joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a21a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a44eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0x5db40c
mov dword [ebx + 8], 0x4f
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.LexerD.0
mov byte [ebx + 0x14], 1
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov byte [ebx + 0x24], 0
mov dword [ebx + 0x28], 0xffffffff
mov dword [ebx + 0x428], 0
mov dword [ebx + 0x42c], 0
mov dword [ebx + 0x430], 0
mov byte [ebx + 0x434], 0
mov dword [ebx + 0x438], 0xffffffff
mov dword [ebx + 0x838], 0
mov dword [ebx + 0x83c], 0
mov dword [ebx + 0x840], 0
mov byte [ebx + 0x844], 0
mov dword [ebx + 0x848], 0xffffffff
mov dword [ebx + 0xc48], 0
mov dword [ebx + 0xc4c], 0
mov dword [ebx + 0xc50], 0
mov byte [ebx + 0xc54], 0
mov dword [ebx + 0xc58], 0xffffffff
mov dword [ebx + 0x1058], 0
mov dword [ebx + 0x105c], 0
mov dword [ebx + 0x1060], 0
mov byte [ebx + 0x1064], 0
mov dword [ebx + 0x1068], 0xffffffff
mov dword [ebx + 0x1468], 0
mov dword [ebx + 0x146c], 0
mov dword [ebx + 0x1470], 0
mov byte [ebx + 0x1474], 0
mov dword [ebx + 0x1478], 0xffffffff
mov dword [ebx + 0x1878], 0
mov dword [ebx + 0x187c], 0
mov dword [ebx + 0x1880], 0
mov byte [ebx + 0x1884], 0
mov dword [ebx + 0x1888], 0xffffffff
lea edi, [ebx + 0x1c88]
lea ecx, [edi + 8]
mov dword [ebp - 0x14], edi
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
push 0
mov byte [ebp - 4], 9
push 0x5adadd
mov dword [edi], 0x1000100
mov byte [edi + 4], 1
call fcn.0040af10
push 0
push 0x5adadd
lea ecx, [edi + 0x20]
call fcn.0040af10
mov word [edi + 0x38], 0x100
mov dword [edi + 0x3c], 0xffffffff
mov byte [edi + 0x40], 0
lea ecx, [ebx + 0x1ccc]
mov byte [ebp - 4], 0xa
call fcn.004a1ed0
invalid
Function at 0x5111c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp + 8], eax
jb 0x5111e7
mov ebx, dword [ebx]
cmp eax, 8
jae 0x511219
mov eax, dword [ebx]
mov edi, 7
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov edi, eax
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x51122b
mov edi, SysReAllocString
lea eax, [edi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x51123d
or ecx, 0xffffffff
jmp 0x511245
cmp ecx, 0x1000
jb 0x51126d
lea eax, [ecx + 0x23]
cmp eax, ecx
ja 0x51124f
or eax, 0xffffffff
push eax
call fcn.0059df75
add esp, 4
test eax, eax
je 0x511267
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x511280
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test ecx, ecx
je 0x51127e
push ecx
call fcn.0059df75
add esp, 4
mov ecx, eax
jmp 0x511280
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [esi], ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
pop ebp
or ebx, edi
sub edi, esi
or edi, edx
cmp ebp, ebx
jb 0x5112b2
Function at 0x511b60
Capabilities:
Hash data using murmur3

Disassembly:
xchg edx, esi
dec edi
mov dword [0x60343c], edx
call fcn.00479592
inc eax
xchg esi, edx
add dword [0x6037e2], 0x9549cc93
push esi
invalid
out dx, al
adc al, 0x2f
Function at 0x566fa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c4
mov eax, dword [0x5f300c]
xor eax, esp
mov dword [esp + 0x3c0], eax
push edi
push 0x3a0
lea eax, [esp + 0x24]
mov edi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [edi + 0x7b0]
add esp, 0xc
mov dword [esp + 8], 0x3b8
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
push 0x40
push 0x10
push 0x10
push 1
push str.SCITE
push dword [0x602f64]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x30], 0x8000
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esp + 0x1c], eax
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + 0x5d7290]
mov word [esp + eax + 0x20], cx
test cx, cx
je 0x56703b
add eax, 2
cmp eax, 0x100
jb 0x567020
push 6
push dword [edi + 0x7b0]
xor eax, eax
mov word [esp + 0x126], ax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
je 0x567072
push 0
push dword [edi + 0x7b0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x3c4]
pop edi
xor ecx, esp
call fcn.0059df64
mov esp, ebp
pop ebp
ret

Function at 0x567090
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c4
mov eax, dword [0x5f300c]
xor eax, esp
mov dword [esp + 0x3c0], eax
push esi
push 0x3ac
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x7b0]
add esp, 0xc
mov dword [esp + 8], 0x3b8
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [esp + 0x3c4]
pop esi
xor ecx, esp
call fcn.0059df64
mov esp, ebp
pop ebp
ret
Function at 0x574860
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
call fcn.005737e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push eax
push 0
push dword [ebx + 4]
push 0x15
push 0x64
push 2
push 2
push 0x44000000
push 0x5d8018
push 0x5d801c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 4
push eax
mov dword [ebx + 0x44], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0xc]
push 0x30
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push eax
push 0
push dword [ebx + 4]
push 0x15
push 0x64
push 2
push 2
push 0x54000000
push 0x5d7ff0
push str.msctls_progress32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 0x4c], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x574aa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x5f300c]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
call fcn.005737e0
push 0x6666ff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x44], eax
mov ecx, esi
push str.Find:
lea eax, [esp + 8]
push eax
call fcn.00573350
push 0
mov eax, dword [eax + 4]
mov dword [esi + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push eax
push 0xfd
push dword [esi + 4]
push 0x15
push 0x12c
push 2
push 0x32
push 0x44010080
push 0x5d7fec
push str.Edit
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 4
push eax
mov dword [esi + 0x54], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0xc]
push 0x30
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xfe
push str.Find_Next
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00573420
lea ecx, [esp + 4]
push ecx
mov eax, dword [eax + 4]
push eax
mov dword [esi + 0x5c], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0x18]
sub ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
inc eax
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x38], eax
pop esi
xor ecx, esp
call fcn.0059df64
mov esp, ebp
pop ebp
ret
Function at 0x575300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x5f300c]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
call fcn.005737e0
push 0x6666ff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x44], eax
mov ecx, esi
push str.Find:
lea eax, [esp + 8]
push eax
call fcn.00573350
push 0
mov eax, dword [eax + 4]
mov dword [esi + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push eax
push 0xde
push dword [esi + 4]
push 0x50
push 0x12c
push 2
push 0x32
push 0x44010042
push 0x5d8074
push 0x5d8078
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
mov dword [esi + 0x54], eax
push dword [esi + 0xc]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 4]
push eax
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, dword [esp + 8]
inc eax
push 0
add eax, ecx
mov ecx, esi
push 1
mov dword [esi + 0x38], eax
lea eax, [esp + 0xc]
push str.Find_Next
push eax
call fcn.00573420
push 0
push 0xf5
push str.Mark_All
mov eax, dword [eax + 4]
mov ecx, esi
mov dword [esi + 0x88], eax
lea eax, [esp + 0x10]
push eax
call fcn.00573420
push 1
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [esi + 0x90], eax
lea eax, [esp + 8]
push dword [0x5ff1b0]
push dword [0x5ff1a8]
push eax
call fcn.00573420
push 1
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [esi + 0x5c], eax
lea eax, [esp + 8]
push dword [0x5ff1bc]
push dword [0x5ff1b4]
push eax
call fcn.00573420
mov eax, dword [eax + 4]
mov ecx, esi
push 1
mov dword [esi + 0x64], eax
lea eax, [esp + 8]
push dword [0x5ff1c8]
push dword [0x5ff1c0]
push eax
call fcn.00573420
push 1
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [esi + 0x6c], eax
lea eax, [esp + 8]
push dword [0x5ff1d4]
push dword [0x5ff1cc]
push eax
call fcn.00573420
push 1
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [esi + 0x74], eax
lea eax, [esp + 8]
push dword [0x5ff1e0]
push dword [0x5ff1d8]
push eax
call fcn.00573420
push 1
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [esi + 0x7c], eax
lea eax, [esp + 8]
push dword [0x5ff1ec]
push dword [0x5ff1e4]
push eax
call fcn.00573420
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esi + 0x98], eax
pop esi
xor ecx, esp
call fcn.0059df64
mov esp, ebp
pop ebp
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402f78
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402fb7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402fb7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402fb7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402fb7
cmp dword [ecx + 0x74], 0xe
jbe 0x402fb7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x484abb
Capabilities:
Encode data using xor

Disassembly:
daa
add byte [eax], al
or cl, byte [edx]
adc al, byte [eax]
sub ch, al
add byte [eax], al
push es
push es
sub ah, byte [edx]
add al, byte [ebx]
sub al, cl
add byte [eax], al
push es
sub al, byte [eax]
adc esi, dword [eax]
add eax, 0x2c00
add byte [eax + eax], ch
add byte [eax], al
adc al, 0
add byte [eax + eax], ch
add byte [eax], al
adc al, 0
add byte [ecx], dl
pop ds
or dh, byte [edx + 0x7b]
push es
add byte [eax + 0x18], dh
lea eax, [ecx]
add byte [eax], al
add dword [edx], ecx
push es
push ss
add bh, byte [ebx - 0x62]
add dword [eax], eax
add al, 0xa2
push es
pop ss
add ecx, dword [esp + esi*2 - 0x5dff0000]
push es
sub byte [0x73060000], cl
xor dword [ecx], eax
add byte [esi], al
sub dh, byte [esi]
add bh, byte [ebx - 0x62]
add dword [eax], eax
add al, 3
sub bl, cl
add byte [eax], al
push es
sub cl, byte [esi + 2]
jnp 0x484aa0
add dword [eax], eax
add al, 3
sub byte [edi], ah
add byte [eax], al
or al, byte [eax + ebp]
retf
Function at 0x486a97
Capabilities:
Encode data using xor

Disassembly:
pop ss
add byte [eax], al
push es
sub cl, byte [esi + 2]
sub byte [esi], ch
add dword [eax], eax
push es
add ch, byte [eax]
sub al, 1
add byte [esi], al
add ch, byte [eax]
sub eax, 0x2a060001
adc esi, dword [eax]
push es
add byte [ebx], cl
add eax, dword [eax]
add byte [0x73110000], dh
mov dword [eax], 0x60a0a00
or cl, byte [edx]
push es
jb 0x486b05
adc eax, 0x8d177000
add dword [eax], eax
add byte [ecx], al
adc eax, dword [edi]
adc dword [edi], eax
push ss
add ch, byte [eax]
add al, 1
add byte [esi], al
sub byte [edi + 1], bh
add byte [esi], al
mov byte [0xd280711], al
add byte [eax], al
push es
outsd dx, dword [esi]
enter 0, 0xa
add ch, byte es:[eax]
add al, 1
add byte [esi], al
cmp dword [edi + 0x6000002], ebx
jb 0x486b64
adc eax, 0x8d177000
add dword [eax], eax
add byte [ecx], al
adc ecx, dword [eax]
adc dword [eax], ecx
push ss
add ch, byte [eax]
push es
add dword [eax], eax
push es
invalid
add byte [esi], al
sub al, 0xd
add ch, byte [eax]
sbb byte [ecx], al
add byte [esi], al
outsd dx, dword [esi]
cmp al, byte [eax]
add byte [edx], cl
sub ecx, dword [edx]
jb 0x486b07
or ch, byte [ebx]
or dh, byte [edx - 0x42]
adc eax, 0xe287000
add byte [eax], al
push es
mov byte [0xd280911], al
add byte [eax], al
push es
outsd dx, dword [esi]
enter 0, 0xa
push es
jb 0x486b36
adc eax, 0xe287000
jo 0x486b8e
push cs
add byte [eax], al
push es
outsd dx, dword [esi]
enter 0, 0xa
add ch, byte es:[eax]
push ss
add dword [eax], eax
push es
sub al, 0xb
add ch, byte [eax]
push ss
add dword [eax], eax
push es
mov gs, word [ecx + 0x17]
das
adc eax, dword [esi]
jb 0x486b44
adc eax, 0xe287000
add byte [eax], al
push es
outsd dx, dword [esi]
leave
add byte [eax], al
or ah, byte [esi]
sub eax, dword [esi + edx + 0xb]
add ch, byte [eax]
push ss
add dword [eax], eax
push es
adc ecx, dword [edx]
push ss
adc ecx, dword [ebx]
sub ebp, dword [0xb110a11]
lcall 0xb58, 0x1725070c
push ss
xor dword [ecx], edx
push es
jb 0x486bb0
adc eax, 0xe287000
add byte [eax], al
push es
outsd dx, dword [esi]
enter 0, 0xa
push es
or byte [edi - 0x37], ch
add byte [eax], al
or ah, byte [esi]
adc dword [ebx], ecx
pop ss
pop eax
adc ecx, dword [ebx]
adc dword [ebx], ecx
adc dword [edx], ecx
mov gs, word [ecx + 0x32]
retf
Function at 0x487c68
Capabilities:
Encode data using xor

Disassembly:
xor al, byte [edx]
and byte [0x28010000], ch
imul eax, dword [ecx], 0
push es
sub al, byte [eax]
add byte [eax], al
adc esi, dword [eax]
add eax, dword [eax]
push ds
add byte [eax], al
add byte [ebx], dl
xor byte [ebx], al
add byte [esi], bl
add byte [eax], al
add byte [ebp], al
add byte [ecx], dl
pop ds
inc eax
or al, byte [esi]
jae 0x487c75
add byte [eax], al
or cl, byte [ebx]
add al, byte [edi]
adc al, byte [eax]
sub byte [ebp], dl
add byte [esi], al
sub al, 7
pop es
outsd dx, dword [esi]
Function at 0x403540
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x20
cdq
and edx, 0xf
add eax, edx
sar eax, 4
test eax, eax
jle 0x4035f1
mov ecx, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
sub edi, ecx
mov esi, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], eax
jmp 0x403576
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
add edi, esi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [edi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x403583
add ecx, 4
add edi, 4
dec ebp
jne 0x403581
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.00401280
add esp, 0xc
lea ebp, [esp + 0x20]
mov edx, 4
mov edi, dword [ebp]
xor eax, eax
mov ecx, 0x18
mov ebx, edi
sub ecx, eax
add eax, 8
shr ebx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], bl
jl 0x4035c5
add ebp, 4
dec edx
jne 0x4035c0
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x403572
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x403600
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x20
cdq
and edx, 0xf
add eax, edx
sar eax, 4
test eax, eax
jle 0x4036b1
mov ecx, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
sub edi, ecx
mov esi, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], eax
jmp 0x403636
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
add edi, esi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [edi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x403643
add ecx, 4
add edi, 4
dec ebp
jne 0x403641
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.004023b0
add esp, 0xc
lea ebp, [esp + 0x20]
mov edx, 4
mov edi, dword [ebp]
xor eax, eax
mov ecx, 0x18
mov ebx, edi
sub ecx, eax
add eax, 8
shr ebx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], bl
jl 0x403685
add ebp, 4
dec edx
jne 0x403680
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x403632
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4036c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x38]
mov dword [esp], 0x12345678
cdq
and edx, 0xf
mov dword [esp + 4], 0x56785678
add eax, edx
mov dword [esp + 8], 0x9abc5678
sar eax, 4
test eax, eax
mov dword [esp + 0xc], 0xdeff5678
jle 0x403797
mov ecx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
push edi
mov esi, ecx
sub ebx, ecx
mov dword [esp + 0x48], eax
lea edi, [ebx + esi]
xor ecx, ecx
xor eax, eax
mov ebp, dword [esp + ecx + 0x20]
xor edx, edx
mov dl, byte [edi + eax]
shl ebp, 8
xor edx, ebp
inc eax
cmp eax, 4
mov dword [esp + ecx + 0x20], edx
jl 0x403713
mov eax, edx
mov edx, dword [esp + ecx + 0x10]
xor edx, eax
add edi, 4
mov dword [esp + ecx + 0x10], edx
add ecx, 4
cmp ecx, 0x10
jl 0x403711
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
call fcn.00401280
add esp, 0xc
xor ebp, ebp
mov edi, dword [esp + ebp + 0x30]
xor eax, eax
mov dword [esp + ebp + 0x10], edi
mov ecx, 0x18
mov edx, edi
sub ecx, eax
add eax, 8
shr edx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], dl
jl 0x403765
add ebp, 4
cmp ebp, 0x10
jl 0x40375b
mov eax, dword [esp + 0x48]
dec eax
mov dword [esp + 0x48], eax
jne 0x40370c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x4037a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov dword [esp], 0x12345678
cdq
and edx, 0xf
mov dword [esp + 4], 0x56785678
add eax, edx
mov dword [esp + 8], 0x9abc5678
sar eax, 4
test eax, eax
mov dword [esp + 0xc], 0xdeff5678
jle 0x403885
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
sub esi, ecx
mov edi, ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], eax
jmp 0x4037f6
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x20]
add esi, edi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [esi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x403803
add ecx, 4
add esi, 4
dec ebp
jne 0x403801
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.004023b0
add esp, 0xc
xor esi, esi
mov eax, dword [esp + esi + 0x30]
mov ecx, dword [esp + esi + 0x10]
xor eax, ecx
mov ecx, dword [esp + esi + 0x20]
mov dword [esp + esi + 0x40], eax
mov ebp, eax
mov dword [esp + esi + 0x10], ecx
xor eax, eax
mov ecx, 0x18
mov edx, ebp
sub ecx, eax
add eax, 8
shr edx, cl
inc edi
cmp eax, 0x20
mov byte [edi - 1], dl
jl 0x403853
add esi, 4
cmp esi, 0x10
jl 0x403839
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x58], eax
jne 0x4037f2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x405040
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x405068
pop edi
pop esi
mov eax, 0xe010
pop ebx
add esp, 0x128
ret
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40508e
pop edi
pop esi
mov eax, 0xe020
pop ebx
add esp, 0x128
ret
mov ebx, dword [esp + 0x138]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4050bf
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4050b9
call esi
cmp eax, 0x12
je 0x4050ce
cmp dword [esp + 0x14], ebx
jne 0x4050a3
pop edi
pop esi
mov eax, 0xe030
pop ebx
add esp, 0x128
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0xe040
pop ebx
add esp, 0x128
ret

Function at 0x4050f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x405111
xor eax, eax
pop edi
add esp, 0x128
ret
lea eax, [esp + 4]
mov dword [esp + 4], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405130
pop edi
add esp, 0x128
ret
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x134]
push esi
cmp eax, ebx
je 0x405163
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40515d
call esi
cmp eax, 0x12
je 0x405170
cmp dword [esp + 0x14], ebx
jne 0x405147
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x24]
mov dword [edx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, 1
pop edi
add esp, 0x128
ret

Function at 0x405240
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 0x1010
je 0x40527d
cmp esi, 0x1011
je 0x40527d
cmp esi, 0x1012
je 0x40527d
cmp esi, 0x1013
je 0x40527d
cmp esi, 0x1014
je 0x40527d
cmp esi, 0x1015
je 0x40527d
cmp esi, 0x1016
jne 0x40528a
push 0x4102a8
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov eax, dword [0x41029c]
test eax, eax
je 0x4052b0
push eax
call dword [0x41026c]
mov eax, dword [0x41029c]
push eax
call dword [0x410250]
mov dword [0x41029c], 0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x406900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x406909
xor ecx, ecx
jne 0x406909
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406950
mov eax, dword [ebp - 0xc]
jmp 0x4069ad
cmp dword [ebp - 4], 1
je 0x406963
cmp dword [ebp - 4], 2
je 0x406963
mov eax, 0xd
jmp 0x4069ad
cmp dword [ebp + 0xc], 0
je 0x4069a1
cmp dword [ebp - 8], 0
je 0x406999
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x406990
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x406997
mov eax, 0xd
jmp 0x4069ad
jmp 0x4069a1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc