joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047f5
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [ebp + 0x10]
push 0x419
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x41d
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret

Function at 0x404831
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
mov esi, 0x415c58
push esi
push dword [ebp + 8]
call sub.MSVCRT.dll__wfopen
mov edi, eax
xor ebx, ebx
cmp edi, ebx
pop ecx
pop ecx
je 0x404929
push edi
push 1
lea eax, [ebp - 8]
push 2
push eax
mov dword [ebp - 8], ebx
call sub.MSVCRT.dll_fread
push edi
call sub.MSVCRT.dll_fclose
add esp, 0x14
cmp word [ebp - 8], 0xfeff
mov dword [ebp - 4], ebx
jne 0x404885
mov dword [ebp - 4], 1
push esi
push dword [ebp + 8]
call sub.MSVCRT.dll__wfopen
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
mov edi, eax
je 0x4048a8
push edi
push 1
lea eax, [ebp - 8]
push 2
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov esi, 0x400
push esi
call fcn.00401863
push edi
push esi
lea eax, [ebp - 0x410]
push 1
push eax
mov byte [ebp - 0x410], bl
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, ebx
je 0x40491f
cmp word [ebp - 8], 0xfeff
mov byte [ebp + eax - 0x410], bl
jne 0x4048fa
mov ecx, dword [ebp + 0xc]
mov byte [ebp + eax - 0x40f], bl
lea eax, [ebp - 0x410]
push eax
call fcn.00401221
jmp 0x4048b6
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 4]
call fcn.004010d3
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00401203
lea ecx, [ebp - 4]
call fcn.00401911
jmp 0x4048b6
push edi
call sub.MSVCRT.dll_fclose
pop ecx
push 1
pop ebx
lea ecx, [ebp + 8]
call fcn.00401911
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x405425
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x4261b4]
xor ebx, ebx
cmp ecx, ebx
push edi
je 0x405451
mov ecx, dword [ecx]
lea eax, [esi + 0x214]
mov dword [eax], ecx
add dword [0x4261b8], 4
cmp dword [eax], ebx
jmp 0x40547d
push dword [esi + 0x20c]
lea edi, [esi + 0x214]
push 1
push 4
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
jae 0x40547b
push str.Read_Error
mov ecx, esi
call fcn.00404f48
cmp dword [edi], ebx
je 0x4055bb
mov ecx, esi
call fcn.00405190
mov ecx, esi
call fcn.00404fb7
lea edi, [esi + 0x220]
mov ecx, 0x3f1
mov eax, 0x20202020
rep stosd dword es:[edi], eax
cmp dword [esi + 0x214], ebx
mov dword [ebp - 4], 0xfc4
mov dword [ebp - 8], ebx
jbe 0x4055bb
mov edi, 0xfff
mov ecx, esi
call fcn.004051b6
mov ebx, eax
cmp bx, 0x100
jge 0x40551f
mov eax, dword [0x4261c4]
test eax, eax
je 0x4054f3
mov ecx, dword [0x4261c8]
lea edx, [ecx + 1]
cmp edx, dword [0x4261c0]
jge 0x405504
mov byte [ecx + eax], bl
inc dword [0x4261c8]
jmp 0x405504
push dword [esi + 0x210]
movsx eax, bx
push eax
call sub.MSVCRT.dll_putc
pop ecx
pop ecx
mov eax, dword [ebp - 4]
movsx ecx, ax
inc eax
and eax, edi
inc dword [ebp - 8]
mov byte [ecx + esi + 0x220], bl
mov dword [ebp - 4], eax
jmp 0x4055ac
mov ecx, esi
call fcn.004052f6
xor ecx, ecx
mov cx, ax
mov eax, dword [ebp - 4]
sub eax, ecx
dec eax
lea ecx, [ebx - 0xfd]
and eax, edi
test cx, cx
jle 0x4055ac
movsx eax, ax
mov dword [ebp - 0xc], eax
movsx eax, cx
add dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
and eax, edi
movzx bx, byte [eax + esi + 0x220]
mov eax, dword [0x4261c4]
test eax, eax
je 0x405580
mov ecx, dword [0x4261c8]
lea edx, [ecx + 1]
cmp edx, dword [0x4261c0]
jge 0x405591
mov byte [ecx + eax], bl
inc dword [0x4261c8]
jmp 0x405591
push dword [esi + 0x210]
movsx eax, bx
push eax
call sub.MSVCRT.dll_putc
pop ecx
pop ecx
mov eax, dword [ebp - 4]
movsx ecx, ax
inc eax
and eax, edi
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
mov byte [ecx + esi + 0x220], bl
mov dword [ebp - 4], eax
jne 0x40554d
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x214]
jb 0x4054be
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4071ed
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [0x49f4e0]
cmp esi, 2
push edi
mov dword [ebp - 4], ecx
je 0x40720b
cmp esi, 3
jne 0x407223
push 5
pop edi
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x407262
inc edi
cmp edi, 0x100
jl 0x40720e
push 1
pop edi
cmp esi, edi
je 0x40722f
cmp esi, 3
jne 0x40729b
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
cmp dword [0x415eb8], eax
mov ecx, dword [ebp - 8]
jne 0x40724f
cmp dword [0x415ebc], ecx
je 0x40729b
cmp dword [0x415ec0], edi
mov dword [0x415eb8], eax
mov dword [0x415ebc], ecx
je 0x407291
xor esi, esi
cmp dword [0x49f50c], esi
jne 0x40727a
cmp dword [0x415e90], esi
je 0x40727a
mov dword [0x427234], esi
push esi
call sub.MSVCRT.dll_time
add eax, dword [0x415ea0]
pop ecx
mov dword [0x49f50c], eax
jmp 0x407347
mov dword [0x415ec0], 2
xor esi, esi
cmp dword [0x49f50c], esi
jle 0x407339
push esi
call sub.MSVCRT.dll_time
mov edx, dword [0x49f50c]
sub edx, eax
cmp edx, esi
pop ecx
jg 0x4072c2
mov dword [0x49f50c], esi
mov eax, dword [0x42619c]
push 0x7f
mov dword [ebp - 0x20c], eax
pop ecx
xor eax, eax
push edx
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
push str._03d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x49f724
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x407347
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 4]
push 0x41b
push dword [eax + 0x830]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x407347
cmp dword [0x415e90], esi
je 0x407347
mov dword [0x427234], edi
pop edi
pop esi
leave
ret
Function at 0x409af7
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0x204
push esi
mov esi, ecx
jne 0x409b0b
call fcn.0040a244
jmp 0x409b80
push dword [esi + 0x830]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x409b72
push ebx
push edi
push 5
push dword [esi + 0x830]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
xor edi, edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0x830]
call ebx
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0x830]
call ebx
push 3
push edi
push edi
push edi
push edi
push edi
push dword [esi + 0x830]
call ebx
push dword [esi + 0x830]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop ebx
jmp 0x409b80
push 0
push dword [esi + 0x830]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x40acc2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push 0x40023
push 0xcb
mov edi, ecx
call fcn.004032ee
pop ecx
push eax
push 0xca
call fcn.004032ee
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40adc7
push 0
push dword [0x40f1e8]
call fcn.0040b5df
pop ecx
pop ecx
call fcn.0040c2eb
push str._Uninstall
lea ecx, [ebp - 8]
call fcn.004010d3
push 0x416b10
lea ecx, [ebp - 4]
call fcn.004010d3
lea eax, [ebp - 8]
push eax
push dword [0x40f1e8]
lea ecx, [ebp - 0x14]
call fcn.00401075
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00404938
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404938
lea ecx, [ebp - 0x10]
call fcn.00401911
lea ecx, [ebp - 0x14]
call fcn.00401911
lea ecx, [ebp - 4]
call fcn.00401911
lea ecx, [ebp - 8]
call fcn.00401911
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a885
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00404938
push 5
push 0
push 0
push dword [eax]
push str.open
push dword [edi + 0x830]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.00401911
lea ecx, [ebp - 0x10]
call fcn.00401911
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0xc]
call fcn.00401911
pop edi
leave
ret

Function at 0x40af27
Capabilities:
Terminate thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push dword [esi + 0x810]
mov dword [esi], 0x40d470
push 7
push 2
push dword [esi + 0x81c]
call fcn.0040afc1
mov esi, dword [esi + 8]
test esi, esi
je 0x40af5c
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret

Function at 0x40af5e
Capabilities:
Terminate thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push dword [esi + 0x810]
push 7
push 2
push dword [esi + 0x81c]
call fcn.0040afc1
mov eax, dword [esi + 8]
test eax, eax
je 0x40af91
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 8], 0
pop esi
ret
Function at 0x40b04e
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
push edi
mov ebx, str.Shell_TrayWnd
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x40b08b
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x40b08b
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x40b14f
lea eax, [ebp - 0x24]
push eax
push 5
mov dword [ebp - 0x24], 0x24
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x40b0f1
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x40b0d5
dec eax
je 0x40b0b6
dec eax
je 0x40b0d5
dec eax
jne 0x40b14f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
mov dword [eax], edx
add ecx, 0xfffffff0
mov dword [eax + 8], ecx
jmp 0x40b14f
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x40b0d0
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x40b12e
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x40b11c
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x40b14f
add eax, 0xffffffe2
jmp 0x40b14c
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b186
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x40b1c5
call fcn.0040b154
test eax, eax
je 0x40b1c5
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.0040b04e
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8
Function at 0x40b2a6
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x810], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x80c], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, esi
call fcn.0040b1f0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40b2df
mov dword [esi + 0x814], eax
cmp dword [ebp + 0x18], 0
je 0x40b311
mov eax, dword [esi + 8]
test eax, eax
je 0x40b2f8
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x40b319
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14

