joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44954b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044984b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4496c3
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4496c3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x449672
jg 0x4495a4
test eax, eax
je 0x449668
push 1
push 0x1000
call fcn.0042fa00
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4495ca
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x44965f
push 0x8000
push ebx
call fcn.00421461
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4495f6
jg 0x4495f1
cmp ecx, 0x1000
jb 0x4495f6
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0043c32e
add esp, 0x10
cmp eax, 0xffffffff
je 0x44963b
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4495f1
jl 0x449622
test ecx, ecx
jne 0x4495e3
push dword [ebp - 0xc]
push ebx
call fcn.00421461
push esi
call fcn.0042e487
add esp, 0xc
xor edi, edi
jmp 0x4496d4
cmp byte [edi + 0x24], 0
je 0x449652
cmp dword [edi + 0x20], 5
jne 0x449652
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x44965d
mov edi, dword [edi + 0x18]
jmp 0x44965f
xor edi, edi
push esi
call fcn.0042e487
pop ecx
jmp 0x4496d4
test ecx, ecx
jg 0x449634
jl 0x449672
test eax, eax
jae 0x449634
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044643a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x449695
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x449634
jmp 0x4496cc
push ebx
call fcn.00439ffa
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x449634
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4496d4
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4496d1
mov edi, dword [edi + 0x18]
jmp 0x4496d4
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0044643a
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp int.00401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0xdd7408
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x60874584
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401fb0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0xee47
mov ecx, 0x18108
mov dword [ebp - 0x14], 0x6c63
mov edi, 0x6937
mov dword [ebp - 8], 0xf1b8
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 0x10
mov dword [ebp - 0x1c], 0x801
mov eax, 0x3c
mov dword [ebp - 0x18], 0xe294
mov edx, 0x7841
mov dword [ebp - 0xc], 0xd5e0
mov ebx, 0xca09
mov dword [ebp - 0x10], 0xac85
mov dword [ebp - 0x20], 0x1816c
mov esi, 0x14054
mov dword [ebp - 4], 0x2903c
mov dword [ebp - 0x24], 1
mov ecx, dword [ebp - 8]
add eax, 0x545b
and ecx, dword [ebp - 0x18]
add dword [ebp - 0x14], 0x82b
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
cmp esi, 0x3686
je 0x4020f2
mov ecx, dword [ebp - 0x1c]
add esi, 0xffffeff0
sub ecx, 0x141d0
and esi, 0x3620
cmp dword [ebp - 0xc], 0x3813
mov dword [ebp - 0x1c], ecx
je 0x4020f2
add dword [ebp - 0x20], 0xdb92
or edx, ecx
mov ecx, dword [ebp - 4]
sub esi, 0xddf1
sub edi, 0x180ab
mov dword [ebp - 0x2c], edx
or ebx, eax
cmp eax, 0x6fe2
jne 0x4020f5
xor dword [ebp - 0xc], 0x15aa3
and ecx, 0xd5c5
mov dword [ebp - 4], ecx
cmp edx, 0x1077c
jge 0x4020f5
push 0x7c6
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
