x38
push eax
mov edx, 0x5504a0
mov edi, eax
call fcn.004011f1
add esp, 0x14
and dword [ebp - 0x48], 0
mov ebx, dword [ebp - 0x48]
lea ebx, [ebx + 0x550508]
movzx edi, byte [ebx]
lea esi, [ebp - 0x44]
call fcn.00401252
movzx edi, byte [ebx]
lea esi, [ebp - 0x28]
call fcn.00401252
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push 0x30
push eax
mov edx, 0x5504d8
call fcn.004011f1
inc dword [ebp - 0x48]
add dword [ebp - 0x4c], 0x30
cmp dword [ebp - 0x48], 0x10
pop ecx
pop ecx
jl 0x40103f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa527
leave
ret

Function at 0x40108f
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x570470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x4c], eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
mov ebx, ecx
call fcn.004012a4
lea eax, [ebp - 0x44]
push 0x40
push eax
mov edx, 0x5503d0
mov edi, eax
call fcn.004011f1
add esp, 0x14
mov dword [ebp - 0x48], 0x10
push 8
pop ecx
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [ebp - 0x24]
call fcn.0040113c
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
xor byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0x20
jl 0x4010ea
push 8
pop ecx
lea esi, [ebp - 0x6c]
lea edi, [ebp - 0x44]
add ebx, 0x30
dec dword [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
jne 0x4010d4
lea eax, [ebp - 0x44]
push 0x40
push eax
mov edx, 0x550410
mov edi, eax
call fcn.004011f1
mov ebx, dword [ebp - 0x4c]
mov eax, edi
push eax
call fcn.004012e2
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa527
leave
ret 8