joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008f950
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100e0610
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x1008f999
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x1008f999
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x1008f980
mov ecx, dword [esp + 0x2c]
movzx edx, byte [ecx + 0xc]
movzx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x1008fa68
mov edi, ecx
nop dword [eax + eax]
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x1008fa46
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x1008fa30
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x1008f9d0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x1008fad6
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ecx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x1008fab7
push edx
call fcn.1008fb20
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x1008fac4
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100900f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100e0610
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x1009010f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x100901d9
jb 0x10090134
test eax, eax
jne 0x100901d9
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [ebp + 0x16c]
mov dword [ebp + 0x34], ecx
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x30], eax
test edi, edi
je 0x10090185
nop dword [eax]
test esi, esi
je 0x1009016a
mov al, byte [ebx]
lea ecx, [ebp + 0x40]
xor byte [ecx + edi], al
inc ebx
inc edi
mov dword [esp + 0x18], ecx
dec esi
and edi, 0xf
jne 0x10090150
jmp 0x10090172
mov dword [esp + 0x18], ecx
test edi, edi
jne 0x100901cb
lea eax, [ebp + 0x60]
push eax
push ecx
call fcn.10091800
mov ecx, dword [esp + 0x20]
add esp, 8
jmp 0x10090189
mov dword [esp + 0x18], ecx
mov eax, esi
lea edx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x100901ab
push eax
push ebx
push edx
push ecx
call fcn.100915d0
add ebx, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x100901cb
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x100901cb
mov edx, dword [esp + 0x18]
nop dword [eax + eax]
mov al, byte [ecx + ebx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, esi
jb 0x100901c0
mov dword [ebp + 0x16c], edi
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x100913a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.100e0610
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x1009140c
mov eax, dword [esp + 0x20]
mov ebx, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x10091549
mov dword [esi + 0x40], 0
lea edx, [esi + 0x60]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x4c], 0
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [esp + 0x24]
push edi
lea edi, [esi + 0x40]
cmp ebx, 0x10
jb 0x100914af
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov esi, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], eax
mov eax, ecx
lea edx, [ebp + 1]
mov edi, 4
nop dword [eax]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub edi, 1
jne 0x10091460
push dword [esp + 0x14]
push esi
call fcn.10091800
mov ecx, dword [esp + 0x20]
add esp, 8
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0x2c], 1
jne 0x10091453
mov esi, dword [esp + 0x24]
lea edi, [esi + 0x40]
lea edx, [esi + 0x60]
test ebx, ebx
je 0x100914d5
xor ecx, ecx
test ebx, ebx
je 0x100914cb
nop dword [eax]
mov al, byte [ecx + ebp]
xor byte [edi + ecx], al
inc ecx
cmp ecx, ebx
jb 0x100914c0
push edx
push edi
call fcn.10091800
add esp, 8
mov edx, dword [esp + 0x1c]
xor ebx, ebx
shld ebx, edx, 3
xor byte [esi + 0x4b], bl
mov eax, ebx
shl edx, 3
xor byte [esi + 0x4f], dl
mov ecx, edx
shrd ecx, eax, 0x18
xor byte [esi + 0x4c], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
xor byte [esi + 0x4d], cl
shrd eax, ebx, 8
xor byte [esi + 0x4e], al
lea eax, [esi + 0x60]
push eax
push edi
call fcn.10091800
movzx ebx, byte [esi + 0x4c]
add esp, 8
movzx eax, byte [esi + 0x4d]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 0x4f]
shl ebx, 8
or ebx, eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x4c]
pop edi
mov dword [esi + 0xc], eax
pop ebp
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
inc ebx
add esp, 0xc
mov eax, ebx
mov byte [esi + 0xf], bl
shr eax, 0x18
mov byte [esi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [esi + 0xe], al
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10099b40
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x10099bbf
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10099b90
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.10080c70
add esp, 0x10
cmp dword [esp + 0x24], 0xffffffff
je 0x10099b90
push 0
push 0
push 0x66
push 0x10a
push 0x10
call fcn.100559f0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
ret
test esi, esi
je 0x10099b75
cmp edi, 0x40a
je 0x10099bb4
cmp edi, 0x43f
je 0x10099bb4
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10099bb9
mov eax, 0x20
cmp dword [esp + 0x20], eax
jne 0x10099b75
push ebx
push 0
push 0x1010936d
push 0x40
call fcn.10052770
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10099bf1
push eax
push eax
push 0x41
push 0x10a
push 0x10
call fcn.100559f0
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x10099c08
push dword [esp + 0x24]
push esi
push ebx
call fcn.100e2d40
add esp, 0xc
jmp case.0x10099d32.1036
cmp edi, 0x40a
je 0x10099c28
cmp edi, 0x43f
je 0x10099c28
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10099c2d
mov eax, 0x20
push 0
push 0x1010936d
push eax
call fcn.10052ca0
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x10099c5b
push eax
push eax
push 0x41
push 0x10a
push 0x10
call fcn.100559f0
add esp, 0x14
jmp 0x10099cae
cmp ebp, 2
jne 0x10099ced
cmp edi, 0x40a
je 0x10099c84
cmp edi, 0x43f
je 0x10099c84
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10099c89
mov eax, 0x20
push eax
push esi
call fcn.1005f560
add esp, 8
test eax, eax
jg 0x10099cc5
push 0
push 0x1010936d
push esi
call fcn.10052c90
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0
push 0x1010936d
push ebx
call fcn.10052570
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
cmp edi, 0x40a
jne 0x10099cdc
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
jmp 0x10099d20
cmp edi, 0x40b
jne 0x10099d20
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x10099d20
cmp edi, 0x40a
je 0x10099d0d
cmp edi, 0x43f
je 0x10099d0d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10099d12
mov eax, 0x20
push eax
push dword [esp + 0x24]
push esi
call fcn.100e2d40
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x10099d32.1036
movzx eax, byte [eax + 0x10099d8c]
jmp dword [eax*4 + 0x10099d78]
push esi
push ebx
call fcn.100b93c0
jmp 0x10099d5b
push esi
push ebx
call fcn.100b8ef0
jmp 0x10099d5b
push esi
push ebx
call fcn.100c4980
jmp 0x10099d5b
push esi
push ebx
call fcn.100c6b70
add esp, 8
push ebx
push edi
push dword [esp + 0x1c]
call fcn.10058c50
add esp, 0xc
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100a37e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.100209f0
add esp, 4
cmp eax, 0x72
jne 0x100a3959
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov edi, eax
push esi
push dword [esp + 0x28]
and eax, 1
shr edi, 1
push dword [esp + 0x28]
push dword [esp + 0x28]
lea ebp, [eax + edi]
push ebp
push dword [esp + 0x28]
call fcn.10060f30
push eax
call fcn.100a3580
add esp, 0x1c
test eax, eax
je 0x100a397e
push ebx
push 0
push 0x1010936d
push esi
call fcn.10052540
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x100a3861
push eax
push eax
push 0x41
push 0x6f
push 0x34
call fcn.100559f0
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x2c]
add eax, edi
push dword [esp + 0x2c]
push ebp
push eax
call fcn.10061540
push eax
call fcn.100a3580
add esp, 0x1c
test eax, eax
jne 0x100a389c
push eax
push 0x1010936d
push esi
push ebx
call fcn.10052630
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
xor edi, edi
test esi, esi
je 0x100a393e
mov edx, dword [esp + 0x28]
cmp esi, 0x40
jb 0x100a391d
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x100a38c1
cmp ecx, ebx
jae 0x100a391d
mov ecx, esi
mov ebp, ebx
and ecx, 0xffffffc0
mov eax, edx
sub ebp, edx
nop dword [eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ebx + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ebx + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x100a38d0
cmp edi, esi
jae 0x100a393e
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x100a3930
push 0
push 0x1010936d
push esi
push ebx
call fcn.10052630
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call fcn.100a3580
add esp, 0x1c
test eax, eax
jne 0x100a3984
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x100b1fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100e0610
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0x10
lea eax, [edx + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x100b1ff4
cmp ecx, edx
jb 0x100b1ff4
push edi
mov ecx, esi
sub edx, esi
mov edi, 0x10
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x100b1fe3
pop edi
jmp 0x100b2001
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push 0x10
push esi
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x18]
push esi
push dword [eax + 4]
call fcn.10058380
add esp, 0x14
pop esi
test eax, eax
je 0x100b202b
cmp dword [esp], 0x10
jne 0x100b202b
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x100b2170
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x100b21d3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x100b21d3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xc]
cmp edx, eax
mov ebx, eax
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x100b21a6
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x10], al
inc ecx
cmp ecx, ebx
jb 0x100b2197
mov eax, dword [edi + 0xc]
cmp edx, eax
jbe 0x100b21d1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor ecx, ecx
test edx, edx
je 0x100b21d1
nop dword [eax]
mov eax, dword [edi + 0xc]
add eax, ecx
mov al, byte [eax + esi]
xor byte [edi + ecx + 0x30], al
inc ecx
cmp ecx, edx
jb 0x100b21c0
pop edi
pop ebx
pop esi
ret
Function at 0x100ca300
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100ca39d
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100ca321
cmp al, 0x6b
jne 0x100ca39d
inc ecx
cmp al, 0x6b
jne 0x100ca365
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x100ca342
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x100ca342
cmp dl, 0xbb
jne 0x100ca348
inc eax
cmp eax, esi
jl 0x100ca330
sub esi, eax
test eax, eax
jne 0x100ca368
push 0
push 0
push 0x8a
push 0x80
push 4
call fcn.100559f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x100ca38b
push 0
push 0
push 0x8b
push 0x80
push 4
call fcn.100559f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.100e2d40
add esp, 0xc
mov eax, esi
pop esi
ret
push 0
push 0
push 0x89
push 0x80
push 4
call fcn.100559f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100fdd2d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100fdbac

Function at 0x100ff912
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ff5d2
Function at 0x43666f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x449a48
cmp edx, dword [eax]
je 0x436691
add eax, 8
inc ecx
cmp eax, 0x449ad8
jl 0x436682
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x449a48]
jne 0x4367bf
mov eax, dword [0x44a498]
cmp eax, 1
je 0x436799
test eax, eax
jne 0x4366c2
cmp dword [0x447144], 1
je 0x436799
cmp edx, 0xfc
je 0x4367bf
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4366f9
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004380f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00433cf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43673c
lea eax, [ebp - 0x1a4]
push eax
call fcn.00433cf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43d56c
push edi
call fcn.00430a40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004380f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00438100
lea eax, [ebp - 0xa0]
push 0x43d54c
push eax
call fcn.00438100
push dword [esi + 0x449a4c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00438100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00438c04
add esp, 0x2c
pop edi
jmp 0x4367bf
lea eax, [ebp + 8]
lea esi, [esi + 0x449a4c]
push 0
push eax
push dword [esi]
call fcn.00433cf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x45a000
Capabilities:
Encode data using xor

Disassembly:
dec eax
xor esi, esi
dec ecx
mov esp, esp
inc eax
mov dh, 0x40
inc cx
and esp, 0xd8dafa90
dec ecx
fxsave [esp]
dec eax
mov ebx, 0xdc026f5f
sbb dh, 0x68
test al, 0x49
add esp, 8
dec ebp
mov eax, dword [esp]
dec eax
dec esi
dec ecx
xor dword [eax + esi*8 + 0x26], ebx
dec eax
test esi, esi
jne 0x45a028
mov dword [0x70388127], eax
movsb byte es:[edi], byte ss:[esi]
test al, 0x5f
outsd dx, dword [esi]
inc ebx
invalid
Function at 0x40707c
Capabilities:
Set registry value

Disassembly:
mov eax, 0x43b7a5
call fcn.00439f7c
sub esp, 0x94
push ebx
push esi
push edi
push 0xf
xor ebx, ebx
pop edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
mov byte [ebp - 4], 1
push 0x12
push str.SoftwareGGSQGNA_
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
call fcn.004031b4
push 2
lea ecx, [ebp - 0x9c]
pop edx
lea esi, [ebp - 0x18]
call fcn.004064d9
push ebx
push 1
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 2
call fcn.004027c9
push 7
push str.InstKey
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.004031b4
mov dword [ebp - 0x10], 0xac3
cmp byte [ebp - 0x14], bl
je 0x40713a
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x407127
lea eax, [ebp - 0x38]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push ebx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.004027c9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00406add
test al, al
je 0x4071b2
cmp dword [ebp - 0x44], ebx
jbe 0x40719e
push 3
push 0x4405a8
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.004031b4
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x18]
call fcn.00406537
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.004027c9
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x54]
push eax
add ecx, 0xc
call fcn.0040311b
cmp dword [ebp - 0x70], ebx
jbe 0x4071b2
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 8]
call fcn.00406bfe
mov dword [ebp - 0x1c], eax
sub esp, 0x10
mov dword [ebp - 0x10], esp
mov esi, esp
push ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x10], esp
call fcn.00403399
mov eax, dword [ebp + 8]
add eax, 8
push 0xaba
push eax
mov dword [ebp + 8], eax
call fcn.0040505a
push ecx
mov dword [ebp - 0x10], esp
lea esi, [ebp - 0x64]
mov dword [ebp - 0x10], esp
call fcn.00403399
mov byte [ebp - 4], 3
push 6
push str.STATUS
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.004031b4
push dword [ebp - 0x1c]
lea eax, [ebp - 0x38]
push eax
mov edi, esi
mov byte [ebp - 4], 4
call fcn.00401949
push ebx
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.004027c9
sub esp, 0x10
mov dword [ebp - 0x10], esp
push esp
mov ecx, esi
call fcn.00407482
push 0xa85
push dword [ebp + 8]
call fcn.0040505a
mov eax, esi
push eax
mov byte [ebp - 4], 2
call fcn.0040191a
cmp byte [ebp - 0x14], bl
je 0x40725b
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004027c9
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.004027c9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x40870f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b6d0
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
push edi
push 0x440a34
mov esi, ecx
mov edi, dword [esi]
push 0x65
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x408753
push eax
lea ebx, [esi + 0x1c]
push edi
call fcn.0040abd1
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x408927
mov ecx, dword [eax + 8]
and dword [eax + 8], 0
test ecx, ecx
jne 0x408927
push esi
mov dword [esi + 0x14], 0xb2
mov dword [esi + 0x18], 0xec
call fcn.00408956
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov eax, ebx
cdq
sub eax, edx
fmul qword [0x440ac8]
mov ebx, eax
mov eax, dword [esi + 0x14]
cdq
sub eax, edx
sar eax, 1
sar ebx, 1
sub ebx, eax
call fcn.00439ed0
and dword [esp + 0x24], 0
mov ecx, eax
mov eax, dword [esi + 0x18]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [esp + 0x10]
cdq
neg edi
sub eax, edx
sub edi, ecx
push 0x1c
sar eax, 1
push 0x440608
lea ecx, [esp + 0x1c]
add edi, eax
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], 0
call fcn.004031b4
and dword [esp + 0x11c], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00408d54
push 0
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x124], 2
call fcn.004027c9
push 1
push 3
lea ecx, [esp + 0x70]
call fcn.00409501
mov byte [esp + 0x11c], 3
cmp dword [esp + 0x44], 8
mov eax, dword [esp + 0x30]
jae 0x408844
lea eax, [esp + 0x30]
push 0x440628
push ecx
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0040a8fd
add esp, 0xc
push eax
call fcn.0040a8fd
pop ecx
pop ecx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x6c]
call fcn.004095b3
cmp dword [eax + 0x14], 8
jb 0x40887b
mov ecx, dword [eax]
jmp 0x40887d
mov ecx, eax
xor eax, eax
push eax
push dword [esi]
push eax
push eax
push dword [esi + 0x18]
push dword [esi + 0x14]
push edi
push ebx
push SysReAllocString
push ecx
push str.Thistle
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 1
lea ecx, [esp + 0x54]
mov dword [esi + 4], eax
call fcn.0040579d
call fcn.004089d6
push esi
call fcn.00408bf1
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x48]
sub eax, dword [esi + 0x44]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4088f5
push 0x408675
push 0xbb8
push 0x401
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
add esi, 0x58
push esi
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
add esi, 8
push esi
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
lea ecx, [esp + 0x68]
mov byte [esp + 0x11c], 2
call fcn.0040893c
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.0040579d
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret