joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a19a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ce7a1
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x4a19dd
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004c6345
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.004c568d
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.0049a960
lea ecx, [esp + 8]
call fcn.004c65b4
lea ecx, [esp + 0x30]
call fcn.004c57f1
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.004c568d
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.0049add0
lea ecx, [esp + 0x74]
call fcn.004c57f1
lea ecx, [esp + 8]
call fcn.004c65b5
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.00498600
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.0049a900
mov ecx, esi
call fcn.0049b410
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.0049a900
mov ecx, esi
call fcn.0049b410
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.0049a900
mov ecx, esi
call fcn.0049b410
mov ecx, dword [edi + 0x5c]
call fcn.00497de0
push eax
mov ecx, esi
call fcn.00497df0
mov ecx, dword [edi + 0x5c]
call fcn.004983a0
push eax
mov ecx, esi
call fcn.00498340
mov ecx, dword [edi + 0x5c]
call fcn.004984c0
push eax
mov ecx, esi
call fcn.00498470
mov ecx, dword [edi + 0x5c]
push 0
call fcn.004976c0
push eax
mov ecx, esi
call fcn.004976d0
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.004c5769
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.004c5769
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.004c63ce
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x4a3240
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ce9c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004bc790
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004bc790
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004a3d60
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x4a3db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ceaa0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004c8338
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x4a3de3
xor al, al
jmp 0x4a3f0f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x4a3e05
xor al, al
jmp 0x4a3f0f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x4a3e18
xor al, al
jmp 0x4a3f0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x4a3e2c
xor al, al
jmp 0x4a3f0f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004bc855
test eax, eax
jne 0x4a3e60
xor al, al
jmp 0x4a3f0f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x4e031c
mov dword [esp + 0x20], ebp
call fcn.004c8338
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004c5342
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004c5399
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x4a3ef4
mov ax, word [ebx]
test ax, ax
je 0x4a3ee6
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.004a3f30
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4a3eca
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004c5399
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x4a4430
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004c69f2
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4a4476
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004adae8
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x4fe178
push ecx
call fcn.004af70f
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x4a52d0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4a5373
test eax, eax
jbe 0x4a5373
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4a5373
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4a531e
xor esi, esi
jmp 0x4a5324
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4a534f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0042d070
add esi, eax
push esi
mov ebx, esi
call fcn.0042d070
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4a5330
pop ebp
test edi, edi
pop edi
jne 0x4a5373
test ebx, ebx
je 0x4a5373
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004ae570
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4a5495
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4a55ad
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a55ad
mov eax, dword [esi + 0x3c]
push eax
call fcn.004bff65
mov esi, eax
test esi, esi
je 0x4a55ad
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4a55ad
mov ecx, esi
call fcn.004a5420
cmp edi, eax
jge 0x4a55ad
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4a5533
mov dword [esp + 0x34], 1
jmp 0x4a558e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4a55ad
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004a49d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4c0908
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c0940
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004be983
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004be95b
jmp 0x4c094c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c2104
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c2146
call fcn.004c8338
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c2146
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c213d
xor eax, eax
jmp 0x4c214e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c2154
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c8868
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c8896
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c88b4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c87ce
jmp 0x4c88b4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c88b4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c87ce
test edi, edi
mov eax, edi
jne 0x4c889e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x409280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40928f
pop dword [ebp - 0x38]
mov eax, 0x40928f
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x5b84afb7
add dword [ebp - 0x48], 0xf2cd9594
mov dword [ebp - 0x44], 0x279b77bc
sub dword [ebp - 0x44], 0xf5682b77
mov dword [ebp - 0x40], 0x60d75b4e
sub dword [ebp - 0x40], 0x148b1720
mov dword [ebp - 0x3c], 0x629a77a3
add dword [ebp - 0x3c], 0x9d65885d
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xe5dceeed
add dword [ebp - 0x48], 0x8e957a69
mov dword [ebp - 0x44], 0xc7801f7d
add dword [ebp - 0x44], 0x79ec41f8
mov dword [ebp - 0x40], 0x840e40de
add dword [ebp - 0x40], 0xdf612b8e
mov dword [ebp - 0x3c], 0xba1cb1de
add dword [ebp - 0x3c], 0x45e34e22
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x42e549f5
sub eax, 0x42a3f9a9
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3b775
push 0
call eax
mov ecx, 0x4c88
mov edx, eax
mov edi, 0xb00501c8
sub edi, 0xafc30dc8
add edi, dword [ebp - 0x38]
mov esi, 0xbf374e6f
add esi, 0x2e90429b
mov dword [ebp - 0x2c], 0x6f3aea1b
mov ebx, dword [edi]
add dword [ebp - 8], 0xf5c29039
add ebx, esi
xor dword [ebp - 0x10], 0x9b04f1f8
mov dword [edx], ebx
add dword [ebp - 4], edi
add edx, 0x873b40db
sub edx, 0x873b40d7
add edi, 4
loop 0x4093a1
add eax, 0x4098a650
add eax, 0xbf687ea3
xor ebx, ebx
add ebx, eax
add eax, 0x89ca9116
sub eax, 0x89ca9111
mov ecx, 0x67fb8906
add ecx, 0x984476fa
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40f197
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a16b
mov dword [ebp - 0x14], eax
cmp dword [0x43093c], esi
jne 0x40f28a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f217
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f36a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f36a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f36a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43093c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x430940], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x430944], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43094c], eax
test eax, eax
je 0x40f287
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x430948], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2af
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2a2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push 4
pop eax
jmp 0x40f36c
cmp dword [ebp - 0x14], esi
je 0x40f2c4
push dword [0x43093c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2a9
mov eax, dword [0x430948]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f322
cmp dword [0x43094c], edi
je 0x40f322
push eax
call ebx
push dword [0x43094c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f322
test eax, eax
je 0x40f322
call ecx
test eax, eax
je 0x40f317
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f317
test byte [ebp - 8], 1
jne 0x40f322
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f352
mov eax, dword [0x430940]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
call eax
mov esi, eax
test esi, esi
je 0x40f34f
mov eax, dword [0x430944]
cmp eax, edi
je 0x40f34f
push eax
call ebx
test eax, eax
je 0x40f34f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43093c]
call ebx
test eax, eax
je 0x40f36a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f36c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040482b
mov esp, ebp
pop ebp
ret
Function at 0xd14058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d141a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd1407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd1406a
add dl, dl
jne 0xd14089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd140dc
xor eax, eax
add dl, dl
jne 0xd14096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd1417d
add dl, dl
jne 0xd140a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd140b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd140bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd140c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd140d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd14075
mov eax, 1
add dl, dl
jne 0xd140ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd140f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd140e1
sub eax, ebx
mov ebx, 1
jne 0xd14128
mov ecx, 1
add dl, dl
jne 0xd1410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd14119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd14105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd14075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd1413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd1414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd14136
cmp eax, 0x7d00
jae 0xd1416d
cmp eax, 0x500
jb 0xd14168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd14075
cmp eax, 0x7f
ja 0xd14170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd14075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd1419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd14075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401c66
pop dword [ebp - 0x48]
mov eax, 0x401c66
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5bccedc5
add dword [ebp - 0x58], 0xf2855786
mov dword [ebp - 0x54], 0x3865e390
sub dword [ebp - 0x54], 0x632974b
mov dword [ebp - 0x50], 0xb83784f8
sub dword [ebp - 0x50], 0x6beb40ca
mov dword [ebp - 0x4c], 0x2d0d53ee
sub dword [ebp - 0x4c], 0x2d0d53ee
lea eax, [ebp - 0x58]
push eax
mov eax, 0xa486ba1
add eax, 0xf5f7c4b3
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6c8f093b
add dword [ebp - 0x58], 0x7e3601b
mov dword [ebp - 0x54], 0x8d343227
add dword [ebp - 0x54], 0xb4382f4e
mov dword [ebp - 0x50], 0x6cee2ecb
add dword [ebp - 0x50], 0xf6813da1
mov dword [ebp - 0x4c], 0xa9daeabe
add dword [ebp - 0x4c], 0x56251542
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xaafb8bf1
sub eax, 0xaabb5bc5
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3870a
push 0
call eax
mov ecx, 0x4fd6
xor edx, edx
add edx, eax
mov edi, 0x5d47c548
add edi, 0xa2f8aab8
add edi, dword [ebp - 0x48]
mov esi, 0x7b48ae7e
mov dword [ebp - 0x30], 0x7e34737c
mov ebx, dword [edi]
xor dword [ebp - 0x40], ebx
add ebx, esi
xor dword [ebp - 0x2c], 0x654779f7
mov dword [edx], ebx
sub dword [ebp - 4], ecx
add edx, 0x47f32688
add edx, 0xb80cd97c
add edi, 0x38bf75a8
sub edi, 0x38bf75a4
loop 0x401d79
add eax, 0x313769f8
add eax, 0xcec9c833
xor ebx, ebx
add ebx, eax
add eax, 0x191e9c10
sub eax, 0x191e9c0b
mov ecx, 0xda166f03
sub ecx, 0xd9d66f03
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x405699
Capabilities:
Resolve function by hash

Disassembly:
mov eax, dword fs:[0x30]
test eax, eax
js 0x4056af
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebx, dword [eax + 8]
jmp 0x4056b8
mov eax, dword [eax + 0x34]
mov ebx, dword [eax + 0xb8]
pop esi
add esi, 3
push ebx
mov edx, 0xec0e4e8e
call esi
push eax
mov edx, 0x7c0dfcaa
call esi
push eax
push edi
mov edx, 0x4ee4a045
call esi
xor edx, edx
push edx
push 0x6d756369
push 0x6c656167
push esp
push edx
push edx
call eax
push eax
mov edx, 0x75da1966
call esi
call eax
xchg edi, eax
mov edx, 0xffd97fb
call esi
call eax
cmp edi, 0xb7
jne 0x405707
mov esp, ebp
popal
ret
call fcn.00405728
sti
xchg edi, eax
std
pcmpeqd mm5, qword [ebp - 0x50]
inc ebp
jb 0x405714
mov bl, 0x16
mov eax, dword [0xd2d83d6a]
invalid

Function at 0x405d63
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x405d7c
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x405d8a
dec eax
jmp 0x405d8a
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x405d94
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x405e1b
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x405dd2
cmp byte [ebx], 0x2e
je 0x405e02
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.00405d63
pop esi
jmp 0x405e02
push ebx
call dword [edi + 0x30]
push eax
call 0x405de1
js 0x405e45
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x405e02
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.00405e1d
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x405db1
push esi
call dword [edi + 0x40]
leave
ret
jae 0x405eb2
jb 0x405eb7
insb byte es:[edi], dx
js 0x405eb3
invalid