joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59db84
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x59dd90
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
imul esi, dword [esp + 0x24], 3
push edi
mov edi, 0xff
shl ebx, 2
mov dword [esp + 0x28], edx
cmp dword [esp + 0x40], edi
jne 0x59dca0
mov dword [esp + 0x40], ebx
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x24]
imul ebp, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
add ebp, ebx
mov ebx, dword [eax + 0xcc]
add ebp, dword [esp + 0x20]
imul ebx, edx
add ebx, dword [eax + 0xc8]
add ebx, esi
cmp dword [esp + 0x38], 0
jle 0x59dc69
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
movzx edi, byte [ebp + 3]
mov esi, 0xff
movzx eax, byte [ebp + 2]
sub esi, edi
movzx ecx, byte [ebx + 2]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x59dbfa
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
dec ecx
or eax, 0xffffffff
mov dword [esp + 0x3c], ecx
inc edx
push 1
cmp dword [esi + 0xe8], 0
mov esi, dword [esp + 0x14]
pop ebx
cmovne eax, ebx
mov dword [esp + 0x28], edx
add eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x40]
test ecx, ecx
jne 0x59dbc5
jmp 0x59dd8c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x24]
imul ebp, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
add ebp, ebx
mov ebx, dword [eax + 0xcc]
add ebp, dword [esp + 0x20]
imul ebx, edx
add ebx, dword [eax + 0xc8]
add ebx, esi
cmp dword [esp + 0x38], 0
jle 0x59dd5a
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
movzx eax, byte [ebp + 3]
mov esi, 0xff
imul eax, dword [esp + 0x40]
movzx ecx, byte [ebx + 2]
cdq
idiv edi
mov edi, eax
movzx eax, byte [ebp + 2]
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
mov edi, 0xff
add eax, ecx
cdq
idiv edi
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x59dce1
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
dec ecx
or eax, 0xffffffff
mov dword [esp + 0x3c], ecx
inc edx
push 1
cmp dword [esi + 0xe8], 0
mov esi, dword [esp + 0x18]
pop ebx
cmovne eax, ebx
mov dword [esp + 0x28], edx
add eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x10]
test ecx, ecx
jne 0x59dca8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x59e75f
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x30]
mov ebp, dword [esi + 0xd4]
test edi, edi
je 0x59e804
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
push ebx
shl ecx, 2
mov ebx, ebp
imul ebx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x1c]
imul edx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
add edx, ecx
mov ecx, dword [esi + 0xcc]
add edx, dword [esp + 0x18]
imul ecx, eax
add ecx, dword [esi + 0xc8]
add ecx, ebx
cmp dword [esp + 0x30], 0
jle 0x59e7e2
mov esi, dword [esp + 0x30]
mov al, byte [edx + 2]
xor byte [ecx + 2], al
mov al, byte [edx + 1]
xor byte [ecx + 1], al
mov al, byte [edx]
lea edx, [edx + 4]
xor byte [ecx], al
add ecx, ebp
sub esi, 1
jne 0x59e7c0
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc eax
xor ecx, ecx
mov dword [esp + 0x24], eax
inc ecx
or eax, 0xffffffff
cmp dword [esi + 0xe8], 0
cmovne eax, ecx
add eax, dword [esp + 0x34]
sub edi, ecx
mov ecx, dword [esp + 0x28]
jne 0x59e78f
pop ebx
pop edi
pop esi
pop ebp
ret 0x24

Function at 0x59eb43
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul ecx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ecx
test ebx, ebx
je 0x59ec11
push ebp
mov ebp, dword [esp + 0x24]
push esi
imul esi, dword [esp + 0x2c], 3
imul eax, dword [esp + 0x24], 3
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov edx, eax
imul edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], edx
add edi, esi
mov esi, dword [eax + 0xcc]
add edi, dword [esp + 0x20]
imul esi, ebp
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x38]
test ecx, ecx
jle 0x59ebde
mov ebx, 0xff
mov ebp, ecx
sub ebx, dword [esp + 0x40]
movzx eax, byte [edi]
imul eax, dword [esp + 0x40]
movzx ecx, byte [esi]
imul ecx, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc edi
mov byte [esi], al
inc esi
sub ebp, 1
jne 0x59ebb1
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
xor esi, esi
dec ebx
or eax, 0xffffffff
inc esi
mov dword [esp + 0x3c], ebx
inc ebp
cmp dword [ecx + 0xe8], 0
mov ecx, dword [esp + 0x10]
cmovne eax, esi
mov dword [esp + 0x2c], ebp
mov esi, dword [esp + 0x14]
add eax, edx
test ebx, ebx
jne 0x59eb78
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x59f222
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x30]
mov ebp, dword [esi + 0xd4]
test edi, edi
je 0x59f2c5
imul ecx, dword [esp + 0x24], 3
mov eax, dword [esp + 0x28]
push ebx
mov ebx, ebp
imul ebx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x1c]
imul edx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
add edx, ecx
mov ecx, dword [esi + 0xcc]
add edx, dword [esp + 0x18]
imul ecx, eax
add ecx, dword [esi + 0xc8]
add ecx, ebx
cmp dword [esp + 0x30], 0
jle 0x59f2a3
mov esi, dword [esp + 0x30]
mov al, byte [edx + 2]
xor byte [ecx + 2], al
mov al, byte [edx + 1]
xor byte [ecx + 1], al
mov al, byte [edx]
lea edx, [edx + 3]
xor byte [ecx], al
add ecx, ebp
sub esi, 1
jne 0x59f281
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc eax
xor ecx, ecx
mov dword [esp + 0x24], eax
inc ecx
or eax, 0xffffffff
cmp dword [esi + 0xe8], 0
cmovne eax, ecx
add eax, dword [esp + 0x34]
sub edi, ecx
mov ecx, dword [esp + 0x28]
jne 0x59f250
pop ebx
pop edi
pop esi
pop ebp
ret 0x24
Function at 0x5a16e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push dword [esp + 0x78]
xor esi, esi
mov ebx, esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x5a187d
push dword [esp + 0x28]
call fcn.004ceea3
test eax, eax
je 0x5a1726
push dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x5a187d
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x5a186a
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x5a1862
push 0x2c
lea eax, [esp + 0x50]
push esi
push eax
call fcn.0046bb30
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x50], 0x28
mov word [esp + 0x5c], ax
pop eax
push esi
push esi
mov word [esp + 0x62], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x5a1862
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push edi
call esi
push 2
xor eax, eax
push eax
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x90]
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x2c]
push edi
call esi
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x5a1862
mov ebp, dword [esp + 0x38]
xor esi, esi
mov edx, dword [esp + 0x3c]
mov eax, ebp
shl eax, 2
mov dword [esp + 0x10], eax
test edx, edx
jle 0x5a1862
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
sub ecx, esi
add eax, 3
dec ecx
xor ebx, ebx
imul ecx, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x7c], eax
test ebp, ebp
jle 0x5a1859
push esi
push ebx
push edi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x7c]
test eax, eax
setne al
dec al
mov byte [ecx], al
add ecx, 4
mov ebp, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x7c], ecx
cmp ebx, ebp
jl 0x5a1831
mov edx, dword [esp + 0x3c]
inc esi
cmp esi, edx
jl 0x5a1814
mov ebx, dword [esp + 0x1c]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [esp + 0x2c]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x68
ret 4
Function at 0x5a38e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5a3a65
cmp dword [esi + 0x20], 0
je 0x5a3a65
cmp dword [esi + 0x24], 0
je 0x5a3a65
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5a3a65
cmp dword [eax], esi
jne 0x5a3a65
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x5a3945
cmp eax, 0x39
je 0x5a3945
cmp eax, 0x45
je 0x5a3945
cmp eax, 0x49
je 0x5a3945
cmp eax, 0x5b
je 0x5a3945
cmp eax, 0x67
je 0x5a3945
cmp eax, 0x71
je 0x5a3945
cmp eax, 0x29a
jne 0x5a3a65
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x5a397e
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x5a39a0
call fcn.005a18a0
jmp 0x5a39a5
call fcn.005a6340
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.005a6c00
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.0046bb30
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x5e664a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x5e6648]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x5e664c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x5e664e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x401ecb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x401ef5
cmp dword [ebp + 0xc], 0
je 0x401ef5
cmp dword [ebp + 0x10], 0
je 0x401ef5
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + 0xa8]
test ecx, ecx
jne 0x401efc
xor al, al
jmp 0x401f95
push 0x1020
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push 0x14
push 0
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x1c
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10]
add eax, 0x1c
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x101c], 1
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 0x10]
add edx, 0x14
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f93
call fcn.00402bc0
cmp eax, 0x3e5
je 0x401f93
xor al, al
jmp 0x401f95
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402364
Capabilities:
Get system information on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov cl, byte [eax + 0xa8]
test ecx, ecx
jne 0x402381
jmp 0x40243f
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x28], 0
jmp 0x40239d
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + ecx + 2]
cmp dword [ebp - 0x28], edx
jae 0x4023be
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
jmp 0x402394
push 1
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xa
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x2c]
call fcn.00402190
mov eax, dword [ebp - 0x2c]
add eax, 0x90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x5c], 0
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0xa8], 0
mov esp, ebp
pop ebp
ret
Function at 0x4060d8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push bind
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x406125
push 0x40
push 0x4116e4
push 0x4116f4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40616f
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x40613e
xor eax, eax
jmp 0x40616f
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406166
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40616a
xor eax, eax
jmp 0x40616f
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x406173
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0x80
push 3
push 0
push 0
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4061c0
push 0x40
push 0x411704
push 0x411714
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4061dc
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40650e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40da02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push esi
push edi
mov dword [ebp - 0x134], ecx
mov dword [ebp - 4], 1
push 0x104
push 0
lea eax, [ebp - 0x130]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x1e
push 0
lea ecx, [ebp - 0x2c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp + 0x400]
call fcn.00402af0
push eax
lea edx, [ebp - 0x130]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp + 0x404]
call fcn.00402af0
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.BuildSer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp + 0x408]
push ecx
sub esp, 0x3f8
mov ecx, 0xfe
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
call fcn.004061e0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x400]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x404]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x404
Function at 0x40761e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40db1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea eax, [ebp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x1c]
add ecx, 0x618
call fcn.0040c4a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
jmp 0x40766c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x10]
jge 0x4076fc
push 1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x558
call sub.MFC42.DLL_CListCtrl::GetItemText
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402af0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0040bce0
and eax, 0xff
test eax, eax
je 0x4076e8
lea ecx, [ebp + 0x260]
push ecx
push 2
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x558
call sub.MFC42.DLL_CListCtrl::SetItemText
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
jmp 0x4076fc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
jmp 0x407663
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x3fc

Function at 0x40a0f3
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x40a105
jmp 0x40a176
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
call fcn.0040bd80
add eax, 1
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a170
mov ecx, dword [ebp + 8]
call fcn.0040bd80
push eax
push 0
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
push edx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret
Function at 0x40b8cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40df84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x13c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x144], ecx
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::CFile
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x411eec
lea edx, [ebp - 0x128]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
mov byte [ebp - 4], 1
push 0
push 0x8000
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Open
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::GetLength
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x148]
mov dword [ecx + 0x494], edx
mov eax, dword [ebp - 0x144]
cmp dword [eax + 0x490], 0
je 0x40b9c3
mov ecx, dword [ebp - 0x144]
mov edx, dword [ecx + 0x490]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x138]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [ebp - 0x144]
mov dword [ecx + 0x490], 0
mov edx, dword [ebp - 0x144]
mov eax, dword [edx + 0x494]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x13c], ecx
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x13c]
mov dword [edx + 0x490], eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ecx + 0x494]
push edx
push 0
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax + 0x490]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x144]
mov eax, dword [edx + 0x494]
push eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ecx + 0x490]
push edx
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Read
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFile::Close
mov dword [ebp - 0x24], 1
jmp 0x40ba65
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x140], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040cfc0
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1018c7ff
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x1018c816
mov eax, dword [ebp + 8]

Function at 0x10199dd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
push dword [esp + 4]
jmp 0x10199e11
mov byte [esp + 2], bh
push word [esp + 8]
mov dword [esp + 0x28], esp
pushal
jmp 0x10199e5c
mov dword [esp + 0x28], esp
pushal
push word [esp + 0xe]
jmp 0x10199e61
jo 0x10199de1
mov byte [esp + 2], bh
push word [esp + 8]
jmp 0x10199dfb
push word [esp + 0xe]
call fcn.10199e3f
pushfd
jmp 0x10199d85

Function at 0x10199e97
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
jmp 0x10199e66
lea esp, [esp + 2]
jmp 0x10199e7c

Function at 0x1019a005
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
call fcn.10199fd6

Function at 0x1019a03b
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror dx, cl
jno 0x1019a06c
mov byte [esp + 1], al
call fcn.1019a056
sbb eax, 0xc7342dbd
inc edx
or al, 0x9f
mov byte [esp + 1], al
jmp 0x1019a0ec

Function at 0x1019a056
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1019a086
pushal
mov bh, byte [esp + 0x15]
lea ebx, [esp + edi]
pop eax
rcr ax, cl
xchg dword [esp + 0x1c], edi
jmp 0x1019a0b2

Function at 0x1019c289
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp], edi
pushfd
jmp 0x1019be24
mov byte [esp + 2], ch
lea esp, [esp + 0xa]
jmp 0x1019c22d

Function at 0x101a985a
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1018e5c3
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1018e5dd
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1018e5cc
pop esi
jmp 0x1018e5e8
ret 4
jmp 0x1018e5b6