joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40740b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x40742f
jl 0x407426
test esi, esi
jne 0x40742f
xor eax, eax
xor edx, edx
jmp 0x407526
cmp dword [edi + 0x38], 0
je 0x407444
push ebx
push esi
push dword [ebp + 8]
call fcn.0040752d
jmp 0x407526
mov eax, dword [edi + 0x1c]
mov edx, esi
mov dword [ebp - 8], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x407459
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40745b
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
test eax, eax
je 0x40749c
cmp eax, esi
jb 0x40746e
mov eax, esi
mov dword [ebp - 4], eax
push eax
push ecx
push dword [ebp + 8]
call fcn.00422a00
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp + 8]
sub edx, ecx
add eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], edx
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4074a2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x40751a
mov ecx, edi
call fcn.00406a9a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x4074f6
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.0043043a
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x4074f2
cmp edx, eax
ja 0x4074bf
jmp 0x4074f9
sub esi, edx
jmp 0x40751f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x40751d
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.0043043a
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x40751d
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x458888
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045847b

Function at 0x45f8ea
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f7be

Function at 0x4620df
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00461abd
Function at 0x405ebd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
push 0x45f328
call fcn.00412010
pop ecx
pop ecx
sub eax, esi
je 0x405edb
sub eax, 1
je 0x405ef4
jmp 0x405eef
mov eax, dword [ebp + 8]
mov dword [0x45f36c], eax
call fcn.00406780
call fcn.0040609c
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword [0x45f368]
test eax, eax
je 0x405f0a
push eax
call fcn.00405f37
pop ecx
mov dword [0x45f368], esi
mov eax, dword [0x45f370]
test eax, eax
je 0x405f1a
push eax
call fcn.004205c9
pop ecx
push str.Error_during_parsing_jnlp_file..._n
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004069a7
pop ecx
pop ecx
push 0xffffffffffffffff
call fcn.004208b5
int3

Function at 0x407428
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push esi
mov esi, dword [ebp + 0x11a4]
lea eax, [ebp - 0x74]
push edi
mov edi, dword [ebp + 0x11a0]
push edi
push 0x44db94
push 0x44dbc4
push 0xffffffffffffffff
push 0x1000
push eax
call fcn.004046a8
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4074c4
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x208
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x4074dd
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x1194]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ff49
add ebp, 0x1198
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80], 1
jne 0x4074c4
cmp dword [esi + 4], 0
je 0x4074f8
push dword [esi + 4]
call fcn.004205c9
pop ecx
push edi
call fcn.004146d8
mov ecx, eax
lea eax, [esi + 8]
push eax
push ecx
mov dword [esi + 4], ecx
call fcn.00406f86
add esp, 0xc
cmp dword [esi], 0
je 0x40751d
push dword [esi]
call fcn.004205c9
pop ecx
lea ecx, [ebp + 0xf8c]
push ecx
call fcn.004146d8
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
jmp 0x4074c6
Function at 0x407592
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00408324
push 2
pop esi
push 0x44dc38
mov word [ebp - 0x14], si
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x407633
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
je 0x40762c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, edi
je 0x40762c
push accept
push esi
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, edi
je 0x40762c
push dword [ebp - 0x12]
call dword [sym.imp.WSOCK32.dll_ntohs]
movzx eax, ax
mov dword [ebx], eax
mov eax, esi
jmp 0x407635
push esi
call fcn.004083c4
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ff49
leave
ret

Function at 0x4076d5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
push esi
movlpd qword [ebp - 0xc], xmm0
call fcn.00408324
push 2
pop esi
push dword [ebp + 8]
mov word [ebp - 0x14], si
call dword [sym.imp.WSOCK32.dll_htons]
push 0x44dc50
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40772c
or eax, 0xffffffff
jmp 0x407749
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x407747
push esi
call fcn.004083c4
pop ecx
jmp 0x407727
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ff49
leave
ret

Function at 0x408284
Capabilities:
Terminate process

Disassembly:
push 0x21010
push 0x44f018
push dword [esp + 0xc]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xb
call fcn.00409ee8
pop ecx
push eax
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
pop ecx
pop ecx
call fcn.00421336
push dword [esp + 4]
cmp dword [eax], 0
je 0x4082c9
call fcn.00422334
pop ecx
jmp 0x4082df
push 0x44f060
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
add esp, 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0xc
call fcn.00409ee8
pop ecx
push eax
push str._s__d_n
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
add esp, 0x10
push 0xffffffffffffffff
call fcn.004208b5
int3
Function at 0x408324
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x461390], 0
jne 0x4083a0
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.0040c03b
mov esi, eax
pop ecx
test esi, esi
jne 0x40836a
push str.wsock32.dll
call fcn.0040c03b
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
je 0x4083b5
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x40837f
push 0xe
jmp 0x4083b7
test edi, edi
je 0x408394
push str.WSASendDisconnect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46138c], eax
pop edi
mov dword [0x461390], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040ff49
add esp, 0x194
ret
push 0xd
call fcn.00409ee8
pop ecx
push eax
call fcn.00408284
int3
Function at 0x409761
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4097b0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x409827
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x409851
xor eax, eax
jmp 0x40989b
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x409892
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x228], ebx
je 0x40988b
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x409870
jmp 0x409891
mov esi, dword [ebp - 0x218]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ff49
leave
ret

Function at 0x4098a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4098ff
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
test eax, eax
jne 0x4098f9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x409901
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret

Function at 0x409daa
Capabilities:
Terminate process

Disassembly:
push 0xb
call fcn.00409ee8
pop ecx
push eax
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
pop ecx
pop ecx
call fcn.00421336
push dword [esp + 4]
cmp dword [eax], 0
je 0x409dd9
call fcn.00422334
pop ecx
jmp 0x409def
push str._t_s_n
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
add esp, 0xc
jmp fcn.00409d9d
Function at 0x40d9b6
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1044
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1058]
lea eax, [esp + 0x84c]
push edi
mov edi, dword [esp + 0x1058]
mov ebp, 0x800
push ebp
xor ebx, ebx
push ebx
push eax
call fcn.00411e00
push esi
push ebx
push edi
push 0xffffffffffffffff
lea eax, [esp + 0x86c]
push 0x400
push eax
call fcn.004046ea
add esp, 0x24
test eax, eax
jns 0x40da1e
xor eax, eax
mov word [esp + 0x104e], ax
push 0x40
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00411e00
lea eax, [esp + 0x1c]
push 0x20
push eax
call fcn.0040d936
push 0x43e7dc
lea eax, [esp + 0x28]
push 0x20
push eax
call fcn.0042396d
push ebp
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.00411e00
mov ecx, edi
add esp, 0x2c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40da5c
sub ecx, edx
sar ecx, 1
cmp ecx, 6
jbe 0x40daac
lea eax, [edi - 0xc]
mov edx, 0x43e7e0
lea eax, [eax + ecx*2]
mov si, word [eax]
xor ecx, ecx
inc ecx
cmp si, word [edx]
jne 0x40daa4
test si, si
je 0x40daa0
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x40daa4
add eax, 4
add edx, 4
test si, si
jne 0x40da7b
mov eax, ebx
jmp 0x40daa8
sbb eax, eax
or eax, ecx
test eax, eax
je 0x40daae
mov ecx, ebx
lea esi, [esp + 0x10]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40dab5
sub esi, edx
lea eax, [esp + 0x850]
push eax
sar esi, 1
mov edx, 0x43e800
test ecx, ecx
mov eax, str.Error:
cmove eax, edx
push eax
lea edi, [esi + esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x6c]
add eax, edi
push eax
call fcn.004046a8
add esp, 0x20
test eax, eax
jns 0x40db27
mov eax, dword [0x43e82c]
mov dword [esp + 0x846], eax
mov eax, dword [0x43e830]
mov dword [esp + 0x84a], eax
push edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.00411880
lea edi, [esp + 0x5c]
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x40db41
mov eax, dword [0x43e834]
mov dword [edi], eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff49
add esp, 0x1044
ret
Function at 0x40eae7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
xor esi, esi
inc edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
call fcn.0041f5c5
pop ecx
test eax, eax
je 0x40eb1d
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004239e2
add esp, 0xc
test eax, eax
jne 0x40eb3c
mov eax, edi
jmp 0x40eb68
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push dword [0x4525dc]
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40eb40
xor eax, eax
jmp 0x40eb68
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
cmove esi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x40efca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x40f039
push str.DeploymentRuleSet.jar
lea eax, [ebp - 0x804]
push eax
push str._sSunJavaDeployment_s
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040f50f
add esp, 0x14
test eax, eax
jle 0x40f039
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f039
test al, 0x10
jne 0x40f039
xor eax, eax
inc eax
jmp 0x40f03b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ff49
leave
ret

Function at 0x42b2bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ae0e

Function at 0x42fdfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042faad

Function at 0x42fe07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042fc37
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4034db
pop dword [ebp - 0x34]
mov eax, 0x1cb565fb
add eax, 0xe38acee0
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x59d45c15
sub dword [ebp - 0x44], 0xb8216ca
mov dword [ebp - 0x40], 0x60c3f78b
sub dword [ebp - 0x40], 0x2e90ab46
mov dword [ebp - 0x3c], 0x258648a0
sub dword [ebp - 0x3c], 0xd93a0472
mov dword [ebp - 0x38], 0xe3c77ff7
sub dword [ebp - 0x38], 0xe3c77ff7
lea eax, [ebp - 0x44]
push eax
mov eax, 0xcc962cfd
add eax, 0x33aa1357
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x77afcd67
add dword [ebp - 0x44], 0xfcc29bef
mov dword [ebp - 0x40], 0x66c3efca
sub dword [ebp - 0x40], 0x25578e55
mov dword [ebp - 0x3c], 0x94a8a18c
add dword [ebp - 0x3c], 0xcec6cae0
mov dword [ebp - 0x38], 0x1cbeaad8
add dword [ebp - 0x38], 0xe3415528
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd7b72b7c
add eax, 0x288914d4
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x384c0
push 0
call eax
mov ecx, 0x706e1526
sub ecx, 0x706dc781
xor ebx, ebx
add ebx, eax
mov edx, 0x23d91db4
add edx, 0xdc67664c
add edx, dword [ebp - 0x34]
mov edi, 0xf56fb2ae
sub edi, 0x945a8f7d
mov esi, dword [edx]
sub dword [ebp - 8], edx
xor esi, edi
xor dword [ebp - 0x28], 0xdea9275c
mov dword [ebx], esi
xor dword [ebp - 0x20], 0xa4c70d2
add ebx, 0x13b67e30
add ebx, 0xec4981d4
add edx, 0x36692f9b
add edx, 0xc996d069
loop 0x4035ff
add eax, 0x12967
mov ebx, eax
add eax, 0x5babbc57
sub eax, 0x5babbc52
mov ecx, 0xf9291225
add ecx, 0x716eddb
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x40893f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop ecx
sub eax, 1
call fcn.00408963
push eax
mov eax, dword [esp]
add esp, 4
xor dword [esi], ecx
inc esi
cmp esi, edi
jne fcn.0040893f
add edx, eax
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4047e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4047f4
pop dword [ebp - 0x44]
mov eax, 0xd8310c8d
add eax, 0x280f3b67
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x34f50
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x36ed
xor edx, edx
add edx, eax
mov ebx, 0xcb9b8970
sub ebx, 0xcb5a4dac
add ebx, dword [ebp - 0x44]
mov edi, 0x7822a9fe
sub edi, 0x1dca6919
mov esi, dword [ebx]
xor dword [ebp - 0x24], ebx
add esi, edi
add dword [ebp - 0x18], 0x3bfcf936
mov dword [edx], esi
xor dword [ebp - 0x38], 0x9eb05456
add edx, 0x8495e532
add edx, 0x7b6a1ad2
add ebx, 4
loop 0x40484a
add eax, 0xce87
mov ebx, eax
add eax, 5
mov ecx, 0xc2520c08
add ecx, 0x3dedf3f8
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402abc
Capabilities:
Allocate or change rwx memory

Disassembly:
pop eax
push eax
mov dword [0x40a6f1], eax
mov ebx, 0x40123e
and ebx, 0xfffff000
mov eax, 0x401969
sub eax, ebx
mov dword [0x40a6f5], eax
push 0x40a6f9
push 0x40
push dword [0x40a6f5]
push ebx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [0x40a6f1]
mov byte [eax], 0x90
ret

Function at 0x402c59
Capabilities:
Encode data using xor

Disassembly:
push eax
mov ebx, edi
sub ebx, 0x40123e
mov ah, bl
xor ah, 0x22
xor byte [edi], ah
inc edi
dec cl
jne 0x402c5a
pop eax
ret

Function at 0x407094
Capabilities:
Encode data using xor

Disassembly:
push eax
mov ebx, edi
sub ebx, 0x403130
mov ah, bl
and ebx, 7
add ebx, 0x403124
add ah, byte [ebx]
xor byte [edi], ah
inc edi
dec cl
jne 0x407095
pop eax
ret

Function at 0x408a6a
Capabilities:
Identify system language via api

Disassembly:
push eax
cmp eax, 0
je 0x408b68
call sub.KERNEL32.dll_GetUserDefaultLangID
and ax, 0xff
cmp ax, 7
jne 0x408a91
nop
nop
nop
nop
mov esi, 0x40d067
jmp 0x408afa
cmp ax, 0xc
jne 0x408aa5
nop
nop
nop
nop
mov esi, 0x40d0a0
jmp 0x408afa
cmp ax, 0x15
jne 0x408ab9
nop
nop
nop
nop
mov esi, 0x40d081
jmp 0x408afa
cmp ax, 0x16
jne 0x408acd
nop
nop
nop
nop
mov esi, 0x40d021
jmp 0x408afa
cmp ax, 0x14
jne 0x408ae1
nop
nop
nop
nop
mov esi, 0x40d048
jmp 0x408afa
cmp ax, 0xa
jne 0x408af5
nop
nop
nop
nop
mov esi, 0x40d0c1
jmp 0x408afa
mov esi, 0x40cffd
pop eax
push eax
push eax
push esi
push 0x40a8a6
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [0x40c8da], 0
jne 0x408b26
nop
nop
nop
nop
cmp word [0x40c8de], 0
je 0x408b68
nop
nop
nop
nop
mov esi, 0x40a8a6
inc esi
cmp byte [esi], 0xd
jne 0x408b2b
mov eax, 0
mov al, byte [0x40c8df]
push eax
mov al, byte [0x40c8de]
push eax
mov al, byte [0x40c8dd]
push eax
mov al, byte [0x40c8dc]
push eax
mov al, byte [0x40c8db]
push eax
mov al, byte [0x40c8da]
push eax
push 0x40d0e4
push esi
call sub.USER32.dll_wsprintfA
add esp, 0x20
pop eax
ret

Function at 0x4091d2
Capabilities:
Read .ini file

Disassembly:
push eax
push esi
mov eax, 0x101
push eax
push 0x40af3d
push 0x40d148
push edi
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov edi, 0x40af3d
cmp word [edi], 0x6968
pop ecx
jne 0x40926a
nop
nop
nop
nop
cmp ecx, 0
je 0x409267
nop
nop
nop
nop
push 0x101
push 0x40b131
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
cmp eax, 0
je 0x409267
nop
nop
nop
nop
mov edi, 0x40b131
add edi, eax
dec edi
cmp byte [edi], 0x5c
jne 0x409226
inc edi
movsb byte es:[edi], byte [esi]
cmp byte [esi - 1], 0
jne 0x40922d
push 0x40b131
push 0x101
push 0x40af3d
push 0x40d148
push 0x40d13a
push 0x40d120
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov edi, 0x40af3d
cmp word [edi], 0x6968
jne 0x40926a
nop
nop
nop
nop
mov al, 0x21
ret
add edi, eax
mov al, 0
ret