joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bf80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044c0b0
add esp, 8
cmp eax, 0xffffffff
je 0x44c07f
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffff
je 0x44c05e
push 0x101
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x44c034
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
cmp dword [ebp + 0xc], eax
jne 0x44c010
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x44c032
cmp dword [0x45ff20], 0
je 0x44c032
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x454ab0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x44c04f
cmp dword [0x45ff20], 0
je 0x44c04f
mov eax, dword [ebp - 0x40]
push eax
push str._nread_error_:_nblu___d_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x44c07d
cmp dword [0x45ff20], 0
je 0x44c07d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push str._nopen_error_:_handle___d___nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
jmp 0x44c09a
cmp dword [0x45ff20], 0
je 0x44c09a
mov ecx, dword [ebp + 8]
push ecx
push str._nstat_error_:_nomfic___s_n_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret
Function at 0x44c0d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4584e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push 0x180
push 0x502
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x44c152
mov ecx, dword [ebp - 4]
push ecx
push 0x454b44
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR90.dll__write]
add esp, 0xc
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
jmp 0x44c1e8
call dword [sym.imp.MSVCR90.dll__errno]
cmp dword [eax], 0x11
jne 0x44c1e1
push 0x100
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_int___cdecl__open_char_const___int__int_]
add esp, 0xc
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x44c1df
push 0x14
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x13
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll__read]
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44c1bc
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.MSVCR90.dll_atol]
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x44c1c3
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR90.dll__close]
add esp, 4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
je 0x44c1df
mov dword [ebp - 0x28], 0xffffffff
jmp 0x44c1e8
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00435ab0
mov esp, ebp
pop ebp
ret
Function at 0x461000
Capabilities:
Encode data using xor

Disassembly:
cmp esi, 0xf763
ja 0x461013
adc dl, bh
mov edx, 0xdda67977
bswap edx
mov al, bh
test ch, 0x4e
cmp ebp, 0x1ab3
jno 0x461027
imul eax, ecx
imul esi, esi
movsx ecx, dh
jmp 0x46102f
xor al, 0xd2
xor ebp, 0x233b
ja 0x46103c
add dh, 0x61
push 0xb153af
push eax
mov ah, 0xf4
sub eax, 0xe81d78
mov dl, bl
cmp edi, 0x8747
jo 0x46105b
test edx, 0xa6bf626e
mov ebx, 0x102
xor ebx, 0x100
imul ebx, ebx, 0x11a
mov edx, ebx
test ebp, 0x722a35ef
imul ecx, ebx
test esi, 0xaa01cc87
mov ebp, 0xcb0709a1
lea eax, [0xfffea2d7]
sub eax, 0xdee
lea edx, [eax]
xor edx, 0xea9
bswap ebp
sub ebx, edx
inc esi
sub ebx, 0x165c1
add esi, esi
not ecx
xor al, 0xe9
cmp ebx, 0xc3
jae 0x46106c
neg dh
mov dh, 0x31
call 0x461150
mov eax, 0x8145d703
mov cl, 0x75
test edx, 0xd3d89a09
jmp 0x4610cf
mov bl, cl
dec edx
mov edx, ebx
push edx
test bl, 0xdf
pop ebx
test eax, 0x2202d23a
mov dl, al
mov eax, ebx
lea edx, [0x69bcd2c4]
mov ebx, 0x22847555
jmp 0x4610f4
neg ebx
bswap ebx
or bh, 0xbe
sub bl, cl
inc bl
push 0x19a
mov dh, 0x90
pop esi
bswap edx
xor esi, 0x19a
mov esi, 0xcc8
or dl, dh
sub esi, 0xcc8
lea ebx, [0x71967c13]
or esi, eax
test bh, bl
test ecx, 0xb2d010e6
mov ecx, esi
or al, 0xaf
bswap eax
push ecx
pop edi
jne 0x46113f
imul eax, ebx
movzx eax, di
bswap ecx
mov edx, 0x44be2d85
add ebp, edi
ja 0x461150
mov edi, ecx
mov edi, 0x175fc168
pop edx
xor eax, 0xcfad0454
sbb ch, bl
adc cl, 0x8d
lea eax, [ebx]
mov cl, 0x5f
cmp ecx, edx
xor ebx, eax
imul ebp, edx, 0x2639217e
movd mm1, edx
movd ecx, mm1
jae 0x461178
imul eax, ebx
mov dl, 0x81
mov edx, esi
add ecx, 0x52fb
cmp edi, edx
sub ecx, 0x3ad
test dh, 0xc6
test cl, ah
test bl, bl
mov dh, al
mov dh, 0x12
push ecx
pop edx
lea ebx, [0xe68afd0f]
mov bh, bh
mov edi, edx
inc esi
sub eax, edi
cmp ebx, 0xa1a7
jne 0x4611ad
mov ebx, edx
cmp edi, 0x4e91
je 0x4611c1
add dh, ch
test edi, 0xddc0793c
dec bl
bswap edi
mov edi, eax
push 0x49b9d0
push ebx
jo 0x4611cd
mov al, 0xc8
push ecx
jmp 0x4611d3
imul esi, edi
jmp 0x4611de
sub edi, 0xd277
mov dl, dl
lea ebx, [0xa402bbe5]
ret
Function at 0x4011b3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44927e
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x449279
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449d6c]
call sub.kernel32.dll_ResumeThread
mov dword [0x449d78], 0x10007
push 0xa
call sub.kernel32.dll_Sleep
push 0x449d78
push dword [0x449d6c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x449e30], eax
jne 0x401237
jmp 0x401239
jmp 0x401213
push dword [0x449d6c]
call sub.kernel32.dll_SuspendThread
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44927e
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
leave
ret 4

Function at 0x40126e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44927e
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push 0
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44928e
push dword [0x4493ce]
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x449279
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x449279
push dword [0x4493ce]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x449d6c]
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep
mov dword [0x449d78], 0x10007
push 0x449d78
push dword [0x449d6c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x449e30], eax
jne 0x401340
jmp 0x401351
mov eax, dword [0x4493ce]
mov ebx, dword [0x449e30]
cmp eax, ebx
je 0x4013b4
jmp 0x401323
push dword [0x449d6c]
call sub.kernel32.dll_SuspendThread
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44927e
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44928e
push dword [0x4493ce]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 0
leave
ret 4
push dword [0x449d6c]
call sub.kernel32.dll_SuspendThread
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44927e
push dword [ebp + 8]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44a044]
push 0
mov al, byte [0x44927d]
movzx ax, al
push ax
push 0x44928e
push dword [0x4493ce]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 1
leave
ret 4
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44a9b0]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x44a9b0], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret
Function at 0x4038fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.004038aa
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.004038bf
lea eax, [ebp - 0x72c]
push eax
push dword [ebp + 8]
call fcn.004038bf
add esp, 0x14
push 0x70
pop ebx
lea esi, [ebp - 0x71c]
mov edi, ebx
lea eax, [esi - 0x10]
push esi
push eax
call fcn.004038bf
push esi
call fcn.00403872
add esp, 0xc
add esi, 0x10
dec edi
jne 0x403937
movsx edx, word [0x44a620]
xor esi, esi
shl edx, 2
mov edi, dword [ebp + 0x10]
movsx eax, si
mov ecx, eax
add eax, edx
mov eax, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and eax, dword [ebp + ecx - 0x1c]
inc esi
mov dword [ecx + edi], eax
cmp si, 4
jb 0x40395c
mov dword [ebp - 8], 0x44a7e8
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403872
and dword [ebp - 4], 0
pop ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx - 0x1c6]
movzx ecx, word [ecx]
movsx esi, cx
movsx edi, ax
shl esi, 2
shl edi, 2
movsx eax, word [ebp - 4]
mov edx, dword [ebp + 0x10]
lea ebx, [esi + eax]
mov ebx, dword [ebp + ebx*4 - 0x72c]
mov ecx, eax
add eax, edi
xor ebx, dword [ebp + eax*4 - 0x72c]
shl ecx, 2
and ebx, dword [ebp + ecx - 0x1c]
add edx, ecx
xor dword [edx], ebx
inc dword [ebp - 4]
cmp word [ebp - 4], 4
jb 0x4039af
add dword [ebp - 8], 2
dec dword [ebp - 0xc]
jne 0x403988
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ea7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
xor ecx, ecx
push esi
inc ecx
push edi
mov eax, ecx
xor edi, edi
mov esi, 0xe3
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ebf
cmp ax, cx
jne 0x403f01
mov eax, 0xe2
xor edi, edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
cmp di, 0x71
movzx eax, dx
jl 0x403ee5
jmp 0x403f22
push 0x71
pop edi
cwde
mov word [ebp + eax*2 - 0x1d8], di
add eax, eax
cdq
mov ebx, esi
idiv ebx
inc edi
movzx eax, dx
mov edx, 0xe2
cmp di, dx
jl 0x403f04
mov eax, ecx
mov word [0x44a620], ax
or eax, 0xffffffff
mov word [0x44a7e6], ax
mov edi, ecx
mov dword [ebp - 8], 0x70
lea eax, [ecx + ecx]
cdq
mov ecx, esi
idiv ecx
movzx eax, dx
movsx ecx, ax
lea eax, [ecx + ecx]
mov edx, eax
neg edx
mov bx, word [ebp + edx - 0x10]
mov dx, word [ebp + edx - 0x14]
mov word [ebp - 0xe], dx
mov dx, word [ebp + eax - 0x1da]
mov ax, word [ebp + eax - 0x1d6]
mov word [ebp - 0xc], dx
xor edx, edx
mov word [ebp - 0x10], bx
mov word [ebp - 0xa], ax
mov dword [ebp - 4], edx
movsx eax, word [ebp - 4]
movzx eax, word [ebp + eax*2 - 0x10]
cmp ax, 0x71
jge 0x403fa3
movsx ebx, dx
imul ebx, ebx, 0xe3
add ebx, edi
mov word [ebx*2 + 0x44a620], ax
inc edx
inc dword [ebp - 4]
cmp dx, 2
jl 0x403f80
inc edi
dec dword [ebp - 8]
jne 0x403f3c
push 0x70
pop ebx
xor eax, eax
push 0x10
mov word [0x44a600], ax
pop eax
mov edx, eax
mov edi, 0xffff0000
mov esi, edi
and esi, ebx
je 0x403fd6
add word [0x44a600], dx
mov ebx, esi
cdq
sub eax, edx
sar eax, 1
movzx edx, ax
movsx eax, dx
mov esi, edi
mov ecx, eax
shr esi, cl
xor edi, esi
test dx, dx
jne 0x403fc7
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403ff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038bf
lea eax, [ebp - 0x10]
push eax
call fcn.0040383c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004038fa
mov esi, dword [ebp + 0xc]
add esp, 0x18
push dword [ebp + 0x10]
xor edi, edi
cmp word [esi], di
je 0x404042
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004038fa
add esp, 0xc
jmp 0x404048
call fcn.004038aa
pop ecx
mov edx, dword [ebp + 0x10]
movsx eax, di
mov ecx, eax
mov eax, dword [esi + eax*4 + 0x14]
shl ecx, 2
xor eax, dword [ebp + ecx - 0x20]
add edx, ecx
xor dword [edx], eax
inc edi
cmp di, 4
jb 0x404048
pop edi
pop esi
leave
ret
Function at 0x40670b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], fcn.004068b9
mov dword [ebx + 4], 0x989680
mov word [ebx + 8], 0
mov byte [ebx + 0xa], al
mov byte [ebx + 0xb], 1
call fcn.00401371
push eax
lea ecx, [ebx + 0xc]
call fcn.00401791
push dword [ebp + 8]
xor edi, edi
lea ecx, [ebx + 0x14]
mov dword [ebx + 0x10], edi
call fcn.00403f59
mov dword [ebx + 0x18], edi
call fcn.00401371
push eax
lea ecx, [ebx + 0x1c]
call fcn.00401791
movzx eax, byte [0x442d19]
neg eax
sbb eax, eax
and eax, 0x442d20
mov dword [ebp + 8], eax
je 0x4067de
lea ecx, [ebp + 0xc]
push ecx
mov ecx, eax
call fcn.0040661e
mov esi, dword [ebp + 0xc]
cmp dword [esi - 0xc], edi
je 0x4067ba
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x989680
push str.MaxLogFileSize
push str.LoggingSettings
call edi
mov dword [ebx + 4], eax
xor eax, eax
push esi
inc eax
push eax
push str.LogFileWide
push str.LoggingSettings
call edi
test eax, eax
setne al
jmp 0x4067c4
xor eax, eax
mov dword [ebx + 4], 0x989680
inc eax
mov byte [ebx + 0xb], al
lea ecx, [ebx + 0x1c]
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.004015e6
lea ecx, [esi - 0x10]
call fcn.004015ce
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x4069aa
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x441008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
lea edx, [ebp - 0x8c]
push esi
xor eax, eax
mov dword [ebp - 0x94], ebx
push edi
lea esi, [ebx + 0x14]
mov dword [ebp - 0x98], eax
mov ecx, dword [esi]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x9c], esi
call fcn.00404ce8
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebx + 4]
jbe 0x4069fe
mov ecx, ebx
call fcn.00406bd5
xor eax, eax
cmp byte [ebx + 0xa], al
setne al
xor ecx, ecx
push ecx
push 0x80
lea eax, [eax*2 + 2]
push eax
push ecx
push 3
push 0x40000000
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x18], eax
cmp eax, 0xffffffff
jne 0x406a37
xor edi, edi
xor al, al
mov dword [ebx + 0x18], edi
jmp 0x406a9f
mov edx, esi
lea ecx, [ebp - 0x8c]
call fcn.004084b3
mov esi, dword [ebp - 0x8c]
lea edi, [ebp - 0x28]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
xor edi, edi
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x406aae
call fcn.0040865d
push dword [ebx + 0x14]
push dword [ebx + 0x1c]
push str.LOG_SYSTEM:___s_:_ERROR___Log_path__s_has_a_reparse_point
call fcn.0040883a
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], edi
lea ecx, [esi - 0x10]
call fcn.004015ce
mov al, byte [ebp - 0x98]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041682f
leave
ret
mov eax, dword [ebp - 0x28]
shr eax, 0xa
and al, 1
jne 0x406a6b
mov ecx, dword [ebx + 0x18]
call fcn.004056b6
test al, al
jne 0x406a6b
lea ecx, [ebp - 0xbc]
call fcn.004021a0
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x88]
push 0x43a750
push eax
call fcn.00401cff
add esp, 0x14
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0xbc]
push edi
push 0xc0010000
push eax
call fcn.0040221d
lea ecx, [ebp - 0x88]
mov bl, al
call fcn.00401de8
test bl, bl
je 0x406b2c
push ecx
lea eax, [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call fcn.00403029
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406b65
mov eax, dword [ebp - 0x94]
cmp byte [eax + 0xb], 0
je 0x406b65
xor ecx, ecx
push ecx
mov dword [ebp - 0x94], ecx
lea ecx, [ebp - 0x94]
push ecx
push 2
push 0x439658
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 0x98], 1
call fcn.004021e6
jmp 0x406a91
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4283e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42849c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428497
mov ecx, dword [ebp - 8]
push ecx
call fcn.00428990
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428456
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428456
xor eax, eax
jmp 0x42849c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283ef
mov esp, ebp
pop ebp
ret