joyce8/EMBER2024-capa huggingface dataset:
Function at 0x729fe195
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [ebx + 0x30]
push edi
and dword [eax], 0
mov esi, dword [ecx + 0x34]
mov edi, dword [esi + 0xd88]
test edi, edi
je 0x729fe1e3
mov eax, dword [esi + 0xdc0]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x58]
test edx, edx
je 0x729fe1df
mov edx, dword [edx + 0x74]
mov edx, dword [edx]
cmp byte [edx + 0x37], 0x1d
jne 0x729fe1df
cmp dword [eax + 0x40], 0
jne 0x729fe1df
cmp eax, ecx
jne case.default.0x729fe36e
test edi, edi
jne 0x729fe249
mov eax, dword [ebp + 0x14]
sub eax, 0xa1
je 0x729fe200
dec eax
dec eax
je 0x729fe200
sub eax, 0x15e
je 0x729fe200
dec eax
dec eax
jne case.default.0x729fe36e
mov eax, dword [ebx + 0x24]
and eax, 8
cmp al, 8
jne case.default.0x729fe36e
mov eax, dword [ebp + 0x1c]
movsx ecx, ax
shr eax, 0x10
cmp dword [ebp + 0x14], 0x201
mov dword [ebp - 8], ecx
movsx eax, ax
mov dword [ebp - 4], eax
je 0x729fe22e
cmp dword [ebp + 0x14], 0x203
jne 0x729fe238
lea eax, [ebp - 8]
push eax
push ebx
call fcn.7298c02a
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call fcn.729fe64d
push 1
pop eax
jmp 0x729fe28a
mov ebx, dword [esi + 0xdc0]
mov eax, ebx
push dword [eax + 0x30]
call fcn.7298c410
mov edi, dword [ebp + 0x14]
cmp ebx, eax
je 0x729fe268
cmp edi, 0x215
jne 0x729fe280
cmp dword [ebp + 0xc], ebx
jne 0x729fe291
cmp edi, 0x1012
je 0x729fe27a
cmp edi, 0x1f
jne 0x729fe291
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push esi
call fcn.729fea69
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18
cmp edi, 0x14
ja 0x729fe2d5
je 0x729fe30f
cmp edi, 0xf
je 0x729fe30f
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi + 0xdc0]
jne case.default.0x729fe36e
mov eax, dword [ebp + 0x1c]
movsx edx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 4], eax
mov eax, 0xa0
cmp edi, eax
mov dword [ebp - 8], edx
ja 0x729fe323
je 0x729fe34e
cmp edi, 0x20
jne case.default.0x729fe36e
call fcn.729fe437
jmp 0x729fe28a
cmp edi, 0x85
je 0x729fe30f
cmp edi, 0x88
je 0x729fe30f
cmp edi, 0xff
jbe 0x729fe29d
cmp edi, 0x102
jbe case.0x729fe36e.513
cmp edi, 0x103
jbe 0x729fe29d
cmp edi, 0x106
jbe case.0x729fe36e.513
jmp 0x729fe29d
cmp dword [esi + 0xd8c], 0
je 0x729fe29d
push esi
call fcn.729fe5bd
jmp 0x729fe29d
mov eax, 0x200
cmp edi, eax
ja 0x729fe35f
je 0x729fe344
lea eax, [edi - 0xa1]
cmp eax, 8
ja case.default.0x729fe36e
jmp dword [eax*4 + 0x729fe3bd]
lea eax, [ebp - 8]
push eax
push ecx
call fcn.7298c02a
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.729fe7b5
jmp case.0x729fe36e.513
add edi, 0xfffffdff
cmp edi, 8
ja case.default.0x729fe36e
jmp dword [edi*4 + 0x729fe3e1]
lea eax, [ebp - 8]
push eax
push ecx
call fcn.7298c02a
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jl case.0x729fe36e.513
push 4
call edi
test ax, ax
jl case.0x729fe36e.513
push 2
call edi
test ax, ax
jl case.0x729fe36e.513
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.729fe9d2
jmp case.0x729fe36e.513
Function at 0x729feb7a
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 1
mov bx, word [eax + 4]
mov ecx, dword [edi + 0x30]
mov esi, dword [ecx + 0x34]
pop ecx
cmp dword [eax], ecx
jne 0x729feb9b
mov ebx, ecx
movzx eax, bx
test eax, eax
jl 0x729fec1e
cmp eax, ecx
jle 0x729febce
cmp eax, 2
jne 0x729fec1e
cmp dword [esi + 0xd88], 0
je 0x729febca
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.729fe9d2
xor eax, eax
jmp 0x729febff
cmp dword [esi + 0xd88], 0
je 0x729febde
push ecx
push esi
call fcn.729fea69
cmp bx, 1
jne 0x729febca
push dword [edi + 0x30]
mov esi, dword [edi + 0x3c]
call fcn.7298c52e
push esi
push edi
call fcn.7298d02a
test eax, eax
je 0x729fec06
mov eax, 0x16c
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call fcn.729fe64d
jmp 0x729febca
push 5
pop eax
jmp 0x729febff

Function at 0x729fec23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
and dword [ebp + 8], 0
push esi
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
inc eax
shr eax, 1
je 0x729fec46
mov cx, word [esi]
xor word [ebp + 8], cx
inc esi
inc esi
dec eax
jne 0x729fec3a
mov cl, byte [ebp + 8]
xor eax, eax
mov al, byte [ebp + 9]
pop esi
xor eax, ecx
pop ebp
ret 4

Function at 0x72a015e3
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [ebp + 8]
push esi
push edi
and dword [ebp - 4], 0
push 8
and dword [eax], 0
pop esi
push 3
mov dword [ebp - 0x14], esi
pop edi
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 9
call fcn.7294a0ba
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x72a0162c
mov eax, 0x800a0209
pop edi
pop esi
pop ebx
leave
ret 8
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x72a016b8
xor edi, edi
lea esi, [ebp - 0x14]
push dword [esi]
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x72a01690
inc edi
add esi, 4
cmp edi, 4
jb 0x72a0163c
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push ebx
call esi
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x72a01685
cmp dword [0x72a50ac0], eax
je 0x72a01673
cmp ebx, 2
jne 0x72a01673
push 9
call esi
push 0
push 0
push eax
push ebx
push edi
push dword [ebp + 8]
call fcn.72a013e7
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
jmp 0x72a01625
mov ebx, dword [ebp + edi*4 - 0x14]
cmp ebx, 3
jne 0x72a01651
mov esi, dword [sym.imp.USER32.dll_EnumClipboardFormats]
push 0
call esi
test eax, eax
je 0x72a01651
cmp eax, 3
je 0x72a016b4
cmp eax, 0xe
je 0x72a016b4
push eax
jmp 0x72a016a1
mov ebx, eax
jmp 0x72a01651
cmp ebx, 2
je 0x72a01651
cmp ebx, edi
je 0x72a01651
cmp ebx, esi
je 0x72a01651
cmp ebx, 0xe
je 0x72a01651
cmp ebx, 9
je 0x72a01651
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 0x800a01cc
jmp 0x72a01625
Function at 0x1101262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0110126e

Function at 0x11018e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.011018fa

Function at 0x1101961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.01101974

Function at 0x110c262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0110c26e

Function at 0x110c8e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.0110c8fa

Function at 0x110c961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.0110c974
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401c66
pop dword [ebp - 0x28]
mov eax, 0xce620848
sub eax, 0xce21ebe2
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe1472d56
sub dword [ebp - 0x38], 0x92f4e80b
mov dword [ebp - 0x34], 0x77cbda5d
sub dword [ebp - 0x34], 0x45988e18
mov dword [ebp - 0x30], 0x55f48aeb
sub dword [ebp - 0x30], 0x9a846bd
mov dword [ebp - 0x2c], 0xcda7e635
sub dword [ebp - 0x2c], 0xcda7e635
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa111abe5
add eax, 0x5f2e846f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8daffc3b
add dword [ebp - 0x38], 0xe6c26d1b
mov dword [ebp - 0x34], 0xbf5c5a55
add dword [ebp - 0x34], 0x82100720
mov dword [ebp - 0x30], 0x69b8b9fa
sub dword [ebp - 0x30], 0x6494d8e
mov dword [ebp - 0x2c], 0xe4fd3112
sub dword [ebp - 0x2c], 0xe4fd3112
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35cd2
push 0
call eax
mov ecx, 0x33fd12a7
add ecx, 0xcc0332a1
xor esi, esi
add esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x28]
mov edi, 0x3b8d09c5
add edi, 0x5c35a53a
sub dword [ebp - 0xc], 0x50604adb
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0xa9ed21e
xor ebx, edi
sub dword [ebp - 0x1c], 0x1455620
mov dword [esi], ebx
add dword [ebp - 0xc], 0x6ee6ced0
add esi, 0xb78d8179
add esi, 0x48727e8b
add edx, 0x41c8f186
add edx, 0xbe370e7e
loop 0x401d7f
add eax, 0x86a4e494
add eax, 0x795c235f
mov ebx, eax
add eax, 5
mov ecx, 0x96cec70c
sub ecx, 0x968ec70c
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401900
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x401960
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401a56
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x4019d0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x4019a5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x4019b5
cmp byte [esp + 0x1e], 0
je 0x4019b5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x4019b5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x401cf0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x406030
call sym._EnterCriticalSection_4
mov ebx, dword [0x406048]
sub esp, 4
test ebx, ebx
je 0x401d3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d34
test esi, esi
je 0x401d34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d10
mov dword [esp], 0x406030
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x401cb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401cfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401cf4
test esi, esi
je 0x401cf4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401cd0
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401ee0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402008
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f6e
cmp eax, 4
jne 0x401f90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f7e
cmp edx, 4
je 0x401f7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401ee0

Function at 0x403fdf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404037
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x405c74
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40402a
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x404039
xor eax, eax
pop esi
leave
ret 4
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
jmp loc.0040a02c

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1005f33d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1005f34c
pop dword [ebp - 0x30]
mov eax, 0xcf8d731a
sub eax, 0xbf877fce
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xf63b6007
sub dword [ebp - 0x40], 0xa7e91abc
mov dword [ebp - 0x3c], 0x922d74ce
sub dword [ebp - 0x3c], 0x5ffa2889
mov dword [ebp - 0x38], 0xbc6156d
add dword [ebp - 0x38], 0x40862ec1
mov dword [ebp - 0x34], 0x4c8b9aa9
sub dword [ebp - 0x34], 0x4c8b9aa9
lea eax, [ebp - 0x40]
push eax
mov eax, 0x8b5cd1d
add eax, 0x752a317
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xf7c9d094
add dword [ebp - 0x40], 0x7ca898c2
mov dword [ebp - 0x3c], 0xe9659993
add dword [ebp - 0x3c], 0x5806c7e2
mov dword [ebp - 0x38], 0x885d7d1b
add dword [ebp - 0x38], 0xdb11ef51
mov dword [ebp - 0x34], 0x7d4ba8f1
sub dword [ebp - 0x34], 0x7d4ba8f1
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a633
push 0
call eax
mov ecx, 0xda0737c6
add ecx, 0x25f90155
xor edi, edi
add edi, eax
mov edx, 0xcb98b3a2
sub edx, 0xbb8d23a2
add edx, dword [ebp - 0x30]
mov esi, 0xd5928a57
sub esi, 0x24180b02
sub dword [ebp - 0x14], edx
mov ebx, dword [edx]
add dword [ebp - 0x18], ecx
xor ebx, esi
xor dword [ebp - 0x24], edi
mov dword [edi], ebx
mov dword [ebp - 8], 0xef1523c
add edi, 4
add edx, 0x86e1488f
add edx, 0x791eb775
loop 0x1005f46b
add eax, 0xd73f
mov ebx, eax
add eax, 5
mov ecx, 0x705f0404
sub ecx, 0x605f0404
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4018b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], eax
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0xff
ja 0x401a7d
add eax, 0x2ba
lea esi, [edi + eax*4]
mov eax, dword [esi]
test eax, eax
je 0x401a7d
add eax, 0x328
xor ecx, ecx
mov word [ebp - 0x214], cx
mov ebx, 0x104
cmp word [eax], cx
je 0x401916
push ecx
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x214]
call fcn.00401190
mov ecx, dword [esi]
test ecx, ecx
je 0x401922
push ecx
call fcn.00401a90
cmp word [ebp - 0x214], 0
mov dword [esi], 0
je 0x401984
mov ecx, ebx
lea eax, [ebp - 0x214]
nop word [eax + eax]
cmp word [eax], 0
je 0x40194e
add eax, 2
sub ecx, 1
jne 0x401940
mov eax, ebx
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x401977
push ecx
push str..part
push ecx
sub ebx, edx
lea ecx, [ebp - 0x214]
lea ecx, [ecx + edx*2]
mov edx, ebx
call fcn.00401190
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x23c]
cmp edx, 0xff
je 0x401a18
mov ecx, edx
mov dword [ebp - 0x238], edx
nop
mov eax, dword [esi + 4]
lea ebx, [esi + 4]
test eax, eax
je 0x401a12
mov dword [esi], eax
mov dword [ebx], 0
mov dword [eax + 0x68], ecx
mov eax, dword [esi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x224]
push eax
push dword [edi + 4]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x220]
push 5
push 0
push 0
add eax, 0xffffffba
push eax
push dword [ebp - 0x224]
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x238]
mov esi, ebx
inc ecx
mov dword [ebp - 0x238], ecx
cmp ecx, 0x100
jl 0x4019a0
mov edx, dword [ebp - 0x23c]
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x30]
dec ecx
mov dword [edi + 0x2c], ecx
cmp eax, edx
jg 0x401a2a
cmp ecx, eax
jne 0x401a2e
dec eax
mov dword [edi + 0x30], eax
push eax
mov ecx, edi
call fcn.00401b60
lea eax, [ebp - 0x234]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
movzx ecx, word [ebp - 0x228]
movzx eax, word [ebp - 0x22c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 5
push dword [edi + 4]
call esi
cmp dword [edi + 0x2c], 0
jne 0x401a7d
push 0
push 0
push 0x800b
push dword [edi + 8]
call esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bbdc
mov esp, ebp
pop ebp
ret 4