joyce8/EMBER2024-capa huggingface dataset:
Function at 0x615fcd
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0xef
out dx, eax
scasd eax, dword es:[edi]
ret
out dx, eax
xchg edx, eax
mov bl, 0x64
int 0x5d
sub al, 0xd3
adc byte [ebp - 0x69], ah
and eax, 0x69995bb9
and dword [0xe2716311], 0xd0fec052
jne 0x615f39
mov bh, byte [0xe606b294]
aas
loope 0x615f81
adc dh, 0x50
cmp al, 0xea
dec ebp
push ebp
aas
invalid
jno 0x615f97
bound ebx, qword [edi + 0x10]
dec ch
pop eax
pop ebp
insb byte es:[edi], dx
mov al, byte [0x3598ee90]
lahf
add dword [ebp + 0x4e395b74], eax
loope 0x615fae
add byte [esi - 0x34bc62dc], bl
pop ds
scasb al, byte es:[edi]
loopne 0x615fb0
out dx, eax
scasd eax, dword es:[edi]
adc bl, bl
push edi
push ds
cmp byte [edx], dl
and eax, 0x21c2820b
ficomp word [esi + 0x638f916b]
loope 0x615f7d
test al, 1
mov esp, 0xa4826704
or edx, dword [edx + 0x42]
push edi
bswap esi
xor cl, byte [edi + 0x6f908029]
out dx, al
aas
in al, 0xc8
bound ebp, qword [edx - 0x517af5e0]
ja 0x615ff2
xchg ecx, eax
jne 0x616058
xor dh, al
imul edi, dword [ebp + 0x41d9410a], 0xd4af48b0
ret 0xfe32
into
popfd
cmp ebp, dword [ebx + 0x6f]
inc ebx
cli
sub eax, 0xe48254e4
jl 0x616074
je 0x616089
scasd eax, dword es:[edi]
push cs
popfd
adc al, 0x1d
and ebp, 0xffffffce
xchg edi, eax
push 0x8c8329f9
inc eax
mov al, byte [eax + 0x71]
jnp 0x6160a2
sub dword [ebx + 0x408a408c], eax
jno 0x6160f7
and eax, 0x72235fe3
mov dh, byte [eax + edx*8]
jecxz 0x6160de
and esi, dword [edx - 0x76]
xor al, 0xd0
invalid
inc ecx
mov esp, 0xad1ea50e
pop ss
mov ebp, 0xdfa11c1f
sub dword [esi + 0x5f610fe4], edi
ret 0xd72f
inc byte [ebx + 0x70]
retf
dec edx
cmp esp, eax
insd dword es:[edi], dx
mov dh, byte [eax + edi + 0x20728035]
sti
jle 0x61613c
mov ebx, 0xd78b9b3c
dec ebp
push cs
das
add dh, ah
invalid
and edx, eax
jae 0x61617a
push cs
xor dl, byte [ebx]
int3
mov ebx, 0x479f4636
shl byte [edx], 0x35
mov al, byte [esi]
insd dword es:[edi], dx
push 0xe03280db
dec esp
movsb byte es:[edi], byte [esi]
and byte [edx], bh
iretd
and eax, 0xec8e19fe
dec eax
mov eax, 0xe887fff9
js 0x616137
add eax, 0x240358a6
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
pop eax
add esp, dword [ebx + ebp*4]
cmp ecx, dword [eax - 0x6a]
jno 0x61616c
inc esp
in eax, dx
aad 0x9d
add ch, byte [ebx - 0x474ba6b8]
js 0x616172
int1
psubd mm3, qword [eax + 0x61]
dec ebp
and dh, dh
out 0xbf, al
pop ebx
or bl, byte [edx - 0x4804ddd6]
into
pushal
cli
insd dword es:[edi], dx
jecxz 0x6161ca
lcall 0xa8c6, 0x5f6aba06
nop
invalid
cmc
cmp dl, byte [ecx - 0xc11aa6f]
invalid
Function at 0x62337d
Capabilities:
Encode data using xor

Disassembly:
dec edi
or ebx, 0x4ac3608a
xor ch, dh
cmp dword [ebp + 0x5e959de8], eax
and dword [esi + ebp*2 + 0x6186a6c1], ecx
arpl word [ecx - 0x69], bx
das
sti
lahf
add byte [eax - 0x4f], 0xb1
out 0x9f, al
ror byte [ebp - 0x6c0db621], 0xc0
scasd eax, dword es:[edi]
adc byte [edi + 0x7be28bca], bh
iretd
mov esp, edx
jnp 0x6232e4
scasd eax, dword es:[edi]
ficom dword [edi - 0x30cb78b5]
or eax, 0x87b0c8c8
mov dword [eax + 0xc], eax
movsd dword es:[edi], dword [esi]
pop edx
mov edx, 0x63a1af26
div byte [ecx + 0x31]
jnp 0x623311
pop ecx
cmpsb byte [esi], byte es:[edi]
fistp qword [esi + 0x32]
xor dl, byte [eax + 0x144eac39]
push eax
mov byte [eax - 0x1b], al
dec edx
dec esi
adc al, 0x50
mov byte [eax - 0x1b], al
dec edx
inc eax
lahf
insb byte es:[edi], dx
pop ds
enter 0x18e1, 0xffffffffffffff8f
js 0x623361
dec ebx
cld
jge 0x623345
jmp 0x623315
sub eax, 0x2f03c00
nop
xlatb
mov ah, 0x1f
not byte [edx]
cmp ebx, ecx
pushal
mov al, 8
scasd eax, dword es:[edi]
fist dword [ebx - 0x1dffc517]
shl byte [ecx - 0x34], cl
xor dword [edi + 0x61e08d52], ebp
loop 0x623367
popal
int3
out dx, eax
popfd
leave
stosd dword es:[di], eax
jge 0x623393
insd dword es:[edi], dx
cmc
imul esi, dword [edx], 0xc1970812
or al, byte [esi]
add byte [edi - 3], cl
or dword [eax - 0x7060f463], edx
cmp dword [eax + 0x3b], esp
insd dword es:[edi], dx
mov dh, 0xf0
jne 0x62343d
dec ebp
xor dword [esi - 0x1d], esi
scasb al, byte es:[edi]
sbb byte [edx - 0x4c], dl
into
sub al, 0x2f
add byte [edi], bh
pop esp
push es
mov cl, 0x81
invalid
mov word [esi + 0x79ce5510], ss
sahf
pop esp
mov esp, 0xce037b11
push ebx
retf

Function at 0x62d477
Capabilities:
Encode data using xor

Disassembly:
arpl word [ecx], sp
jecxz 0x62d4e6
xchg ebx, eax
invalid
adc ah, byte [edx + ecx*8 + 0x3fc7d181]
enter 0x4295, 0xffffffffffffff9b
lahf
dec esp
sub ebx, eax
mov al, 0xd2
call 0x59842a5a
xchg ebx, eax
cli
dec ecx
sub eax, 0x36733e9d
clc
clc
ror dword [ebx], cl
sub ah, byte [eax + 0x25ff550e]
retf
push eax
mov dword [0x1caa2a10], eax
add dword [edi - 0x421bb054], esi
push eax
inc ebx
inc edx
xchg ebp, eax
jo 0x62d499
mov al, byte [0x5c188d81]
jmp 0x62d515
or dword [ebp + 0x16eb5c18], 0x7048381d
fbstp tbyte [eax]
push 0x88227213
adc al, bh
pop eax
sti
adc ah, byte [edi - 0xf]
adc al, 0x87
jl 0x62d4f8
loop 0x62d558
inc ecx
jg 0x62d4b9
invalid
adc al, 0xf
test dword [0xfa11b6c], ebp
mov eax, dword [edi]
retf

Function at 0x656c61
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x8c4163bb], al
mov byte [0x2c5c3679], al
or dl, byte [edx + 0x342a9c9c]
pop ebp
scasd eax, dword es:[edi]
invalid
Function at 0x401edd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401f1c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401f1c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f1c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401f1c
cmp dword [ecx + 0x74], 0xe
jbe 0x401f1c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41bb8c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b9fd

Function at 0x41bf87
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040cef0
mov eax, dword [0x47ec00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041abf2
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41bfc9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41c125
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00428070
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x481318]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041cf7e
mov ecx, dword [esi*4 + 0x481318]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41c11e
cmp eax, dword [edi + ecx + 0x24]
jne 0x41c11e
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c11e
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041cf7e
add esp, 0x14
test edx, edx
jl 0x41c11e
jg 0x41c094
test eax, eax
jb 0x41c11e
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41c11e
jl 0x41c0ae
cmp dword [ebp - 0x1008], eax
ja 0x41c11e
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41c0cc
test ebx, ebx
je 0x41c105
cmp ecx, edi
jae 0x41c105
mov al, byte [ecx]
cmp al, 0xd
jne 0x41c0e6
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41c0f2
cmp byte [ecx + 1], 0xa
jne 0x41c0f2
inc ecx
jmp 0x41c0f2
movzx eax, al
movsx eax, byte [eax + 0x47eed0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41c0cc
cmp edx, ebx
jne 0x41c0cc
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41c123
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040c539
leave
ret
Function at 0x41c41c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x481318]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c45c
cmp byte [ebx], 0xa
jne 0x41c45c
or byte [eax + edi + 0x28], 4
jmp 0x41c461
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41c55f
mov al, byte [edx]
cmp al, 0x1a
je 0x41c541
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41c490
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41c4b5
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41c4bf
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41c472
jmp 0x41c55f
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c53c
cmp dword [ebp - 0xc], 0
je 0x41c53c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x481318]
test byte [eax + edi + 0x28], 0x48
je 0x41c516
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41c501
mov byte [esi], dl
jmp 0x41c512
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x481318]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41c55f
cmp byte [ebp - 1], 0xa
jne 0x41c525
cmp esi, ebx
jne 0x41c525
mov byte [esi], 0xa
jmp 0x41c55e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041cf9c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41c55f
mov byte [esi], 0xd
jmp 0x41c55e
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x481318]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c55b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c55f
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41c568
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x481318]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41c5ab
cmp word [esi], dx
jne 0x41c5ab
or byte [edi + eax + 0x28], 4
jmp 0x41c5b0
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41c703
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41c6e3
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41c5f2
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41c628
cmp eax, edx
jae 0x41c634
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41c5ca
jmp 0x41c703
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c6df
cmp dword [ebp - 0x14], 0
je 0x41c6df
mov eax, dword [ebx*4 + 0x481318]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41c6b7
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41c680
mov word [esi], cx
jmp 0x41c6b3
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x481318]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x481318]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x481318]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41c703
pop ebx
cmp word [ebp - 4], bx
jne 0x41c6c8
cmp esi, dword [ebp + 0xc]
jne 0x41c6c8
mov word [esi], bx
jmp 0x41c700
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041cf9c
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41c703
push 0xd
jmp 0x41c6fc
mov ecx, dword [ebx*4 + 0x481318]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41c6fa
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41c703
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1061bc2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.010615fa
test al, al
je 0x1061be5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1061c41
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1061c32
cmp dword [ebp + 0x10], 0
je 0x1061c32
lea esi, [edi + edi]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov ebx, esp
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1061c23
push eax
push edi
push ebx
push dword [ebp + 0x10]
call fcn.01060390
jmp 0x1061c41
test edi, edi
jle 0x1061c2e
mov eax, dword [ebp + 0x10]
and word [eax], 0
xor eax, eax
jmp 0x1061c41
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x8b9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008b91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8b907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8b906a
add dl, dl
jne 0x8b9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8b90dc
xor eax, eax
add dl, dl
jne 0x8b9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8b917d
add dl, dl
