joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 8], edi
jmp 0x4a63b2
mov eax, dword [ebp + 8]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
nop
call 0x75bd53c6
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a646a
lea ecx, [ebp - 0x10]
push ecx
push ebx
nop
call 0x75bd59e2
test eax, eax
je 0x4a6455
mov eax, dword [ebp - 0xc]
test eax, eax
mov eax, dword [ebp - 0x10]
jg 0x4a6455
jl 0x4a63f9
cmp eax, 0x6400000
ja 0x4a6455
push eax
nop
call 0x75059cee
mov esi, eax
add esp, 4
test esi, esi
je 0x4a6455
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
push 0
push edx
push eax
push esi
push ebx
nop
call 0x75bd3ed3
test eax, eax
je 0x4a6455
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x4a6439
mov cl, byte [edi + esi]
dec cl
xor cl, 0x55
mov byte [edi + esi], cl
mov eax, dword [ebp - 4]
inc edi
cmp edi, eax
jb 0x4a6426
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
call fcn.004a62f0
add esp, 0xc
test eax, eax
je 0x4a6455
mov dword [ebp - 8], 1
push ebx
nop
call 0x75bd1410
test esi, esi
je 0x4a646a
push esi
nop
call 0x75059894
add esp, 4
jmp 0x4a647a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a6860
Capabilities:
Decompress data using quicklz

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
call fcn.004a67b0
mov ebx, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esp + 0x20]
push ebp
add esi, ebp
mov edi, 1
lea ecx, [ebx + eax - 1]
mov dword [esp + 0x20], ecx
call fcn.004a6760
add esp, 8
cmp edi, 1
jne 0x4a689a
mov edi, dword [esi]
add esi, 4
mov eax, dword [esi]
mov edx, edi
and edx, 1
cmp dl, 1
jne 0x4a694f
shr edi, 1
test al, 3
mov dword [esp + 0x14], edi
jne 0x4a68c4
shr eax, 2
and eax, 0x3f
inc esi
mov ecx, eax
mov eax, 3
jmp 0x4a692b
test al, 2
jne 0x4a68dc
shr eax, 2
and eax, 0x3fff
add esi, 2
mov ecx, eax
mov eax, 3
jmp 0x4a692b
test al, 1
mov ecx, eax
jne 0x4a68f9
shr eax, 2
shr ecx, 6
and eax, 0xf
and ecx, 0x3ff
add eax, 3
add esi, 2
jmp 0x4a692b
and ecx, 0x7f
cmp cl, 3
mov ecx, eax
je 0x4a691a
shr eax, 2
shr ecx, 7
and eax, 0x1f
and ecx, 0x1ffff
add eax, 2
add esi, 3
jmp 0x4a692b
shr eax, 7
and eax, 0xff
shr ecx, 0xf
add eax, 3
add esi, 4
mov edx, ebx
xor edi, edi
sub edx, ecx
mov ecx, ebx
sub edx, ebx
mov ebp, dword [edx + ecx]
add edi, 3
mov dword [ecx], ebp
add ecx, 3
cmp edi, eax
jb 0x4a6935
mov edi, dword [esp + 0x14]
add ebx, eax
jmp 0x4a6890
mov edx, dword [esp + 0x18]
lea ecx, [edx - 0xa]
cmp ebx, ecx
jae 0x4a6973
mov edx, edi
and edx, 0xf
mov ecx, dword [edx*4 + 0x568874]
mov dword [ebx], eax
shr edi, cl
add ebx, ecx
add esi, ecx
jmp 0x4a6890
cmp ebx, edx
ja 0x4a6990
cmp edi, 1
jne 0x4a6984
add esi, 4
mov edi, 0x80000000
mov al, byte [esi]
mov byte [ebx], al
inc ebx
inc esi
shr edi, 1
cmp ebx, edx
jbe 0x4a6977
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4adf60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push 0x5697c8
call fcn.004ade80
push 0x16
call fcn.004f4146
add esp, 0x14
push 3
call fcn.00416ebe
nop
nop
nop
nop
nop
nop
Function at 0x4ed3f4
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00416b90
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x4ed3bb
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x4ed3cd
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x4ed573
push esi
call fcn.004c1000
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x4ed403
push 0x5866e0
push 0x68
push 0x5866c8
call fcn.004adf60
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x4ed460
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.004cad30
add esp, 0xc
test eax, eax
je 0x4ed566
mov eax, dword [esp + 0x98]
push ebp
push eax
push edi
call fcn.004caee0
add esp, 0xc
test eax, eax
je 0x4ed566
lea esi, [ebx + 0x4c]
lea ecx, [ebx + 0x50]
push esi
push ecx
push edi
call fcn.004caf00
add esp, 0xc
test eax, eax
je 0x4ed566
jmp 0x4ed49f
test ebp, ebp
jl 0x4ed46c
cmp ebp, 0x80
jle 0x4ed480
push 0x5866a0
push 0x75
push 0x5866c8
call fcn.004adf60
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x4c]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x4ed4c4
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x4ed4cd
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x1c]
push ebp
push esi
push edi
call fcn.004cad30
add esp, 0xc
test eax, eax
je 0x4ed566
push esi
call fcn.004c1000
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.004caee0
add esp, 0x10
test eax, eax
je 0x4ed566
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x4ed514
lea edi, [ebx + 0x34]
push ebp
push esi
push edi
call fcn.004cad30
add esp, 0xc
test eax, eax
je 0x4ed566
push esi
call fcn.004c1000
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.004caee0
add esp, 0x10
test eax, eax
je 0x4ed566
lea eax, [ebx + 0x1c]
add ebx, 4
push eax
push ebx
call fcn.004cafa0
add esp, 8
test eax, eax
jne 0x4ed57c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x4ed552
jmp 0x4ed4cb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x80
ret
Function at 0x4f4790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x502058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x20]
push eax
nop
call 0x753f72c4
push eax
call fcn.00416570
mov ecx, dword [ebp + 0x20]
lea edi, [ebp + 0x8c]
push edi
push ecx
mov esi, eax
nop
call 0x75400c62
mov edx, dword [ebp + 0x94]
xor ebx, ebx
sub edx, 0xf
mov dword [esp + 0x1c], ebx
mov dword [edi], edx
mov dword [esp + 0x18], 0x51248c
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x48], ebx
push eax
nop
call 0x754f4f17
push eax
lea ecx, [esp + 0x1c]
call fcn.004165b2
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
and eax, edx
push eax
mov eax, dword [esi + 4]
push edi
push eax
nop
call 0x75400eb6
cmp dword [esp + 0x50], ebx
je 0x4f486d
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x24], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x28], edx
mov edx, dword [ebp + 0x6c]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x70]
push ecx
push edx
push edi
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.004165a0
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push 0xffffffffffffffff
push eax
nop
call 0x75403309
mov ecx, dword [ebp + 0x70]
mov edx, dword [ebp + 0x6c]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
jmp 0x4f4876
mov ecx, dword [ebp + 0x6c]
mov edx, dword [ebp + 0x70]
push ecx
push edx
push edi
mov ecx, esi
call fcn.004165a0
lea ecx, [esp + 0x18]
call fcn.0041659a
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x5124b8
push ebx
push 0x5a84f8
push 0x5a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 1
call fcn.004f3bf6
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0x30]
push 1
mov ecx, esi
mov ebx, eax
call fcn.0041658e
mov edx, dword [esi]
push 0xc8
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x38], ecx
sub eax, 3
push 0x5a84f4
lea ecx, [esp + 0x54]
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], eax
call fcn.00416450
mov eax, dword [esp + 0x50]
mov edx, dword [esi]
lea edi, [esp + 0x30]
push 5
mov ecx, dword [eax - 8]
push edi
push ecx
push eax
mov ecx, esi
mov byte [esp + 0x58], 2
call dword [edx + 0x70]
lea ecx, [esp + 0x50]
mov byte [esp + 0x48], 1
call fcn.004161d4
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x30]
lea ecx, [esp + 0x10]
call fcn.0041659a
mov ecx, dword [esi + 4]
mov edx, dword [ebp + 0x20]
push ecx
push edx
nop
call 0x753f7446
mov esi, 0x512450
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 3
call fcn.0041659a
mov dword [esp + 0x10], 0x5123e0
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 4
call fcn.0041659a
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406ad1
pop dword [ebp - 0x28]
mov eax, 0xf2e2efb4
add eax, 0xd5d7b1d
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x8146ec02
add dword [ebp - 0x38], 0xcd0b5949
mov dword [ebp - 0x34], 0xaeed104f
sub dword [ebp - 0x34], 0x7cb9c40a
mov dword [ebp - 0x30], 0x9160a58f
sub dword [ebp - 0x30], 0x45146161
mov dword [ebp - 0x2c], 0x4efdada0
add dword [ebp - 0x2c], 0xb1025260
lea eax, [ebp - 0x38]
push eax
mov eax, 0x9edea077
add eax, 0x61622fdd
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xa8655ce9
sub dword [ebp - 0x38], 0x33f2f393
mov dword [ebp - 0x34], 0x7f3b892d
sub dword [ebp - 0x34], 0x3dcf27b8
mov dword [ebp - 0x30], 0x4ac8ca8f
add dword [ebp - 0x30], 0x18a6a1dd
mov dword [ebp - 0x2c], 0x178608e9
add dword [ebp - 0x2c], 0xe879f717
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x369be
push 0
call eax
mov ecx, 0x83981274
sub ecx, 0x8397d72c
mov ebx, eax
mov edi, 0xdbb6cfff
add edi, 0x248ae001
add edi, dword [ebp - 0x28]
mov edx, 0x6758f865
xor dword [ebp - 8], 0xd751cb6d
mov esi, dword [edi]
xor esi, edx
add dword [ebp - 0x18], 0x157043bb
mov dword [ebx], esi
sub dword [ebp - 8], ebx
add ebx, 0x59a13b09
sub ebx, 0x59a13b05
add edi, 0xa0235e6e
sub edi, 0xa0235e6a
loop 0x406be8
add eax, 0xe1a25fc1
add eax, 0x1e5e8032
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x434e40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
add word [edi + 0x3490c], 9
push edi
or ebp, 0xffffffff
jmp 0x434e6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x434e71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x434e60
mov eax, 1
