joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490410
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50cd10
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x54e39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x1c], 0
je 0x490557
cmp dword [edi + 0x14], 0
je 0x490557
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
lea eax, [ebx + ebx]
call fcn.0049c7d0
mov esi, esp
test esi, esi
je 0x490557
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi + 0x14]
mov ecx, esi
mov eax, dword [eax + 0x7c8]
lea edx, [ecx + 2]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4904a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004088f0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0
test eax, eax
je 0x4904e6
mov esi, ecx
cmp word [esi], 0xa
je 0x49057a
add esi, 2
sub eax, 1
jne 0x4904d4
mov ecx, dword [edi + 0x14]
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae edx, dword [ebp - 0x28]
mov eax, dword [ecx]
push edx
call dword [eax + 0x19c]
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x490532
push 0
push 0
push 0xb0
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
and eax, 0xf
lea ecx, [ebx - 1]
cmp eax, ecx
je 0x490532
push ebx
push ebx
push 0xb1
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x14]
push 0
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push dword [ebp - 0x44]
call dword [eax + 0x20]
mov ecx, eax
call fcn.0042a6f0
lea ecx, [ebp - 0x28]
call fcn.00407650
xor eax, eax
lea esp, [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049bdac
mov esp, ebp
pop ebp
ret 0x10
test esi, esi
je 0x4904e6
sub esi, ecx
sar esi, 1
cmp esi, 0xffffffff
je 0x4904e6
push esi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004685b0
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4905ac
mov edx, dword [edx]
mov ecx, dword [edi + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x19c]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00407650
push esi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004685b0
cmp dword [eax + 0x14], 8
jb 0x4905db
mov eax, dword [eax]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x40]
call fcn.00407650
jmp 0x490532
Function at 0x490f90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi]
cmp eax, 0x17
jne 0x490fbd
movzx eax, word [esi + 0x55c]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.USER32.dll_SetCursor]
cmp eax, 0xd
jne 0x49100c
mov eax, dword [esi]
call dword [eax + 0x34]
push dword [edi + 0x10]
push dword [edi + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x49106d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x568], xmm0
mov eax, dword [edi + 0xc]
mov dword [esi + 0x560], eax
mov eax, dword [edi + 0x10]
pop edi
mov dword [esi + 0x564], eax
mov byte [esi + 0x578], 1
pop esi
pop ebp
ret 4
cmp eax, 0xe
jne 0x49102d
mov ecx, dword [esi + 0x558]
mov byte [esi + 0x578], 0
test ecx, ecx
je 0x49106d
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
ret 4
cmp eax, 9
jne 0x491067
cmp dword [esi + 0x558], 0
je 0x49106d
cmp byte [esi + 0x578], 0
je 0x49106d
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x49106d
mov ecx, dword [esi + 0x558]
lea eax, [edi + 0xc]
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
pop esi
pop ebp
ret 4
push edi
call fcn.0042ff80
pop edi
pop esi
pop ebp
ret 4

Function at 0x491080
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi]
cmp eax, 0xd
jne 0x4910cf
mov eax, dword [esi]
push ebx
call dword [eax + 0x34]
push dword [edi + 0x10]
mov ebx, eax
push dword [edi + 0xc]
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4910c8
mov eax, dword [edi + 0xc]
sub eax, dword [ebx]
mov dword [esi + 0x55c], eax
mov eax, dword [edi + 0x10]
sub eax, dword [ebx + 4]
mov dword [esi + 0x560], eax
mov byte [esi + 0x564], 1
pop ebx
pop edi
pop esi
pop ebp
ret 4
cmp eax, 0xe
jne 0x4910f0
mov ecx, dword [esi + 0x558]
mov byte [esi + 0x564], 0
test ecx, ecx
je 0x4910c9
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
ret 4
cmp eax, 9
jne 0x491122
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x491122
mov ecx, dword [esi + 0x558]
test ecx, ecx
je 0x4910c9
cmp byte [esi + 0x564], 0
je 0x4910c9
mov edx, dword [ecx]
lea eax, [edi + 0xc]
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [edx]
push edi
mov ecx, esi
call fcn.0042ff80
pop edi
pop esi
pop ebp
ret 4
Function at 0x4984a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d128
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x54e39c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp byte [esi + 0x20], 0
jne 0x4984e7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 1
jbe 0x498523
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x498bf0
push 0
push 0
call fcn.004e7420
xor ecx, ecx
mov dword [esi + 0x10], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x44]
call sub.gdiplus.dll_GdipCreateFromHDC
mov edi, dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipGraphicsClear
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
push dword [eax + 0x28]
push 0
push 0
push dword [eax + 4]
push edi
call sub.gdiplus.dll_GdipDrawImageRectI
test eax, eax
push ebx
cmovne esi, eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
call fcn.00430ac0
mov ecx, esi
call fcn.004988b0
push edi
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ef30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049eaa0
Function at 0x4a0180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d493
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x54e39c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x80], 0
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00424240
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x4a0393
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
je 0x4a0393
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x4a0393
push eax
call esi
test eax, eax
je 0x4a0393
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
push 0x201
push dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00423740
mov esi, dword [ebp - 0x90]
test eax, eax
jne 0x4a0384
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.004dd9e0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a0384
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x4a02ab
cmp eax, 2
jne 0x4a0384
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x4a02cc
test cl, 1
jne 0x4a0384
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x4a02d2
jmp 0x4a0384
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x4a0384
lea ecx, [ebp - 0x78]
call fcn.0049e520
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x78]
call fcn.0049e5e0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
lea eax, [ebp - 0x20]
push 0x524cf8
push eax
call fcn.004a0790
push 0x2a
push dword [ebp - 0x78]
call fcn.0049eaa0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x84], eax
jne 0x4a037c
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a0332
sub edx, ecx
lea eax, [ebp - 0x74]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.0049e370
push dword [0x54e3cc]
lea eax, [ebp - 0x74]
push dword [0x54e3c8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4a036d
mov dword [edi], 1
lea ecx, [ebp - 0x78]
call fcn.0049d890
mov edi, 1
jmp 0x4a0386
lea ecx, [ebp - 0x78]
call fcn.0049d890
xor edi, edi
test esi, esi
je 0x4a0395
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a0395
xor edi, edi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x80]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049bdac
mov esp, ebp
pop ebp
ret
Function at 0x4a03d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x4a03e5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a03f0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4a3630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a36a1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4a366f
cmp eax, 2
jne 0x4a368b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4a369b
test ecx, ecx
je 0x4a3696
test cl, 1
jne 0x4a368b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4a369b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4a7492
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4fa18d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x55a550]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4fa1ce
cmp byte [edx], 0xa
jne 0x4fa1ce
or byte [eax + edi + 0x28], 4
jmp 0x4fa1d3
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4fa2c4
mov al, byte [ebx]
cmp al, 0x1a
je 0x4fa2a5
cmp al, 0xd
je 0x4fa1fc
mov byte [esi], al
inc esi
inc ebx
jmp 0x4fa29a
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4fa21c
cmp byte [eax], 0xa
jne 0x4fa211
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4fa217
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4fa29a
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fa293
cmp dword [ebp - 0x14], 0
je 0x4fa293
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x55a550]
test byte [eax + edi + 0x28], 0x48
je 0x4fa26a
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4fa25a
mov byte [esi], dl
jmp 0x4fa296
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x55a550]
mov byte [eax + edi + 0x2a], dl
jmp 0x4fa296
cmp byte [ebp - 1], 0xa
jne 0x4fa27c
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4fa27c
mov byte [esi], 0xa
jmp 0x4fa219
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004e7274
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4fa297
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4fa1e5
jmp 0x4fa2c4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x55a550]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4fa2bf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4fa2c4
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fa2cf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x55a550]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4fa313
cmp word [edx], bx
jne 0x4fa313
or byte [edi + eax + 0x28], 4
jmp 0x4fa318
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4fa46c
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4fa44c
cmp ax, word [ebp - 0x10]
je 0x4fa351
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4fa441
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4fa377
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4fa367
push ecx
pop eax
push 4
jmp 0x4fa36c
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4fa43b
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fa432
cmp dword [ebp - 0x18], 0
je 0x4fa432
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x55a550]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4fa3fe
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4fa3c2
mov word [esi], ax
jmp 0x4fa3f6
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x55a550]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x55a550]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x55a550]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4fa441
cmp word [ebp - 4], ax
jne 0x4fa413
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4fa413
mov word [esi], ax
add esi, 2
jmp 0x4fa441
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004e7274
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4fa43e
jmp 0x4fa435
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4fa331
jmp 0x4fa46c
mov ecx, dword [ecx*4 + 0x55a550]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4fa463
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4fa46c
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ffbf2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ff894
Function at 0x4031b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4031bf
pop dword [ebp - 0x2c]
mov eax, 0x4031bf
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe9336860
sub dword [ebp - 0x3c], 0x9ae12315
mov dword [ebp - 0x38], 0xd8e004c
add dword [ebp - 0x38], 0x24a54bf9
mov dword [ebp - 0x34], 0x44947012
sub dword [ebp - 0x34], 0xf8482be4
mov dword [ebp - 0x30], 0x9591fc65
sub dword [ebp - 0x30], 0x9591fc65
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x9b02848
add eax, 0xf6910848
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x86004855
add dword [ebp - 0x3c], 0xee722101
mov dword [ebp - 0x38], 0x2960c099
add dword [ebp - 0x38], 0x180ba0dc
mov dword [ebp - 0x34], 0xf0e7566a
add dword [ebp - 0x34], 0x72881602
mov dword [ebp - 0x30], 0x736057e6
sub dword [ebp - 0x30], 0x736057e6
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xeab99a9a
sub eax, 0xea786a5e
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b78d
push 0
call eax
mov ecx, 0x1ab1b580
add ecx, 0xe54e9633
xor edi, edi
add edi, eax
mov ebx, 0x41a000
add ebx, dword [ebp - 0x2c]
mov edx, 0xa5745b2f
xor dword [ebp - 8], 0x65bd6e0f
mov esi, dword [ebx]
mov dword [ebp - 0x20], 0xca5efabe
sub esi, edx
mov dword [ebp - 0xc], 0xfcc5a3b8
mov dword [edi], esi
xor dword [ebp - 0x10], ecx
add edi, 0xf2cdb64a
add edi, 0xd3249ba
add ebx, 0xf95c1d4e
add ebx, 0x6a3e2b6
loop 0x4032d2
add eax, 0x75ac3c4e
add eax, 0x8a54e551
xor ebx, ebx
add ebx, eax
add eax, 0xd3ca3209
add eax, 0x2c35cdfc
mov ecx, 0x81c63def
sub ecx, 0x81863def
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x410280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41029c
mov dword [eax], ecx
jmp 0x41029e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410310
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x10be0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10be01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10be007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10be006a
add dl, dl
jne 0x10be0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10be00dc
xor eax, eax
add dl, dl
jne 0x10be0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10be017d
add dl, dl
jne 0x10be00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10be00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10be00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10be00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10be00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10be0075
mov eax, 1
add dl, dl
jne 0x10be00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10be00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10be00e1
sub eax, ebx
mov ebx, 1
jne 0x10be0128
mov ecx, 1
add dl, dl
jne 0x10be010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10be0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10be0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10be0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10be013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10be014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10be0136
cmp eax, 0x7d00
jae 0x10be016d
cmp eax, 0x500
jb 0x10be0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10be0075
cmp eax, 0x7f
ja 0x10be0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10be0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10be019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10be0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10110b30], 0
je 0x10001539
mov eax, dword [0x10110b30]
jmp 0x100016d6
mov dword [0x10110b30], 0x10110b08
push 0x28
push 0
push 0x10110b08
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10110b08], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10110b0c], eax
cmp dword [0x10110b0c], 0
jne 0x1000157f
xor eax, eax
jmp 0x100016d6
push str.ImagehlpApiVersionEx
mov eax, dword [0x10110b0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b10], eax
push str.SymInitialize
mov ecx, dword [0x10110b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b14], eax
push str.SymSetOptions
mov edx, dword [0x10110b0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b18], eax
push str.SymGetOptions
mov eax, dword [0x10110b0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b1c], eax
push str.SymLoadModule
mov ecx, dword [0x10110b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b20], eax
push str.SymGetModuleInfo
mov edx, dword [0x10110b0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b24], eax
push str.SymGetSymFromName
mov eax, dword [0x10110b0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b28], eax
push str.BindImage
mov ecx, dword [0x10110b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10110b2c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x10110b10], 0
je 0x1000165d
lea eax, [ebp - 8]
push eax
call dword [0x10110b10]
cmp dword [0x10110b10], 0
je 0x1000166f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x1000168a
mov edx, dword [0x10110b0c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10110b0c], 0
xor eax, eax
jmp 0x100016d6
cmp dword [0x10110b14], 0
je 0x100016a3
push 0
push 0
mov eax, dword [0x10110b08]
push eax
call dword [0x10110b14]
cmp dword [0x10110b1c], 0
je 0x100016d1
cmp dword [0x10110b18], 0
je 0x100016d1
call dword [0x10110b1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10110b18]
mov eax, dword [0x10110b30]
mov esp, ebp
pop ebp
ret