joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404dbb
Capabilities:
Create process on windows

Disassembly:
add byte [edx], ch
call dword [sym.imp.GDI32.dll_GetFontData]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call dword [sym.imp.USER32.dll_DispatchMessageA]
jnp 0x404ded
jp 0x404ded
call 0xaa4e5b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
je 0x404e05
jne 0x404e05
int 0x20
call dword [sym.imp.USER32.dll_CreateMenu]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
pushf
jb 0x404e42
je 0x404e3d
jne 0x404e3d
call fcn.00405129
add byte [edx - 0xc], dh
call 0x404e44
jb 0x404e38
add esp, 4
popf
je 0x404e4e
jne 0x404e4e
call 0x163f4ebc
add al, dl
inc eax
add byte [eax - 0x6f6f6f70], dl
push 0
call dword [sym.imp.COMDLG32.dll_PrintDlgA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
pushf
push 0xa
jb 0x404e92
je 0x404e99
jne 0x404e99
call 0x47377d
add byte [eax], al
call 0x404e9d
call 0xe937c284
call 0xeb451324
add ch, al
call 0x71645ba7
add ch, al
call 0x2bb2c28
jae 0x404e92
call 0x504d288
jmp 0x404ea4
dec dword [esp]
jno 0x404eab
call 0x7b1dc896
add ch, al
call 0x66451338
popfd
jns 0x404e8a
jp 0x404eb1
call 0x504d29c
add esp, 4
popf
jmp 0x404eba
jl 0x404ebf
jmp 0x404ec1
je 0x404ebc
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
jne 0x404ede
je 0x404ede
call 0xaa4f4c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
call dword [sym.imp.COMDLG32.dll_PrintDlgA]
je 0x404f29
jne 0x404f29
jmp 0x404f2c
pop ecx
jp 0x404f19
jmp 0x404f22
jnp 0x404f19
add dword [ecx - 0x15], edx
hlt
push ecx
jmp 0x404f1c
jmp 0x404f25
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_StretchBlt]
call 0x404f54
mov dword [ebx - 0x14ec3f7d], 0x2eb580b
int 0x20
add eax, 2
jmp 0x404f5f
push eax
ret
Function at 0x404e44
Capabilities:
Get file system object information

Disassembly:
add byte [edx], ch
call dword [sym.imp.GDI32.dll_GetFontData]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call dword [sym.imp.USER32.dll_DispatchMessageA]
jnp 0x404ded
jp 0x404ded
call 0xaa4e5b
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
je 0x404e05
jne 0x404e05
int 0x20
call dword [sym.imp.USER32.dll_CreateMenu]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
pushf
jb 0x404e42
je 0x404e3d
jne 0x404e3d
call fcn.00405129
add byte [edx - 0xc], dh
call 0x404e44
jb 0x404e38
add esp, 4
popf
je 0x404e4e
jne 0x404e4e
call 0x163f4ebc
add al, dl
inc eax
add byte [eax - 0x6f6f6f70], dl
push 0
call dword [sym.imp.COMDLG32.dll_PrintDlgA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
pushf
push 0xa
jb 0x404e92
je 0x404e99
jne 0x404e99
call 0x47377d
add byte [eax], al
call 0x404e9d
call 0xe937c284
call 0xeb451324
add ch, al
call 0x71645ba7
add ch, al
call 0x2bb2c28
jae 0x404e92
call 0x504d288
jmp 0x404ea4
dec dword [esp]
jno 0x404eab
call 0x7b1dc896
add ch, al
call 0x66451338
popfd
jns 0x404e8a
jp 0x404eb1
call 0x504d29c
add esp, 4
popf
jmp 0x404eba
jl 0x404ebf
jmp 0x404ec1
je 0x404ebc
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
jne 0x404ede
je 0x404ede
call 0xaa4f4c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
call dword [sym.imp.COMDLG32.dll_PrintDlgA]
je 0x404f29
jne 0x404f29
jmp 0x404f2c
pop ecx
jp 0x404f19
jmp 0x404f22
jnp 0x404f19
add dword [ecx - 0x15], edx
hlt
push ecx
jmp 0x404f1c
jmp 0x404f25
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_StretchBlt]
call 0x404f54
mov dword [ebx - 0x14ec3f7d], 0x2eb580b
int 0x20
add eax, 2
jmp 0x404f5f
push eax
ret

Function at 0x40594a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418490]
jne 0x405954
repz ret
jmp fcn.004074aa
Function at 0x40ac4b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406c70
and dword [ebp - 4], 0
cmp dword [0x41a9cc], 0
mov ebx, eax
jne 0x40acfc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40adad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x415228
push edi
call esi
test eax, eax
je 0x40adad
push eax
call fcn.00406bfe
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41a9cc], eax
call esi
push eax
call fcn.00406bfe
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41a9d0], eax
call esi
push eax
call fcn.00406bfe
