joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x84], 0
call fcn.00401994
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
push eax
lea eax, [0x4044a5]
lea edx, [fcn.00401a04]
sub eax, edx
push eax
push fcn.00401a04
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401337
push esi
call fcn.0040188f
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004018dd
mov eax, esi
add eax, 0x1cc00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov edi, dword [ebp - 0x88]
mov eax, esi
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov ebx, eax
add ebx, edi
push ebx
lea edi, [0x4060e4]
mov ebx, esi
dec ebx
and edi, ebx
push edi
call fcn.00401a04
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401994
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
call sub.KERNEL32.dll_GetLastError
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7fc51f70
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x24194d4b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x51071ad9
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4635579
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1fdb0c0c
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x425d1cbb
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401120
Capabilities:
Check os version

Disassembly:
sub esp, 0xbc
mov eax, dword [0x4296d4]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x34]
dec eax
je 0x401212
dec eax
jne 0x40127d
mov eax, dword [esp + 0x28]
cmp eax, 4
mov dword [0x46a238], 0
ja 0x401182
mov eax, 3
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
cmp eax, 5
jne 0x40127d
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4011ab
mov eax, 5
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
cmp eax, 1
jne 0x4011c8
mov eax, 7
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
cmp eax, 2
jne 0x40127d
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4011f2
lea ecx, [esp]
push ecx
call eax
xor eax, eax
cmp word [esp], 9
sete al
add eax, 8
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
cmp dword [esp + 0x28], 4
mov dword [0x46a238], 1
jb 0x40127d
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x401243
mov eax, 2
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
cmp eax, 0xa
jne 0x401260
mov eax, 4
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
cmp eax, 0x5a
jne 0x40127d
mov eax, 6
mov ecx, dword [esp + 0xb8]
call fcn.0040d4a7
add esp, 0xbc
ret
mov ecx, dword [esp + 0xb8]
xor eax, eax
call fcn.0040d4a7
add esp, 0xbc
ret
Function at 0x401e60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0xf4240
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040d750
mov ecx, eax
mov esi, edx
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push esi
push ecx
call fcn.0040d710
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jl 0x401ed6
jg 0x401ed4
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x18]
jb 0x401ed6
jmp 0x401ed8
jmp 0x401ea6
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x402170
Capabilities:
Check for time delay via gettickcount

Disassembly:
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
push esi
push 2
xor esi, esi
push eax
push ecx
call fcn.00407b10
test al, 1
jne 0x4021b0
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push esi
push edx
push eax
call fcn.00407b10
and al, 7
cmp al, 7
jge 0x4021b5
mov esi, 1
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
or eax, 7
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 2
push edx
push eax
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
and eax, 0xde
push eax
push 2
push ecx
push edx
call fcn.00407ad0
test esi, esi
je 0x402282
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
push edi
push 0
push eax
push ecx
call fcn.00407b10
xor edx, edx
mov dx, word [0x4ab534]
mov word [0x46a24c], ax
xor eax, eax
mov ax, word [0x4ab532]
push 2
push edx
push eax
call fcn.00407b10
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [0x46a254], ax
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x78
jb 0x402278
pop edi
pop esi
ret
Function at 0x4022e0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x100
mov eax, dword [0x4296d4]
push esi
mov dword [esp + 0x100], eax
push 0x80
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x429198
lea ecx, [esp + 0x64]
push ecx
call esi
push str.MATRIX.INI
lea edx, [esp + 0x64]
push edx
call esi
push str.LPT_PORT
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x60]
push ecx
push 0xb
lea edx, [esp + 0xc]
push edx
push 0x4291b0
push str.AccessLPT
lea eax, [esp + 0x24]
push eax
call esi
lea ecx, [esp + 4]
push 0x4291c0
push ecx
call fcn.00410f8f
add esp, 8
test eax, eax
jne 0x402387
mov dword [0x429008], eax
or ax, 0xffff
pop esi
mov ecx, dword [esp + 0xfc]
call fcn.0040d4a7
add esp, 0x100
ret
push edi
lea edx, [esp + 0x64]
push edx
push 0xb
lea eax, [esp + 0x10]
push eax
push 0x4291c4
push str.DirectAccess
lea ecx, [esp + 0x28]
mov edi, 1
push ecx
mov dword [0x429008], edi
call esi
lea edx, [esp + 8]
push 0x4291d8
push edx
call fcn.00410f8f
add esp, 8
test eax, eax
jne 0x4023d8
mov dword [0x46a2b4], edi
mov dword [0x46a2b8], edi
mov dword [0x46a2bc], edi
lea eax, [esp + 0x64]
push eax
push 0xa
push 0x4291dc
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edx, [esp + 0x64]
push edx
push 0xb
mov word [0x4292a0], ax
lea eax, [esp + 0x10]
push eax
push 0x4291e8
push 0x4291ec
lea ecx, [esp + 0x28]
push ecx
call esi
lea edx, [esp + 8]
push 0x4291fc
push edx
call fcn.00410f8f
mov ecx, dword [esp + 0x10c]
add esp, 8
neg eax
sbb eax, eax
neg eax
pop edi
mov dword [0x42913c], eax
xor ax, ax
pop esi
call fcn.0040d4a7
add esp, 0x100
ret
Function at 0x4027e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov bl, al
mov esi, 8
lea esp, [esp]
xor ecx, ecx
test bl, 1
push ecx
je 0x40282b
mov cx, word [0x4ab532]
xor eax, eax
mov ax, word [0x4ab534]
push eax
push ecx
call fcn.00407b10
xor edx, edx
mov dx, word [0x4ab534]
or eax, 0x80
push eax
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
jmp 0x40285b
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push ecx
push edx
call fcn.00407b10
and eax, 0x7f
push eax
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
or eax, 0x40
push eax
push 0
push ecx
push edx
call fcn.00407ad0
call fcn.00402450
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
push 0
push eax
push ecx
call fcn.00407b10
xor edx, edx
mov dx, word [0x4ab534]
or eax, 0x40
push eax
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
call fcn.00407ad0
call fcn.00402450
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
shr bl, 1
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
and eax, 0xbf
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
dec esi
jne 0x4027f0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402a31
push edi
call fcn.004024c0
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
or eax, 0x40
push eax
push 0
push ecx
push edx
call fcn.00407ad0
call fcn.00402450
call fcn.004024c0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4029c2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, 0x32
ja 0x4029bb
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
push 1
push eax
push ecx
call fcn.00407b10
test al, 0x10
je 0x402992
jmp 0x4029e5
mov esi, 1
jmp 0x4029e5
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 1
push edx
push eax
call fcn.00407b10
movsx esi, al
and esi, 0x10
shr esi, 4
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
and eax, 0xbf
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
test esi, esi
pop edi
je 0x402a31
pop esi
xor eax, eax
pop ebx
ret 8
pop esi
mov eax, 1
pop ebx
ret 8
Function at 0x402a40
Capabilities:
Check for time delay via gettickcount

Disassembly:
xor eax, eax
mov ax, word [0x4ab534]
push ebx
xor ecx, ecx
mov cx, word [0x4ab532]
push esi
push 0
push eax
push ecx
call fcn.00407b10
xor edx, edx
mov dx, word [0x4ab534]
or eax, 0x80
push eax
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
call fcn.00407ad0
call fcn.00402450
xor ebx, ebx
mov esi, 8
jmp 0x402a90
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
or eax, 0x40
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 1
sar ebx, 1
and ebx, 0x7f
push edx
push eax
call fcn.00407b10
test al, 0x10
je 0x402af7
or ebx, 0x80
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
and eax, 0xbf
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
dec esi
jne 0x402a90
mov eax, dword [esp + 0xc]
test eax, eax
push 0
je 0x402b7e
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push edx
push eax
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab534]
or eax, 0x80
xor edx, edx
mov dx, word [0x4ab532]
push eax
push 0
push ecx
push edx
jmp 0x402baf
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
push eax
push ecx
call fcn.00407b10
xor edx, edx
mov dx, word [0x4ab534]
and eax, 0x7f
push eax
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
call fcn.00407ad0
call fcn.00402450
call fcn.004024c0
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
or eax, 0x40
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
call fcn.004024c0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402c3c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 1
push edx
push eax
call fcn.00407b10
test al, 0x10
jne 0x402c3b
call esi
sub eax, edi
cmp eax, 0x32
jb 0x402c14
pop edi
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
push 0
push ecx
push edx
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab532]
and eax, 0xbf
push eax
xor eax, eax
mov ax, word [0x4ab534]
push 0
push eax
push ecx
call fcn.00407ad0
call fcn.00402450
xor edx, edx
mov dx, word [0x4ab534]
xor eax, eax
mov ax, word [0x4ab532]
push 0
push edx
push eax
call fcn.00407b10
xor ecx, ecx
mov cx, word [0x4ab534]
xor edx, edx
mov dx, word [0x4ab532]
or eax, 0x80
push eax
push 0
push ecx
push edx
call fcn.00407ad0
call fcn.00402450
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x403840
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x98
mov eax, dword [0x4296d4]
mov dword [esp + 0x94], eax
mov eax, dword [0x46a23c]
test eax, eax
je 0x403870
xor eax, eax
mov ecx, dword [esp + 0x94]
call fcn.0040d4a7
add esp, 0x98
ret
push esi
push edi
push 0x50
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x429148
lea ecx, [esp + 0x2c]
push ecx
call esi
push str.MATRIX.INI
lea edx, [esp + 0x2c]
push edx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x28]
push eax
push 0x1f
lea ecx, [esp + 0x84]
push ecx
push 0x429154
push str.HiRes
push 0x429160
mov dword [0x46a25c], 0
call esi
mov al, byte [esp + 0x7c]
cmp al, 0x4e
je 0x403939
cmp al, 0x6e
je 0x403939
lea edx, [esp + 0x28]
push edx
push 0x1f
lea eax, [esp + 0x10]
push eax
push 0x429168
push str.hrwert
push 0x429174
call esi
lea ecx, [esp + 8]
push ecx
call fcn.00411a7d
add esp, 4
mov edi, eax
call fcn.00401e40
test ax, ax
jle 0x403939
test edi, edi
mov dword [0x46a25c], 1
jne 0x403922
mov edi, 1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x94]
call fcn.0040d4a7
add esp, 0x98
ret
lea edx, [esp + 0x28]
push edx
push 0x1f
lea eax, [esp + 0x10]
push eax
push 0x42917c
push str.wert
push str.DELAY
call esi
lea ecx, [esp + 8]
push ecx
call fcn.00411a7d
add esp, 4
test eax, eax
jg 0x403996
mov esi, 0x640
lea esp, [esp]
cmp bx, 0x4d
jne 0x40397d
call fcn.00403130
jmp 0x403984
push 1
call fcn.00402cd0
test ax, ax
jne 0x4039ab
add esi, 0x64
cmp esi, 0x1b58
jle 0x403970
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x94]
call fcn.0040d4a7
add esp, 0x98
ret
call fcn.00402640
push 0
push 1
mov al, 0x32
call fcn.004027e0
test eax, eax
je 0x4039c4
call fcn.004024c0
call fcn.004024c0
mov ecx, dword [esp + 0x9c]
pop edi
lea eax, [esi + esi*2 + 0x3e8]
pop esi
call fcn.0040d4a7
add esp, 0x98
ret
Function at 0x4039f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [0x429008]
push ebp
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 8], ebp
jne 0x403a0d
xor ax, ax
pop ebp
add esp, 0x10
ret 8
mov ecx, dword [0x429298]
or ax, 0xffff
cmp ecx, ebp
mov word [0x4ab534], ax
jne 0x403a45
movsx eax, word [esp + 0x1c]
push eax
call fcn.00407700
cmp ax, bp
jl 0x403c19
xor eax, eax
mov ax, word [0x4ab534]
mov dword [esp + 8], 1
push ebx
push esi
xor ecx, ecx
mov cx, word [0x4ab532]
push edi
push ebp
push eax
mov word [esp + 0x20], ax
mov word [esp + 0x24], cx
push ecx
call fcn.00407b10
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push 1
push esi
push edi
mov word [0x46a24c], ax
call fcn.00407b10
push 2
push esi
push edi
mov word [0x46a250], ax
call fcn.00407b10
mov word [0x46a254], ax
call fcn.004020c0
cmp dword [0x46a258], ebp
jne 0x403aab
mov ebx, 0x4d
call fcn.00403840
mov dword [0x46a258], eax
call fcn.00403130
test ax, ax
je 0x403b80
xor ebp, ebp
call fcn.00402640
push ebp
push 1
mov al, 0x35
call fcn.004027e0
test eax, eax
jne 0x403ad1
or ebp, 0xffffffff
push 0
push 0
call fcn.00402a40
push 0
push 0
mov byte [esp + 0x1a], al
call fcn.00402a40
mov bl, al
mov byte [esp + 0x13], bl
call fcn.004026d0
cmp byte [0x46a261], 0x15
mov dword [0x429140], 1
jb 0x403b80
call fcn.00402640
push 0
push 1
mov al, 0x49
call fcn.004027e0
test eax, eax
jne 0x403c20
or ebp, 0xffffffff
mov bl, byte [esp + 0x28]
call fcn.004026d0
test bp, bp
jne 0x403b80
cmp bl, 1
jne 0x403b80
call fcn.00402640
mov edx, dword [0x429140]
push edx
push 1
mov al, 0x4c
call fcn.004027e0
test eax, eax
je 0x403b77
mov esi, 0x4ab538
mov edi, 8
mov eax, dword [0x429140]
push eax
push 0
call fcn.00402a40
mov cl, byte [esp + 0x13]
mov dl, byte [esp + 0x12]
add al, cl
inc al
xor al, dl
mov byte [esi], al
inc esi
dec edi
jne 0x403b56
call fcn.004026d0
mov ebp, dword [esp + 0x28]
call fcn.00402640
push 0
push 1
mov al, 0x32
call fcn.004027e0
test eax, eax
je 0x403b99
call fcn.004024c0
call fcn.004024c0
xor edx, edx
mov dx, word [0x46a24c]
xor eax, eax
mov ax, word [0x4ab534]
xor ecx, ecx
mov cx, word [0x4ab532]
mov word [esp + 0x24], ax
mov word [esp + 0x1c], cx
push edx
push 0
push eax
push ecx
call fcn.00407ad0
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ax, word [0x46a250]
push eax
push 1
push esi
push edi
call fcn.00407ad0
xor ecx, ecx
mov cx, word [0x46a254]
push ecx
push 2
push esi
push edi
call fcn.00407ad0
mov eax, dword [esp + 0x14]
test eax, eax
pop edi
pop esi
pop ebx
je 0x403c0f
movsx edx, word [esp + 0x1c]
push edx
call fcn.00407950
test bp, bp
jge 0x403c16
xor ebp, ebp
mov ax, bp
pop ebp
add esp, 0x10
ret 8
cmp bp, 0xffff
je 0x403b20
lea esi, [esp + 0x24]
not bl
mov edi, 4
mov al, byte [esi]
mov dl, byte [esp + 0x12]
push 1
xor al, dl
push 1
add al, bl
inc esi
call fcn.004027e0
dec edi
jne 0x403c35
mov ecx, dword [0x429140]
push ecx
push 0
call fcn.00402a40
mov dl, byte [esp + 0x13]
mov bl, al
mov al, byte [esp + 0x12]
add bl, dl
inc bl
xor bl, al
jmp 0x403b24