mov edx, dword [ebp - 0x2c]
mov eax, 0x6fe2
sub eax, dword [ebp - 0x28]
add esp, 4
add dword [ebp - 0x10], edi
mov ecx, dword [ebp - 4]
xor ebx, 0x2453
and edi, 0x5d85
cmp ecx, 0x12e85
jne 0x402113
sub dword [ebp - 0x24], 1
jne 0x402050
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 8
mov ecx, 0x2249
call fcn.00401690
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403a00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
inc esi
cmp edi, 0x1497d
jne 0x403a51
push 0x630e
push 0x115ef
push 0x185a9
push 0x11a1e
push 0x10473
push 0x130ea
push 0xc75c
push 0x6d7a
push 0x17db9
mov edi, 0x1fd7f
call ebx
add esp, 0x24
cmp esi, 0x13282
jl 0x403a11
pop edi
pop esi
pop ebx
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 0x14
mov eax, 0xc1ee
pop ebp
ret
Function at 0x404640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov esi, 0x8f99
mov ecx, 0x18c2
push edi
mov edi, edx
mov edx, 0xbd22
cmp ebx, 0x72a3
jne 0x404672
mov dword [ebp - 8], 0xffffffee
mov eax, 0x190b4
jmp 0x40467e
mov eax, 0x16f52
mov dword [ebp - 8], 0xffff77a2
mov dword [ebp - 4], eax
add edx, 0xaaf0
lea eax, [ecx + 0xa722]
mov ecx, 0x16e1b
push eax
call fcn.00403d00
add esp, 4
lea edx, [eax - 0x11916]
test edx, edx
jle 0x4046d0
mov eax, dword [ebp - 4]
nop dword [eax + eax]
or ebx, dword [ebp - 8]
xor esi, edi
and eax, 0x8d88
and esi, 0x1d0a
mov ecx, edi
sub edx, 1
jne 0x4046b0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, 0x340
push 0x126e0
mov edi, 0x15bc
xor ebx, 0x1445
call fcn.00404700
add esp, 4
push 0x126e0
call fcn.00404700
mov edx, dword [ebp + 8]
add esp, 8
cmp edx, 0x7e12
jge 0x404a74
mov ecx, 0x7e12
sub ecx, edx
mov edx, 0x1692e
nop dword [eax + eax]
xor edx, edi
sub ebx, eax
and eax, 0x9d86
or edi, 0x10d99
sub ecx, 1
jne 0x404a60
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406740
Capabilities:
Encode data using xor
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x5a4b
xor ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov dword [ebp + 0xc], ebx
mov ecx, dword [ebp + 0x14]
and ecx, eax
mov dword [ebp - 0x1c], edx
and ebx, 0x1b7
mov dword [ebp - 0x18], 0x6416
push edi
mov dword [ebp - 0x28], ebx
mov edx, 0xa51e
mov ebx, dword [ebp + 8]
mov edi, 0x17e8c
mov dword [ebp - 0x14], 0x1835f
mov dword [ebp - 4], 0x11ff5
mov dword [ebp - 0x24], 0x3ccb
mov dword [ebp - 0xc], 0x12212
mov dword [ebp - 8], 0x106ee
mov dword [ebp - 0x20], 0x1d869
nop dword [eax + eax]
xor ecx, 0xfe58
or edx, 0x24cc
or esi, 0x144b6
mov dword [ebp + 0x14], ecx
cmp dword [ebp - 0x1c], 0x9da7
mov dword [ebp + 8], edx
jle 0x40681e
mov ecx, dword [ebp + 0x1c]
sub eax, 0x1505c
sub ecx, dword [ebp - 4]
or edi, edx
push 0x11f43
mov dword [ebp + 0x1c], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x20]
add esp, 4
sub eax, dword [ebp - 0x14]
add dword [ebp + 0xc], 0xf26e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
cmp ebx, 0x5180
jge 0x40681b
mov edx, dword [ebp - 0xc]
add dword [ebp - 0x18], eax
xor edx, edi
xor dword [ebp + 0x14], edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
and edx, 0x2612
inc dword [ebp + 0x10]
or ebx, dword [ebp + 0x1c]
add dword [ebp - 0x14], ecx
and ebx, 0xf91b
or dword [ebp - 8], 0x7862
xor ecx, 0xf0d7
xor dword [ebp - 0x24], eax
or esi, dword [ebp - 0x18]
or edi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], 0x164c9
mov dword [ebp - 0x28], ecx
je 0x406887
xor ebx, 0x1712c
xor edi, 0xddd
cmp ebx, 0x3e02
jbe 0x406887
or dword [ebp - 4], 0x1703e
xor dword [ebp + 0x1c], 0xb7a9
or dword [ebp - 0x1c], 0x5a72
mov ecx, dword [ebp - 0x20]
xor dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0x15ce0
mov ecx, dword [ebp + 0x14]
jl 0x4067b0
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0xa598]
call fcn.00403830
sub esp, 8
call fcn.00403610
mov ecx, eax
add esp, 8
lea eax, [ecx - 0xebfc]
test eax, eax
jle 0x4068dd
cmp dword [ebp - 0x24], 0xce1e
je 0x4068d2
xor esi, 0x1134e
sub eax, 1
jne 0x4068c5
jmp 0x4068dd
xor esi, 0x1134e
sub eax, 1
jne 0x4068d2
cmp esi, 0x11c0f
je 0x4068fb
cmp ecx, 0x175ae
jle 0x4068fb
push 0x14b4d
call dword [sym.imp.USER32.dll_MessageBeep]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov esi, 0xd458
mov dword [ebp - 0x18], ecx
mov edi, 0xddc5
mov dword [ebp - 0xc], 0x4bbc
mov ecx, 0x17ad0
mov dword [ebp - 0x10], 0x8c25
mov eax, 0x6d24
mov dword [ebp - 8], 0x1556a
mov ebx, 0x1574
mov dword [ebp - 0x1c], 0xac9b
mov edx, 0xa0f4
nop dword [eax]
or dword [ebp - 8], 0xd58d
and edx, 0xa106
cmp edi, 0x572d
je 0x4077a5
sub ebx, 0xc4da
cmp dword [ebp - 0x18], 0xc3f5
jge 0x4077a5
or ebx, 0x9557
add eax, 0x1670
sub edx, 0xac9b
inc dword [ebp - 0x14]
sub edi, eax
xor esi, dword [ebp - 0x18]
sub ecx, 0x12017
and dword [ebp - 0xc], 0xaa17
cmp dword [ebp - 0x14], 0x10071
jl 0x407770
xor esi, 0x12e2
mov dword [ebp - 4], 0x7260
mov eax, 0xa867
mov dword [ebp - 0x14], eax
cmp edi, 0x13740
jne 0x407830
mov eax, dword [ebp - 0xc]
xor ecx, 0x16e40
push 0xbd
push 0x6d9d
push 0x11519
push 0x2c6b
push 0x13e13
sub edx, ecx
mov dword [ebp - 0x18], ecx
add eax, 0x1857
add eax, edx
push 0x10b49
push 0x38e
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_SetScrollRange]
sub ebx, dword [ebp - 8]
add esp, 0x1c
add dword [ebp + 8], 0x8aa5
jmp 0x40783c
mov edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 8
mov ecx, 0x2249
call fcn.00401690
mov ecx, 0x127e9
call fcn.00401b30
mov ecx, dword [ebp - 0x14]
mov eax, 0x2de4
mov edx, dword [ebp - 4]
nop dword [eax]
or ebx, dword [ebp + 8]
xor esi, edi
xor eax, dword [ebp - 0xc]
inc edx
sub dword [ebp - 0x10], 0x3140
sub ecx, 0x2b336
mov dword [ebp - 0x14], ebx
and esi, 0x499b
mov ebx, 0xffff78f7
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
add ebx, 0xf1df
add dword [ebp - 0x1c], ebx
sub edi, eax
cmp dword [ebp - 8], 0xe560
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jge 0x40794c
sub esi, 0x16aa9
cmp ebx, 0xc77c
je 0x40794c
add dword [ebp - 0x10], ebx
or esi, 0x157ca
sub dword [ebp + 8], edi
cmp dword [ebp - 0x10], 0xc2a5
jle 0x40794c
add eax, 0x13671
add esi, edx
or eax, 0x1311f
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
and edi, eax
cmp dword [ebp - 0x1c], 0x2566
je 0x40794f
push 0xa0d3
push 0x14583
push 0x2924
push 0x8cf6
push 0x1472f
push 0xf5f
xor ecx, esi
sub ecx, 0x48bb
push 0x7ef6
push 0x13fa
mov dword [ebp - 0x14], ecx
and edi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x14]
add esp, 0x20
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp edx, 0x7261
jl 0x407880
pop edi
pop esi
pop ebx
mov eax, 0xffff78f7
mov esp, ebp
pop ebp
ret
Function at 0x407eb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0xee47
mov ecx, 0x18108
mov esi, edx
call fcn.00401170
mov edi, 0x2022
add esp, 4
sub edi, dword [ebp + 0x10]
cmp esi, 0x1d2b
jge 0x407eeb
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, 0x1148
mov esi, 0x300a
jmp 0x407ef5
mov edx, 0x11178
mov esi, 0x392a
sub esp, 0x18
lea eax, [edi + 0x2ff0]
add edx, 0x2109
push eax
call fcn.00403a00
add esp, 0x1c
lea eax, [esi + 0x106b1]
mov edx, 0x4237
push 0x1110a
push 0xd6a1
push ecx
push eax
sub esp, 8
push 0x2aac
push ecx
call fcn.00404100
add esp, 0x20
mov eax, 0x5ebd
pop edi
pop esi
pop ebp
ret

Function at 0x407fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x18], 0x144b
push ebx
push esi
push edi
mov esi, 0x121ed
mov edi, 0x4d57
mov ebx, 0x15ccc
jge 0x408057
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
cmp ebx, 0x172af
jle 0x408037
mov eax, dword [ebp + 0x1c]
add eax, 0x100fd
mov dword [ebp + 0x1c], eax
cmp eax, 0x5e9d
je 0x408037
push 0xd648
push 0x13e05
push 0x11929
push 0x14edc
push 0x61a7
push 0x17c5
push 0x11b98
push 0x4dbb
push 0x94e2
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [ebp + 8]
add esp, 0x24
inc ecx
add ebx, 0xb6a6
add edi, 0x1478a
mov dword [ebp + 8], ecx
xor esi, 0x41d2
cmp ecx, 0x161c
jl 0x407fe4
jmp 0x408074
mov eax, dword [ebp + 8]
nop word [eax + eax]
inc eax
add edi, 0x1478a
xor esi, 0x41d2
cmp eax, 0x161c
jl 0x408060
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 8
mov ecx, 0x2249
call fcn.00401690
push 0x5ad4
mov ecx, 0x11c9e
sub ecx, edi
push ecx
push 0x3ae9
push ecx
add ecx, 0x19638
push 0x7a
push ecx
push ecx
call fcn.004013a0
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x408210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
sub esp, 0xc
mov dword [ebp - 0xc], 0x800c
mov esi, edx
mov dword [ebp - 8], 0xeac7
mov edx, 0x1541a
mov dword [ebp - 0x10], esi
mov ebx, 0xb128
push 0x126e9
push 0x6f00
call fcn.004043b0
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 0x14
push 0x3507
push ecx
call fcn.00401980
add esp, 0x10
mov edx, 0xcaa2
push 0x8c88
push 0x5dc3
push 0x16a09
push 0xc66a
push ecx
call fcn.00402dd0
mov edi, dword [ebp + 0x10]
add esp, 0x14
or dword [ebp + 8], 0xf85e
xor edi, 0x15bf0
cmp esi, 0x4634
mov dword [ebp - 4], 0x268d
mov esi, dword [ebp + 0xc]
mov edx, 0x9bba
mov ecx, 0xbee
mov eax, 0xfffed6a1
cmove ecx, edx
mov edx, 0x2987
xor dword [ebp - 4], 0x15987
add edx, 0x16548
sub esi, 0xc00b
and ebx, 0xf49f
add eax, 0x101e8
inc ecx
cmp edx, 0xbe73
jle 0x40831d
sub dword [ebp - 0xc], esi
sub ebx, 0x139b1
cmp eax, 0x2eed
je 0x40831d
and dword [ebp + 8], 0x9821
xor esi, 0xa9f8
add edi, 0xfb3f
or dword [ebp - 8], esi
cmp ecx, 0xbef
jl 0x4082d0
and dword [ebp - 0x10], 0xb885
add ebx, 0xffffe353
mov edx, dword [ebp - 8]
and esi, 0x7a92
mov ecx, dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ebx
cmp edx, 0xd4e
jne 0x4083aa
or ecx, 0x101eb
add ebx, 0xb5ee
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], ebx
cmp eax, 0x1771b
je 0x4083aa
push 0x11393
push 0x146ca
call dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, dword [ebp + 0xc]
add ebx, 0xd1a1
mov ecx, dword [ebp - 4]
or esi, 0x23b5
mov dword [ebp + 0x10], ebx
add esp, 8
mov ebx, dword [ebp + 8]
mov edx, 0xfffffc9b
xor eax, ebx
xor esi, eax
cmp dword [ebp - 0xc], 0x7039
jle 0x4083ad
add esi, 0x13909
jmp 0x4083ad
mov ebx, dword [ebp + 8]
sub edi, esi
cmp dword [ebp + 0x10], 0x5c33
jge 0x4083f7
mov eax, dword [ebp - 0x10]
sub eax, ebx
cmp eax, 0x12759
jle 0x4083f7
cmp edx, 0x38aa
jle 0x4083f7
xor edi, ecx
cmp eax, 0x153d1
jle 0x4083f7
push 0x14419
push 0x3335
push 0x13a51
push 0x150a1
push 0x172bb
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4099d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xee47
mov ecx, 0x18108
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x185a5
mov edi, 0xce75
mov esi, 0x11ac2
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 8
mov ecx, 0x2249
call fcn.00401690
mov eax, dword [ebp + 0x10]
add eax, 0x1417a
mov dword [ebp - 0x10], 0x1356f
cmp dword [ebp + 0xc], 0x693a
mov dword [ebp - 0xc], 0xf667
mov dword [ebp - 8], eax
je 0x409a42
add eax, 0xc3c3
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0x18]
mov eax, 0x14199
sub eax, 0xa81a
and ebx, 0x8e55
cmp dword [ebp - 0x18], 0x9a59
mov dword [ebp - 4], eax
jne 0x409ac7
push 0x11679
push 0x1339b
push 0x17fca
push 0xe068
push 0xc87b
push 0x14bfe
push 0xa31f
push 0x11366
push 0x131e9
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0x24
cmp dword [ebp + 0x18], 0xa83b
jge 0x409ac7
mov eax, dword [ebp + 0xc]
mov edx, 0xffff7e79
xor eax, dword [ebp + 0x10]
and dword [ebp - 4], 0x9460
and eax, 0x118de
add ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebp + 0xc], eax
and edi, 0xce75
jmp 0x409acc
mov edx, 0xb3e8
sub esp, 8
add edx, 0xffff6f5c
call fcn.00407970
add eax, 0xfffea5b7
add esp, 8
mov ecx, 0xf667
test eax, eax
jle 0x409b0a
mov edx, dword [ebp - 8]
nop
sub edx, dword [ebp + 0xc]
and ecx, 0x16170
or edi, 0x1158e
sub eax, 1
jne 0x409af0
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov edx, 0x15e16
mov eax, 0x15e17
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [ebp + 0x18], eax
nop dword [eax]
mov eax, dword [ebp - 0x10]
xor esi, 0x1b6f
and eax, 0x1337e
add edi, 0x6008
and esi, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0x9165
jge 0x409b8f
cmp esi, 0xace8
jae 0x409b8f
mov eax, dword [ebp - 0x14]
cmp eax, 0xb3ef
jle 0x409b8f
push 0x1633b
push 0x2743
push 0x14a68
push 0x156cd
and eax, ecx
or ebx, 0x17a93
push 0x15a11
push 0x1243d
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
add esp, 0x18
or dword [ebp - 4], edi
mov edx, dword [ebp - 4]
xor ecx, edx
sub esi, 0xc796
add ebx, 0xffffa7c8
mov dword [ebp - 0xc], ecx
sub dword [ebp + 0x18], 1
jne 0x409b20
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00403820
sub esp, 8
call fcn.00403610
add esp, 4
call fcn.00401a70
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x422040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xee47
mov ecx, 0x18108
mov ebx, 0x219c6
call fcn.00401170
add esp, 4
push 0x5ad4
push ecx
push 0x3ae9
push ecx
push 0x7a
push 0x11df5
push ecx
call fcn.004013a0
add esp, 0x10
mov esi, 0x149a0
push 0xc6eb
sub esp, 0x10
call fcn.004035c0
add esp, 0xc
call fcn.00406ee0
add esp, 4
mov dword [0x47eddc], 0
mov edi, eax
push 0xc466
sub esp, 0xc
call fcn.00404b60
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [0x47edf0], 0x137b87
call fcn.00404370
push 0xee47
mov ecx, 0x18108
mov dword [ebp - 4], eax
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
add esp, 0xc
lea ecx, [edi + 0x8efe]
call fcn.004064e0
add esp, 0x14
call fcn.00407550
push ecx
push 0xd290
sub esp, 8
call fcn.00407680
mov ecx, 0x16f61
call fcn.00401710
add esp, 4
push 0x139f3
call fcn.00406000
add esp, 0x14
push 0x425c
push ecx
push 0x2d8b
push ecx
push 0xba1c
call fcn.00406a50
mov edi, dword [ebp - 4]
push 0xee47
mov dword [0x47edf4], 0x19fa0c
lea ecx, [edi + 0x1d6b]
call fcn.00401170
call fcn.00406bd0
add esp, 4
mov dword [ebp - 8], eax
call fcn.00406ee0
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
mov ecx, dword [ebp - 8]
add esp, 0x1c
xor ecx, 0x30bf
lea eax, [ecx - 0x1eff]
test eax, eax
jle 0x4221ae
nop dword [eax]
xor edi, 0x17fac
sub eax, 1
jne 0x4221a0
mov dword [ebp - 4], edi
add ecx, 0xff6a
call fcn.00404a80
sub esp, 0xc
push 0x15f83
call fcn.00406150
add esp, 0xc
mov edx, 0x183a7
mov edi, eax
push 0xc1fd
push 0xb3ec
push ecx
push 0x7799
mov ecx, 0x7663
call fcn.00403290
mov ecx, 0x16f61
call fcn.00401710
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
push 0xee47
mov ecx, 0x18108
call fcn.00401170
mov eax, dword [ebp - 0xc]
add esp, 0x24
add eax, 0x2935
nop dword [eax + eax]
inc esi
cmp edi, 0x13683
jg 0x422251
cmp edi, 0x525e
je 0x422262
add ebx, 0xe3d5
or eax, 0x10e6c
or edi, 0x675f
cmp esi, 0x149a1
jl 0x422240
push 0xa28f
push 0x7f11
push 0x51c2
push 0xa13c
push 0xd5f1
push 0x5af0
push 0x63b4
push 0xd2c7
mov edx, 0x8060
mov dword [ebp - 8], eax
mov ecx, 0xbe68
call fcn.0040f3c0
add esp, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [ebp - 4]
lea ecx, [ebx - 0x1dffe]
and esi, dword [ebp - 8]
sub esp, 0x18
mov dword [0x47eddc], eax
call fcn.004064e0
sub esp, 8
call fcn.004051e0
add esp, 0x14
push 0x12e64
sub esp, 0xc
call fcn.00401de0
mov ecx, 0x2249
call fcn.00401690
call fcn.00401fb0
add esp, 0x18
lea ecx, [esi - 0xab3]
call fcn.00405f80
push 0xc1fd
push 0xb3ec
push ecx
push 0x7799
mov edx, 0x183a7
mov ecx, 0x7663
call fcn.00403290
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42755d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42759c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42759c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42759c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42759c
cmp dword [ecx + 0x74], 0xe
jbe 0x42759c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433984
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4339c3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4339c3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4339c3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4339c3
cmp dword [ecx + 0x74], 0xe
jbe 0x4339c3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x453609
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004534dd