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41a9d4], eax
call esi
push eax
call fcn.00406bfe
pop ecx
mov dword [0x41a9dc], eax
test eax, eax
je 0x40acfc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406bfe
pop ecx
mov dword [0x41a9d8], eax
mov eax, dword [0x41a9d8]
cmp eax, ebx
je 0x40ad54
cmp dword [0x41a9dc], ebx
je 0x40ad54
push eax
call fcn.00406c79
push dword [0x41a9dc]
mov esi, eax
call fcn.00406c79
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ad54
test edi, edi
je 0x40ad54
call esi
test eax, eax
je 0x40ad4b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ad4b
test byte [ebp - 0xc], 1
jne 0x40ad54
or dword [ebp + 0x10], 0x200000
jmp 0x40ad8d
mov eax, dword [0x41a9d0]
cmp eax, ebx
je 0x40ad8d
push eax
call fcn.00406c79
pop ecx
test eax, eax
je 0x40ad8d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ad8d
mov eax, dword [0x41a9d4]
cmp eax, ebx
je 0x40ad8d
push eax
call fcn.00406c79
pop ecx
test eax, eax
je 0x40ad8d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41a9cc]
call fcn.00406c79
pop ecx
test eax, eax
je 0x40adad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40adaf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4068fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40691f
xor eax, eax
test eax, eax
je 0x406932
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406932
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x46590c], 0
push esi
jne 0x406a8f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a69
mov dword [ecx*4 + 0x465908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a64
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406ac0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x465908]
xor eax, esi
inc ecx
dec edx
jne 0x406aa2
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401690
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4016ca
mov ebx, esi
jmp 0x4016bc
and eax, 0xff
cmp eax, 0x5c
jne 0x4016bb
mov byte [ebx], 0
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
mov byte [ebx], 0x5c
inc ebx
mov al, byte [ebx]
test al, al
jne 0x4016a3
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
pop esi
pop ebx
ret
Function at 0x401c2a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x401c4a
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x401c53
cmp byte [ebx], 0
jne 0x401c57
xor eax, eax
jmp 0x401cd6
xor esi, esi
jmp 0x401c98
inc ebx
xor ecx, ecx
mov cl, al
cmp ecx, 0x3d
jne 0x401c7f
cmp dword [ebp - 4], 0
je 0x401c7f
test esi, esi
jne 0x401c7f
cmp dword [ebp + 8], 0
je 0x401c7b
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x401c98
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x401c8d
cmp ecx, 0xa
jne 0x401c95
cmp ecx, 0xd
jne 0x401c9e
inc ebx
jmp 0x401c9e
mov byte [edx], al
inc edx
mov al, byte [ebx]
test al, al
jne 0x401c5b
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x401cd4
mov edx, dword [ebp - 4]
test esi, esi
mov byte [edx], 0
je 0x401cd4
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.0040322c
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401cde
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffff7bc
mov ebx, eax
mov byte [esp], dl
lea esi, [esp + 0x408]
cmp byte [esp], 0
je 0x401d74
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x22
jne 0x401d24
lea edx, [ebx + 1]
lea eax, [esp + 8]
call fcn.0040322c
lea eax, [esp + 8]
mov edx, 0x22
call fcn.004031bc
test eax, eax
je 0x401d44
mov byte [eax], 0
jmp 0x401d44
lea eax, [esp + 8]
mov edx, ebx
call fcn.0040322c
mov edx, 0x4071cd
lea eax, [esp + 8]
call fcn.00403200
test eax, eax
je 0x401d44
mov byte [eax], 0
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401d74
mov edx, str..exe
lea eax, [esp + 8]
call fcn.004032dc
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401ecb
mov al, byte [0x408520]
test al, al
je 0x401d9e
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x401d92
mov edx, 0x4071ce
mov eax, ebx
call fcn.004032dc
mov edx, 0x408520
mov eax, ebx
call fcn.004032dc
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00403164
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x1c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x401dc7
lea edx, [ebx + 1]
jmp 0x401dc9
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x401e1a
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x401df2
jmp 0x401deb
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x401deb
mov byte [ebx + eax], 0x20
jmp 0x401df2
inc eax
cmp byte [ebx + eax], 0
jne 0x401ddb
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x401e07
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x401e19
cmp edx, 0x20
jne 0x401e10
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x401e21
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x401dd0
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x448]
push ecx
push 0x400
push dword [esi + 0x10]
call sub.KERNEL32.DLL_GetFullPathNameA
test eax, eax
je 0x401e49
lea eax, [esp + 0x444]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x401e73
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x401ecb
cmp byte [0x40703c], 0
jne 0x401e86
cmp byte [esp], 0
je 0x401e90
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x40703c], 0
je 0x401eb3
cmp byte [esp], 0
jne 0x401eb3
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x401ecb
cmp byte [esp], 0
je 0x401ec0
mov edx, 0xc8
jmp 0x401ec5
mov edx, 0x3e8
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x844
pop esi
pop ebx
ret
Function at 0x401ed4
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.004031ac
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.00403280
test eax, eax
jne 0x401f6b
push 0x4071d5
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.004031ac
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.00403164
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x402148
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x40290c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, 0x408520
call sub.KERNEL32.DLL_GetCommandLineA
test eax, eax
je 0x402937
xor edx, edx
mov dl, byte [eax]
cmp edx, 0x22
jne 0x402937
inc eax
jmp 0x402931
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
je 0x402937
inc eax
mov dl, byte [eax]
test dl, dl
jne 0x402927
test eax, eax
je 0x402998
xor edx, edx
jmp 0x40295c
xor ecx, ecx
mov cl, byte [eax + edx]
cmp ecx, 0x20
je 0x40294e
cmp ecx, 0x2f
jne 0x40295b
mov ecx, ebx
add edx, eax
mov eax, ecx
call fcn.0040322c
jmp 0x402962
inc edx
cmp byte [eax + edx], 0
jne 0x40293f
xor eax, eax
jmp 0x402992
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
je 0x402975
cmp edx, 0x2f
jne 0x402991
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x402985
cmp edx, 0x53
jne 0x402991
mov dword [0x407048], 1
jmp 0x402998
inc eax
cmp byte [ebx + eax], 0
jne 0x402966
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x40785c], ebx
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x408920], eax
push str.RICHED32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
push 0x400
push 0x408120
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edx, 0x408120
mov eax, 0x407880
call fcn.00403414
call fcn.0040100c
cmp dword [0x407044], 0
jle 0x4029f8
mov eax, dword [0x407040]
call fcn.00402fc0
push dword [0x408920]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov dword [0x407864], 2
push 0
call sub.KERNEL32.DLL_ExitProcess
pop ebx
ret
Function at 0x403888
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b4
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0xc]
push eax
mov esi, edx
mov edx, dword [ebp - 4]
mov eax, edi
lea ecx, [ebp - 8]
call fcn.00403a74
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x3c]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
inc ecx
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
inc eax
sub eax, dword [ebp - 0x30]
test bl, bl
mov dword [ebp - 0x14], eax
je 0x40391f
cmp byte [ebp + 8], 0
jne 0x40391f
mov eax, dword [ebp - 0x34]
mov ecx, 0x64
imul dword [ebp - 8]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
add eax, dword [ebp - 0x14]
pop ecx
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x40395c
push 0x400
lea eax, [ebp - 0x43c]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x43c]
lea edx, [ebp - 0x43c]
mov eax, edi
call fcn.00403710
lea edx, [ebp - 0x43c]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x14], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov esi, eax
test esi, esi
je 0x403a69
push 0x400
lea ecx, [ebp - 0x83c]
push ecx
push esi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x83c], 0
je 0x4039b8
push 1
push dword [ebp - 4]
lea ecx, [ebp - 0x83c]
lea edx, [ebp - 0x83c]
mov eax, edi
call fcn.00403710
lea eax, [ebp - 0x83c]
push eax
push esi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x403a57
lea edx, [ebp - 0x84c]
push edx
push esi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
sar edx, 1
jns 0x4039e0
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 8]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x844]
sub eax, dword [ebp - 0x84c]
inc eax
imul dword [ebp - 8]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x840]
sub eax, dword [ebp - 0x848]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ecx
push 0
push esi
call sub.USER32.DLL_SetWindowPos
push 2
push esi
call sub.USER32.DLL_GetWindow
mov esi, eax
test esi, esi
jne 0x403978
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403bf8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x4089a4
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne 0x403c12
call fcn.00403bc0
mov eax, ebp
cmp edi, 8
jb 0x403c9d
xor ebx, dword [eax]
xor edx, edx
mov dl, bl
sub edi, 8
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
xor ebx, dword [eax + 4]
add eax, 8
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x403c1d
xor edx, edx
jmp 0x403cb7
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp edi, edx
ja 0x403ca1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403f2c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00403014
test eax, eax
jne 0x403f49
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop esi
pop ebx
ret
or eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x403fe8
Capabilities:
Set file attributes

Disassembly:
push dword [0x408dd4]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
ret

Function at 0x404038
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop ebx
ret
Function at 0x4063b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
mov eax, 0x40d700
mov edx, dword [esp]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
xor edx, dword [0x40d800]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
xor edx, dword [0x40d804]
mov dword [esp + 8], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [ecx + 8]
mov ebx, dword [edx + 0xc]
xor ecx, dword [0x40d808]
xor ebx, dword [0x40d80c]
xor esi, esi
mov edx, ebx
mov edi, ebx
shr edi, 0x15
shl edx, 0xb
or edx, edi
mov edi, esi
and edi, 3
add edx, ecx
xor edx, dword [edi*4 + 0x40d800]
mov ebp, edx
mov edi, edx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi]
movzx ebp, byte [eax + ebp]
shl ebp, 8
or edi, ebp
mov ebp, edx
shr ebp, 0x10
shr edx, 0x18
and ebp, 0xff
and edx, 0xff
movzx ebp, byte [eax + ebp]
movzx edx, byte [eax + edx]
shl ebp, 0x10
shl edx, 0x18
or edi, ebp
or edi, edx
mov edx, ecx
xor edi, dword [esp + 4]
mov dword [esp + 0xc], edi
mov edi, ecx
shr edi, 0xf
shl edx, 0x11
or edx, edi
mov edi, esi
and edi, 3
xor edx, ebx
inc esi
add edx, dword [edi*4 + 0x40d800]
mov ebp, edx
mov edi, edx
shr ebp, 8
and edi, 0xff
and ebp, 0xff
movzx edi, byte [eax + edi]
movzx ebp, byte [eax + ebp]
shl ebp, 8
or edi, ebp
mov ebp, edx
shr ebp, 0x10
shr edx, 0x18
and ebp, 0xff
and edx, 0xff
movzx ebp, byte [eax + ebp]
movzx edx, byte [eax + edx]
shl ebp, 0x10
shl edx, 0x18
or edi, ebp
or edi, edx
xor edi, dword [esp + 8]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov edx, edi
mov ebx, edx
mov ecx, dword [esp + 0xc]
cmp esi, 0x20
jl 0x40640b
mov eax, dword [esp + 0x10]
xor ecx, dword [0x40d800]
mov dword [eax], ecx
xor ebx, dword [0x40d804]
mov edx, dword [esp + 0x10]
mov dword [edx + 4], ebx
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x10]
xor ecx, dword [0x40d808]
mov dword [eax + 8], ecx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
xor edx, dword [0x40d80c]
mov dword [ecx + 0xc], edx
mov eax, dword [esp]
call fcn.004066cc
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret