joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4400b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x473fd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046796d
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046d003
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0046e51f
test eax, eax
je 0x4401cc
mov ecx, dword [esp + 0x3c]
call fcn.0046d030
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x440190
push edi
mov ecx, esi
call fcn.0046a699
mov ecx, esi
call fcn.00440330
cmp dword [esp + 0x38], 1
jne 0x4401c5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046a7d4
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x442bf0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x442c23
push esi
call fcn.00445d00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x442c1c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x442ca9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x442c92
mov eax, dword [esi + 8]
test eax, eax
je 0x442c47
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x442c8e
cmp eax, 2
je 0x442c92
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x442c3a
cmp eax, 3
je 0x442c6d
cmp eax, 1
jne 0x442c3a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x442c3a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x442c3a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00442cd0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x442cb8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00442cd0
add esp, 4
pop esi
ret
Function at 0x44f6d0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x44f71a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x44f749
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x44f78b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x452fd0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x453073
test eax, eax
jbe 0x453073
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x453073
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45301e
xor esi, esi
jmp 0x453024
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45304f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004071e0
add esi, eax
push esi
mov ebx, esi
call fcn.004071e0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x453030
pop ebp
test edi, edi
pop edi
jne 0x453073
test ebx, ebx
je 0x453073
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00457430
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4531b5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4532cd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4532cd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00467dbf
mov esi, eax
test esi, esi
je 0x4532cd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4532cd
mov ecx, esi
call fcn.00453120
cmp edi, eax
jge 0x4532cd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x453253
mov dword [esp + 0x34], 1
jmp 0x4532ae
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4532cd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00452720
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x468763
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46879b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00466817
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004667ef
jmp 0x4687a7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x469e51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x469e93
call fcn.0046f90f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x469e93
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x469e8a
xor eax, eax
jmp 0x469e9b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00469ea1
pop edi
pop esi
pop ebx
ret 4

Function at 0x46fe3f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46fe6d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46fe8b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046fda5
jmp 0x46fe8b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46fe8b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046fda5
test edi, edi
mov eax, edi
jne 0x46fe75
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xbbe652
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [esp + 4]
xchg esi, ebx
mov ebx, dword [esp]
dec si
lea esp, [esp + 1]
jmp 0xbbe63c

Function at 0xbc66ab
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xbacb53
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xbacb6d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xbacb5c
pop esi
jmp 0xbacb78
ret 4
jmp 0xbacb46

Function at 0xbde835
Capabilities:
Encrypt data using aes

Disassembly:
shl edi, cl
pushal
lea ebx, reloc.RASAPI32.dll_RasHangUpA
jmp 0xbde964
lea esi, [esi + 0xc]
movzx edx, byte [esi]
pop esi
movzx esi, byte [eax + 0xd]
jmp 0xbde852
mov dword [ecx + 8], edx
push esi
mov esi, eax
jmp 0xbde868
Function at 0xbdec90
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0xbdecdc
push esi
mov esi, edi
mov dword [esi], ecx
pop esi
mov edx, 0xd9e3447e
jmp 0xbdecc4
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dh, 0x66
jmp 0xbdece7
add ebx, 4
mov edx, ecx
stc
not dx
jmp 0xbdecb2
push ecx
mov ecx, eax
add ecx, 4
jmp 0xbdecf3
mov edx, dword [ecx]
pop ecx
stc
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0xbded6e
cmc
sub esp, 0x1e
lea esp, [esp + 2]
xor ecx, edx
jmp 0xbded13
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
jmp 0xbded3d

Function at 0xbdee06
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
jmp 0xbdee6c
lea esp, [esp + 2]
jmp 0xbdee47
mov ah, byte [esp]
dec ax
mov eax, dword [edx]
pushal
lea esp, [esp + 0xa]
jmp 0xbdee23
mov dword [edx - 4], edi
mov di, 0x2f75
pushfd
sub esp, 0x11
lea esp, [esp + 1]
jmp 0xbdee9a
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov ah, dh
jmp 0xbdee39
mov dword [edx], edi
push edx
pushal
jmp 0xbdee83
lea eax, [ebx + esi]
xchg bl, dl
mov esi, dword [esp]
mov dword [esp + 0x14], ecx
push ebx
lea esp, [esp + 4]
jmp 0xbdeeb9
mov edi, dword [ecx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
jmp 0xbdee79
mov dword [ecx + 4], eax
jmp 0xbdeec2
popal
lea edx, [edx + 4]
mov edi, dword [edx]
pop edx
jmp 0xbdeea3
push ebp
pushal
xchg cx, ax
xchg ecx, eax
jmp 0xbdef11
mov dword [esp + 8], edx
push edx
lea esp, [esp + 4]
popal
lea ebp, [ebp + 4]
jmp 0xbdeee7
Function at 0xbdf075
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xbdf108
sub esp, 4
jmp 0xbdf09f
movzx ebx, byte [esi + 5]
push si
push word [esp]
and edx, ecx
jmp 0xbdf0b5
lea esp, [esp + 2]
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov ebx, esp
bsr ebx, ebp
jmp 0xbdf0cc

Function at 0xbdf216
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
mov ecx, 0x5bbecc97
mov dword [esp + 0x14], esi
popal
jmp 0xbdf1be
mov bx, ax
neg bh
bsf ebx, esi
pushal
push edx
jmp 0xbdf19c
add edx, 6
movzx ebx, byte [edx]
pop edx
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbdf1f3
lea esp, [esp + 2]
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbdf1b2
push bp
add esp, 0
clc
lea esp, [esp + 2]
and ebx, ecx
jmp 0xbdf2e6
jmp 0xbdf1e0
lea ecx, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [ecx]
pop ecx
jmp 0xbdf23a
push ecx
mov ecx, edx
lea ecx, [ecx*4]
jmp 0xbdf218
and edx, ecx
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbdf2b4
mov edi, ebp
lea edi, [ecx + 0x88]
jmp 0xbdf284
movzx ebx, byte [esi + 9]
sub esp, 0x1a
lea esp, [esp + 2]
and edx, ecx
jmp 0xbdf22e
mov edi, edx
shr edi, 0x18
call 0xbdf26e
push word [esp]
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x15
pop word [esp + 9]
lea esp, [esp + 3]
jmp 0xbdf2c4
mov edx, dword [esi + 8]
pushal
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbdf249
and edi, ecx
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
and ebx, ecx
jmp 0xbdf310
clc
push ecx
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov bh, 0x89
jmp 0xbdf25f
movzx ebx, byte [esi + 0xa]
sub esp, 6
push word [esp + 5]
jmp 0xbdf359
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov ebx, esp
mov bl, ch
mov ebx, dword [esp]
jmp 0xbdf2fa
lea esp, [esp + 2]
jmp 0xbdf3a1
lea esi, reloc.RASAPI32.dll_RasHangUpA
mov ebx, dword [esi]
pop esi
pushfd
push dword [esp + 1]
push word [esp + 4]
jmp 0xbdf324
push esi
mov esi, ebx
lea esi, [esi*4]
jmp 0xbdf33a
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbdf389
setg bl
mov ebx, dword [esp]
movzx ebx, byte [esi + 0xd]
and edx, ecx
jmp 0xbdf365
and edx, ecx
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
cmc
jmp 0xbdf3f9
and ebx, ecx
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov ebx, dword [esp]
jmp 0xbdf37b
mov edi, 0x46ffb667
jmp 0xbdf3de
add eax, 8
mov dword [eax], edi
pop eax
lea edi, [eax + ebp]
lea edi, [esi*4]
jmp 0xbdf3b3
mov ebx, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
btr edi, ebx
jmp 0xbdf427
mov edx, dword [esi + 0xc]
push eax
mov eax, esi
jmp 0xbdf3cc
add esp, 0x18
lea esp, [esp + 1]
lea esp, [esp + 4]
popal
sub esp, 0xe
lea esp, [esp + 2]
jmp 0xbdf452
pushal
lea ecx, [edi*4]
mov dword [esp], edx
sub esp, 0x1b
push word [esp + 0x17]
jmp 0xbdf401
shr edi, 0x18
call 0xbdf43c
push ecx
jmp 0xbdf4ad
pushal
mov dword [esp + 0x18], edi
popal
lea ecx, [ecx*4]
jmp 0xbdf481
Function at 0xbdf4d8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
and ebx, ecx
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0xbdf4f1
jmp 0xbdf4bc
push ecx
pushal
lea ebx, [ecx - 0xcc]
ror edi, 0xd
neg cl
jmp 0xbdf518
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
pushfd
mov dword [esp], edx
jmp 0xbdf4da
popal
jmp 0xbdf556
add di, 0xa8c1
mov dword [esp + 0x18], esi
sub esp, 0x1b
pushfd
lea esp, [esp + 3]
lea esp, [esp + 0x1c]
jmp 0xbdf502

Function at 0xbdf7bd
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esi + 0xc], edi
jmp 0xbdf5bf
and edx, ecx
xor edi, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
dec dword [ebp - 4]
jmp 0xbdf585
jne 0xbab053
je 0xbab005
and ebx, ecx
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + reloc.RASAPI32.dll_RasHangUpA]
jmp 0xbdf59b
mov edx, dword [edx*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x1f
push cx
lea esp, [esp + 0x1a]
lea esp, [esp + 3]
jmp 0xbdf635
lea esp, [esp + 3]
and edx, ecx
jmp 0xbdf683

Function at 0xcab1d5
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp + 1]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0xcab21c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xcab203
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x4013d0
Capabilities:
Inspect load icon resource

Disassembly:
push 0x585cc8
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [0x58e990]
mov eax, dword [eax*4 + 0x585cb4]
mov ecx, dword [esp + 4]
movzx edx, ax
push edx
push 0
mov dword [0x585cdc], 0
mov dword [0x585ccc], ecx
mov dword [0x585cd8], 0x2b10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401423
jmp fcn.004014f0
ret

Function at 0x4015e0
Capabilities:
Inspect load icon resource

Disassembly:
movzx ecx, word [esp + 4]
push ecx
push 0
mov dword [0x585ccc], eax
mov dword [0x585cd8], 0x2b10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x401614
xor edx, edx
test eax, eax
setne dl
mov al, dl
ret 4
call fcn.004014f0
xor edx, edx
test eax, eax
setne dl
mov al, dl
ret 4
Function at 0x4074a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x248
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x240], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x42]
push ecx
mov word [esp + 0x44], ax
call fcn.004ff6c0
add esp, 0xc
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4074e0
mov eax, dword [esi + 8]
add eax, 4
push eax
lea edx, [esp + 0x3c]
push 0x104
push edx
call fcn.004fa6de
add esp, 0xc
lea eax, [esp + 0x38]
push 0x5c
push eax
call fcn.004fcabf
add esp, 8
test eax, eax
jne 0x407541
cmp byte [esi + 0x11c], al
je 0x407516
add esi, 0xc
jmp 0x407519
mov esi, dword [esi + 8]
add esi, 4
push esi
push 0x55c034
push edi
call fcn.00409a40
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004fa259
add esp, 0x248
ret
xor ecx, ecx
lea edx, [esp + 8]
mov word [eax], cx
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.004fc6e4
add esp, 8
test eax, eax
je 0x4075b9
push 0
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407596
lea edx, [esp + 0x38]
push edx
push 0x55c048
push edi
call fcn.00409a40
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004fa259
add esp, 0x248
ret
push 0x10000000
lea eax, [esp + 0x3c]
push 1
push eax
call fcn.004134f0
add esp, 0xc
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.00413890
add esp, 8
mov ecx, dword [esp + 0x244]
pop esi
xor ecx, esp
mov al, 1
call fcn.004fa259
add esp, 0x248
ret
Function at 0x40b890
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x522c3b
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x581500]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x581500]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x13a]
push ecx
mov esi, edx
mov word [esp + 0x13c], ax
call fcn.004ff6c0
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40b93d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00409990
mov esi, eax
push 0x55cef4
push 0x55d15c
mov edx, esi
call fcn.00411e80
push edi
push 0x55db48
mov edx, esi
call fcn.00411e80
add esp, 0x10
xor al, al
jmp 0x40b9eb
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b947
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x40b989
lea eax, [esp + 0x130]
lea edx, [eax + 2]
jmp 0x40b970
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b970
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.004114e0
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.00411710
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x40b9b4
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.00411710
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x40b9e9
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x40b9e9
push eax
call fcn.004faac5
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004fa259
add esp, 0x33c
ret