joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60ced4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x60ceeb
add esp, 0xfffffff0
call fcn.00408568
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0047cc40
mov eax, dword [0x639970]
cmp byte [eax], 0
jne 0x60cf18
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x639cdc]
cmp word [eax + 2], 0
jne 0x60cf32
mov eax, dword [0x639cdc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0060f36c
mov eax, dword [0x639e1c]
cmp word [eax + 2], 0
jne 0x60cf4c
mov eax, dword [0x639e1c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0060f570
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5299f4]
call fcn.0052ff1c
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x60fae8
mov dl, 1
mov eax, dword [0x43f314]
call fcn.00407e7c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x43f314]
call fcn.00407e7c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x52e790]
call fcn.0053a1d8
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x60d13c
mov eax, dword [0x639b80]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0053a6f4
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x60fdd0
mov dl, 1
mov eax, dword [0x43f314]
call fcn.00407e7c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x639b80]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425ad0
test eax, eax
je 0x60d066
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425928
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425ab4
test eax, eax
je 0x60d07e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aadc
push ebx
push 0x60ed4c
call fcn.00602084
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x639970]
cmp byte [eax], 0
jne 0x60d0cf
mov eax, ebx
call fcn.0060d304
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.00610008
mov eax, ebx
call fcn.00610c90
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x60d133
call fcn.004085c0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60d630
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x60d6d2
cmp dword [ebx + 0xac], 0
jne 0x60d6cc
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x60d570
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x60d6cc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x60d692
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x60d6cc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.00467928
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x60d6a1
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x60d978
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6417c0]
cmp dword [eax + 0x188], 0
je 0x60dae1
test bl, bl
jne 0x60da34
cmp dword [esi + 0xb4], 0
jne 0x60da29
mov eax, esi
call fcn.00610ae0
push eax
push 0x60d878
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x60d9fa
mov eax, dword [0x6417c0]
cmp byte [eax + 0xeb], 0
je 0x60d9fa
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x60d9db
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x60d9fa
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x60d9e3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x60da29
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00467928
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x60da09
inc dword [esi + 0xb4]
jmp 0x60dae1
cmp dword [esi + 0xb4], 0
jle 0x60dae1
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x60dae1
cmp dword [esi + 0x58], 0
je 0x60da96
mov eax, dword [0x6417c0]
cmp byte [eax + 0xeb], 0
je 0x60da96
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x60da77
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x60da96
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x60da7f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x60dac5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00467928
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x60daa5
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5fe6f4]
call fcn.0040c3ac
pop edi
pop esi
pop ebx
ret
Function at 0x60e868
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x60e8c5
cmp byte [ebx + 0xeb], 0
jne 0x60e8c5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e9c
mov eax, dword [esi]
test eax, eax
je 0x60e8b2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x60e8d2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0f4
jmp 0x60e8d2
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0f4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x61021c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x61028d
mov eax, esi
call fcn.0055d69c
test al, al
je 0x61028d
mov eax, dword [ebx + 0x98]
call fcn.0055d2c8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x61028d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x61027e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0055d2c8
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00553ea0
jmp 0x61028d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.00610028
pop esi
pop ebx
ret
Function at 0x61b72c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x61b7c6
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x61b74b
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x61b7dc
dec edx
je 0x61b811
jmp 0x61b862
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x61b862
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61b974
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x61b993
add edx, 3
sar edx, 2
test edx, edx
jle 0x61baa1
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x61b9c8
je 0x61ba0b
sub ecx, 0x2b
je 0x61ba01
sub ecx, 4
je 0x61ba06
dec ecx
sub ecx, 0xa
jb 0x61b9f3
jmp 0x61ba0e
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x61b9da
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x61b9e5
jmp 0x61ba0e
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x61ba0e
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x61ba0e
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x61ba0e
mov byte [eax], 0x3e
jmp 0x61ba0e
mov byte [eax], 0x3f
jmp 0x61ba0e
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x61b9ab
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x61ba5f
cmp byte [esp + 7], 0xff
jne 0x61ba5f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x61ba96
cmp dl, 0xff
je 0x61ba96
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x61b9a2
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x61e0a0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x61e0bb
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x61e0b0
pop edi
pop esi
ret
Function at 0x624acc
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x624c18
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409d14
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x248], ebx
mov byte [ebp - 0x244], 0
lea edx, [ebp - 0x248]
xor ecx, ecx
mov eax, 0x624c34
call fcn.00425da0
mov eax, dword [ebp - 0x240]
call fcn.0040aa3c
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x624b4f
call fcn.0042d118
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0xc
call fcn.0040786c
lea eax, [ebp - 0x23c]
xor ecx, ecx
mov edx, 0x224
call fcn.0040786c
mov eax, 0x224
mov dword [ebp - 0x238], eax
push 0
lea edx, [ebp - 0xc]
push edx
push eax
lea eax, [ebp - 0x23c]
push eax
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x2d1400
push ebx
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x624ba3
call fcn.0042d118
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x624bbe
lea esi, [ebp + eax - 0x23c]
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.0040aa70
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x624bd9
lea esi, [ebp + eax - 0x23c]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.0040aa70
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x624bf4
lea esi, [ebp + eax - 0x23c]
mov eax, dword [ebp + 0xc]
mov edx, esi
call fcn.0040aa70
cmp ebx, 0xffffffff
je 0x624bff
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624c1f
lea eax, [ebp - 0x240]
call fcn.00409d14
ret
Function at 0x625818
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
add esp, 0xfffffe08
mov ebx, eax
mov edi, esp
xor eax, eax
mov ecx, 0x7d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0x23
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, ebx
mov eax, esp
call fcn.00425bb8
add esp, 0x1f8
pop edi
pop ebx
ret
Function at 0x40cc7b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x434ad7
call fcn.004339e0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004028e9
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004028e9
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004028e9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004028e9
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40d3e4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x434bff
call fcn.004339e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004029bc
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004029bc
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004029bc
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.004029bc
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.004029bc
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.004029bc
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.004029bc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40dd71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40dd80
pop dword [ebp - 0x44]
mov eax, 0x40dd80
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3c5bb
push 0
mov eax, 0xb1a46c7d
add eax, 0x4e9f13b3
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xd7d22a21
add ecx, 0x282e24a6
mov edx, eax
mov ebx, 0x44c600
add ebx, dword [ebp - 0x44]
mov edi, 0x14f1f517
sub edi, 0x18e24340
sub dword [ebp - 8], 0x6eeabe3e
mov esi, dword [ebx]
xor dword [ebp - 0x1c], eax
add esi, edi
mov dword [edx], esi
sub dword [ebp - 0x38], 0x4dffc4b4
add edx, 4
add ebx, 0xf902c0d6
add ebx, 0x6fd3f2e
loop 0x40ddd4
add eax, 0x9db33aee
sub eax, 0x9db20cff
mov ebx, eax
add eax, 5
mov ecx, 0xe38ca46
sub ecx, 0xdf8ca46
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x412d32
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x412d5f
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x444740]
xor eax, edi
inc esi
cmp esi, edx
jb 0x412d3e
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x402180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040b44b

Function at 0x4022c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4022d5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402314
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402310
lea ebx, [ebx]
cmp esi, edx
jae 0x402314
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402300
cmp esi, edx
jb 0x402319
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x404730
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x5a8040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x404911
push 0x228
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0x22c
push 0
push eax
call fcn.0052c790
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404911
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0052c790
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052b09f
add esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, str.Hwp.exe
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4047fd
test dx, dx
je 0x4047f9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4047fd
add eax, 4
add ecx, 4
test dx, dx
jne 0x4047d7
xor eax, eax
jmp 0x404802
sbb eax, eax
or eax, 1
test eax, eax
je 0x404923
mov ecx, str.Hword.exe
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40483b
test dx, dx
je 0x404837
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40483b
add eax, 4
add ecx, 4
test dx, dx
jne 0x404815
xor eax, eax
jmp 0x404840
sbb eax, eax
or eax, 1
test eax, eax
je 0x404923
mov ecx, str.HCell.exe
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404879
test dx, dx
je 0x404875
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404879
add eax, 4
add ecx, 4
test dx, dx
jne 0x404853
xor eax, eax
jmp 0x40487e
sbb eax, eax
or eax, 1
test eax, eax
je 0x404923
mov ecx, str.HShow.exe
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4048b7
test dx, dx
je 0x4048b3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4048b7
add eax, 4
add ecx, 4
test dx, dx
jne 0x404891
xor eax, eax
jmp 0x4048bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x404923
mov eax, str.Hpdf.exe
lea ecx, [ebp - 0x20c]
jmp 0x4048d0
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4048f6
test dx, dx
je 0x4048f2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4048f6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4048d0
xor eax, eax
jmp 0x4048fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x404923
lea eax, [ebp - 0x438]
push eax
push esi
call edi
test eax, eax
jne 0x404796
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00529d59
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00529d59
mov esp, ebp
pop ebp
ret
Function at 0x405470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544fd3
mov eax, dword fs:[0]
push eax
sub esp, 0x224
push ebx
push esi
push edi
mov eax, dword [0x5a8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push ecx
lea ecx, [ebp - 0x230]
call fcn.00402c90
mov dword [ebp - 4], 0
call fcn.0040e6bf
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4054cc
push 0x80004005
call fcn.00402a30
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea ebx, [edi + 0x118]
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.0040a240
cmp al, 1
jne 0x405501
push 0x90
call fcn.00415ddb
test eax, eax
je 0x405520
push 0x90
jmp 0x405514
push 0x3ff
call fcn.00415ddb
test eax, eax
je 0x405520
push 0x3ff
push eax
lea ecx, [ebp - 0x14]
call fcn.004023f0
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
lea ecx, [ebp - 0xa4]
jle 0x405537
lea eax, [ebp - 0x14]
push eax
call fcn.004039d0
jmp 0x405543
push 0xa
push 0x5892a8
call fcn.00402590
cmp dword [edi + 0x13bc], 1
jne 0x405557
call fcn.0040a150
mov byte [ebp - 0xa0], al
cmp dword [edi + 0x17d4], 1
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jne 0x405598
lea eax, [ebp - 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallce085a78_074e_4823_8dc1_8a721b94b76d
push reloc.OLEAUT32.dll_SysReAllocString
call ecx
push dword [ebp - 0x10]
test eax, eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x405588
call eax
xor al, al
jmp 0x40558c
call eax
mov al, 1
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov byte [ebp - 0x9e], al
cmp dword [edi + 0x15c8], 1
jne 0x4055d0
lea eax, [ebp - 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalldfea0fad_88b2_4a1f_8536_3f8f9391f4ef
push reloc.OLEAUT32.dll_SysReAllocString
call ecx
push dword [ebp - 0x10]
test eax, eax
jne 0x4055c2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4055ca
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov byte [ebp - 0x9f], al
cmp byte [ebp - 0xa0], 1
je 0x4055eb
cmp byte [ebp - 0x9f], 1
je 0x4055eb
cmp byte [ebp - 0x9e], 1
jne 0x405653
mov eax, dword [edi + 0xb54]
test eax, eax
je 0x405623
cmp eax, 2
je 0x405623
cmp byte [edi + 0x2216], 0
jne 0x405623
cmp byte [edi + 0x2217], 0
jne 0x405623
lea ecx, [ebp - 0x230]
call fcn.0040b7b6
cmp eax, 1
je 0x405623
push 0
call fcn.0052b715
cmp byte [ebp - 0xa0], 1
jne 0x405633
mov ecx, ebx
call fcn.004095a0
cmp byte [ebp - 0x9e], 1
jne 0x405643
mov ecx, ebx
call fcn.00409ea0
cmp byte [ebp - 0x9f], 1
jne 0x405653
mov ecx, ebx
call fcn.00409bf0
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x405671
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xffffffff
call fcn.00402dd0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret