joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ee0
Capabilities:
Check for software breakpoints

Disassembly:
enter 0x10c, 2
push ebx
push ecx
push edx
mov dword [ebp - 0xc], esp
movzx eax, byte [0x4d89fd]
dec eax
movzx eax, al
sub eax, 1
jbe 0x420f93
mov byte [ebp - 0x14], al
mov byte [ebp - 0x10], 1
inc byte [ebp - 0x10]
movzx eax, byte [ebp - 0x10]
movzx eax, byte [eax + 0x4d8d06]
cmp eax, 0xda
je 0x420f62
cmp eax, 0xce
je 0x420f62
cmp eax, 0xcc
jg 0x420f31
cmp eax, 0xc8
jge 0x420f62
cmp eax, 0xc5
je 0x420f62
cmp eax, 0xc3
jg 0x420f46
cmp eax, 0xbf
jge 0x420f62
cmp eax, 0xbc
jg 0x420f54
cmp eax, 0xb9
jge 0x420f62
cmp eax, 0xb4
je 0x420f62
cmp eax, 0xb3
jne 0x420f70
movzx eax, byte [ebp - 0x10]
mov byte [eax + 0x4d8d06], 0x20
jmp 0x420f8a
cmp eax, 0xcd
je 0x420f7e
cmp eax, 0xc4
jne 0x420f8a
movzx eax, byte [ebp - 0x10]
mov byte [eax + 0x4d8d06], 0x3d
dec byte [ebp - 0x14]
jne 0x420f06
push 0x4d8328
lea eax, [ebp - 0x114]
push eax
push 0x4d8d06
push 2
movzx eax, byte [0x4d89fd]
sub eax, 2
push eax
call fcn.00401cd0
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.00420e50
call fcn.00420d70
call fcn.0041a4f0
pop edx
pop ecx
pop ebx
leave
ret
Function at 0x427f72
Capabilities:
Check os version

Disassembly:
enter 0xa4, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov dword [ebp - 0xac], 6
mov dword [ebp - 0xa0], 0x94
lea ebx, [ebp - 0xa0]
push ebx
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
ja 0x427fb7
mov eax, dword [ebp - 0xac]
or eax, 0x20
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 4]
lea ebx, [eax + 0xbe]
push ebx
lea ecx, [eax + 0xba]
push ecx
push 0
push 0
push 2
push 0
push dword [ebp - 0xac]
call sub.winspool.drv_EnumPrintersA
mov edi, dword [ebp - 4]
cmp dword [edi + 0xba], 0
jbe 0x428047
push dword [edi + 0xba]
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov edi, dword [ebp - 4]
mov dword [edi], eax
lea ebx, [edi + 0xbe]
push ebx
lea eax, [ebp - 0xa4]
push eax
push dword [edi + 0xba]
push dword [edi]
push 2
push 0
push dword [ebp - 0xac]
call sub.winspool.drv_EnumPrintersA
test al, al
jne 0x428045
mov eax, dword [ebp - 4]
mov edi, 0
mov dword [eax + 0xbe], edi
push dword [eax]
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapFree
jmp 0x428059
mov eax, 0
mov dword [edi + 0xbe], eax
mov esi, 0
mov dword [edi], esi
pop edx
pop ecx
pop ebx
leave
ret

Function at 0x43de12
Capabilities:
Get graphical window text

Disassembly:
enter 0x110, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
movzx eax, byte [ebp + 0xc]
imul eax, eax, 0x16
mov edi, dword [ebp - 4]
lea eax, [edi + eax + 0x1009]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x12], 0
jbe 0x43de93
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp + 8]
inc eax
push eax
call fcn.004039f0
movzx eax, byte [ebp + 8]
inc eax
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax + 0x12]
call sub.user32.dll_GetWindowTextA
lea ebx, [ebp - 0x118]
push ebx
push dword [ebp - 0x14]
call fcn.004039a0
mov edi, dword [ebp + 0x10]
lea esi, [ebp - 0x118]
call fcn.00401940
lea eax, [ebp - 0x14]
push eax
movzx ebx, byte [ebp + 8]
inc ebx
push ebx
call fcn.004031c0
jmp 0x43dea0
mov edi, dword [ebp + 0x10]
mov esi, 0x4c67fd
call fcn.00401940
pop edx
pop ecx
pop ebx
leave
ret 0xc
Function at 0x4505c2
Capabilities:
Read data from internet
Receive data

Disassembly:
enter 0x140, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
lea eax, [eax + 0x114]
push eax
push dword [ebp + 8]
call fcn.004039f0
lea eax, [ebp - 0x18]
push eax
push 0x12c
call fcn.004039f0
mov edi, dword [ebp - 4]
push dword [edi + 0x114]
push 0x4cbd6c
call fcn.00419480
mov byte [ebp - 0x30], 1
mov byte [ebp - 0x2c], 1
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push pe_nt_image_headers32
call fcn.004039f0
push dword [ebp - 0x18]
push 0x4cbd6d
call fcn.00419480
push dword [ebp - 0x1c]
push 0x4cbd6e
call fcn.00419480
lea eax, [ebp - 0x24]
push eax
push 0xff
push dword [ebp - 0x1c]
mov edi, dword [ebp - 4]
push dword [edi + 0x12a]
call sub.wininet.dll_InternetReadFile
mov byte [ebp - 0x30], al
test al, al
je 0x4506a7
cmp dword [ebp - 0x24], 0
jbe 0x4506a5
mov ebx, dword [ebp - 0x20]
add ebx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
dec eax
cmp eax, ebx
jb 0x450675
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jmp 0x450680
mov eax, dword [ebp + 8]
dec eax
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
push dword [eax + 0x114]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
call fcn.00450790
push eax
call fcn.00450750
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x20], eax
jmp 0x4506a5
jmp 0x450703
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x2c], 0
push 0x4cbd6f
mov esi, 0x4cbd91
lea edi, [ebp - 0x130]
call fcn.00401b30
lea eax, [ebp - 0x148]
push eax
push 0
push dword [ebp - 0x24]
fild qword [esp]
add esp, 8
sub esp, 8
fstp qword [esp]
wait
push 7
push 0
call fcn.0040b7f0
lea esi, [ebp - 0x148]
lea edi, [ebp - 0x130]
call fcn.00401af0
mov eax, edi
push eax
call fcn.004135d0
mov al, byte [ebp - 0x2c]
test al, al
je 0x450723
mov bl, byte [ebp - 0x30]
test bl, bl
je 0x450717
cmp dword [ebp - 0x24], 0
jbe 0x450723
mov eax, dword [ebp - 0x20]
cmp dword [ebp + 8], eax
ja 0x45061d
lea eax, [ebp - 0x1c]
push eax
push pe_nt_image_headers32
call fcn.004031c0
lea ebx, [ebp - 0x18]
push ebx
push 0x12c
call fcn.004031c0
mov al, byte [ebp - 0x2c]
pop edx
pop ecx
pop ebx
leave
ret 4
Function at 0x4507c2
Capabilities:
Check http status code

Disassembly:
enter 0x228, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
lea eax, [eax + 0x114]
push eax
push 0x200
call fcn.004039f0
mov edi, dword [ebp - 4]
mov dword [edi + 0x104], 0xa
mov eax, 0
mov dword [edi + 0x108], eax
lea ebx, [edi + 0x108]
push ebx
lea eax, [edi + 0x104]
push eax
push dword [edi + 0x114]
push 0x13
push dword [edi + 0x12a]
call sub.wininet.dll_HttpQueryInfoA
mov byte [ebp - 0x18], al
test al, al
je 0x450946
lea ebx, [ebp - 0x118]
push ebx
mov eax, dword [ebp - 4]
push dword [eax + 0x114]
call fcn.004039a0
lea ecx, [ebp - 0x118]
push ecx
call fcn.0041ae80
mov dword [ebp - 0x14], eax
cmp eax, 0xc8
sete bl
mov byte [ebp - 0x18], bl
test bl, bl
jne 0x450944
mov eax, dword [ebp - 4]
mov dword [eax + 0x104], 0x200
mov edi, 0
mov dword [eax + 0x108], edi
lea ebx, [eax + 0x108]
push ebx
lea ecx, [eax + 0x104]
push ecx
push dword [eax + 0x114]
push 0x14
push dword [eax + 0x12a]
call sub.wininet.dll_HttpQueryInfoA
test al, al
je 0x450901
lea eax, [ebp - 0x118]
push eax
mov edi, dword [ebp - 4]
push dword [edi + 0x114]
call fcn.004039a0
lea ebx, [ebp - 0x118]
push ebx
mov esi, 0x4cbd9c
lea edi, [ebp - 0x218]
call fcn.00401b30
lea eax, [ebp - 0x230]
push eax
push 0
push dword [ebp - 0x14]
fild qword [esp]
add esp, 8
sub esp, 8
fstp qword [esp]
wait
push 7
push 0
call fcn.0040b7f0
lea esi, [ebp - 0x230]
lea edi, [ebp - 0x218]
call fcn.00401af0
mov eax, edi
push eax
call fcn.004135d0
jmp 0x450944
mov esi, 0x4cbda7
lea edi, [ebp - 0x118]
call fcn.00401b30
lea eax, [ebp - 0x218]
push eax
mov ebx, dword [ebp - 4]
push dword [ebx + 0x114]
call fcn.004039a0
lea esi, [ebp - 0x218]
lea edi, [ebp - 0x118]
call fcn.00401af0
mov eax, edi
push eax
push 0x4cbdb5
call fcn.004135d0
jmp 0x450955
push 0x4cbdb6
push 0x4cbdd5
call fcn.004135d0
mov eax, dword [ebp - 4]
lea ebx, [eax + 0x114]
push ebx
push 0x200
call fcn.004031c0
mov al, byte [ebp - 0x18]
pop edx
pop ecx
pop ebx
leave
ret

Function at 0x450b02
Capabilities:
Connect to http server

Disassembly:
enter 8, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push 3
push 0x4cbf6a
push 0x4cbf6b
mov bx, word [eax + 0x120]
push ebx
push dword [eax + 0x12e]
push dword [eax + 0x122]
call sub.wininet.dll_InternetConnectA
mov edi, dword [ebp - 4]
mov dword [edi + 0x126], eax
test eax, eax
jne 0x450b54
push 0x4cbf6c
push 0x4cbf86
call fcn.004135d0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x126], 0
setne bl
mov al, bl
pop edx
pop ecx
pop ebx
leave
ret

Function at 0x450b72
Capabilities:
Create http request

Disassembly:
enter 8, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x4000000
push 0x4cbf87
push 0x4cbf88
push 0
push 0x4cbf89
call sub.wininet.dll_InternetOpenA
mov edi, dword [ebp - 4]
mov dword [edi + 0x122], eax
test eax, eax
jne 0x450bb6
push 0x4cbf96
push 0x4cbfaa
call fcn.004135d0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x122], 0
setne bl
mov al, bl
pop edx
pop ecx
pop ebx
leave
ret
Function at 0x405230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push ebp
mov ecx, 8
mov esi, dword [0x41d038]
mov ebp, 0x8000
mov edx, dword [edi]
mov eax, esi
shr edx, 0x10
mov esi, dword [edi + 4]
shr esi, 0x10
xor edx, ebp
xor esi, ebp
add eax, edx
shr eax, 1
add edx, esi
shr edx, 1
xor eax, ebp
mov word [edi], ax
xor edx, ebp
mov word [edi + 4], dx
add edi, 8
dec ecx
jne 0x405249
mov dword [0x41d038], esi
pop ebp
pop edi
pop esi
pop ebp
ret

Function at 0x405280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push ebp
mov ecx, 8
mov ebp, 0x80008000
mov esi, dword [0x41d038]
mov ebx, 0xfffefffe
xor esi, ebp
mov edx, dword [edi + 4]
mov eax, esi
mov esi, dword [edi + 0xc]
xor edx, ebp
xor esi, ebp
and edx, ebx
and esi, ebx
add eax, edx
rcr eax, 1
add edx, esi
rcr edx, 1
xor eax, ebp
xor edx, ebp
mov dword [edi], eax
mov dword [edi + 8], edx
add edi, 0x10
dec ecx
jne 0x4052a1
xor esi, ebp
pop ebp
mov dword [0x41d038], esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4070e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x41d030], 0
push ebx
push esi
push edi
jne case.default.0x40710b
cmp dword [0x499410], 2
jne 0x4072b4
mov eax, dword [0x41e2e4]
cmp eax, 3
ja case.default.0x40710b
jmp dword [eax*4 + 0x40730c]
mov edi, dword [0x41e2dc]
mov edx, 0x10
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 4
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 0x10
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x407138
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x10
mov eax, dword [0x41e2e0]
lea esi, [0x4991f0]
mov ecx, 4
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 0x10
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x407190
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x20
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 8
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
push ebp
mov eax, dword [esi]
mov edx, dword [esi + 0xc0]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 4]
mov edx, dword [esi + 0xc4]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 8
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x4071e9
pop ebp
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x10
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 8
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 0xc0]
xor eax, 0x80008000
xor edx, 0x80008000
and eax, 0xfffefffe
and edx, 0xfffefffe
add eax, edx
mov ebx, dword [esi + 4]
rcr eax, 1
mov edx, dword [esi + 0xc4]
xor ebx, 0x80008000
xor edx, 0x80008000
and ebx, 0xfffefffe
and edx, 0xfffefffe
add esi, 8
add edx, ebx
rcr edx, 1
xor eax, 0x80008000
shl edx, 0x10
and eax, 0xffff
add edi, 4
xor edx, 0x80000000
or eax, edx
dec ecx
mov dword [edi - 4], eax
jne 0x407248
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x10
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 4
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 0x10
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x4072da
pop edi
pop esi
pop ebx
ret
Function at 0x407320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x41d030], 0
push ebx
push esi
push edi
jne case.default.0x40734b
cmp dword [0x499410], 2
jne 0x4074f4
mov eax, dword [0x41e2e4]
cmp eax, 3
ja case.default.0x40734b
jmp dword [eax*4 + 0x40754c]
mov edi, dword [0x41e2dc]
mov edx, 0x30
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 0xc
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 0x10
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x407378
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x30
mov eax, dword [0x41e2e0]
lea esi, [0x4991f0]
mov ecx, 0xc
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 0x10
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x4073d0
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x60
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
push ebp
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov ebp, 0x18
mov eax, dword [esi]
mov edx, dword [esi + 0xc0]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc4]
mov dword [edi], eax
shl edx, 0x10
and ecx, 0xffff
or edx, ecx
add esi, 8
mov dword [edi + 4], edx
add edi, 8
dec ebp
jne 0x407429
pop ebp
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x30
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 0x18
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 0xc0]
xor eax, 0x80008000
xor edx, 0x80008000
and eax, 0xfffefffe
and edx, 0xfffefffe
add eax, edx
mov ebx, dword [esi + 4]
rcr eax, 1
mov edx, dword [esi + 0xc4]
xor ebx, 0x80008000
xor edx, 0x80008000
and ebx, 0xfffefffe
and edx, 0xfffefffe
add esi, 8
add edx, ebx
rcr edx, 1
xor eax, 0x80008000
shl edx, 0x10
and eax, 0xffff
add edi, 4
xor edx, 0x80000000
or eax, edx
dec ecx
mov dword [edi - 4], eax
jne 0x407488
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x41e2dc]
mov edx, 0x30
mov eax, dword [0x41e2e0]
lea esi, [0x499130]
mov ecx, 0xc
add edx, eax
lea edi, [edi + eax*2]
mov dword [0x41e2e0], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
shl edx, 0x10
and eax, 0xffff
or eax, edx
mov ebx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi], eax
shl edx, 0x10
and ebx, 0xffff
or ebx, edx
add esi, 0x10
mov dword [edi + 4], ebx
add edi, 8
dec ecx
jne 0x40751a
pop edi
pop esi
pop ebx
ret

Function at 0x407560
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x493414], 2
jne 0x40756e
jmp fcn.00406ed0
jmp fcn.00406cc0
Function at 0x409190
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x48cd20]
lea esi, [0x48ad20]
shl eax, 0xc
mov cl, byte [0x41f488]
add esi, eax
lea edi, [0x48b520]
add edi, eax
cmp cl, 0
mov eax, esi
je 0x4091bc
mov esi, edi
mov edi, eax
mov ecx, dword [0x41f490]
xor eax, eax
shl ecx, 2
mov edx, 0x10
add esi, ecx
add edi, ecx
mov ebx, dword [edx*4 + 0x48cdc0]
dec edx
mov ecx, dword [eax*4 + 0x48ce00]
inc eax
mov dword [esi], ecx
xor ebx, 0x80000000
mov dword [edi], ebx
add edi, 0x40
add esi, 0x40
cmp eax, 0x10
jne 0x4091d0
xor eax, eax
add esi, 0x40
mov ebx, dword [0x48cdc0]
add edi, 0x40
mov dword [esi - 0x40], eax
xor ebx, 0x80000000
mov eax, 1
mov edx, 0x1f
mov dword [edi - 0x40], ebx
mov ebx, dword [edx*4 + 0x48cdc0]
dec edx
mov ecx, dword [eax*4 + 0x48cdc0]
inc eax
xor ebx, 0x80000000
xor ecx, 0x80000000
mov dword [esi], ebx
add esi, 0x40
mov dword [edi], ecx
add edi, 0x40
cmp eax, 0x10
jne 0x409219
pop edi
pop esi
pop ebx
ret

Function at 0x40a880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov eax, dword [0x48cd20]
lea esi, [0x48ad20]
shl eax, 0xc
mov cl, byte [0x41f488]
add esi, eax
lea edi, [0x48b520]
add edi, eax
cmp cl, 0
mov eax, esi
je 0x40a8ac
mov esi, edi
mov edi, eax
mov ecx, dword [0x41f490]
xor eax, eax
shl ecx, 2
mov edx, 0x10
add esi, ecx
add edi, ecx
mov ebx, dword [edx*4 + 0x48cdc0]
sub edx, 2
mov ecx, dword [eax*4 + 0x48ce00]
add eax, 2
mov dword [esi], ecx
xor ebx, 0x80000000
mov dword [edi], ebx
add edi, 0x80
add esi, 0x80
cmp eax, 0x10
jne 0x40a8c0
xor eax, eax
add esi, 0x80
mov ebx, dword [0x48cdc0]
add edi, 0x80
mov dword [esi - 0x80], eax
xor ebx, 0x80000000
mov eax, 2
mov edx, 0x1e
mov dword [edi - 0x80], ebx
mov ebx, dword [edx*4 + 0x48cdc0]
sub edx, 2
mov ecx, dword [eax*4 + 0x48cdc0]
add eax, 2
xor ebx, 0x80000000
xor ecx, 0x80000000
mov dword [esi], ebx
add esi, 0x80
mov dword [edi], ecx
add edi, 0x80
cmp eax, 0x10
jne 0x40a919
pop edi
pop esi
pop ebx
ret
Function at 0x401442
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x401459
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
je 0x40148e
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40148a
cmp edi, eax
jae 0x40148e
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40147c
cmp edi, eax
jb 0x401492
xor eax, eax
jmp 0x40149b
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x402b2a
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x48
mov eax, 0x44f328
call fcn.0042ecf6
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ebx
call fcn.004036d5
push 0xf0000000
xor esi, esi
inc esi
push esi
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push ebx
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call edi
test eax, eax
jne 0x402b8c
push ebx
push esi
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x402c18
cmp dword [ebp - 0x30], ebx
je 0x402c0e
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
xor eax, eax
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x28]
mov dword [ebp - 0x34], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ebx, [ebp - 0x20]
lea ecx, [ebp - 0x54]
call fcn.00402aac
push 0xffffffffffffffff
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x2c]
push 0
call fcn.004025ff
push 0
push esi
lea esi, [ebp - 0x54]
call fcn.004026e6
xor ebx, ebx
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x2c]
call fcn.0042ed79
ret
Function at 0x40407a
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x20
mov eax, 0x44f27c
call fcn.0042ec8d
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
ja 0x4040a4
push ebx
push 1
lea esi, [ebp + 8]
call fcn.004026e6
xor eax, eax
jmp 0x40418a
lea edi, [eax - 1]
lea eax, [ebp + 8]
call fcn.00401694
cmp word [eax], 0x5c
jne 0x4040dc
mov edi, dword [ebp + 0x1c]
dec edi
lea eax, [ebp + 8]
call fcn.00401694
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x4040d2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00402146
xor edi, edi
inc edi
cmp dword [ebp + 0x1c], 3
jb 0x40417d
lea eax, [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.0040268b
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x404101
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404113
test al, 0x10
je 0x404113
mov ebx, edi
push 0
push edi
lea esi, [ebp - 0x2c]
call fcn.004026e6
test ebx, ebx
jne 0x40417d
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov ebx, esp
sub esp, 0x1c
lea eax, [ebp + 8]
mov esi, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0040268b
call fcn.00404030
add esp, 0x1c
call fcn.0040407a
add esp, 0x1c
test eax, eax
je 0x40416c
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x40415b
lea eax, [ebp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x40416c
mov ebx, edi
jmp 0x40416e
xor ebx, ebx
push 0
push edi
lea esi, [ebp + 8]
call fcn.004026e6
mov eax, ebx
jmp 0x40418a
push 0
push edi
lea esi, [ebp + 8]
call fcn.004026e6
mov eax, edi
call fcn.0042ed65
ret
Function at 0x4052fa
Capabilities:
Check if file exists
Move file

Disassembly:
mov eax, dword [esi + 8]
push edi
xor edi, edi
mov dword [esi], vtable.CExtractOutFile.0
cmp eax, 0xffffffff
je 0x405321
lea ecx, [esi + 0x14]
push ecx
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or dword [esi + 8], 0xffffffff
cmp dword [esi + 0x10], edi
je 0x40534a
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x40534a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40534a
push 1
push dword [esi + 0x10]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x40535b
push eax
call fcn.0042cb0a
pop ecx
mov dword [esi + 0x10], edi
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x40536c
push eax
call fcn.0042cb0a
pop ecx
mov dword [esi + 0xc], edi
pop edi
ret

Function at 0x4066f6
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push ebp
push esi
push edi
mov edi, eax
add edi, 4
push dword [edi]
call ebx
push 0x3023
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x23
pop esi
call fcn.004439ba
push dword [edi]
mov esi, eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push esi
push 0x3024
push eax
call ebp
push 0x24
pop esi
call fcn.004439ba
push dword [edi]
mov esi, eax
call ebx
push esi
push 0x3023
push eax
call ebp
push 0x25
pop esi
call fcn.004439ba
push dword [edi]
mov esi, eax
call ebx
push esi
push 2
push eax
call ebp
push 0x3e9
push dword [edi]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
mov eax, edi
jne 0x40677e
push 2
jmp 0x406780
push 0
call fcn.0040526d
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret

Function at 0x406eb1
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, eax
add edi, 4
push 4
mov eax, edi
call fcn.0040526d
push 0x1e
pop esi
call fcn.004439ba
push dword [edi]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
call esi
push ebx
push 0
push 0x479
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi]
call esi
push 2
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret