joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29840bbe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x29840bcd
pop dword [ebp - 0x30]
mov eax, 0xe8b25c4d
sub eax, 0xbf2e5080
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x6b565c26
add dword [ebp - 0x40], 0xe2fbe925
mov dword [ebp - 0x3c], 0xfe6f2caf
add dword [ebp - 0x3c], 0x33c41f96
mov dword [ebp - 0x38], 0xf5b55aa3
sub dword [ebp - 0x38], 0xa9691675
mov dword [ebp - 0x34], 0x22d2aa36
sub dword [ebp - 0x34], 0x22d2aa36
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xa3913506
add dword [ebp - 0x40], 0xd0e13450
mov dword [ebp - 0x3c], 0x78ea2602
sub dword [ebp - 0x3c], 0x377dc48d
mov dword [ebp - 0x38], 0xe3fd4e3b
add dword [ebp - 0x38], 0x7f721e31
mov dword [ebp - 0x34], 0x53ce54b8
sub dword [ebp - 0x34], 0x53ce54b8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x91ed2a53
add eax, 0x97984665
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4bd67
push 0
call eax
mov ecx, 0x3f016d90
sub ecx, 0x3f011760
xor esi, esi
add esi, eax
mov edx, 0x29896400
add edx, dword [ebp - 0x30]
mov edi, 0xc16a885d
add edi, 0xca10173b
xor dword [ebp - 0x20], 0x44c9080b
mov ebx, dword [edx]
add dword [ebp - 8], 0xeb8233f6
xor ebx, edi
sub dword [ebp - 0x1c], esi
mov dword [esi], ebx
xor dword [ebp - 0x24], 0xc7167ffb
add esi, 0x5eabfc16
sub esi, 0x5eabfc12
add edx, 0x661b6683
sub edx, 0x661b667f
loop 0x29840ce6
add eax, 0xf3fa5680
add eax, 0xc06f513
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x29800000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4014a2
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
and dword [ebp - 0x44c], 0
mov dword [0x41a534], 0x6538
push 0x6538
call fcn.0040384e
pop ecx
mov dword [0x41a52c], eax
push 0x6538
push 0x405030
push dword [0x41a52c]
call fcn.0040198a
add esp, 0xc
push 0x100
call fcn.0040384e
pop ecx
mov dword [0x41a530], eax
push 0x100
push 0x40b56c
push dword [0x41a530]
call fcn.0040198a
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [0x40babc], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x40bac8], eax
cmp dword [0x40bac8], 0
jne 0x401535
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.VirtualProtect
push dword [0x40bac8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40bab4], eax
cmp dword [0x40bab4], 0
jne 0x40155c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040119d
cmp dword [0x405008], 9
jne 0x40158e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [0x405010], 0
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp loc.0041b252
Function at 0x4013da
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov edx, dword [0x863f8c]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x20], esi
push edi
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
cmp edx, 0x594
jne 0x40141b
push ebx
lea eax, [ebp - 0x850]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x863f8c]
mov eax, dword [0x41b2f8]
lea ecx, [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x30], 0x9e3779b9
mov dword [ebp - 0x1c], eax
call fcn.004013ce
add dword [ebp - 8], 0x23f
cmp edx, 0x14
jne 0x401458
push ebx
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov ecx, dword [0x41b300]
mov ebx, dword [0x41b304]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x863f8c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x863f88]
cmove eax, edx
xor edx, edx
cmp dword [0x863f8c], 0x3eb
mov dword [0x863f88], eax
mov eax, dword [0x863ee0]
cmove eax, edx
mov edx, dword [ebp - 8]
mov dword [0x863ee0], eax
lea edx, [edx + edi]
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
add dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 4]
mov dword [0x863f84], 0xf4ea3dee
call fcn.004013ab
mov ecx, dword [ebp - 0x10]
xor ecx, eax
mov dword [ebp - 4], eax
cmp dword [0x863f8c], 0x213
mov dword [ebp - 0x10], ecx
jne 0x401531
lea eax, [ebp - 0x3c]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub esi, ecx
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ebx, esi
mov ecx, dword [ebp - 0xc]
add eax, esi
mov edx, dword [ebp - 4]
shr ebx, cl
xor edx, eax
add ebx, dword [ebp - 0x1c]
cmp dword [0x863f8c], 0xb03
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
jne 0x401573
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
xor edx, ebx
mov ecx, edi
mov dword [ebp - 4], edx
call fcn.004013d5
mov edi, eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
jne 0x401474
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015ae
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x863f8c]
sub esp, 0x400
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x863ee4]
test esi, esi
je 0x4015fc
cmp eax, 0x959
jne 0x4015e8
push 0
lea eax, [ebp - 0x400]
push eax
push str.peturoj
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.004013da
add edi, 8
dec esi
je 0x4015fc
mov eax, dword [0x863f8c]
jmp 0x4015cd
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40c6e2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a550]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004070c7
mov dword [ebp - 0x14], eax
cmp dword [0x44ad4c], esi
jne 0x40c7d5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c762
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c8b5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c8b5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c8b5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x44ad4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44ad50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x44ad54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44ad5c], eax
test eax, eax
je 0x40c7d2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44ad58], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c7fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c7ed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c80f
push 4
pop eax
jmp 0x40c8b7
cmp dword [ebp - 0x14], esi
je 0x40c80f
push dword [0x44ad4c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c7f4
mov eax, dword [0x44ad58]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c86d
cmp dword [0x44ad5c], edi
je 0x40c86d
push eax
call ebx
push dword [0x44ad5c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c86d
test eax, eax
je 0x40c86d
call ecx
test eax, eax
je 0x40c862
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c862
test byte [ebp - 8], 1
jne 0x40c86d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c89d
mov eax, dword [0x44ad50]
cmp eax, edi
je 0x40c89a
push eax
call ebx
test eax, eax
je 0x40c89a
call eax
mov esi, eax
test esi, esi
je 0x40c89a
mov eax, dword [0x44ad54]
cmp eax, edi
je 0x40c89a
push eax
call ebx
test eax, eax
je 0x40c89a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44ad4c]
call ebx
test eax, eax
je 0x40c8b5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c8b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x41a1e8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a1ec]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0x2d5112c], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x454]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov ecx, dword [0x41a1f0]
mov edx, dword [str._rQJ]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x2d5112c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d51128]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x2d5112c], 0x3eb
mov dword [0x2d51128], eax
mov eax, dword [0x2d5107c]
cmove eax, dword [ebp - 8]
mov dword [0x2d5107c], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], edx
and dword [ebp - 8], 0
mov dword [0x2d51124], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x2d5112c], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x401359
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x2d5112c], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139c
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jne 0x40127f
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb47
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406d97
mov dword [ebp - 0x14], eax
cmp dword [0x457808], esi
jne 0x40bc3a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40bbc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40bd1a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40bd1a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40bd1a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x457808], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45780c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x457810], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457818], eax
test eax, eax
je 0x40bc37
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457814], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40bc5f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40bc52
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40bc74
push 4
pop eax
jmp 0x40bd1c
cmp dword [ebp - 0x14], esi
je 0x40bc74
push dword [0x457808]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40bc59
mov eax, dword [0x457814]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40bcd2
cmp dword [0x457818], edi
je 0x40bcd2
push eax
call ebx
push dword [0x457818]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40bcd2
test eax, eax
je 0x40bcd2
call ecx
test eax, eax
je 0x40bcc7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40bcc7
test byte [ebp - 8], 1
jne 0x40bcd2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40bd02
mov eax, dword [0x45780c]
cmp eax, edi
je 0x40bcff
push eax
call ebx
test eax, eax
je 0x40bcff
call eax
mov esi, eax
test esi, esi
je 0x40bcff
mov eax, dword [0x457810]
cmp eax, edi
je 0x40bcff
push eax
call ebx
test eax, eax
je 0x40bcff
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x457808]
call ebx
test eax, eax
je 0x40bd1a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40bd1c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040398d
mov esp, ebp
pop ebp
ret
Function at 0x4051c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40a6a8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x4051df
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x40a6a4], 1
mov byte [0x40a6a0], bl
jne 0x405239
mov ecx, dword [0x40aa28]
test ecx, ecx
je 0x405227
mov esi, dword [0x40aa24]
sub esi, 4
cmp esi, ecx
jb 0x405227
mov eax, dword [esi]
test eax, eax
je 0x405220
call eax
mov ecx, dword [0x40aa28]
sub esi, 4
cmp esi, ecx
jae 0x405212
push 0x407014
push 0x407010
call fcn.00405270
add esp, 8
push 0x40701c
push 0x407018
call fcn.00405270
add esp, 8
test ebx, ebx
jne 0x405260
push ebp
mov dword [0x40a6a8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x1d048fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d5f8c0
sub esp, 0x1c
sub eax, 0x8f33677
push eax
lea ecx, [ebp - 0x1a]
call fcn.01d06342
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb al, al
inc al
je 0x1d0496b
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d04939
sub eax, edx
push esi
mov esi, eax
mov eax, 0x1d5f8d4
sub eax, 0x19797830
push eax
lea ecx, [ebp - 0x14]
call fcn.01d0637f
push esi
push dword [ebp + 8]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x1d04f1f
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.01d048fb
push 0x26394866
lea ecx, [ebp - 0x1b]
call fcn.01d062ca
push eax
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp + 8], eax
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1d04f7d
mov eax, dword [esi + 0x74c]
push ebx
push ebx
push 0x478
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp + 8], ebx
pop edi
pop esi
pop ebx
je 0x1d04f8e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4
Function at 0x1d05ba2
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x1d56ee5
call fcn.01d55708
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CCSListView.4.0
mov dword [esi + 0x94], vtable.CCSListView.3.0
mov dword [esi + 0x98], vtable.CCSListView.2.0
mov dword [esi + 0x9c], vtable.CCSListView.1.0
mov dword [esi + 0xa0], vtable.CCSListView.0
push 0x3e8
push dword [esi + 0x734]
mov dword [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1d05c04
push 1
push dword [esi + 0x734]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x734]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esi + 0x730]
test ebx, ebx
je 0x1d05c28
mov ecx, ebx
call fcn.01d3f0aa
push ebx
call sub.mfc100.dll_Ordinal_1296
pop ecx
and dword [esi + 0x730], 0
lea ecx, [esi + 0x750]
call fcn.01d22814
push dword [esi + 0x750]
call sub.mfc100.dll_Ordinal_1296
pop ecx
lea ecx, [esi + 0x738]
mov byte [ebp - 4], 6
call fcn.01d3fcae
lea ecx, [esi + 0x5bc]
mov byte [ebp - 4], 5
call dword [sym.imp.SkinControls.dll_public_virtual:_void___thiscall_CSkinSplitter::destructor_void_]
mov edi, dword [sym.imp.SkinControls.dll_public_virtual:_void___thiscall_CSkinButton::destructor_void_]
lea ecx, [esi + 0x4e8]
mov byte [ebp - 4], 4
call edi
lea ecx, [esi + 0x414]
mov byte [ebp - 4], 3
call edi
lea ecx, [esi + 0x25c]
mov byte [ebp - 4], 2
call fcn.01d35bc1
lea ecx, [esi + 0x254]
mov byte [ebp - 4], 1
call sub.mfc100.dll_Ordinal_1004
lea ecx, [esi + 0xa4]
mov byte [ebp - 4], 0
call fcn.01d36966
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.mfc100.dll_Ordinal_946
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1d06164
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0x4c
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x83bdb00]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d0618e
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xb
jl 0x1d0616d
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d0619f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push 0xd
mov esi, ecx
pop ebx
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx - 0x57cd1e03]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d061c9
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 5
jl 0x1d061a8
mov byte [esi + 5], 0
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1d061da
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xfd
xor edx, edx
mov eax, dword [esp + 0xc]
mov al, byte [eax + edx + 0x7ac6db82]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x1d06206
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 5
jl 0x1d061e5
mov byte [esi + 5], 0
mov eax, esi
pop esi
pop ebx
ret 4