joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cf3
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x401d04
push 0xd
pop eax
jmp 0x401d2e
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x401d07
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4022d1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x40c150]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.00407701
mov ebx, eax
cmp ebx, esi
je 0x402344
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ab9
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40235c
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.004022d1
cmp eax, esi
jne 0x40238e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x40234c
lea ecx, [ebp - 0x74]
call fcn.00401080
push dword [ebp - 0x78]
mov ecx, edi
call fcn.00401be8
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00401080
mov eax, esi
jmp 0x40232a
Function at 0x40531b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x40c150]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
mov eax, dword [ebp + 0x7b0]
push esi
push 0x20019
xor esi, esi
push str.SOFTWAREJavaSoftJava_Plug_in
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x64], 0x800
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
call fcn.00407701
test eax, eax
je 0x405390
lea ecx, [ebp - 0x74]
call fcn.00401080
mov ecx, dword [ebp + 0x7a4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00406ab9
add ebp, 0x7a8
leave
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x60], esi
push esi
jmp 0x4053d2
lea eax, [ebp - 0x5c]
push eax
call fcn.00404e2f
inc dword [ebp - 0x60]
pop ecx
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x64], 0x800
push dword [ebp - 0x74]
call edi
cmp eax, esi
je 0x4053ac
pop edi
cmp eax, 0x103
jne 0x4053ea
mov dword [ebp - 0x68], 1
lea ecx, [ebp - 0x74]
call fcn.00401080
lea eax, [ebp - 0x5c]
push eax
push 0x40a108
push dword [ebp + 0x7b4]
push dword [ebp - 0x78]
call dword [sym.imp.MSVCR100.dll_sprintf_s]
mov esi, dword [ebp - 0x68]
add esp, 0x10
jmp 0x405370

Function at 0x406ab9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c150]
jne 0x406ac3
repz ret
jmp fcn.00407026
Function at 0x406fac
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40abd0
call fcn.00406fc0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x40c5f4], ebx
jne 0x406d47
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x40c5f0
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x406d81
cmp eax, esi
jne 0x406d74
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x406d84
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x406d5b
xor esi, esi
inc esi
mov eax, dword [0x40c5ec]
cmp eax, esi
jne 0x406d97
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x406dd2
mov eax, dword [0x40c5ec]
test eax, eax
jne 0x406dcc
mov dword [0x40c5ec], esi
push 0x40821c
push 0x408210
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x406dd2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x406eec
mov dword [0x40c274], esi
mov eax, dword [0x40c5ec]
cmp eax, esi
jne 0x406df6
push 0x40820c
push 0x4081f4
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x40c5ec], 2
cmp dword [ebp - 0x24], ebx
jne 0x406e03
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40c5f8], ebx
je 0x406e24
push 0x40c5f8
call fcn.00407701
pop ecx
test eax, eax
je 0x406e24
push ebx
push 2
push ebx
call dword [0x40c5f8]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406e7d
cmp al, bl
je 0x406e3d
cmp dword [ebp - 0x1c], ebx
jne 0x406e7d
mov al, byte [esi]
cmp al, bl
je 0x406e4d
cmp al, 0x20
ja 0x406e4d
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406e3d
test byte [ebp - 0x40], 1
je 0x406e59
movzx eax, word [ebp - 0x3c]
jmp 0x406e5c
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x40c270], eax
cmp dword [0x40c264], ebx
jne 0x406ed2
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x406e8c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x406e9f
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406e2b
cmp dword [0x40c274], ebx
jne 0x406ee0
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c270]
call fcn.00407005
ret
call fcn.00407701
jmp 0x406d19
Function at 0x407701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407710
pop dword [ebp - 0x28]
mov eax, 0xdcabfc57
sub eax, 0xdc6b8547
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5ca8d290
sub dword [ebp - 0x38], 0xe568d45
mov dword [ebp - 0x34], 0x3abf57b5
sub dword [ebp - 0x34], 0x88c0b70
mov dword [ebp - 0x30], 0xea79a355
sub dword [ebp - 0x30], 0x9e2d5f27
mov dword [ebp - 0x2c], 0x440f5391
sub dword [ebp - 0x2c], 0x440f5391
lea eax, [ebp - 0x38]
push eax
mov eax, 0x4548f80c
sub eax, 0x450877f8
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x584d2711
sub dword [ebp - 0x38], 0xe3dabdbb
mov dword [ebp - 0x34], 0x921b1a40
add dword [ebp - 0x34], 0xaf514735
mov dword [ebp - 0x30], 0x44df287c
add dword [ebp - 0x30], 0x1e9043f0
mov dword [ebp - 0x2c], 0x357354f8
add dword [ebp - 0x2c], 0xca8cab08
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x232bd3c
sub eax, 0x1f23d2c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38a44
push 0
call eax
mov ecx, 0x5af5eebf
sub ecx, 0x5af5a0d3
xor ebx, ebx
add ebx, eax
mov esi, 0xc22d5251
add esi, 0x3e1399af
add esi, dword [ebp - 0x28]
mov edi, 0x4b9c7b01
add edi, 0xdcbe0382
sub dword [ebp - 0xc], 0x16db10e2
mov edx, dword [esi]
xor dword [ebp - 0x10], 0x6cd165be
xor edx, edi
sub dword [ebp - 0x10], 0x8eea784e
mov dword [ebx], edx
add dword [ebp - 0x20], 0xb70df217
add ebx, 0xec2cdfa
add ebx, 0xf13d320a
add esi, 0x4da363fe
add esi, 0xb25c9c06
loop 0x407834
add eax, 0x9ba88ce8
sub eax, 0x9ba76265
xor ebx, ebx
add ebx, eax
add eax, 0x266dde82
add eax, 0xd9922183
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4058bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4058cc
pop dword [ebp - 0x38]
mov eax, 0x4058cc
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x21c31a17
add dword [ebp - 0x48], 0x2c8f2b34
mov dword [ebp - 0x44], 0xcde50aa2
sub dword [ebp - 0x44], 0x9bb1be5d
mov dword [ebp - 0x40], 0x87690e6c
sub dword [ebp - 0x40], 0x3b1cca3e
mov dword [ebp - 0x3c], 0x5dc2316e
sub dword [ebp - 0x3c], 0x5dc2316e
lea eax, [ebp - 0x48]
push eax
mov eax, 0x5e420015
sub eax, 0x5e012fc1
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x37a21164
sub dword [ebp - 0x48], 0xc32fa80e
mov dword [ebp - 0x44], 0xebeeaa1a
sub dword [ebp - 0x44], 0xaa8248a5
mov dword [ebp - 0x40], 0x7d04582d
sub dword [ebp - 0x40], 0x1994ebc1
mov dword [ebp - 0x3c], 0x865b4151
sub dword [ebp - 0x3c], 0x865b4151
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xb8be8381
add eax, 0x47824ccb
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d6a4
push 0
call eax
mov ecx, 0x2dbebdf7
sub ecx, 0x2dbe667e
xor esi, esi
add esi, eax
mov edi, 0xc474cea2
sub edi, 0xc4331ea2
add edi, dword [ebp - 0x38]
mov edx, 0xb711379a
sub dword [ebp - 4], edi
mov ebx, dword [edi]
xor dword [ebp - 0x2c], 0x60c188d7
sub ebx, edx
mov dword [ebp - 0x14], 0x7f6e1a3a
mov dword [esi], ebx
add dword [ebp - 0x28], 0xbeeb87f0
add esi, 0x7403570d
add esi, 0x8bfca8f7
add edi, 4
loop 0x4059e5
add eax, 0x7c698009
sub eax, 0x7c682f52
mov ebx, eax
add eax, 0xc40214b3
add eax, 0x3bfdeb52
mov ecx, 0xd34e2efb
add ecx, 0x2cf1d105
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x100695e2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10069621
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10069621
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10069621
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10069621
cmp dword [ecx + 0x74], 0xe
jbe 0x10069621
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1006c0ed
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1006c18a
push ebx
push esi
call fcn.1006c0b6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1006c04a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1006c137
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1006c189
push edi
push eax
call fcn.1006a1eb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1006c157
call fcn.1006a1b1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1006c188
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1006c04a
add esp, 0x20
test eax, eax
jne 0x1006c176
push edi
call fcn.1006a1b1
jmp 0x1006c17e
push ebx
call fcn.1006a1b1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1006c3f7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x1007f1e4
push str.FlsAlloc
push 0x1f
call fcn.1006c313
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c42b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10074108]
call esi
jmp 0x1006c431
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1006c475
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x1007f208
push str.FlsGetValue
push 0x21
call fcn.1006c313
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c4ac
push dword [ebp + 8]
mov ecx, esi
call dword [0x10074108]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1006c4b4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x1007f21c
push str.FlsSetValue
push 0x22
call fcn.1006c313
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006c4ee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10074108]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0xa78058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a781a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa7807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7806a
add dl, dl
jne 0xa78089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa780dc
xor eax, eax
add dl, dl
jne 0xa78096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa7817d
add dl, dl
jne 0xa780a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa780b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa780bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa780c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa780d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa78075
mov eax, 1
add dl, dl
jne 0xa780ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa780f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa780e1
sub eax, ebx
mov ebx, 1
jne 0xa78128
mov ecx, 1
add dl, dl
jne 0xa7810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa78119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa78105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa78075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa7813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa7814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa78136
cmp eax, 0x7d00
jae 0xa7816d
cmp eax, 0x500
jb 0xa78168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa78075
cmp eax, 0x7f
