joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10187580
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10285871
call fcn.1009d1d3
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10187120
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1018765b
mov dword [ebp - 8], 0
jmp 0x101875ec
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1018765b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1009c27e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10187659
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1009c27e
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.10188360
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009c27e
jmp 0x101875e3
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1009c27e
mov esp, ebp
pop ebp
ret

Function at 0x10188710
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10285871
call fcn.1009d1d3
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x101887cc
mov dword [ebp - 8], 0
jmp 0x10188753
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x101887ae
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1009c27e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x101887ac
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1009c27e
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009c27e
jmp 0x1018874a
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x10282aac]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1009c27e
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1009c27e
mov esp, ebp
pop ebp
ret
Function at 0x10188f00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10285935
call fcn.1009d1d3
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10188f68
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10188f68
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10188f68
xor eax, eax
jmp 0x10188fa9
mov dword [ebp - 8], 1
jmp 0x10188f7a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10188fa4
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10188fa2
xor eax, eax
jmp 0x10188fa9
jmp 0x10188f71
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1009c27e
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431fd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x410c41
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040d0c2
mov dword [ebp - 0x14], eax
cmp dword [0x4210d8], edi
jne 0x410d32
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x410cbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410e12
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x410e12
push 0x419318
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410e12
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4210d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4210dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4210e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4210e8], eax
test eax, eax
je 0x410d2f
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4210e4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410d57
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410d4a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x410d6c
push 4
pop eax
jmp 0x410e14
cmp dword [ebp - 0x14], edi
je 0x410d6c
push dword [0x4210d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410d51
mov eax, dword [0x4210e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x410dca
cmp dword [0x4210e8], esi
je 0x410dca
push eax
call ebx
push dword [0x4210e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410dca
test eax, eax
je 0x410dca
call ecx
test eax, eax
je 0x410dbf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x410dbf
test byte [ebp - 8], 1
jne 0x410dca
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x410dfa
mov eax, dword [0x4210dc]
cmp eax, esi
je 0x410df7
push eax
call ebx
test eax, eax
je 0x410df7
call eax
mov edi, eax
test edi, edi
je 0x410df7
mov eax, dword [0x4210e0]
cmp eax, esi
je 0x410df7
push eax
call ebx
test eax, eax
je 0x410df7
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4210d8]
call ebx
test eax, eax
je 0x410e12
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x410e14
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f76
leave
ret
Function at 0x4c8240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov eax, dword [0x4e454c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4c8283
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4e454c]
call fcn.0041ab50
mov ebx, eax
mov eax, dword [esp]
cmp eax, dword [ebx]
jne 0x4c827f
mov eax, dword [ebx + 4]
jmp 0x4c8349
inc edi
dec esi
jne 0x4c8262
mov edi, dword [esp]
mov ebx, edi
xor esi, esi
mov edx, ebp
mov eax, ebx
call fcn.004c7ee8
test al, al
jne 0x4c829b
mov byte [ebp], 1
xor eax, eax
mov al, byte [ebp]
add esi, eax
xor eax, eax
mov al, byte [ebp]
add ebx, eax
cmp esi, 5
jb 0x4c828a
mov edx, esi
mov eax, edi
call fcn.004c8020
add eax, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
call fcn.00402768
mov ebp, eax
mov eax, 0x14
call fcn.00402768
mov ebx, eax
mov eax, dword [esp]
mov dword [ebx], eax
mov dword [ebx + 4], ebp
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], esi
mov eax, esi
call fcn.00402768
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0xc]
mov eax, edi
mov ecx, esi
call fcn.004029dc
mov edx, ebx
mov eax, dword [0x4e454c]
call fcn.0041a9f4
lea eax, [esp + 0xc]
push eax
push 0x40
mov eax, dword [esp + 0x10]
push eax
push ebp
call sub.kernel32.dll_VirtualProtect
mov edx, ebp
mov eax, edi
mov ecx, esi
call fcn.004029dc
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.004c80bc
lea edx, [esi + edi]
lea eax, [esi + ebp]
call fcn.004c7d30
mov edx, dword [esp + 4]
mov eax, edi
call fcn.004c7d30
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c85a8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.004c7b98
test al, al
je 0x4c85ec
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4c85ec
cmp dword [eax + 0x3c], 0
je 0x4c85ec
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.004c7b98
test al, al
je 0x4c85ea
cmp dword [esi], 0x4550
je 0x4c85ec
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4cccec
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040a108
add esp, 0x108
pop ebx
ret

Function at 0x4ccd14
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040a108
add esp, 0x108
pop ebx
ret
Function at 0x4ccd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4ccdb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4ccda2
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4ccd85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccdbf
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4cd470
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cd520
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xc8
mov eax, ebx
call fcn.00404358
mov eax, dword [ebp - 8]
call fcn.00402768
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407890
xor eax, eax
push ebp
push 0x4cd503
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4cd4ed
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404550
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.0040914c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004043ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd50a
mov eax, dword [ebp - 4]
call fcn.00402788
ret

Function at 0x4cd6ec
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4e4584
xor eax, eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + eax*4 + 0x5e4], ecx
inc eax
cmp eax, 0x65
jne 0x4cd6f7
xor edi, edi
push 0x40
mov eax, dword [ebx]
mov ecx, dword [eax + 0x3cc]
mov dl, 1
mov eax, dword [0x418a80]
call fcn.0041d5ac
mov ebp, eax
mov eax, dword [ebx]
mov dword [eax + 0x788], ebp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp + 4]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov eax, dword [ebx]
mov dword [eax + 0x790], esi
test esi, esi
je 0x4cd76c
push 0
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebp, eax
mov eax, dword [ebx]
mov dword [eax + 0x794], ebp
test ebp, ebp
je 0x4cd76c
mov edi, 1
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cdd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4cde08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4cddf2
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4cddd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cde0f
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4cde18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.0040a108
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ce0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4ce118
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4ce102
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4ce0e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce11f
lea eax, [ebp - 4]
call fcn.00404358
ret

Function at 0x4ce128
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffca0
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4ce20a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ce1e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x209]
mov edx, dword [ebp - 4]
call fcn.00409fb4
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402944
lea eax, [ebp - 0x309]
mov edx, dword [ebp - 8]
call fcn.00409fb4
lea eax, [ebp - 0x350]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ea4
mov dword [ebp - 0x350], 0x44
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x350]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x209]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4ce1d5
xor ebx, ebx
call fcn.00403da0
jmp 0x4ce1ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce1ea
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce211
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040437c
ret
Function at 0x4d08cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d0a79
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 8
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov edx, 0x4d0a90
call fcn.00404764
je 0x4d0a5e
mov eax, dword [ebp - 4]
mov edx, 0x4d0a9c
call fcn.00404764
jne 0x4d0954
push 1
push 0
push 0
lea ecx, [ebp - 8]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
call fcn.00404818
push eax
push 0x4d0aa0
mov eax, esi
call fcn.0045d65c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d0a5e
mov eax, dword [ebp - 4]
mov edx, 0x4d0ab0
call fcn.00404764
jne 0x4d097f
lea ecx, [ebp - 0xc]
mov edx, 0xa
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00433774
jmp 0x4d0a5e
mov eax, dword [ebp - 4]
mov edx, 0x4d0abc
call fcn.00404764
jne 0x4d09da
lea ecx, [ebp - 0x10]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00433774
push 1
push 0
push 0
lea ecx, [ebp - 0x14]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404818
push eax
push 0x4d0aa0
mov eax, esi
call fcn.0045d65c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d0a5e
mov eax, dword [ebp - 4]
mov edx, 0x4d0ac8
call fcn.00404764
jne 0x4d0a5e
push 4
lea ecx, [ebp - 0x18]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00404818
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4e2150]
mov eax, dword [eax]
call fcn.00476e38
mov eax, dword [ebp - 0x1c]
call fcn.00404818
mov ecx, eax
mov eax, dword [0x4e2150]
mov eax, dword [eax]
pop edx
call fcn.004774b4
cmp eax, 6
jne 0x4d0a5e
push 1
push 0
push 0
lea ecx, [ebp - 0x20]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404818
push eax
push 0x4d0aa0
mov eax, esi
call fcn.0045d65c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0a80
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.0040437c
ret

Function at 0x4d17cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4d1844
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4d182e
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4d1811
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d184b
lea eax, [ebp - 4]
call fcn.00404358
ret
Function at 0x4d35c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404808
xor eax, eax
push ebp
push 0x4d3640
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004043ac
mov eax, dword [ebp - 4]
call fcn.00404618
mov esi, eax
test esi, esi
jle 0x4d362a
mov ebx, 1
mov eax, edi
call fcn.00404870
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4d360d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3647
lea eax, [ebp - 4]
call fcn.00404358
ret
Function at 0xcb5370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xcb538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xcde074
push ecx
mov edi, eax
call fcn.00cc9198
mov esi, eax
add esp, 8
test esi, esi
jne 0xcb53cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00cc902e
push esi
call fcn.00cc8fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret