joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458810
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x458827
add esp, 0xfffffff0
call fcn.00403420
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004192e8
mov eax, dword [0x4719b0]
cmp word [eax + 2], 0
jne 0x45884f
mov eax, dword [0x4719b0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459ee8
mov eax, dword [0x471a60]
cmp word [eax + 2], 0
jne 0x458869
mov eax, dword [0x471a60]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a0e0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4115c8]
call fcn.004030cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4115c8]
call fcn.004030cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b83c]
call fcn.004230b4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4589f0
mov eax, dword [0x4718d4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423484
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45a680
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4718d4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c16c
test eax, eax
je 0x45895e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408498
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c194
test eax, eax
je 0x458972
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040bc
mov eax, dword [0x4717b8]
cmp byte [eax], 0
jne 0x4589a6
mov eax, ebx
call fcn.00458b18
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045a85c
mov eax, ebx
call fcn.0045b220
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4589e6
call fcn.00403478
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458d98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x472bb0]
cmp dword [eax + 0x30], 0
je 0x458e42
cmp dword [ebx + 0x94], 0
jne 0x458e3c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458d28
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458e3c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458e02
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458e3c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413930
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458e11
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4599a4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4599d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f3c
jmp 0x4599e6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ea0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45aa38
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45aa79
mov eax, esi
call fcn.00440ce0
test al, al
je 0x45aa79
mov eax, dword [ebx + 0x84]
call fcn.004409dc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45aa79
push 0
mov eax, dword [ebx + 0x84]
call fcn.004409dc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45e224
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45e252
mov eax, ebx
call fcn.0045ecd8
cmp dword [ebx + 0x40], 0
je 0x45e24b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45e2c3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45e2b5
cmp dword [ebx + 8], 0
je 0x45e274
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45e286
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45e2b5
cmp dword [ebx + 8], 0
je 0x45e267
cmp eax, 3
je 0x45e299
dec eax
jne 0x45e267
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45e267
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45e267
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x45e2e1
cmp dword [ebx + 0x14], 0xcc
je 0x45e2e1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045e2ec
pop ebx
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10018018
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x10018018
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10018027
pop dword [ebp - 0x20]
mov eax, 0xdd7451ae
sub eax, 0xcd72d187
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3be9b
push 0
mov eax, 0x55e32b94
add eax, 0xba1fd5c8
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x731bae8c
add ecx, 0x8ce4882f
xor ebx, ebx
add ebx, eax
mov esi, 0x554cc6d8
sub esi, 0x45480ad8
add esi, dword [ebp - 0x20]
mov edi, 0xb0a452bb
sub edi, 0x663b034a
add dword [ebp - 4], ebx
mov edx, dword [esi]
mov dword [ebp - 0x18], 0x962ed37a
xor edx, edi
add dword [ebp - 4], ebx
mov dword [ebx], edx
add dword [ebp - 0x10], 0xdb4b1fe9
add ebx, 0xb5c588a7
sub ebx, 0xb5c588a3
add esi, 0xe238447c
add esi, 0x1dc7bb88
loop 0x10018088
add eax, 0xcdbf
xor ebx, ebx
add ebx, eax
add eax, 0xf4b4e20c
sub eax, 0xf4b4e207
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1001ab69
Capabilities:
Extract resource via kernel32 functions
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001ab95
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0
call fcn.1001b2ca
add esp, 0xc
jmp 0x1001abb7
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001abaf
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1001abb7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret

Function at 0x1001b1fe
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001b22b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
push 0x64b9
push 0x2c36
call fcn.1001b281
add esp, 0x10
jmp 0x1001b27d
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001b26b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001b269
push 0x1c27
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x1001b27d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001b27d
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret
Function at 0x1001b4d2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001b4f9
push 0x4cbd
push 1
push 0x59df
call fcn.1001b5b2
add esp, 0xc
jmp 0x1001b5ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001b592
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
push dword [eax]
push dword [ebp - 0x2c]
push 0x5180
mov eax, dword [ebp - 0x30]
push dword [eax]
push 0x521a
push 0
push 0x5897
push 0x3180
push 1
mov eax, dword [ebp - 0x34]
push dword [eax]
push 0x7ade
push 1
call fcn.1001d62d
add esp, 0x30
jmp 0x1001b5ae
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001b5ae
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret
Function at 0x10033dbd
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10033dea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0x7146
push 0x9db
call fcn.10033e4e
add esp, 0x10
jmp 0x10033e4a
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10033e2a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10033e28
push 0
push 0x23c2
push 0xef0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x10033e4a
push 0
push 0x542
push 0xde5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov esp, ebp
pop ebp
ret
Function at 0x1003d231
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006b46c
call fcn.10069e18
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x45c0
cmp dword [ebp - 0x1c], 0x4973
push edi
mov dword [ebp - 0x10], esp
jle 0x1003d2b3
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
and dword [ebp - 0x24], 0
mov ecx, edi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
sar esi, cl
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1065c418
xor eax, ebx
cdq
push edx
push eax
call fcn.1003d477
inc edi
cmp edi, 0x4473
jl 0x1003d26e
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x6713
jl 0x1003d260
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x22c6
jl 0x1003d25b
inc ebx
cmp ebx, 0x2ed4
jl 0x1003d256
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4304
jge 0x1003d2cf
mov edx, 0x100086f8
mov ecx, 0x1065c418
call fcn.10039666
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100656a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10070758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10056a68
mov dword [ebp - 0x14], eax
cmp dword [0x1065d540], esi
jne 0x10065798
push 0x800
push esi
push 0x10007fd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10065725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10065878
push esi
push esi
push 0x10007fd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10065878
push 0x10007fe8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10065878
push eax
call ebx
push 0x10007ff4
push edi
mov dword [0x1065d540], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008004
push edi
mov dword [0x1065d544], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008018
push edi
mov dword [0x1065d548], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065d550], eax
test eax, eax
je 0x10065795
push 0x10008034
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065d54c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100657bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100657b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100657d2
push 4
pop eax
jmp 0x1006587a
cmp dword [ebp - 0x14], esi
je 0x100657d2
push dword [0x1065d540]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100657b7
mov eax, dword [0x1065d54c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10065830
cmp dword [0x1065d550], edi
je 0x10065830
push eax
call ebx
push dword [0x1065d550]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10065830
test eax, eax
je 0x10065830
call ecx
test eax, eax
je 0x10065825
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10065825
test byte [ebp - 8], 1
jne 0x10065830
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10065860
mov eax, dword [0x1065d544]
cmp eax, edi
je 0x1006585d
push eax
call ebx
test eax, eax
je 0x1006585d
call eax
mov esi, eax
test esi, esi
je 0x1006585d
mov eax, dword [0x1065d548]
cmp eax, edi
je 0x1006585d
push eax
call ebx
test eax, eax
je 0x1006585d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065d540]
call ebx
test eax, eax
je 0x10065878
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006587a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10053f40
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413fa8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x414122
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40ec68]
call fcn.00402af4
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040352c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040ecbc
mov eax, dword [ebp - 0x14c]
mov edx, 0x414138
call fcn.00403800
je 0x414052
push dword [ebp - 4]
push 0x414138
push 0x414144
lea eax, [ebp - 4]
mov edx, 3
call fcn.004037b0
lea eax, [ebp - 8]
mov ecx, 0x414138
mov edx, dword [ebp - 4]
call fcn.0040373c
jmp 0x41405f
lea eax, [ebp - 4]
mov edx, 0x414144
call fcn.004036f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4140f7
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x414091
add eax, 0xffffffe8
sub eax, 8
jae 0x4140e0
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x4140e0
lea eax, [ebp - 0x11c]
cmp eax, 0x414148
je 0x4140e0
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036c4
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.0040373c
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x41407b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414129
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004034b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0909f420
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0909f420
mov al, bl
call fcn.090091e6
ret