ja 0xa78170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa78075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa7819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa78075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41a6c4
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41a6e8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41a6d0
add dl, dl
jne 0x41a6f3
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41a744
xor eax, eax
add dl, dl
jne 0x41a700
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41a7e1
add dl, dl
jne 0x41a70f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41a71a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41a725
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41a730
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41a73a
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41a6df
mov eax, 1
add dl, dl
jne 0x41a752
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41a75d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41a749
sub eax, ebx
mov ebx, 1
jne 0x41a790
mov ecx, 1
add dl, dl
jne 0x41a776
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41a781
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41a76d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41a6df
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41a7a7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41a7b2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41a79e
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41a6df
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41a802
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41a6df
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x41b2f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, 6
lodsd eax, dword [esi]
bswap eax
ror eax, 0xd
mov edx, eax
not edx
lodsd eax, dword [esi]
rol eax, 0xb
bswap eax
xor eax, edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 9
bswap eax
mov edx, eax
not edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 7
bswap eax
xor eax, edx
mov edx, eax
not edx
stosd dword es:[edi], eax
rol eax, 5
xor eax, edx
stosd dword es:[edi], eax
lea esi, [edi - 0x10]
dec ebx
test ebx, ebx
jne 0x41b305
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41b348
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0xfffefdfc
mov ecx, pe_nt_image_headers32
mov ebx, dword [ebp + 0x10]
mov dword [ebx + ecx*4 - 4], eax
sub eax, 0x4040404
dec ecx
jne 0x41b35b
mov edi, dword [ebp + 0xc]
mov esi, pe_nt_image_headers32
xor ebx, ebx
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x41b375
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 8]
mov esi, 0x20
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x41b3ae
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov esi, pe_nt_image_headers32
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x41b3e7
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41b41c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
xor edx, edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x41b468
push ebp
mov ebp, dword [ebp + 0x10]
mov dl, byte [ebp + ecx]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
mov dl, byte [ebp + edx]
inc dl
mov al, byte [ebp + edx]
xor byte [edi], al
mov dl, byte [ebp + ebx]
xchg byte [ebp + ecx], dl
mov byte [ebp + ebx], dl
inc cl
inc edi
dec esi
test esi, esi
jne 0x41b439
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4168de
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d25
mov dword [ebp - 0x14], eax
cmp dword [0x465914], esi
jne 0x4169d1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41695e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x416ab1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x416ab1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416ab1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x465914], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x465918], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x46591c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465924], eax
test eax, eax
je 0x4169ce
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465920], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4169f6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4169e9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x416a0b
push 4
pop eax
jmp 0x416ab3
cmp dword [ebp - 0x14], esi
je 0x416a0b
push dword [0x465914]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4169f0
mov eax, dword [0x465920]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416a69
cmp dword [0x465924], edi
je 0x416a69
push eax
call ebx
push dword [0x465924]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416a69
test eax, eax
je 0x416a69
call ecx
test eax, eax
je 0x416a5e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x416a5e
test byte [ebp - 8], 1
jne 0x416a69
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x416a99
mov eax, dword [0x465918]
cmp eax, edi
je 0x416a96
push eax
call ebx
test eax, eax
je 0x416a96
call eax
mov esi, eax
test esi, esi
je 0x416a96
mov eax, dword [0x46591c]
cmp eax, edi
je 0x416a96
push eax
call ebx
test eax, eax
je 0x416a96
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x465914]
call ebx
test eax, eax
je 0x416ab1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x416ab3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406eea
mov esp, ebp
pop ebp
ret