joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4333c0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x44f92d
call fcn.0044d07c
sub esp, 0x260
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
je 0x4333f7
lea eax, [ebp - 0x26c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
cmp edi, ebx
jne 0x43343f
xor eax, eax
jmp 0x43348a
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x26c]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.004064e0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
or esi, 0xffffffff
cmp edi, esi
jne 0x433434
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
call fcn.0042b317
mov eax, esi
jmp 0x43348a
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
call fcn.0042b317
mov esi, dword [ebp + 0x10]
push 0x2c
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
push ebx
push 0x30c
lea eax, [esi + 0x2c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x240]
push eax
push ebx
push dword [0x462014]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
mov cl, byte [ebp + eax*2 - 0x38]
mov byte [esi + eax + 0x338], cl
inc eax
cmp eax, 0xe
jl 0x433477
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x43423d
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4354d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
xor bl, bl
call esi
mov dword [ebp - 4], eax
test bl, bl
jne 0x4354fc
xor ecx, ecx
lea eax, [edi + 8]
inc ecx
lock xadd dword [eax], ecx
mov ecx, dword [ebp + 8]
mov edx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x435538
or ecx, 0xffffffff
cmp dword [ebp + 0xc], ecx
je 0x435522
call esi
sub eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jbe 0x43553c
mov ecx, dword [ebp + 0xc]
sub ecx, eax
push dword [edi + 4]
push ecx
call fcn.0042fcb8
dec eax
pop ecx
pop ecx
je 0x435534
mov bl, 1
jmp 0x4354ee
xor bl, bl
jmp 0x4354ee
mov al, 1
jmp 0x43553e
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x435e39
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
mov esi, ecx
call edi
movzx ebx, ax
push 1
shl ebx, 0x10
call edi
movzx eax, ax
or eax, ebx
and eax, 0x10001
cmp eax, dword [esi + 8]
je 0x435e81
push 0xffffffffffffffe0
push 0
mov dword [esi + 8], eax
call fcn.00434a18
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetClassLongW]
cmp eax, 0x8000
setne al
test al, al
jne 0x435e91
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esi + 4]
setne al
test al, al
je 0x435e9a
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_EndMenu]
pop edi
pop esi
pop ebx
ret
Function at 0x435e9e
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 4]
inc eax
push edi
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x435ebf
xor al, al
jmp 0x435f07
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x435ed3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x435ebb
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x435eeb
add ecx, 2
push ecx
push dword [esi]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x435ef0
xor ecx, ecx
mov word [eax], cx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne al
pop edi
pop esi
ret

Function at 0x436624
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0xc]
mov dword [esi + 4], eax
test ebp, ebp
je 0x43667c
push eax
call fcn.0043447d
pop ecx
test al, al
jne 0x43667c
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
mov dword [esi], ebp
call edi
movzx ebx, ax
push 1
shl ebx, 0x10
call edi
movzx eax, ax
push 0x436569
push 0x32
or eax, ebx
push esi
and eax, 0x10001
push ebp
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop ebx
jmp 0x436683
and dword [esi], 0
and dword [esi + 8], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x436894
Capabilities:
Clear file content

Disassembly:
mov eax, 0x44f7b2
call fcn.0044d07c
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x18]
call fcn.00401978
xor ebx, ebx
mov dword [ebp - 4], ebx
test dword [ebp + 0x14], 0x300
mov esi, dword [ebp + 0xc]
setne byte [ebp - 0xd]
cmp esi, ebx
jne 0x4368ce
test byte [ebp + 0x14], 4
mov byte [ebp + 0xc], bl
je 0x4368d2
mov byte [ebp + 0xc], 1
push ebx
lea ecx, [ebp - 0x18]
push ebx
cmp byte [ebp - 0xd], bl
je 0x4368e9
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00436128
jmp 0x4368fe
xor eax, eax
cmp byte [ebp + 0xc], bl
setne al
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
call fcn.0043610b
test eax, eax
setne al
cmp al, bl
jne 0x436926
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004019a2
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
cmp esi, ebx
je 0x43694d
cmp esi, 0xffffffff
jne 0x436935
push 2
push ebx
push ebx
jmp 0x436938
push ebx
push ebx
push esi
push dword [ebp - 0x18]
call fcn.00430d87
add esp, 0x10
cmp edx, ebx
jg 0x43694d
jl 0x436907
cmp eax, ebx
jb 0x436907
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jbe 0x436959
mov ecx, eax
cmp ecx, ebx
je 0x43696c
push ecx
push dword [edi]
lea ecx, [ebp - 0x18]
call fcn.00435a29
test al, al
je 0x436907
mov eax, dword [ebp + 0x14]
test al, 1
je 0x436989
push 2
push 0x451ebc
lea ecx, [ebp - 0x18]
call fcn.00435a29
test al, al
je 0x436907
mov eax, dword [ebp + 0x14]
test al, 2
je 0x43699e
cmp byte [ebp + 0xc], bl
je 0x43699e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 0xd], bl
je 0x4369cb
shr eax, 9
and al, 1
movzx eax, al
push eax
lea ecx, [ebp - 0x18]
call fcn.004361a6
test al, al
jne 0x4369cb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004019a2
mov al, bl
jmp 0x436915
mov bl, 1
jmp 0x4369b8
Function at 0x436f5e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x44f80e
call fcn.0044d07c
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x436f7b
mov esi, dword [ebx]
push esi
call fcn.0042df10
mov edi, eax
test edi, edi
jne 0x436f92
push eax
push eax
mov ecx, ebx
call fcn.0042b525
jmp 0x437010
mov eax, edi
cdq
sub eax, edx
sar eax, 1
push esi
lea ecx, [ebp - 0x10]
lea edi, [edi + eax + 0x32]
call fcn.00404b9e
and dword [ebp - 4], 0
push edi
lea ecx, [ebp + 8]
call fcn.0040e184
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call ebx
mov esi, eax
dec esi
cmp esi, edi
jle 0x436fe4
push esi
lea ecx, [ebp + 8]
call fcn.0043c3d6
inc esi
push esi
push eax
push dword [ebp - 0x10]
call ebx
dec eax
mov esi, eax
mov ecx, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.0042a4a1
mov byte [ebp - 4], 0
push dword [ebp + 8]
call fcn.0043c28e
and dword [ebp + 8], 0
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call fcn.0043c28e
and dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x437021
Capabilities:
Get common file path

Disassembly:
mov eax, 0x44f820
call fcn.0044d07c
push ecx
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
cmp byte [eax + 0x462dc0], 1
push edi
mov edi, ecx
jne 0x43706a
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.0043a380
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0
jne 0x437066
cmp eax, 0xffff
ja 0x437066
push 0
push edi
push eax
call fcn.0043d80f
add esp, 0xc
jmp 0x43708e
xor al, al
jmp 0x43708e
push esi
xor esi, esi
push dword [esi*8 + 0x4552cc]
push ebx
call sym.qmmacro.exe_q_stricmp
pop ecx
pop ecx
test eax, eax
je 0x437086
inc esi
cmp esi, 0x34
jl 0x43706d
cmp esi, 0x34
jne 0x43709e
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
mov esi, dword [esi*8 + 0x4552c8]
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov eax, 0xf0
cmp esi, eax
jge 0x4370f6
push 0x104
lea ecx, [ebp + 8]
call fcn.0043c3d6
push ebx
push esi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4370e7
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
call fcn.0043c28e
and dword [ebp + 8], 0
mov al, bl
jmp 0x43708d
push dword [ebp + 8]
mov ecx, edi
call fcn.0042beae
jmp 0x4371d6
sub esi, eax
je 0x4371c3
dec esi
je 0x4371b5
dec esi
je 0x437180
dec esi
je 0x43716c
dec esi
je 0x437128
dec esi
jne 0x4371d6
push edi
push dword [0x4621b8]
call fcn.00430a3c
pop ecx
pop ecx
jmp 0x4371d6
mov ecx, 0x462180
call fcn.0042d087
cmp eax, 1
jne 0x43714e
cmp byte [0x462238], 0
je 0x437147
mov eax, str._temp_LowQM_portable
jmp 0x437161
mov eax, str._temp_LowQM
jmp 0x437161
cmp byte [0x462238], 0
mov eax, str._temp_QM_portable
jne 0x437161
mov eax, str._temp_QM
push ebx
push eax
mov ecx, edi
call fcn.004371e1
jmp 0x4371d6
push ebx
push str._windows_Media
mov ecx, edi
call fcn.004371e1
mov bl, 1
jmp 0x4370d3
mov esi, 0x104
push esi
lea ecx, [ebp + 8]
call fcn.0043c3d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
mov ecx, edi
call fcn.0042beae
push 0x5c
mov ecx, edi
call fcn.00430f5c
push 1
push ebx
mov ecx, edi
call fcn.0043765d
jmp 0x4371d6
mov eax, dword [0x4621fc]
dec eax
push eax
push 0x4621f8
jmp 0x4371cf
mov eax, dword [0x4621bc]
dec eax
push eax
push 0x4621b8
mov ecx, edi
call fcn.0042c5e5
cmp dword [edi + 4], ebx
setne bl
jmp 0x4370d3
Function at 0x4380d0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x44f8ac
call fcn.0044d07c
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x20]
call fcn.00401978
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 1
test byte [ebp + 0x14], 2
jne 0x43816e
cmp dword [ebp + 0xc], ebx
jne 0x43816e
cmp dword [ebp + 0x10], 0xffffffff
jne 0x43816e
mov ecx, dword [0x461e9c]
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
call dword [eax + 0x24]
cmp eax, ebx
je 0x43816e
mov ecx, dword [0x461e9c]
mov edx, dword [ecx]
push esi
push dword [ebp + 8]
push eax
call dword [edx + 0x2c]
test al, al
je 0x438272
mov esi, dword [esi + 4]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x30]
call fcn.0042b317
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004019a2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
test byte [ebp + 0x14], 1
je 0x43818f
push ebx
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.00437481
test al, al
je 0x438272
mov eax, dword [ebp - 0x30]
mov dword [ebp + 8], eax
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.004360e5
test eax, eax
je 0x438272
push dword [ebp - 0x20]
call fcn.00430d62
pop ecx
mov edi, eax
mov esi, edx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x4381ec
xor eax, eax
cmp eax, esi
ja 0x4381e9
jb 0x4381c3
cmp ecx, edi
jae 0x4381e9
sub edi, ecx
sbb esi, eax
push ebx
push eax
push ecx
push dword [ebp - 0x20]
call fcn.00430d87
add esp, 0x10
cmp edx, ebx
jl 0x438272
jg 0x4381ec
cmp eax, ebx
jb 0x438272
jmp 0x4381ec
mov dword [ebp + 0x10], ebx
xor eax, eax
cmp eax, esi
jb 0x4381fc
ja 0x4381f9
cmp dword [ebp + 0x10], edi
jb 0x4381fc
mov dword [ebp + 0x10], edi
cmp dword [ebp + 0x10], 0x80000000
jb 0x43820f
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x438272
mov byte [ebp - 4], 2
push dword [ebp + 0x10]
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.0042b412
mov dword [ebp - 4], 1
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x438243
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
push dword [esi]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438272
cmp dword [ebp - 0x14], edi
je 0x438253
push ebx
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0042b525
mov esi, dword [ebp - 0x14]
jmp 0x438144
mov ecx, dword [ebp - 0x18]
call fcn.0042b420
or esi, 0xffffffff
jmp 0x438144
Function at 0x438282
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x44f8c1
call fcn.0044d07c
sub esp, 0x40c
push ebx
push esi
lea eax, [ebp - 0x414]
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x418], eax
and dword [ebp - 4], 0
test byte [ebp + 0xc], 1
mov ebx, dword [ebp + 8]
mov esi, 0x200
jne 0x438304
mov edi, dword [sym.imp.USER32.dll_InternalGetWindowText]
jmp 0x4382d7
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x4383cc
add esi, esi
push esi
lea ecx, [ebp - 0x418]
call fcn.00437ffa
push esi
push dword [ebp - 0x418]
push ebx
call edi
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4382be
test byte [ebp + 0xc], 2
jne 0x4383cc
push ebx
call fcn.00434188
pop ecx
test eax, 0x40000000
je 0x4383cc
push ebx
call fcn.0043447d
pop ecx
test al, al
je 0x438346
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x4383a1
lea esi, [eax + 1]
push 0x400
lea eax, [esi + esi]
push eax
lea ecx, [ebp - 0x418]
call fcn.00436c77
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x10], eax
jmp 0x4383a1
push 0
lea eax, [ebp - 0x10]
push eax
mov edi, 0x3e8
push edi
push 0
push 0
push 0xe
push ebx
call fcn.00433d2d
add esp, 0x1c
test eax, eax
jne 0x438368
and dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x4383a1
lea esi, [eax + 1]
push 0x400
lea eax, [esi + esi]
push eax
lea ecx, [ebp - 0x418]
call fcn.00436c77
push 0
lea ecx, [ebp - 0x10]
push ecx
push edi
push eax
push esi
push 0xd
push ebx
call fcn.00433d2d
add esp, 0x1c
test eax, eax
jne 0x4383a1
and dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4383ab
and dword [ebp - 0x10], 0
dec esi
cmp dword [ebp - 0x10], esi
jle 0x4383cc
mov ecx, dword [ebp - 0x418]
xor eax, eax
mov word [ecx + esi*2], ax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x418]
mov ecx, esi
call fcn.0042a4a1
mov esi, dword [esi + 4]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.00436c99
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x438c3b
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
and eax, 3
dec edi
mov dl, byte [eax + 0x455854]
js 0x438c6f
push esi
mov eax, dword [esp + 0xc]
lea esi, [eax + edi]
mov al, byte [esi]
mov ecx, edi
and ecx, 3
mov cl, byte [ecx + 0x455854]
add cl, al
xor al, dl
dec edi
mov byte [esi], al
mov dl, cl
jns 0x438c4f
pop esi
pop edi
ret
Function at 0x43936f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, ecx
test eax, eax
je 0x4394ba
mov ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x439392
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x4394ba
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 1
push ebx
push edi
jne 0x439410
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x4394b4
shr eax, 3
mov dword [ebp + 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00439184
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00439091
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp + 8], 8
xor dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call fcn.004391e2
dec dword [ebp + 0x10]
pop ecx
pop ecx
jne 0x4393c3
jmp 0x4394b4
cmp dword [ebp + 0x10], 2
jne 0x43947c
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x4394b4
shr eax, 3
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00439184
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00438f9e
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add dword [ebp + 8], 8
push dword [ebp + 8]
mov edx, eax
xor eax, dword [ebp - 0x10]
mov edi, ecx
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
call fcn.004391e2
dec ebx
pop ecx
pop ecx
jne 0x439430
jmp 0x4394b4
cmp eax, 8
jl 0x4394b4
shr eax, 3
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00439184
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00439091
add dword [ebp + 8], 8
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.004391e2
dec edi
pop ecx
pop ecx
jne 0x439486
pop edi
mov al, 1
pop ebx
jmp 0x4394c4
push 0x4558b0
call fcn.0042dcf8
pop esi
leave
ret 0xc
Function at 0x439632
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
push esi
mov esi, ecx
test eax, eax
je 0x439789
mov ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x439655
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x439789
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 1
push ebx
push edi
jne 0x4396d7
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x439783
shr eax, 3
mov dword [ebp + 0x14], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00439184
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00439091
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], 8
xor dword [ebp - 4], eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call fcn.004391e2
add dword [ebp + 8], 8
dec dword [ebp + 0x14]
pop ecx
pop ecx
jne 0x439686
jmp 0x439783
cmp dword [ebp + 0x14], 2
jne 0x439747
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x439783
shr eax, 3
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00439184
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00438f9e
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], 8
push dword [ebp + 0xc]
mov edx, eax
xor eax, dword [ebp - 0x10]
mov edi, ecx
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
call fcn.004391e2
add dword [ebp + 8], 8
dec ebx
pop ecx
pop ecx
jne 0x4396f7
jmp 0x439783
cmp eax, 8
jl 0x439783
shr eax, 3
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00439184
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.00439091
add dword [ebp + 0xc], 8
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.004391e2
add dword [ebp + 8], 8
dec edi
pop ecx
pop ecx
jne 0x439751
pop edi
mov al, 1
pop ebx
jmp 0x439793
push 0x4558b0
call fcn.0042dcf8
pop esi
leave
ret 0x10
Function at 0x439995
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x44
cmp dword [ebp + 0xc], 1
push esi
mov esi, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0xc], eax
jge 0x4399cb
push str.Incorrect_key_length._Must_be_1_to_56.
call fcn.0042dcf8
jmp 0x439ad0
push 0x38
pop eax
cmp dword [ebp + 0xc], eax
jle 0x4399d6
mov dword [ebp + 0xc], eax
push ebx
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
push 0x48
lea edi, [esi + 0x10]
push 0x4568e0
push edi
call sub.msvcrt.dll_memcpy
push 0x1000
lea eax, [esi + 0x58]
push 0x4558e0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x24
and dword [ebp + 0x10], 0
lea eax, [ebp - 0x44]
mov ecx, edi
mov dword [ebp - 8], 0x12
and dword [ebp - 4], 0
mov dword [ebp + 8], 4
mov edx, dword [ebp - 4]
movzx ebx, byte [eax]
dec dword [ebp + 8]
shl edx, 8
or edx, ebx
inc eax
inc dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x439a4c
and dword [ebp + 0x10], 0
lea eax, [ebp - 0x44]
cmp dword [ebp + 8], 0
jne 0x439a28
mov edx, dword [ebp - 4]
xor dword [ecx], edx
add ecx, 4
dec dword [ebp - 8]
jne 0x439a1d
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00438f9e
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
add edi, 4
inc ebx
mov dword [edi], eax
inc ebx
add edi, 4
cmp ebx, 0x12
jb 0x439a67
lea eax, [esi + 0x58]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], 4
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00438f9e
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
add edi, 4
inc ebx
mov dword [edi], eax
inc ebx
add edi, 4
cmp ebx, 0x100
jl 0x439a9b
add dword [ebp + 0xc], 0x400
dec dword [ebp + 0x10]
jne 0x439a96
pop edi
mov al, 1
pop ebx
pop esi
leave
ret 0xc

Function at 0x43a486
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
test eax, eax
je 0x43a4a7
cmp byte [eax], 0
je 0x43a4a7
push dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_wvsprintfA]
jmp 0x43a4ae
mov edi, dword [esp + 0xc]
mov byte [edi], 0
push edi
call sub.msvcrt.dll_strlen
pop ecx
lea esi, [eax + edi]
push edi
mov byte [esi], 0xa
mov byte [esi + 1], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov byte [esi], 0
pop esi
ret