joyce8/EMBER2024-capa huggingface dataset:
Function at 0x93f614
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x93f7c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x93f7a3
mov dl, 1
mov eax, dword [0x4848a0]
call fcn.004ae450
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409c78
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x93f792
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.008c76b4
test al, al
je 0x93f785
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x93f7d4
lea eax, [ebp - 0x394]
call fcn.0042a0d8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x93f785
xor eax, eax
push ebp
push 0x93f77e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x93f844
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x93f765
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aa2c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x93f765
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aa2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93f785
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x93f685
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004ae378
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93f7cb
lea eax, [ebp - 0x3a0]
call fcn.00409c78
pop eax
jmp eax

Function at 0x94038c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0xa94200]
cmp byte [eax + 0xc5], 0
jne 0x9403fe
cmp dword [0xa94224], 0
jne 0x9403be
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0xa734b4]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0xa94224], eax
cmp dword [0xa94220], 0
jne 0x9403d9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0xa94220], eax
cmp dword [0xa94228], 0
jne 0x9403fe
push esp
push 0
push 0
mov eax, dword [0xa734b0]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0xa94228], eax
pop edx
ret
Function at 0x9407d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x9407e7
add esp, 0xfffffff0
call fcn.004084dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004be29c
mov eax, dword [0xa76fd4]
cmp byte [eax], 0
jne 0x940814
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0xa77830]
cmp word [eax + 2], 0
jne 0x94082e
mov eax, dword [0xa77830]
mov dword [eax + 4], ebx
mov dword [eax], fcn.009428e8
mov eax, dword [0xa77b34]
cmp word [eax + 2], 0
jne 0x940848
mov eax, dword [0xa77b34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00942aec
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x893a44]
call fcn.0089a3f0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x942f78
mov dl, 1
mov eax, dword [0x480e48]
call fcn.00407f40
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x480e48]
call fcn.00407f40
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x898a98]
call fcn.008a3c74
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x940a38
mov eax, dword [0xa774f4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.008a40fc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x94323c
mov dl, 1
mov eax, dword [0x480e48]
call fcn.00407f40
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0xa774f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00429ed8
test eax, eax
je 0x940962
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00429d04
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00429ebc
test eax, eax
je 0x94097a
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aa2c
push ebx
push 0x94255c
call fcn.00935a50
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0xa76fd4]
cmp byte [eax], 0
jne 0x9409cb
mov eax, ebx
call fcn.00940c00
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00943478
mov eax, ebx
call fcn.0094412c
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x940a2f
call fcn.00408534
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x940f30
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x940fd2
cmp dword [ebx + 0xac], 0
jne 0x940fcc
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x940e70
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x940fcc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x940f92
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x940fcc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004a9860
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x940fa1
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x941278
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0xa94200]
cmp dword [eax + 0x188], 0
je 0x9413e1
test bl, bl
jne 0x941334
cmp dword [esi + 0xb4], 0
jne 0x941329
mov eax, esi
call fcn.00943f7c
push eax
push 0x941178
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x9412fa
mov eax, dword [0xa94200]
cmp byte [eax + 0xeb], 0
je 0x9412fa
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x9412db
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x9412fa
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x9412e3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x941329
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004a9860
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x941309
inc dword [esi + 0xb4]
jmp 0x9413e1
cmp dword [esi + 0xb4], 0
jle 0x9413e1
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x9413e1
cmp dword [esi + 0x58], 0
je 0x941396
mov eax, dword [0xa94200]
cmp byte [eax + 0xeb], 0
je 0x941396
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x941377
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x941396
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x94137f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x9413c5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004a9860
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x9413a5
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x93265c]
call fcn.0040ce1c
pop edi
pop esi
pop ebx
ret
Function at 0x942168
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x9421c5
cmp byte [ebx + 0xeb], 0
jne 0x9421c5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e00
mov eax, dword [esi]
test eax, eax
je 0x9421b2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x9421d2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a058
jmp 0x9421d2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a058
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x94368c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x9436fd
mov eax, esi
call fcn.008c0d9c
test al, al
je 0x9436fd
mov eax, dword [ebx + 0x98]
call fcn.008c09c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x9436fd
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x9436ee
push 0
mov eax, dword [ebx + 0x98]
call fcn.008c09c4
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.008b70dc
jmp 0x9436fd
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00943498
pop esi
pop ebx
ret
Function at 0x954440
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409d5c
xor eax, eax
push ebp
push 0x954583
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x954554
xor edx, edx
push ebp
push 0x95454d
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x95448d
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x954520
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x95450f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x9544d0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040a974
mov ecx, ebx
add ecx, ecx
add ecx, 2
mov edx, esi
call fcn.004072d4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x954516
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
pop eax
jmp eax
mov ecx, dword [0xa7715c]
mov dl, 1
mov eax, dword [0x420654]
call fcn.0042f0ec
call fcn.00409370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x95458a
lea eax, [ebp - 4]
call fcn.00409c78
pop eax
jmp eax

Function at 0x98bcbc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00409c78
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x98bced
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.00409e00
add esp, 0x24
pop ebx
ret
Function at 0x9b1880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x9b1888
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x9b1a3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x9b1a58
call fcn.0040abdc
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.009afa88
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x9b1a6c
call fcn.0095d994
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x9b1903
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x9b1944
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.009afa88
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x9b1ad4
call fcn.0095d994
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040ab84
mov eax, esi
mov edx, 0x9b1b00
call fcn.0040ab84
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x9b195c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x9b19ca
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x9b1b14
call fcn.0095d994
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040ab84
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x9b1993
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x9b19be
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x9b1b44
call fcn.0095d994
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040ab84
mov eax, esi
mov edx, 0x9b1b00
call fcn.0040ab84
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x9b19d6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x9b1a01
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x9b1b70
call fcn.0095d994
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040ab84
mov eax, esi
mov edx, 0x9b1b00
call fcn.0040ab84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9b1a46
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409cd8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409cd8
lea eax, [ebp - 4]
call fcn.00409c78
pop eax
jmp eax
Function at 0x9dcce4
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x9dcd00
push esi
mov esi, edx
mov edx, eax
lodsb al, byte [esi]
xor edx, eax
shr eax, 8
shl edx, 2
xor eax, dword [edx + 0xa9449c]
dec ecx
jne 0x9dcceb
pop esi
ret

Function at 0x9ebde8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x9ebe05
xor eax, eax
jmp 0x9ebe8c
movzx ecx, byte [esi]
and cl, 0xff
movzx ecx, cl
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea edx, [eax + 1]
movzx edx, byte [esi + edx]
and dl, 0xff
movzx edx, dl
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x9ebe48
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.009eb908
test al, al
jne 0x9ebe83
xor eax, eax
jmp 0x9ebe8c
mov edx, ebx
mov eax, edi
call fcn.009eb8c0
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0xa3c100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00409d5c
mov eax, dword [ebp - 8]
call fcn.00409d5c
mov eax, dword [ebp + 8]
call fcn.00409d5c
xor eax, eax
push ebp
push 0xa3c262
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004077ac
cmp dword [ebp - 8], 0
je 0xa3c158
cmp dword [ebp + 8], 0
jne 0xa3c174
push 0xa3c280
push dword [ebp - 4]
push 0xa3c280
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040ac64
jmp 0xa3c19e
push 0xa3c280
push dword [ebp - 4]
push 0xa3c280
push 0xa3c290
push dword [ebp - 8]
push 0xa3c2b0
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.0040ac64
mov eax, dword [ebx + 0x558]
call fcn.006d5960
test al, al
jne 0xa3c1bc
lea eax, [ebp - 0xc]
mov edx, 0xa3c2d4
call fcn.0040ab84
jmp 0xa3c1d8
mov eax, dword [ebx + 0x55c]
call fcn.006d5960
test al, al
jne 0xa3c1d8
lea eax, [ebp - 0xc]
mov edx, 0xa3c300
call fcn.0040ab84
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 0x41
mov word [ebp - 0x20], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.0042993c
mov eax, dword [ebp - 0x64]
call fcn.0040a974
push eax
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040a974
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0xa3c235
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa3c269
lea eax, [ebp - 0x64]
call fcn.00409c78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409cd8
lea eax, [ebp + 8]
call fcn.00409c78
pop eax
jmp eax
Function at 0xa4475c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409d5c
xor eax, eax
push ebp
push 0xa447ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a974
push eax
push 0xa447b8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa447b3
lea eax, [ebp - 4]
call fcn.00409c78
pop eax
jmp eax

Function at 0xa4482c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409d5c
mov eax, dword [ebp - 8]
call fcn.00409d5c
xor eax, eax
push ebp
push 0xa4492f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004077ac
cmp dword [ebp - 8], 0
je 0xa44893
push 0xa4494c
push dword [ebp - 4]
push 0xa4495c
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040ac64
jmp 0xa448ad
push 0xa4494c
push dword [ebp - 4]
push 0xa4494c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040ac64
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 0x41
mov word [ebp - 0x20], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.0042993c
mov eax, dword [ebp - 0x64]
call fcn.0040a974
push eax
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040a974
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0xa4490a
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa44936
lea eax, [ebp - 0x64]
call fcn.00409c78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409cd8
pop eax
jmp eax

Function at 0xa44c5c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409d5c
xor eax, eax
push ebp
push 0xa44d08
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a974
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, 0x34
call fcn.004077ac
test ebx, ebx
jbe 0xa44cee
mov eax, ebx
call fcn.00407094
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.0040a974
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xa44d18
push esi
call sub.version.dll_VerQueryValueW
mov edx, edi
mov eax, dword [ebp - 0xc]
mov ecx, 0x34
call fcn.004072d4
mov eax, esi
call fcn.004070b0
mov bl, 1
jmp 0xa44cf0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa44d0f
lea eax, [ebp - 4]
call fcn.00409c78
pop eax
jmp eax
Function at 0x4657da
Capabilities:
Encode data using xor

Disassembly:
xor edi, dword [ecx - 0x7a]
mov byte [0x22fb2b4e], al
wait
frstor dword [edi + ebx*8 + 0x2f5e04a9]
loopne 0x4657cc
and esi, dword [ecx + 0x5d]
mov dword [ebp - 0x3c534911], edx
inc ebx
cmp ch, byte [esi - 0x48]
push cs
sub bl, byte [eax]
mov al, byte [ebx]
retf
bound esi, qword [0xbd334f51]
xor esi, dword [0xd1e6a500]
out 0xd1, al
jp 0x4657bc
jno 0x46579a
push esi
add byte es:[eax + 0x28db8f9f], 0x66
sub byte [esi - 0x2a], ah
nop
stc
daa
xor dword [eax], 0x7476c5c1
loope 0x46585b
mov dh, byte [edi - 0x18b01e74]
aad 0x6a
les edi, [ecx - 0x24]
test bl, 0xfd
std
loop 0x4657f5
jmp 0x46581f
fbld tbyte [0xc00fe974]
mov ah, 0xb2
shr byte [ebx], 1
sub eax, dword [ecx]
rcr byte [esi], 1
jno 0x46589c
xor edx, 0x6b
in eax, dx
mov al, byte [0x42a51e1f]
mov eax, dword [0xc6478553]
mov al, byte [0x7e5118fe]
xchg esp, eax
push dword [ecx - 0x30dc2e7c]
push dword [ecx - 0x30dc2e7c]
pop esp
xor dword [eax - 0x49ab0a97], ecx
adc dword [edx], 6
sbb eax, 0x7ec485f
test byte [edi + 0x5c], bl
pop esp
pop ds
dec eax
and al, 0x88
mov ebp, 0xb88dd4f6
dec esi
fdivr st(4)
pushfd
jns 0x465844
imul edi, dword [edx + 2], 0x1242ad82
inc esp
insb byte es:[edi], dx
iretd
mov ah, 0x95
and edi, ebp
inc ebx
push eax
test bl, ch
dec ebp
xchg edx, eax
cmp dword [esi + edx*4], 0x77fa4c62
sal dword [ebx + 0x26dac11d], 1
add eax, 0x3cf2010f
adc al, 0xff
sbb esi, dword [edx]
jp 0x4658e6
dec ebx
out dx, eax
clc
inc edi
adc dword [edi + 0x46], esp
jnp 0x4658e4
push es
and dword [ebx + 3], ebp
sbb dword [edx], ebx
mov al, byte [edi + 0x1e]
jnp 0x46592e
mov al, byte [ecx]
cmp al, 0x45
push esi
iretd
cmp eax, 0x3d92e52f
or byte [edi], 0xc9
in eax, 0x92
cmp eax, 0xa5c90f80
movsd dword es:[edi], dword [esi]
jno 0x465904
loop 0x465922
ljmp 0xb472:0xebf78118
sbb byte [ecx - 0x4b8d1409], al
popal
jg 0x4658ff
cwde
dec esp
test al, 0xc7
jecxz 0x4658fd
mov dword [0x6d4ab10f], eax
dec edx
insd dword es:[edi], dx
salc
pushal
xchg edi, eax
salc
shr byte [ecx + ebx*4], 0xd9
daa
push 0x632cc7eb
push ebp
push esp
xor al, byte [esi - 9]
popal
or cl, byte [ebp + 0x590ba3d8]
adc dl, ah
ja 0x4658ec
adc edx, dword ds:[ebp - 0x6ca62114]
std
push ss
xor dword [eax], 0xfffffff2
xor dl, dh
std
xor al, 0x7f
scasd eax, dword es:[edi]
aas
push edi
rol cl, cl
aad 0x4e
jp 0x4658f2
mov ah, 0xf4
dec esp
test dword [ecx], 0x40089085
jns 0x465956
int 0x31
and eax, 0x7b9db05f
invalid
inc ebp
add cl, byte [ecx]
iretd