joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437298
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x43d0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x417fd9
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x417e33
sub eax, edx
sar eax, 1
je 0x417fd9
push edi
call dword [0x43817c]
test eax, eax
je 0x417fd9
push 0x14
push 0x65
push ebx
call dword [0x43801c]
mov esi, eax
cmp esi, ebx
je 0x417fcb
push esi
push ebx
call dword [0x438010]
mov edi, eax
cmp edi, ebx
je 0x417fd9
push esi
push ebx
call dword [0x438018]
cmp eax, ebx
je 0x417fd9
push eax
call dword [0x438014]
cmp eax, ebx
je 0x417fd9
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x30]
push ecx
push edi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004051a0
add esp, 8
cmp eax, ebx
je 0x417fb2
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
cmp edi, esi
je 0x417fb2
mov edx, dword [ebp + 8]
push 0x43a978
push edx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0042a9ad
add esp, 0xc
test eax, eax
jne 0x417fb2
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x417fb2
push eax
sub esi, edi
push esi
push 1
push edi
call fcn.0042ab4b
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
cmp esi, eax
sete cl
push edx
mov esi, ecx
call fcn.0042ac32
add esp, 0x14
cmp esi, ebx
je 0x417fb2
lea esi, [ebp - 0x20]
call fcn.004044e0
push 0x6b
mov byte [ebp - 4], 2
call fcn.00404a80
add esp, 4
cmp eax, ebx
je 0x417faa
push eax
mov eax, 0x6b
mov edi, esi
call fcn.00404650
cmp eax, ebx
je 0x417faa
mov edi, dword [ebp - 0x20]
cmp dword [edi - 0xc], ebx
je 0x417faa
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00404500
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0041a200
mov eax, edi
call fcn.0041a0e0
cmp eax, ebx
je 0x417fa2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [0x438048]
test eax, eax
je 0x417fa2
mov eax, dword [ebp - 0x14]
push 1
push ebx
push ebx
push eax
push ebx
push ebx
call dword [0x43816c]
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
call fcn.00419bb0
lea eax, [ebp - 0x20]
call fcn.00419bb0
lea esi, [ebp - 0x30]
call fcn.00405220
jmp 0x417fd9
push edi
call dword [0x43804c]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4182b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43712b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x43d0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, edx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x234]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004051a0
mov edi, dword [ebp - 0x234]
add esp, 8
cmp eax, ebx
je 0x418442
cmp edi, dword [ebp - 0x230]
je 0x418442
lea ecx, [ebp - 0x234]
call fcn.004055e0
push 0x43a9e4
push str.Shlwapi.dll
call dword [0x438008]
push eax
call dword [0x438004]
cmp eax, ebx
je 0x418442
push esi
call eax
cmp eax, ebx
je 0x4183d3
push esi
call dword [0x43804c]
test eax, eax
jne 0x4183d3
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x21c], dx
call fcn.0042b930
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [0x438054]
test eax, eax
je 0x418442
lea edx, [ebp - 0x21c]
push edx
push ebx
push ebx
mov eax, edx
push eax
call dword [0x438058]
test eax, eax
je 0x418442
push 1
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [0x43805c]
test eax, eax
je 0x418442
push 0x43a978
lea edx, [ebp - 0x220]
push esi
push edx
mov dword [ebp - 0x220], ebx
call fcn.0042a9ad
add esp, 0xc
test eax, eax
jne 0x418442
mov eax, dword [ebp - 0x220]
cmp eax, ebx
je 0x418442
mov esi, dword [ebp - 0x230]
push eax
sub esi, edi
push esi
push 1
push edi
call fcn.0042ab4b
mov eax, dword [ebp - 0x220]
push eax
call fcn.0042ae30
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.0042b020
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x220]
sete dl
push eax
mov dword [ebp - 0x224], edx
call fcn.0042ac32
add esp, 0x1c
cmp edi, ebx
je 0x41844f
push edi
call fcn.00429ecb
add esp, 4
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00429ed6
mov esp, ebp
pop ebp
ret
Function at 0x418490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437090
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43d0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea eax, [ebp - 0x18]
push 0x469cf0
xor edi, edi
push eax
xor esi, esi
mov dword [ebp - 4], edi
call fcn.00417730
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], edi
je 0x418565
cmp edi, 2
jge 0x418565
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test edi, edi
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [0x46ae00]
test eax, eax
jne 0x41855c
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test ebx, ebx
jne 0x418528
lea eax, [ebx + 0xd]
jmp 0x418548
push ebx
call dword [0x438060]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x43aa64
push esi
call dword [0x46ade4]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x41855c
push ecx
call dword [0x46addc]
mov ecx, dword [ebp - 0x18]
inc edi
jmp 0x4184e1
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4185a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4370c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43d0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x43e4f0
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00417730
add esp, 8
lea ecx, [ebp - 0x18]
push 0x43e568
push ecx
mov byte [ebp - 4], 1
call fcn.00417730
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [0x43d008]
mov eax, dword [edx + 0xc]
mov ecx, 0x43d008
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x6a
mov byte [ebp - 4], 3
call fcn.00404a80
add esp, 4
cmp eax, ebx
je 0x41aa21
push eax
lea eax, [ebx + 0x6a]
lea edi, [ebp - 0x14]
call fcn.00404650
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx - 0xc], ebx
je 0x41aaad
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], ebx
je 0x41aaad
cmp dword [esi - 0xc], ebx
je 0x41aaad
xor eax, eax
mov dword [ebp - 0x14], eax
nop
cmp eax, 2
jge 0x41aaad
xor ecx, ecx
cmp eax, ebx
setne cl
push 2
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
add ecx, 0x80000001
mov dword [ebp - 0x20], ebx
call fcn.0041a910
test eax, eax
jne 0x41aa91
mov edi, dword [ebp - 0x18]
cmp esi, ebx
je 0x41aa91
push esi
call dword [0x438060]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push edi
mov edi, dword [ebp - 0x28]
push edi
call dword [0x46ade4]
jmp 0x41aa94
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x41aaa2
push edi
call dword [0x46addc]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
jmp 0x41aa40
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41aacd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aaf0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ab12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ae50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [0x46ae08]
test eax, eax
jne 0x41aebe
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x41ae8d
cmp eax, 2
jne 0x41aea8
mov eax, dword [ebp - 4]
test esi, esi
je 0x41aeb8
test eax, eax
je 0x41aeb3
test al, 1
jne 0x41aea8
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x41aeb8
mov eax, 0xd
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.20z2fqnm]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.20z2fqnm]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.20z2fqnm]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.20z2fqnm]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.20z2fqnm]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.20z2fqnm]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40bc80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40bd12
mov eax, dword [0x418284]
test eax, eax
je 0x40bd06
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40bd81
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40bd27
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040b8d0
cmp eax, 7
jne 0x40bd9f
mov eax, dword [0x418284]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40bd72
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40bd90
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40bd53
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040b0e0
mov eax, dword [0x418284]
jmp 0x40bca2
mov dword [esp], edi
call fcn.0040b740
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40bcb7
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40bcf5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x40bcf5
call fcn.0040b0e0
mov eax, dword [0x418284]
jmp 0x40bce0
call fcn.0040b3b0
mov eax, dword [0x418284]
jmp 0x40bcad
call fcn.0040b3b0
mov eax, dword [0x418284]
jmp 0x40bceb
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40892d
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
add ebx, edi
call fcn.0040895d
and edi, ebx
xor dword [edx], esi
sub ebx, 0xd5864b4c
add edx, 1
add ebx, 1
cmp edx, eax
jne fcn.0040892d
sub edi, 0x348ed6f8
ret
Function at 0xc49c50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e000]
push edi
jmp 0xc49c6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc49c71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc49c60
mov eax, 1
add ebx, ebx
jne 0xc49c83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc49c78
jne 0xc49c94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc49c78
xor ecx, ecx
sub eax, 3
jb 0xc49ca8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc49d1a
mov ebp, eax
add ebx, ebx
jne 0xc49cb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xc49cc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xc49ce4
inc ecx
add ebx, ebx
jne 0xc49cd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc49cc5
jne 0xc49ce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc49cc5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc49d04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc49cf5
jmp 0xc49c66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc49d04
add edi, ecx
jmp 0xc49c66
pop esi
mov edi, esi
mov ecx, 0x651
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc49d22
cmp byte [edi], 5
jne 0xc49d22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc49d27
lea edi, [esi + 0x27000]
mov eax, dword [edi]
or eax, eax
je 0xc49d9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f49c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc49d54
mov ecx, edi
jns 0xc49d83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f52c]
or eax, eax
je 0xc49d99
mov dword [ebx], eax
add ebx, 4
jmp 0xc49d71
call dword [esi + 0x2f53c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xc49dd0
cmp al, 0xef
ja 0xc49dc3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xc49da5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xc49db2
mov ebp, dword [esi + 0x2f530]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc49e04
sub esp, 0xffffff80
jmp 0xc24f8f

Function at 0x408945
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.0040895a
add edx, edx
xor dword [ecx], eax
inc ecx
inc edx
cmp ecx, esi
jne fcn.00408945
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x409820
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b14d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x589ed0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x394]
push eax
lea ecx, [ebp - 0x14]
call fcn.004257d0
mov dword [ebp - 4], 0
cmp byte [edi + 0x18], 0
je 0x4099fb
push str.KafanInputDeployerMutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x409890
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409890
mov bl, 1
jmp 0x409896
xor bl, bl
test esi, esi
je 0x4098a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4099fb
push 0
call dword [sym.imp.rime.dll_RimeInitialize]
add esp, 4
cmp byte [ebp + 8], 0
je 0x4098c9
push 0
call dword [sym.imp.rime.dll_RimeStartMaintenance]
add esp, 4
test eax, eax
jne 0x4099fb
lea eax, [ebp - 0x10]
mov byte [edi + 0x18], 0
push eax
push str.kafaninput
mov dword [ebp - 0x10], 0
call dword [sym.imp.rime.dll_RimeConfigOpen]
add esp, 8
test eax, eax
je 0x4099e6
lea esi, [edi + 0x12c]
push 1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.0040e3d0
add esp, 4
lea ecx, [edi + 0x34]
push esi
call fcn.00409a50
lea edx, [edi + 4]
lea ecx, [ebp - 0x10]
call fcn.0040eeb0
mov esi, dword [sym.imp.rime.dll_RimeConfigGetCString]
lea eax, [ebp - 0x10]
push str.product_options_search_url
push eax
call esi
mov edx, eax
add esp, 8
test edx, edx
je 0x40994c
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409936
sub ecx, ebx
push ecx
push edx
lea ecx, [edi + 0x228]
call fcn.00406210
lea eax, [ebp - 0x10]
push str.product_options_website_url
push eax
call esi
mov edx, eax
add esp, 8
test edx, edx
je 0x40997b
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409965
sub ecx, ebx
push ecx
push edx
lea ecx, [edi + 0x240]
call fcn.00406210
lea eax, [ebp - 0x10]
push str.product_options_bbs_url
push eax
call esi
mov edx, eax
add esp, 8
test edx, edx
je 0x4099aa
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409994
sub ecx, ebx
push ecx
push edx
lea ecx, [edi + 0x258]
call fcn.00406210
lea eax, [ebp - 0x10]
push str.product_options_contact_url
push eax
call esi
mov edx, eax
add esp, 8
test edx, edx
je 0x4099d9
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4099c3
sub ecx, esi
push ecx
push edx
lea ecx, [edi + 0x270]
call fcn.00406210
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.rime.dll_RimeConfigClose]
add esp, 4
lea eax, [edi + 0x1c]
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x4099f8
mov eax, dword [eax]
mov byte [eax], 0
mov dword [ebp - 4], 1
mov eax, 0x80000000
mov ecx, dword [ebp - 0x14]
lock xadd dword [ecx], eax
test eax, 0x40000000
jne 0x409a2f
cmp eax, 0x80000000
jle 0x409a2f
lock bts dword [ecx], 0x1e
jb 0x409a2f
call fcn.00425660
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4