add ebx, ebx
jne 0x434e83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x434e78
jne 0x434e94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434e78
xor ecx, ecx
sub eax, 3
jb 0x434ea8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x434f1a
mov ebp, eax
add ebx, ebx
jne 0x434eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x434ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x434ee4
inc ecx
add ebx, ebx
jne 0x434ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x434ec5
jne 0x434ee1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434ec5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x434f04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x434ef5
jmp 0x434e66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x434f04
add edi, ecx
jmp 0x434e66
pop esi
mov edi, esi
mov ecx, 0x12
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x434f22
cmp byte [edi], 1
jne 0x434f22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x434f27
lea edi, [esi + 0x32000]
mov eax, dword [edi]
or eax, eax
je 0x434f9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x34b9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x34bd8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x434f54
mov ecx, edi
jns 0x434f83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x34bdc]
or eax, eax
je 0x434f99
mov dword [ebx], eax
add ebx, 4
jmp 0x434f71
call dword [esi + 0x34bec]
mov ebp, dword [esi + 0x34be0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x434fd3
sub esp, 0xffffff80
jmp 0x401328

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x44e311
Capabilities:
Encode data using xor

Disassembly:
fstp qword [edi + 0x6c]
aam 0x81
pop edx
fucomi st(7)
arpl word [edi + 0x14], cx
lcall 0xe319, 0xbadb0227
jp 0x44e39c
push edi
mov dword [ecx], 0x448239ba
push ds
adc al, 0x36
or ah, ah
jb 0x44e3a2
aad 0xd4
or dword [eax + 0x6a], esp
aaa
pop ss
xchg dword [edx + 0x6b746d87], edx
bound ebx, qword [ecx - 0x6161817]
invalid
enter 0x6277, 0x47
retf

Function at 0x4ba3ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23d8
cmp edx, dword [eax]
je 0x4ba40f
add eax, 8
inc ecx
cmp eax, 0x4c2468
jl 0x4ba400
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23d8]
jne 0x4ba53d
mov eax, dword [0x4c6d5c]
cmp eax, 1
je 0x4ba517
test eax, eax
jne 0x4ba440
cmp dword [0x4c2300], 1
je 0x4ba517
cmp edx, 0xfc
je 0x4ba53d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba477
lea eax, [ebp - 0x1a4]
push 0x4bf878
push eax
call fcn.004badd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb260
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba4ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb260
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf874
push edi
call fcn.004bd130
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf858
push eax
call fcn.004badd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bade0
lea eax, [ebp - 0xa0]
push 0x4bf854
push eax
call fcn.004bade0
push dword [esi + 0x4c23dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bade0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf82c
push eax
call fcn.004bd0a4
add esp, 0x2c
pop edi
jmp 0x4ba53d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23dc]
push 0
push eax
push dword [esi]
call fcn.004bb260
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x418852
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x418861
pop dword [ebp - 0x10]
mov eax, 0xc47d9fdb
add eax, 0x3bc3e886
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x41320
push 0
mov eax, 0x743398c9
add eax, 0x8c0eb94f
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x553d
mov ebx, eax
mov edx, 0xd2ca2319
sub edx, 0xd286cf19
add edx, dword [ebp - 0x10]
mov edi, 0xde994e49
sub edi, 0xd56c0e67
add dword [ebp - 0xc], 0xd1f2efb2
mov esi, dword [edx]
add dword [ebp - 0xc], 0x2b7ca1fa
xor esi, edi
xor dword [ebp - 0xc], edx
mov dword [ebx], esi
sub dword [ebp - 4], ebx
add ebx, 0xfde83c40
sub ebx, 0xfde83c3c
add edx, 4
loop 0x4188ba
add eax, 0x147c7
mov ebx, eax
add eax, 0x3a6e2290
add eax, 0xc591dd75
mov ecx, 0x48be14ff
add ecx, 0xb781eb01
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4026b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x4026bf
xor eax, eax
pop esi
ret 4
mov ecx, dword [esp + 8]
lea eax, [esi + 0x20]
push eax
push ecx
push esi
push 0x402630
push 0
push 0
call fcn.00475dfd
xor edx, edx
add esp, 0x18
test eax, eax
setne dl
mov dword [esi + 0x1c], eax
pop esi
mov eax, edx
ret 4

Function at 0x4095c0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x49ecdb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4c36a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c36a0]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x219], eax
mov word [esp + 0x21d], ax
mov byte [esp + 0x21f], al
push 8
mov esi, ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x21c]
push eax
xor ebx, ebx
push ecx
mov byte [esp + 0x224], bl
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x409672
push 0x4a8cc8
lea edx, [esp + 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409672
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, eax
or ecx, 0x100
cmp eax, ecx
je 0x409672
push ecx
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x7f89
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, eax
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x409695
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
cmp eax, ebx
je 0x409695
mov dword [esi + 0x24], ebx
mov dword [esi + 0x24], edi
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push ebx
push ebx
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esi + 0x58], ebx
mov dword [esi + 0x28], eax
jne 0x40973d
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, ebx
jle 0x40973d
mov dword [esp + 0x14], ebx
lea edi, [eax + 1]
xor eax, eax
cmp eax, ebx
mov dword [esp + 0x22c], ebx
ja 0x4096e0
cmp edi, 0xffffffff
jbe 0x4096ea
push 0x80070057
call fcn.00401160
cmp edi, 0x200
jbe 0x409702
push edi
lea ecx, [esp + 0x18]
call fcn.004037c0
mov eax, dword [esp + 0x14]
jmp 0x40970a
lea eax, [esp + 0x18]
mov dword [esp + 0x14], eax
cmp eax, ebx
mov ebp, eax
je 0x40972c
mov ecx, dword [esi + 4]
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x409728
push ebp
mov ecx, esi
call fcn.004082f0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x40973d
lea ecx, [esp + 0x14]
call fcn.00403310
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00476554
add esp, 0x21c
ret
Function at 0x40d620
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x49f309
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c36a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea eax, [esi + 4]
push eax
mov dword [esi], vtable.CMitThread.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x20]
push eax
push 4
xor ebx, ebx
push esi
push 0x402630
push ebx
push ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [eax], ebx
call fcn.00475dfd
add esp, 0x18
mov dword [esi + 0x1c], eax
mov ebp, dword [esp + 0x28]
lea edi, [esi + 0x2c]
mov dword [esi], vtable.login_thread.0
mov dword [esi + 0x28], ebx
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x20], ebx
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x40d6a4
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040b060
mov ebp, dword [esp + 0x2c]
lea edi, [esi + 0x48]
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [esp + 0x20], 1
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x40d6d6
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040b060
mov ebp, dword [esp + 0x30]
lea edi, [esi + 0x64]
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [esp + 0x20], 2
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x40d708
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040b060
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x44]
mov dword [esi + 0x80], eax
lea edi, [esi + 0x84]
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [esp + 0x20], 3
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x40d747
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040b060
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esi + 0xa8], eax
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x20
Function at 0x414870
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
push esi
je 0x41487d
lea esi, [ecx - 0x88]
jmp 0x41487f
xor esi, esi
mov eax, dword [esi + 4]
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0xf020
push 0x112
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop esi
ret

Function at 0x416810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49fe43
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c36a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, 1
mov dword [esi], vtable.wly::CButtonXYLM.0
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esp + 0x18], edi
mov dword [esi + 0x38], edi
push 0x4052e0
push 0x414fd0
push 3
push 4
lea ecx, [esi + 0x3c]
push ecx
mov byte [esp + 0x2c], al
call fcn.00477164
mov dword [esi + 0x48], edi
mov eax, 0xffffff
push 0xc
mov ecx, esi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], edi
call fcn.00415dc0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret