joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d15d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4d15ef
pop edi
pop esi
pop ebp
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4d1611
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
jne 0x4d1618
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
push eax
call fcn.004d1590
add esp, 8
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4e71d6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x51ade5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051ac64

Function at 0x51f47d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051f13d

Function at 0xdc021e
Capabilities:
Encode data using xor

Disassembly:
add al, ah
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xdc0224
pop ebp
sub ebp, 0x10
sub ebp, 0x9c0214
jmp 0xdc023a
mov eax, 0x9c0214
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e0
mov edx, 0xa9294116
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc0251
jmp 0xdc0264
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1612aedb
scasb al, byte es:[edi]
adc dl, byte [esi]
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0xdc0274
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x729b46d3
xor ch, dl
lahf
adc dh, byte [edx]
jle 0xdc0216
invalid
Function at 0x402460
Capabilities:
Parse pe header

Disassembly:
push esi
push edi
mov edi, ecx
push 0x40
mov esi, dword [edi]
push esi
call fcn.00402420
test eax, eax
jne 0x4024e3
cmp word [esi], 0x5a4d
jne 0x4024e3
mov eax, dword [esi + 0x3c]
mov esi, dword [edi]
add esi, eax
cmp eax, 0x60
jl 0x4024e3
cmp eax, 0x1000
jge 0x4024e3
push 0xf8
push esi
mov ecx, edi
call fcn.00402420
test eax, eax
jne 0x4024e3
cmp dword [esi], 0x4550
jne 0x4024e3
xor eax, eax
xor ecx, ecx
mov ax, word [esi + 6]
mov cx, word [esi + 0x14]
cmp eax, 1
jl 0x4024e3
cmp eax, 0x3e8
jg 0x4024e3
cmp ecx, 0x32
jl 0x4024e3
cmp ecx, 0x2710
jg 0x4024e3
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*8 + 0x18]
push ecx
push esi
mov ecx, edi
call fcn.00402420
test eax, eax
jne 0x4024e3
mov eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x4025b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esi + 0xc]
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x402627
mov eax, dword [esi + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esi]
mov dword [esi + 4], eax
add ecx, eax
test eax, eax
mov dword [esi + 8], ecx
jle 0x40261b
mov edx, dword [esi + 0xc]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40261b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esi + 4]
mov dword [esi], eax
add ecx, eax
test eax, eax
mov dword [esi + 8], ecx
je 0x40261b
pop edi
mov eax, 1
pop esi
ret 8
mov edx, dword [esi]
mov dword [esi + 4], 0
mov dword [esi + 8], edx
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4033c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x140
lea ecx, [esp]
push esi
call fcn.00401710
lea eax, [esp + 0xc]
mov esi, 1
push eax
push esi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40346c
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.ProgramFilesDir
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403461
cmp dword [esp + 0x10], esi
jne 0x403461
mov eax, dword [esp + 8]
test eax, eax
jbe 0x403461
cmp eax, 0x12c
ja 0x403461
dec eax
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 8]
call fcn.00401f90
lea ecx, [esp + 4]
call fcn.00402000
lea ecx, [esp + 4]
call fcn.00401d50
lea ecx, [esp + 4]
call fcn.00401db0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x148]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.00401730
lea ecx, [esp + 4]
call fcn.00401ad0
mov eax, esi
pop esi
add esp, 0x140
ret
Function at 0x403d30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40da34]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x403d60
push 0
push ecx
mov ecx, esp
push 0x40d84c
call fcn.00401730
push ecx
mov ecx, esp
push 0x40da34
call fcn.00401730
call fcn.00403d80
add esp, 0xc
mov ecx, dword [0x40da48]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.0040af50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403d80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
lea ecx, [esp + 0x5c]
mov dword [esp], 0
call fcn.00401d50
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x403dba
lea ecx, [esp + 0x5c]
call fcn.00401ad0
lea ecx, [esp + 0x60]
call fcn.00401ad0
mov eax, 0xff
add esp, 0x58
ret
mov ecx, dword [esp + 0x60]
cmp dword [ecx + 4], 1
jle 0x403de8
lea ecx, [esp + 0x60]
call fcn.00402090
cmp al, 0x5c
jne 0x403de8
mov edx, dword [esp + 0x60]
push 0x7fffffff
lea ecx, [esp + 0x64]
mov eax, dword [edx + 4]
dec eax
push eax
call fcn.00401cd0
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x64]
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x18], 0x44
mov dword [esp + 0xc], ecx
pop edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x403e20
xor eax, eax
jmp 0x403e23
add eax, 8
lea edx, [esp + 4]
lea ecx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x60]
push ecx
push eax
push 0
push 0x4000000
push 0
push 0
add edx, 8
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x403e70
mov eax, dword [esp + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov esi, dword [esp + 4]
lea ecx, [esp + 0x60]
call fcn.00401ad0
lea ecx, [esp + 0x64]
call fcn.00401ad0
mov eax, esi
pop esi
add esp, 0x58
ret
Function at 0x404fc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
lea ecx, [esp + 4]
call fcn.00401d50
lea ecx, [esp + 4]
call fcn.00401db0
lea ecx, [esp + 4]
call fcn.00402090
cmp al, 0x5c
jne 0x40500c
mov eax, dword [esp + 4]
push 0x7fffffff
mov ecx, dword [eax + 4]
dec ecx
push ecx
lea ecx, [esp + 0xc]
call fcn.00401cd0
lea ecx, [esp + 4]
call fcn.00401db0
lea ecx, [esp + 4]
call fcn.00402090
cmp al, 0x5c
je 0x404fdf
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x405027
add eax, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x405036
lea ecx, [esp + 4]
call fcn.00401ad0
mov eax, 1
ret
mov edx, dword [esp + 4]
push esi
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405060
test al, 0x10
je 0x405060
lea ecx, [esp + 8]
mov esi, 1
call fcn.00401ad0
mov eax, esi
pop esi
ret
lea ecx, [esp + 8]
xor esi, esi
call fcn.00401ad0
mov eax, esi
pop esi
ret

Function at 0x405260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x140
lea ecx, [esp]
push esi
call fcn.00401710
mov ecx, dword [esp + 0x14c]
lea eax, [esp + 0xc]
mov esi, 1
push eax
push esi
add ecx, 8
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40531c
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
add edx, 8
push 0
push edx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405311
cmp dword [esp + 0x10], esi
jne 0x405311
mov eax, dword [esp + 8]
test eax, eax
jbe 0x405311
cmp eax, 0x12c
ja 0x405311
dec eax
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 8]
call fcn.00401f90
lea ecx, [esp + 4]
call fcn.00402000
lea ecx, [esp + 4]
call fcn.00401d50
lea ecx, [esp + 4]
call fcn.00401db0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x148]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.00401730
lea ecx, [esp + 4]
call fcn.00401ad0
lea ecx, [esp + 0x14c]
call fcn.00401ad0
lea ecx, [esp + 0x150]
call fcn.00401ad0
mov eax, esi
pop esi
add esp, 0x140
ret

Function at 0x405360
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
add edx, 8
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4053c0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add edx, 8
mov ecx, dword [eax + 4]
add eax, 8
inc ecx
push ecx
push eax
mov eax, dword [esp + 8]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
call fcn.00401ad0
lea ecx, [esp + 0x10]
call fcn.00401ad0
lea ecx, [esp + 0x14]
call fcn.00401ad0
add esp, 8
ret
Function at 0x4053e0
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
lea ecx, [esp + 4]
call fcn.00401710
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 0xf003f
add ecx, 8
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40542d
mov edx, dword [esp + 0x10]
mov eax, dword [esp]
add edx, 8
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
call fcn.00401ad0
lea ecx, [esp + 0xc]
call fcn.00401ad0
lea ecx, [esp + 0x10]
call fcn.00401ad0
add esp, 8
ret

Function at 0x405450
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x140
lea ecx, [esp]
push esi
call fcn.00401710
lea eax, [esp + 0xc]
mov esi, 1
push eax
push esi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054ff
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x150]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054f4
cmp dword [esp + 0x10], esi
jne 0x4054f4
mov eax, dword [esp + 8]
test eax, eax
jbe 0x4054f4
cmp eax, 0x12c
ja 0x4054f4
dec eax
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 8]
call fcn.00401f90
lea ecx, [esp + 4]
call fcn.00402000
lea ecx, [esp + 4]
call fcn.00401d50
lea ecx, [esp + 4]
call fcn.00401db0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x148]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00401730
lea ecx, [esp + 4]
call fcn.00401ad0
mov eax, esi
pop esi
add esp, 0x140
ret
Function at 0x4070f0
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x148
lea ecx, [esp]
push esi
push edi
call fcn.00401710
lea ecx, [esp + 0x154]
call fcn.00402090
cmp al, 0x5c
je 0x40711f
mov dl, 0x5c
lea ecx, [esp + 0x154]
call fcn.00401ee0
lea eax, [esp + 0x154]
push 0x40d108
push eax
lea ecx, [esp + 0x14]
call fcn.00401970
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
add edx, 8
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.00401ad0
cmp esi, 0xffffffff
je 0x4071d1
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x10], 0x10
je 0x4071be
lea edx, [esp + 0x3c]
lea ecx, [esp + 8]
call fcn.00401f30
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4071be
mov edx, 0x40d104
lea ecx, [esp + 8]
call fcn.004023d0
test eax, eax
je 0x4071be
mov edx, 0x40d100
lea ecx, [esp + 8]
call fcn.004023d0
test eax, eax
je 0x4071be
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
lea eax, [esp + 0x158]
push edx
push eax
call fcn.00401850
call fcn.004070f0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x40715e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x154]
push 0x7fffffff
lea ecx, [esp + 0x158]
mov eax, dword [edx + 4]
dec eax
push eax
call fcn.00401cd0
mov ecx, dword [esp + 0x154]
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 8]
call fcn.00401ad0
lea ecx, [esp + 0x154]
call fcn.00401ad0
pop edi
pop esi
add esp, 0x148
ret
Function at 0x407d80
Capabilities:
Get disk size

Disassembly:
sub esp, 0x418
mov ecx, 0x40d99c
push esi
call fcn.00401d50
mov ecx, 0x40d99c
call fcn.00401db0
mov edx, dword [0x40d99c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
add edx, 8
push 0x400
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov esi, eax
test esi, esi
jle 0x407de9
mov ecx, 0x40d99c
call fcn.00401ad0
push esi
lea edx, [esp + 0x20]
mov ecx, 0x40d99c
call fcn.00401a80
mov edx, dword [0x40dac8]
mov ecx, 0x40d99c
call fcn.00402110
lea ecx, [esp + 4]
call fcn.00401710
push 3
lea edx, [esp + 0xc]
mov ecx, 0x40d99c
call fcn.00401c10
mov edx, eax
lea ecx, [esp + 4]
call fcn.00401f10
lea ecx, [esp + 8]
call fcn.00401ad0
mov eax, dword [0x40da98]
test eax, eax
je 0x407e3c
mov ecx, dword [esp + 4]
push 0x40da80
push 0x40da78
add ecx, 8
push 0x40da88
push ecx
call eax
test eax, eax
jne 0x407ead
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
add eax, 8
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x407e6a
xor esi, esi
xor edx, edx
xor ecx, ecx
jmp 0x407e7a
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
imul eax, esi
mov esi, eax
imul eax, edx
imul esi, ecx
xor ecx, ecx
mov dword [0x40da78], esi
mov dword [0x40da7c], 0
mov dword [0x40da80], eax
mov dword [0x40da84], ecx
mov dword [0x40da88], eax
mov dword [0x40da8c], ecx
mov eax, dword [0x40da82]
lea ecx, [esp + 4]
sar eax, 4
push eax
mov dword [0x40da90], eax
call fcn.00402250
mov edx, 0x40c77c
lea ecx, [esp + 4]
call fcn.00401e90
mov edx, dword [0x40daf8]
lea ecx, [esp + 4]
call fcn.00402110
lea ecx, [esp + 4]
call fcn.00401ad0
pop esi
add esp, 0x418
ret
Function at 0x407f50
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x40dad0]
push ebx
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExA]
push esi
test eax, eax
push edi
jne 0x407f9c
mov eax, dword [0x40da3c]
mov ecx, dword [0x40da54]
push 0
push eax
push 0x32d3
push ecx
push 0x96
push 0x116
push 0x28
push 0x140
push 0x50000012
push 0
push str.STATIC
push 0
call ebx
mov dword [0x40dad0], eax
mov eax, dword [0x40dad4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x40800b
mov edx, dword [0x40da3c]
mov eax, dword [0x40da54]
push 0
push edx
push 0x32d4
push eax
push 0x14
push 0x112
push 0x30
push 0x142
push 0x50000001
push str.LITEVERSION
push str.LITEVERZE
call fcn.00402be0
add esp, 8
push eax
push str.STATIC
push 0
call ebx
push 1
push 0xb
mov dword [0x40dad4], eax
call edi
mov ecx, dword [0x40dad4]
push eax
push 0x30
push ecx
call esi
mov eax, dword [0x40dad8]
test eax, eax
jne 0x40806e
mov edx, dword [0x40da3c]
mov eax, dword [0x40da54]
push 0
push edx
push 0x32d5
push eax
push 0x14
push 0x112
push 0x40
push 0x142
push 0x50000001
push str.Distribution_Ensures:
push str.distribuci_zaji
call fcn.00402be0
add esp, 8
push eax
push str.STATIC
push 0
call ebx
push 1
push 0xd
mov dword [0x40dad8], eax
call edi
mov ecx, dword [0x40dad8]
push eax
push 0x30
push ecx
call esi
mov eax, dword [0x40dadc]
test eax, eax
jne 0x4080c3
mov edx, dword [0x40da3c]
mov eax, dword [0x40da54]
push 0
push edx
push 0x32d6
push eax
push 0x14
push 0x112
push 0x63
push 0x142
push 0x50000001
push str._______Gemtree_Software__s.r.o.
push str.STATIC
push 0
call ebx
push 1
push 0x10
mov dword [0x40dadc], eax
call edi
mov ecx, dword [0x40dadc]
push eax
push 0x30
push ecx
call esi
mov eax, dword [0x40dae0]
test eax, eax
jne 0x408118
mov edx, dword [0x40da3c]
mov eax, dword [0x40da54]
push 0
push edx
push 0x32d7
push eax
push 0x14
push 0x112
push 0x76
push 0x142
push 0x50000001
push str.Svazarm._1011__P.O.Box_136
push str.STATIC
push 0
call ebx
push 1
push 0x10
mov dword [0x40dae0], eax
call edi
mov ecx, dword [0x40dae0]
push eax
push 0x30
push ecx
call esi
mov eax, dword [0x40dae4]
test eax, eax
jne 0x40817e
mov edx, dword [0x40da3c]
mov eax, dword [0x40da54]
push 0
push edx
push 0x32d8
push eax
push 0x14
push 0x112
push 0x89
push 0x142
push 0x50000001
push str.756_61_Roznov_pod_Radhostem
push str.756_61_Ro
call fcn.00402be0
add esp, 8
push eax
push str.STATIC
push 0
call ebx
push 1
push 0x10
mov dword [0x40dae4], eax
call edi
mov ecx, dword [0x40dae4]
push eax
push 0x30
push ecx
call esi
mov eax, dword [0x40dae8]
test eax, eax
jne 0x4081e4
mov edx, dword [0x40da3c]
mov eax, dword [0x40da54]
push 0
push edx
push 0x32d9
push eax
push 0x14
push 0x112
push 0x9c
push 0x142
push 0x50000001
push str._______The_Czech_Republic
push 0x40d14c
call fcn.00402be0
add esp, 8
push eax
push str.STATIC
push 0
call ebx
push 1
push 0x10
mov dword [0x40dae8], eax
call edi
mov ecx, dword [0x40dae8]
push eax
push 0x30
push ecx
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x408f80
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x40dabc]
sub esp, 0x1c
test eax, eax
jne 0x40905e
mov eax, dword [0x40da3c]
mov ecx, dword [0x40da54]
push 0
push eax
push 0x32ce
push ecx
push 0x120
push 0x24c
push 0x28
push 0xa
push 0x4020c844
push 0
push str.RichEdit
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExA]
lea ecx, [esp + 0xc]
mov dword [0x40dabc], eax
call fcn.00402550
push 0x40d694
push 0x299
push 0x298
call fcn.00402be0
add esp, 8
lea ecx, [esp + 0x10]
push eax
call fcn.004025b0
mov edx, dword [esp + 0x10]
mov ecx, 0x40da30
push edx
mov edx, dword [esp + 0x10]
call fcn.00401f90
mov ecx, dword [0x40dabc]
lea eax, [esp]
push eax
push 2
push 0x449
push ecx
mov dword [0x40d9dc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x408f20
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x40dabc]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0xc]
call fcn.00402570
add esp, 0x1c
ret

Function at 0x40ab20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40db68]
test eax, eax
jne 0x40ab50
mov eax, dword [0x40da54]
push 0x10
push str.Memory_Error
push str.Insufficient_memory__terminating.
push eax
mov dword [0x40db68], 1
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp fcn.00403d30
ret
Function at 0x40605d
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44a200], 2
jl 0x406082
movaps xmm0, xmmword [0x4347f0]
movaps xmmword [0x441040], xmm0
movaps xmm0, xmmword [0x4347e0]
movaps xmmword [0x441050], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.0040640a
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x4347b8]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x406090
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x406773
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x40679d
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x441060]
inc edi
sub esi, 1
jne 0x406785
pop edi
mov eax, edx
pop esi
ret 0xc

Function at 0x40698a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
xor ebp, ebp
cmp dword [edi], 2
lea esi, [edi + 4]
jne 0x4069e0
mov eax, dword [esi]
push ebx
push ebp
push ebp
push ebp
push ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push dword [esp + 0x5c]
call fcn.00407074
mov edx, ebp
mov ebx, ebp
movzx eax, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor eax, ebx
inc edx
mov ebx, eax
cmp edx, 0x20
jb 0x4069c4
mov dword [esi], eax
pop ebx
cmp dword [edi], 3
jne 0x406a0c
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
push 0x20
push esi
push 0x20
push dword [esp + 0x58]
call fcn.00407074
push 0x20
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00422c30
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x24
ret 8