jne 0x8b90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8b90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8b9075
mov eax, 1
add dl, dl
jne 0x8b90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8b90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8b90e1
sub eax, ebx
mov ebx, 1
jne 0x8b9128
mov ecx, 1
add dl, dl
jne 0x8b910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8b9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8b9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8b9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8b913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8b914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8b9136
cmp eax, 0x7d00
jae 0x8b916d
cmp eax, 0x500
jb 0x8b9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8b9075
cmp eax, 0x7f
ja 0x8b9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8b9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8b919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8b9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x9301ec
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301f2
pop ebp
sub ebp, 6
sub ebp, 0x5301ec
jmp 0x930250
jmp 0x930259
mov eax, 0x5301ec
add eax, ebp
add eax, 0x93
mov ecx, 0x622
mov edx, 0x7e2e0af8
xor byte [eax], dl
inc eax
dec ecx
jne 0x930270
jmp 0x930283
xchg edx, eax
mov eax, 0xf8e8f890
clc
nop
clc
xor al, 0xd4
clc
retf
Function at 0x401a46
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401a65
xor eax, eax
jmp 0x401ae0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401a7b
xor eax, eax
jmp 0x401ae0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x401ac3
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x401ac3
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x401a9c
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x401acf
xor eax, eax
jmp 0x401ae0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x401add
xor eax, eax
jmp 0x401ae0
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4020d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov dword [ebp - 0x30], ecx
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
je 0x4021a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
cmp dword [eax + 4], 0
je 0x4021a2
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
je 0x4021a2
push 0x4ff
push 0x64
push 0
mov eax, dword [ebp - 0x30]
add eax, 0xc
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402140
mov byte [ebp - 1], 1
jmp 0x4021a2
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40214a
jmp 0x4021a2
and dword [ebp - 0x2c], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402185
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x28], 0x12
jne 0x402185
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x40219d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x2710
jbe 0x40219d
jmp 0x4021a2
jmp 0x4020fd
jmp 0x4021c6
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
je 0x4021c6
push 0xbb8
mov eax, dword [ebp - 0x30]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop edi
leave
ret 4
Function at 0x40e1df
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00408220
test eax, eax
je 0x40e244
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x40e23a
cmp dword [ebp + 8], 0x1b
jne 0x40e220
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040815f
jmp 0x40e23a
cmp dword [ebp + 8], 0xd
jne 0x40e23a
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0040815f
push 0
mov ecx, dword [ebp - 4]
call fcn.0040e2ee
leave
ret 0xc
Function at 0x41224d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.00441348
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.00412b61
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4122ab
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.00412de6
mov eax, dword [ebp - 0x21c]
jmp 0x41233a
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x412310
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041224d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412307
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.00412de6
mov eax, dword [ebp - 0x220]
jmp 0x41233a
mov dword [ebp - 4], 0x100
jmp 0x4122b2
lea ecx, [ebp - 0x10]
call fcn.0041238a
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.004123b7
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.00412de6
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0047676d
leave
ret 4

Function at 0x4175b2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d2a20]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
and dword [eax], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0x10], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.uxtheme.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x417669
jmp 0x4176dd
mov eax, dword [ebp - 0x218]
mov dword [eax], 1
push str.OpenThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 4], eax
push str.CloseThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 8], eax
push str.DrawThemeBackground
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0xc], eax
push str.SetWindowTheme
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047676d
leave
ret
Function at 0x419b48
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00419b7b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419b79
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x419b79
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret

Function at 0x42085f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a44d9
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4d2a20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00401d20
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00421972
mov eax, dword [ebp - 0x10]
and dword [eax], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x1c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x20], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x24], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x28], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x30], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x34], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret