joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b20
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov esi, ecx
mov word [esp + 0x18], 0
call fcn.00408700
add esp, 0xc
cmp dword [esi + 0x34], 8
jb 0x405b5f
mov eax, dword [esi + 0x20]
jmp 0x405b62
lea eax, [esi + 0x20]
push 0x42d5bc
push eax
lea ecx, [esp + 0x14]
push 0x42d594
push ecx
call fcn.00408610
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jne 0x405b9a
push 0
lea eax, [esp + 0x10]
push eax
call ebx
cmp dword [esi + 0x34], 8
jb 0x405ba5
mov esi, dword [esi + 0x20]
jmp 0x405ba8
add esi, 0x20
push str.Dict
push esi
lea ecx, [esp + 0x14]
push 0x42d594
push ecx
call fcn.00408610
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call edi
test eax, eax
jne 0x405bd3
push eax
lea eax, [esp + 0x10]
push eax
call ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004086c2
add esp, 0x20c
ret

Function at 0x405c40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x620
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x61c], eax
push esi
push 0x206
lea eax, [esp + 0xe]
push 0
push eax
mov esi, ecx
mov word [esp + 0x14], 0
call fcn.00408700
add esp, 0xc
xor eax, eax
jmp 0x405c80
movzx ecx, word [eax + str.SOFTWARE_]
mov word [esp + eax + 8], cx
add eax, 2
test cx, cx
jne 0x405c80
lea eax, [esp + 8]
add eax, 0xfffffffe
jmp 0x405ca0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x405ca0
cmp dword [esi + 0x50], 8
mov ecx, dword [str.GSInput]
mov edx, dword [0x42d5f8]
mov dword [eax], ecx
mov ecx, dword [0x42d5fc]
mov dword [eax + 4], edx
mov edx, dword [0x42d600]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jb 0x405cda
mov ecx, dword [esi + 0x3c]
jmp 0x405cdd
lea ecx, [esi + 0x3c]
lea edx, [esp + 0x210]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x405ce4
cmp dword [esi + 0x34], 8
jb 0x405d00
mov ecx, dword [esi + 0x20]
jmp 0x405d03
lea ecx, [esi + 0x20]
lea edx, [esp + 0x418]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x405d10
lea eax, [esp + 4]
push eax
push 2
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405d7d
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea edx, [esp + 0x214]
push edx
push 1
push eax
mov eax, dword [esp + 0x14]
push str.CfgRootPath
push eax
call esi
mov edx, dword [esp + 4]
push 0x104
lea ecx, [esp + 0x41c]
push ecx
push 1
push 0
push str.CfgUserPath
push edx
call esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x620]
pop esi
xor ecx, esp
call fcn.004086c2
add esp, 0x620
ret
Function at 0x406730
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
jb 0x406752
mov eax, dword [esi + 0x3c]
jmp 0x406755
lea eax, [esi + 0x3c]
push str.Config
push eax
lea eax, [esp + 0xc]
push 0x42d594
push eax
call fcn.00408610
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406786
lea edx, [esp + 4]
push edx
call fcn.00408060
lea eax, [esp + 4]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x406790
mov ecx, dword [0x42d660]
mov edx, dword [str.nfig.ini]
mov dword [eax], ecx
mov ecx, dword [0x42d668]
mov dword [eax + 4], edx
mov edx, dword [0x42d66c]
mov dword [eax + 8], ecx
mov ecx, dword [0x42d670]
mov dword [eax + 0xc], edx
mov dx, word [0x42d674]
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], dx
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4067e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
lea ecx, [esi + 0x54]
call fcn.00401f70
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.004086c2
add esp, 0x20c
ret

Function at 0x406820
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
jb 0x406842
mov eax, dword [esi + 0x3c]
jmp 0x406845
lea eax, [esi + 0x3c]
push str.Config
push eax
lea eax, [esp + 0xc]
push 0x42d594
push eax
call fcn.00408610
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406876
lea edx, [esp + 4]
push edx
call fcn.00408060
lea eax, [esp + 4]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x406880
mov ecx, dword [str.Related.ini]
mov edx, dword [0x42d68c]
mov dword [eax], ecx
mov ecx, dword [0x42d690]
mov dword [eax + 4], edx
mov edx, dword [0x42d694]
mov dword [eax + 8], ecx
mov ecx, dword [0x42d698]
mov dword [eax + 0xc], edx
mov edx, dword [0x42d69c]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
lea eax, [esp + 4]
lea edx, [eax + 2]
jmp 0x4068d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4068d0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
lea ecx, [esi + 0xc4]
call fcn.00401f70
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.004086c2
add esp, 0x20c
ret
Function at 0x4069a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
jb 0x4069c2
mov eax, dword [esi + 0x3c]
jmp 0x4069c5
lea eax, [esi + 0x3c]
push str.UseData
push eax
lea eax, [esp + 0xc]
push 0x42d594
push eax
call fcn.00408610
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4069f6
lea edx, [esp + 4]
push edx
call fcn.00408060
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406a00
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
lea ecx, [esi + 0x118]
call fcn.00401f70
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.004086c2
add esp, 0x20c
ret
Function at 0x4075a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x438
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x434], eax
push ebp
push esi
push edi
push 0x206
lea eax, [esp + 0x23e]
push 0
push eax
mov ebp, ecx
mov word [esp + 0x244], 0
call fcn.00408700
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
lea ecx, [esp + 0x14]
push 0
push ecx
mov edi, eax
mov dword [esp + 0x18], 0
call fcn.00408700
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40768d
lea edx, [esp + 0xc]
push edx
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x407655
cmp dword [esp + 0x14], edi
je 0x40763c
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x407625
jmp 0x407655
xor eax, eax
mov edi, edi
movzx ecx, word [esp + eax + 0x30]
mov word [esp + eax + 0x238], cx
add eax, 2
test cx, cx
jne 0x407640
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x238]
push ecx
call fcn.0040959e
mov ecx, eax
add esp, 4
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x407671
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x134]
call fcn.00401f70
mov ecx, dword [esp + 0x440]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004086c2
add esp, 0x438
ret

Function at 0x4076b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push 0
push 0x1a
lea eax, [esp + 0x10]
push eax
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4076e0
sub eax, edx
sar eax, 1
je 0x4077a2
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407700
mov edx, dword [0x42d65c]
lea eax, [esp + 0xc]
mov dword [edi], edx
add eax, 0xfffffffe
jmp 0x407720
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x407720
mov ecx, dword [str.GuangSu]
mov dword [eax], ecx
mov ecx, dword [0x42d72c]
mov dword [eax + 4], ecx
mov ecx, dword [0x42d730]
mov dword [eax + 8], ecx
mov ecx, dword [0x42d734]
lea edi, [esp + 0xc]
mov dword [eax + 0xc], ecx
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407756
mov dword [edi], edx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop edi
jne 0x40777e
lea eax, [esp + 8]
push eax
call fcn.00408060
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407785
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esi + 0x38]
call fcn.00401f70
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.004086c2
add esp, 0x210
ret
Function at 0x4077c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push 0
push 0x1a
lea eax, [esp + 0x10]
push eax
push 0
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4077f0
sub eax, edx
sar eax, 1
je 0x40789d
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407810
mov edx, dword [0x42d65c]
mov dword [edi], edx
lea edi, [esp + 0xc]
add edi, 0xfffffffe
jmp 0x407830
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407830
push esi
mov ecx, 7
mov esi, str.GuangSu.users
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x10]
add edi, 0xfffffffe
pop esi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407851
lea ecx, [esp + 0xc]
push ecx
mov dword [edi], edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop edi
jne 0x407879
lea edx, [esp + 8]
push edx
call fcn.00408060
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407880
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00401f70
mov ecx, dword [esp + 0x210]
pop ebx
xor ecx, esp
call fcn.004086c2
add esp, 0x210
ret
Function at 0x407ee0
Capabilities:
Check if file exists

Disassembly:
push esi
push 0xffffffffffffffff
lea esi, [ecx + 0x70]
add ecx, 0x38
push 0
push ecx
mov ecx, esi
call fcn.00401e80
push 5
push str.Skin_
mov ecx, esi
call fcn.00403fe0
cmp dword [esi + 0x18], 8
jb 0x407f0c
mov eax, dword [esi + 4]
jmp 0x407f0f
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407f34
cmp dword [esi + 0x18], 8
jb 0x407f2b
mov esi, dword [esi + 4]
push esi
call fcn.00408060
pop esi
ret
add esi, 4
push esi
call fcn.00408060
pop esi
ret

Function at 0x407fc0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
push esi
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x18]
push ecx
push eax
call edi
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x30
ret

Function at 0x408010
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
push esi
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x18]
push ecx
push eax
call edi
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x30
ret

Function at 0x408060
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408070
sub eax, edx
sar eax, 1
mov ebp, eax
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00408518
mov esi, eax
mov edx, esi
add esp, 4
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4080a5
xor edi, edi
test ebp, ebp
mov byte [esp + 0x10], 1
jl 0x40810e
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [esi + edi*2], 0x5c
jne 0x4080ec
push esi
mov word [esi + edi*2], 0
call ebx
test eax, eax
jne 0x4080e6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x408108
mov word [esi + edi*2], 0x5c
add edi, 1
cmp edi, ebp
jle 0x4080c6
pop ebx
push esi
call fcn.0040877a
movzx eax, byte [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4
mov byte [esp + 0x14], 0
pop ebx
push esi
call fcn.0040877a
movzx eax, byte [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
ret 4
Function at 0x408180
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x210
mov eax, dword [0x437164]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, dword [esp + 0x224]
push edi
mov dword [esp + 0x10], eax
xor edi, edi
jmp 0x4081c0
push 0x206
lea ecx, [esp + 0x1a]
push 0
push ecx
mov word [esp + 0x20], 0
call fcn.00408700
add esp, 0xc
test edi, edi
jne 0x4081f4
push esi
lea edx, [esp + 0x18]
push str._s.bak
push edx
call fcn.00408610
add esp, 0xc
jmp 0x408208
push edi
push esi
lea eax, [esp + 0x1c]
push str._s.bak_d
push eax
call fcn.00408610
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40821e
lea edx, [esp + 0x14]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004086d1
add esp, 8
lea ecx, [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x10]
push 0
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
push 5
push 0
jne 0x40825d
lea eax, [esp + 0x1c]
push eax
call ebx
cmp edi, 0xa
jge 0x40826f
add edi, 1
jmp 0x4081c0
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push 5
push 0
push edx
call ebx
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004086c2
add esp, 0x210
ret 8

Function at 0x4086c2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437164]
jne 0x4086cc
repz ret
jmp fcn.0040cd9e
Function at 0x41a77b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040dddf
xor ebx, ebx
cmp dword [0x43968c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41a850
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x41a7bb
xor eax, eax
jmp 0x41a914
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41a7b4
push eax
call fcn.0040dd7c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43968c], eax
call esi
push eax
call fcn.0040dd7c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439690], eax
call esi
push eax
call fcn.0040dd7c
mov dword [0x439694], eax
lea eax, [ebp - 8]
push eax
call fcn.00411ac0
test eax, eax
pop ecx
pop ecx
je 0x41a81e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004091cd
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41a850
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040dd7c
cmp eax, ebx
pop ecx
mov dword [0x43969c], eax
je 0x41a850
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dd7c
pop ecx
mov dword [0x439698], eax
mov eax, dword [0x439698]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x41a8c9
cmp dword [0x43969c], esi
je 0x41a8c9
push eax
call fcn.0040dde8
pop ecx
call eax
cmp eax, ebx
je 0x41a896
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x43969c]
call fcn.0040dde8
pop ecx
call eax
test eax, eax
je 0x41a896
test byte [ebp - 0x18], 1
jne 0x41a8c9
lea eax, [ebp - 0xc]
push eax
call fcn.00411af7
test eax, eax
pop ecx
je 0x41a8b1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004091cd
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41a8c0
or dword [ebp + 0x10], 0x200000
jmp 0x41a8fa
or dword [ebp + 0x10], 0x40000
jmp 0x41a8fa
mov eax, dword [0x439690]
cmp eax, esi
je 0x41a8fa
push eax
call fcn.0040dde8
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41a8fa
mov eax, dword [0x439694]
cmp eax, esi
je 0x41a8fa
push dword [ebp - 4]
push eax
call fcn.0040dde8
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x43968c]
call fcn.0040dde8
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d470
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42bbd3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x437164]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x4396b8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x4396b8
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x42d7c2
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0041c840
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x642ae6
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.00642b1d
mov ebx, eax
xor ah, byte [esi]
call fcn.00642b1d
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x642b04
ret

Function at 0x642b1d
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x642b26
cmp byte [esi], 0
jne 0x642b23
pop edx
pop esi
pop ecx
ret

Function at 0x642b6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x642b82
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x644c96
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x644cf6
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x644cac
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6f546f2c
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0xccf2e71
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10009d30
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10009d52
mov eax, 0xfffffffd
jmp 0x10009e2f
mov ebx, dword [0x104806c0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10009dfd
mov ebx, dword [0x104806c0]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10009da1
mov ebx, dword [0x104806c0]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10009da1
mov eax, 1
jmp 0x10009da3
xor eax, eax
test eax, eax
je 0x10009dcf
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10009db8
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x104806c0]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10009e25
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10009e2f
mov esp, ebp
pop ebp
ret 4
Function at 0x10041a1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10041a3d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10041a3d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10041a47
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10041a89
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10041aeb
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10041ae6
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10041ad1
test dl, dl
je 0x10041acd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10041ad1
add ecx, 2
add eax, 2
test dl, dl
jne 0x10041ab1
xor eax, eax
jmp 0x10041ad6
sbb eax, eax
or eax, 1
test eax, eax
je 0x10041af7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10041a9e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8