Function at 0x40b581
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0x10], eax
push esi
setne al
and dword [ebp + 0x10], 0
lea ecx, [ebp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40b5d5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x40b5df
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 0xc], eax
push esi
setne al
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40b621
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
Function at 0x40b642
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x208
lea ecx, [ebp - 0x41c]
push ecx
push eax
call fcn.0040b62b
mov eax, dword [0x42619c]
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push 0x416b94
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x214]
push str.___bg
push eax
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x42619c]
mov dword [ebp - 0xc1c], eax
add esp, 0x24
xor eax, eax
cmp dword [ebp + 0xc], esi
mov ecx, 0x1ff
lea edi, [ebp - 0xc18]
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 4], esi
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
pop edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b761
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x40b75d
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
jmp 0x40b763
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40bb32
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
push edi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push esi
push edi
push 4
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push edi
push edi
push edi
push 2
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, esi
mov esi, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x414949
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41f2d0
cmp edx, dword [eax]
je 0x41496b
add eax, 8
inc ecx
cmp eax, 0x41f360
jl 0x41495c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41f2d0]
jne 0x414a99
mov eax, dword [0x423980]
cmp eax, 1
je 0x414a73
test eax, eax
jne 0x41499c
cmp dword [0x41efb8], 1
je 0x414a73
cmp edx, 0xfc
je 0x414a99
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4149d3
lea eax, [ebp - 0x1a4]
push 0x41af08
push eax
call fcn.00413520
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00411ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x414a16
lea eax, [ebp - 0x1a4]
push eax
call fcn.00411ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41af04
push edi
call fcn.0040f4d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x41aee8
push eax
call fcn.00413520
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00413530
lea eax, [ebp - 0xa0]
push 0x41aee4
push eax
call fcn.00413530
push dword [esi + 0x41f2d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00413530
push 0x12010
lea eax, [ebp - 0xa0]
push 0x41aebc
push eax
call fcn.004162b5
add esp, 0x2c
pop edi
jmp 0x414a99
lea eax, [ebp + 8]
lea esi, [esi + 0x41f2d4]
push 0
push eax
push dword [esi]
call fcn.00411ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1006fa60
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
cmp esp, dword [ecx]
salc
sub edx, dword [esp + ebp]
movsb byte es:[edi], byte [esi]
insd dword es:[edi], dx
sal ebx, cl
invalid

Function at 0x10421919
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.10421950
mov ebx, eax
xor ah, byte [esi]
call fcn.10421950
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x10421937
ret

Function at 0x10421950
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x10421959
cmp byte [esi], 0
jne 0x10421956
pop edx
pop esi
pop ecx
ret

Function at 0x104219a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x104219b5
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10423acb
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x10423b2b
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x10423ae1
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc
Function at 0x10520ff3
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc ebp, ecx
into
stosd dword es:[edi], eax
add dl, ah
insb byte es:[edi], dx
jg 0x10520f49
adc cl, dh
in eax, 0x9c
sub esp, 4
in al, dx
add al, 0
add byte [eax], al
mov dword [esp], ebp
mov dword [esp], 0x7eef1549
sub dword [esp], 0x76ff1932
inc dword [esp]
sub dword [esp], 0xb2418c3f
and dword [esp], 0x24fea677
add dword [esp], 0x609193c6
add dword [esp], 0x9ac04a9b
push edi
mov dword [esp], 0x7ba6e9dd
push ecx
mov ecx, 0x7c8e2b0
sub dword [esp + 4], ecx
pop ecx
push edi
mov edi, 0x738fee3d
xor dword [esp + 4], edi
pop edi
push ecx
mov dword [esp], 0xff97dc1
mov dword [esp], ebp
mov dword [esp], ecx
mov dword [esp], ebp
mov dword [esp], eax
push ebp
mov dword [esp], esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], esi
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push esi
push esp
pop esi
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
push dword [esp + 8]
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push edi
mov edi, esp
push ebx
mov ebx, 0x3bf5ee73
not ebx
sub ebx, 0xc40a1188
add edi, ebx
pop ebx
push edx
mov edx, 4
add edi, edx
mov edx, dword [esp]
add esp, 4
xchg dword [esp], edi
pop esp
mov eax, dword [esp]
push ebx
mov ebx, esp
push esi
mov esi, 4
add ebx, esi
pop esi
push eax
mov eax, 0x77fba0f2
push edi
mov edi, 0x3af2bb24
and eax, edi
pop edi
add eax, 0x1ffdd055
or eax, 0x36ff7124
sub eax, 0x7b75c22e
shl eax, 3
sub eax, 0xdc4d7a34
add ebx, eax
pop eax
xchg dword [esp], ebx
pop esp
jmp 0x103afe8a

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x50250c27
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6feb6a0b
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219