joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40426c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push 5
pop edx
mov dword [ebp - 0x90], 0x7fffff37
cmp dword [ebp - 0x90], 0x7fffff8f
jle 0x4042aa
movzx eax, byte [0x40d4c1]
sbb dword [0x40d4b9], eax
mov eax, dword [ebp - 0x7c]
sub eax, dword [0x40d469]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x408090]
test eax, eax
jne 0x404322
mov dword [ebp - 0x20], 0x18
cmp dword [ebp - 0x20], 0
je 0x404308
cmp dword [ebp - 0x20], 0x26
jne 0x4042fa
push 0x824b
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push str.RLL_M4FE91_DXMR_25T_VAA_H03_FWG_CGS
push dword [ebp - 0x14]
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
jmp 0x4042bf
mov al, byte [edx + 0x4084b3]
xor al, 0x5e
add al, 0x30
mov byte [edx + 0x4084b3], al
inc edx
cmp edx, 0x14
jb 0x404273
push esi
push edi
push str.QAZWSXEDCRFV
push str.qazwsxedcrfv
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404371
mov eax, dword [0x4082d4]
mov eax, dword [eax + 0xc]
cmp dword [eax], edi
jne 0x404371
call fcn.00403e51
mov dword [ebp - 0x9c], 0x7fffff21
cmp dword [ebp - 0x9c], 0x7fffff2b
je 0x4044e4
mov edi, eax
cmp dword [ebp - 0x138], 0x4484
ja 0x4043a3
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov esi, 0x5487
or dword [eax], esi
jmp 0x4043c1
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xc8], ecx
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xcc]
adc dword [ecx], eax
mov ecx, 0xb
mov eax, dword [ecx*4 + 0x40d52e]
add byte [eax], 0x3f
mov eax, 0xffffeffd
mov ecx, 0x352e
xor eax, ecx
lea edx, [eax + eax + 0x4a5a]
mov dword [ebp - 4], edx
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x9c]
not edx
mov dword [ebp - 0x9c], edx
mov edx, 0x32e
xor dx, word [esi + 0x408498]
mov esi, 0x22d
add dx, si
mov esi, dword [ebp - 4]
inc eax
movzx edx, dx
xor eax, ecx
mov word [esi + str.d__tB], dx
cmp eax, 0xffffeff8
jne 0x4043da
test edi, edi
je 0x4044e4
push 9
mov eax, dword [ebp - 0x158]
mov ecx, dword [0x40d401]
or eax, ecx
mov dword [ebp - 0x158], eax
pop eax
mov ecx, 0x4084fc
mov esi, 0x408658
and dword [0x40d47d], 0
jmp 0x40446f
mov edx, dword [0x40d47d]
inc edx
mov dword [0x40d47d], edx
cmp dword [0x40d47d], 0x1b
jae 0x4044c3
cmp dword [0x40d47d], 0x2b
jne 0x4044be
push dword [ebp - 0x14]
push dword [ebp - 0x20]
push 0x3abf
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push 0x61c3
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push 0x184f
push dword [ebp - 0x20]
push 0x3c9e
call dword [sym.imp.COMCTL32.dll_CreateToolbarEx]
jmp 0x404462
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
xor dl, 0x5e
add dl, 0x30
mov byte [esi + eax], dl
dec eax
jne 0x4044c7
mov eax, dword [0x4082d4]
mov eax, dword [eax + 0xc]
mov dword [eax], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x40415a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x438354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
ja 0x40415d
call fcn.0041a672
push 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call dword [sym.imp.USER32.dll_LoadImageA]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1e], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
push edi
call fcn.004270bf
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
cmp esi, ebx
je 0x4041b5
cmp dword [ebp + 0xc], 0
jg 0x4041c9
mov eax, dword [ebp - 4]
mov dword [eax], 0x4382c8
mov ecx, dword [ebp - 4]
call fcn.0041c3d6
add esp, 0x10
cmp eax, 0xffffffff
setne cl
mov al, cl
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4048ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438200
mov eax, dword fs:[0]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [ebp - 0x190]
push ecx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
je 0x4048d7
or al, al
je 0x40490d
push 0
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x438020
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 3
mov ecx, 0x43824c
push 0x438374
sub ecx, eax
cmp dword [ebp - 4], ecx
jle 0x404926
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x4048fc
cmp dword [ebp + 8], 0
jne 0x404906
cmp dword [ebp - 8], edi
sete al
add eax, esi
test byte [eax + 4], 1
je 0x404941
test ebx, ebx
jne 0x40491e
mov dword [ebp - 0xc], 0x43831c
test edi, edi
je 0x404930
lea ebx, [ebp - 0x511]
movzx ecx, al
movzx eax, byte [ebx]
cmp ecx, eax
ja 0x404944
sub eax, ecx
pop ebp
ret

Function at 0x405066
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x405093
push 4
call fcn.0041a5f4
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x405093
mov eax, dword [esi + 0xb0]
cmp eax, ebx
jmp 0x405076
push eax
push dword [esi + 4]
call fcn.0042400b
pop ecx
mov ecx, dword [eax + edx*4 + 0x44]
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edi
mov ebx, edi
je 0x4050b4
push 0xb
call fcn.0042f594
pop ecx
test al, al
jns 0x4050a9
test al, 2
jne 0x4050a9
movzx esi, byte [eax + 7]
movzx ebx, byte [ecx + 7]
sub esi, ebx
jne 0x4050af
movzx esi, byte [eax + 3]
movzx ebx, byte [ecx + 3]
sub esi, ebx
jne 0x4050c9
or ecx, 0xffffffff
sub ecx, dword [eax + 0x14]
cmp ecx, dword [ebp + 8]
je 0x4050e7
and dword [ebp - 0x10], 0
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebx + 0xb0], eax
mov eax, dword [ebp + 8]
xor ecx, edx
sub ecx, edx
cdq
sub eax, edx
jne 0x4050f7
or ebx, edx
jmp 0x4050ea
Function at 0x4063a5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x438348]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4383e0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call dword [sym.imp.ole32.dll_OleInitialize]
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov dword [eax + 0xfe8], 0xff0
add eax, 0x1000
dec ecx
and ecx, 0x80000000
or ebx, ecx
mov ecx, dword [0x438240]
or ebx, dword [ebp - 0x20]
cmp ecx, 0x40
je 0x4063ed
push 0x438384
call dword [sym.imp.USER32.dll_GetClassNameW]
push eax
push ebx
push dword [esi]
call fcn.0042c090
pop ecx
shl eax, 6
add eax, dword [edi]
pop ecx
cmp eax, 0x78
je 0x406413
push dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x40641f
inc byte [eax]
cmp byte [esi], 0x31
je 0x40643e
cmp byte [edi], 0
je 0x406430
mov eax, dword [eax]
mov dword [esi], eax
jl fcn.00406451
cmp esi, dword [0x438188]
jae 0x40643c
lea ecx, [ebp - 0x210]
push ecx

Function at 0x409863
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
je 0x409866
test eax, eax
jge 0x409878
call fcn.004046f0
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
inc dword [esi + 4]
and eax, 0xffffffef
or eax, 1
mov dword [ebp - 0x570], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [0x438090]
push esi
mov esi, ecx
mov dword [esi], 0x438160
mov eax, dword [ebx + 8]
mov dword [esi], 0xcccc
add esi, 8
jmp 0x4098b5

Function at 0x40b76a
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
shr edi, cl
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
push edx
push 1
push esi
jmp 0x40b78a
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jb 0x40b7a9
mov ecx, 0x966
mov edx, ecx
or edx, edi
je 0x40b78b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
jmp 0x40b799
mov eax, dword [ebp - 0x1c]
and dword [eax + 0x70], 0xfffffffd
or eax, 0xffffffff
shl eax, cl
mov dword [ebp - 8], ecx
test dword [edi], eax
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.004069b7
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 4], ebx
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x82500000], 0xe58b0043
pop ebp
ret 4
Function at 0x40d7fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
cmp dword [ebp + 0xc], 0
jge 0x40d832
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ebp, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jne 0x40d833
mov esi, dword [eax + 0xc]
cmp esi, 0xfffffffe
je 0x40d80e
mov esi, dword [ebp + 0xc]
push edi
push esi
push ebx
push dword [esi + 4]
mov edi, 0xff
push edi
mov esi, ecx
mov edx, 0x7fff
xor esi, eax
cmp esi, edi
jne 0x40d834
and dword [esi + 8], eax
inc eax
push dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00416437
add esp, 0x10
cmp eax, dword [ebp - 0x1014]
jne 0x40d881
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
jne 0x40d88c
mov edi, dword [0x438230]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x40]
and edx, 2
je 0x40d899
mov ecx, dword [ebp + 8]
add ecx, 8
mov edx, dword [eax]
and edx, esi
lea esi, [edx + ecx]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x6c], ebx
cmp dword [ebp + 0x24], ebx
push ebx
push 0x351
push edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
lea eax, [ebp - 0x10]
push eax
push ebx
mov ebp, ebx
cmp ecx, 0x100
jne 0x40d8ab
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, dword [ebp - 0x1acc]
mov dword [ebp - 0x1ae4], eax
xor eax, eax
xor ebx, ebx
push ebx
xor ebx, ebx
push esi
call fcn.004267fc
mov edi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + edx], 0x438304
mov ecx, dword [ebp + 8]
call fcn.004301bc
add esp, 4
push eax
push dword [ebp + 0xc]
call fcn.0041c839
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x6c]
mov eax, edi
jmp 0x40d91f
mov byte [ecx], dl
jmp 0x40d8fd
or ecx, ecx
jmp 0x40d917

Function at 0x40de52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4382c0
mov eax, dword fs:[0]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
call dword [sym.imp.USER32.dll_GetMenu]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
call fcn.0043074c
xor eax, eax
mov byte [ebp + eax - 0x104], al
inc eax
jae 0x40de77
lea ecx, [eax + 1]
cmp byte [ecx], 0xa
je 0x40de94
push edi
lea eax, [ebp + 8]
mov dword [0x438168], eax
mov eax, dword [ebp - 0x320]
mov dword [0x43837c], 0x438000
mov eax, dword [0x438360]
mov dword [0x438188], eax
mov dword [0x438394], 0x438054
mov dword [0x438264], 0x438288
mov eax, dword [0x43804c]
xor eax, ebp
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40decc
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp + 0x20], eax
mov esi, dword [0x4381d4]
xor eax, eax
jmp 0x40ded7
Function at 0x40e126
Capabilities:
Access peb ldr_data
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x438258]
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx]
mov esi, dword [eax + 0xc]
cmp esi, dword [ecx + 0xc]
je 0x40e172
mov dword [ebp - 8], 0
mov eax, dword [0x438354]
mov dword [ebp - 4], eax
pop esi
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
cmp eax, ebx
jne 0x40e188
mov edi, eax
cmp word [eax], bx
je 0x40e16f
neg eax
sbb eax, eax
shl eax, 1
add eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x54
call fcn.0041feb1
add esp, 0x18
cmp dword [ebp - 4], 0x438174
jge 0x40e19a
push 8
push 0x4382f4
push esi
mov esi, dword [ebp + 0xc]
push esi
cmp esi, edi
jne 0x40e1ad
lea edx, [edx + 0x1f80]
mov dword [0x61959f], 0x9b95aa49
push 0x3ff8d8
call fcn.0040ab46
call fcn.00427e21
sub esi, eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
shl ecx, 0x1f
shr edi, 1
sub dword [ebp - 0x1014], edi
sbb dword [ebp - 0x1010], 0
cmp byte [ebp - 0x1005], 1
jne 0x40e1e5
cmp esi, str.Lhas0
je 0x40e20f
push edi
jae 0x40e1e5
lea esi, [eax + 4]
test ebx, ebx
je 0x40e1ed
mov eax, dword [esi + 8]
mov ecx, dword [0x4382cc]
test dword [eax + 0x70], ecx
jne 0x40e230
imul eax, eax, 0xc
add eax, ecx
mov ecx, eax
call fcn.00423840
mov dword [eax], esi
push ebx
push ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
cmp edx, esi
jae 0x40e251
mov eax, esi
shr eax, 0x18
lea eax, [ebx + eax*2]
imul eax, eax, 0x4d
lea eax, [eax + ecx - 0x134312f4]
sar eax, 0x10
movzx eax, ax
jmp 0x40e25b
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
je 0x40e254
inc ebx
test al, al
jne 0x40e282
add eax, 0
lea esp, [esp]
je 0x40e256
push dword [0x438004]
call fcn.0041f268
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp eax, edi
jb 0x40e271
mov edx, 0xf2a
cmp ax, dx
jb 0x40e282
mov ecx, 0xce6
mov edx, ecx
and edx, 0x8000001f
jns 0x40e294
dec edx
or edx, 0xffffffe0
inc edx
add esp, 0xc
mov dword [ebx + 4], edi
mov dword [ebx + 8], 1
call fcn.0041369d
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x40e2d1
add edi, 0x14
jmp 0x40e2e8
mov esi, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0x4383e4
mov edx, dword [ebp + 8]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push 0x83
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov eax, dword [ebp - 0x20]
and eax, edi
jne 0x40e2f8
mov dword [0x438390], 0x4380e4
cmp dword [ebp + 0x14], ebx
je 0x40e32f
cmp dword [ebp - 0x94], 5
jle 0x40e305
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0040b13a
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x40e322
Function at 0x40ecbc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx ecx, word [eax + 0x42]
movzx edx, word [eax + 0x44]
mov dword [ebp - 4], ecx
or esi, 0x7a90
add dword [esp + 8], 0x6064761
lea eax, [ecx + 0x7ece]
push 0x3f48db
call fcn.0041b946
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
cmp eax, 0x19930520
je 0x40ecc2
cmp dword [esi + 0x18], 0x200
jne 0x40ecbf
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor esi, eax
cmp esi, edi
jb 0x40ecf1
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0x1ad4]
push eax
jmp 0x40ed3c
lea eax, [ebp - 0x1ab8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040fb7d
mov eax, dword [0x438308]
test eax, eax
je 0x40ed32
cmp dword [ebp - 0x1c], eax
jne 0x40ed3c
neg ecx
and ecx, 3
je 0x40ed5a
push 0
push 4
mov eax, 0x438018
call fcn.0042e6b9
cmp dword [eax], 0x2a
jne 0x40ed5a
push 0x1c
call fcn.00418a88
add esp, 4
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.0041830e
pop ebp
ret 4

Function at 0x40f731
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0x10], 0
je 0x40f752
call fcn.0040ce48
push dword [esi + 0x438090]
call fcn.00426f6c
pop ecx
lea ecx, [ebp - 0x10]
call fcn.004289ef
mov eax, esi
imul eax, eax, 0x14
add eax, ecx
mov ecx, eax
call fcn.0040d935
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406cb9
mov dword [ebp - 0x80], eax
jmp 0x40f770

Function at 0x4162e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4380fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x438148]
cmp eax, 2
jb 0x4162f0
lea eax, [ecx + ecx + 8]
cmp eax, 0x438130
jbe 0x416311
xor eax, eax
call fcn.0040ec0d
pop ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.00409e13
add esp, 0x20
test eax, eax
je 0x41633d
and dword [eax + 8], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x6b0], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd0]
call fcn.0042ef45
mov esi, eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x4c], 0
je 0x41635b
push eax
push dword [esi + 4]
call fcn.0041ef4f
pop ecx
mov dword [ebp - 4], esi
push dword [ebp + 0x14]
setne al
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x416367
mov eax, dword [ebp + 0x14]
push esi
mov esi, ecx
call fcn.004058d6
mov eax, dword [esi]
push dword [edi + eax]
call dword [sym.imp.USER32.dll_TranslateMessage]
pop edi
xor ecx, ebp
call fcn.0041e658
add esp, 0xc
pop ebp
ret 4

Function at 0x4168c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x438258]
xor eax, ebp
mov dword [ebp - 8], eax
jl 0x4168ca
push 1
lea ecx, [ebp - 0x4bc]
call fcn.0041bd91
or edi, eax
lea eax, [esi + 0x7c]
push eax
call fcn.00428551
add esp, 0xc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418e98
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 1
push eax
push dword fs:[0]
lea eax, [esp + 0xc]
sub esp, dword [esp + 0xc]
push ebx
push esi
mov dword [eax], edi
movzx esi, word [esi + 0x38]
lea eax, [ebx + 0xc]
push eax
push 8
push dword [0x438358]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x18], eax
jbe 0x418ebb
cmp eax, dword [ebp - 4]
jbe 0x418eb9
mov ebx, 0x1000
push ebx
push esi
push eax
call esi
cmp dword [0x4380e0], 0
mov esi, dword [0x438208]
mov dword [0x4381cc], eax
call fcn.0042817a
pop ecx
jne 0x418f0e
add ecx, 1
or al, al
je 0x418eec
push 5
mov eax, dword [0x438164]
push eax
call fcn.0041ceda
push eax
push 0x1002
push dword [esi + 0x1c]
call fcn.0040364a
test eax, eax
je 0x418f2f
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.004283e7
xor edx, edx
jne 0x418f14
mov dword [ebp - 8], 1
test ebx, ebx
je 0x418f1c
cmp eax, 0x19930522
jne 0x418f27
movzx esi, byte [eax + 0x15]
movzx ebx, byte [ecx + 0x15]
sub esi, ebx
jne 0x418f6f
movzx esi, byte [eax + 2]
movzx ebx, byte [ecx + 2]
sub esi, ebx
je 0x418f6e
add dword [0x43827c], 0x10
mov esi, dword [0x438288]
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edx
cmp eax, 0xffffffff
jne 0x418f8a
xor eax, eax
mov edi, dword [ebp - 8]
test edi, edi
jae 0x418f6e
mov ecx, eax
and ecx, 0x1f
mov edi, eax
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
push ecx
call fcn.00416128
mov dword [ebp - 0x2c], eax
call fcn.004227f2
inc esi
call fcn.004041d4
push dword [ebp + 8]
call fcn.004291e8
add esp, 0x10
or eax, edx
jne 0x418f9c
mov dword [ebp + 8], eax
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edi
push 0x4382e4
call dword [sym.imp.GDI32.dll_PtVisible]
lea ecx, [ebp - 0x438]
push ecx
push ebx
push esi
xor edx, edx
inc edx
dec edi
jne 0x418fca
push esi
mov esi, 0x200
jne 0x418fe0
mov ecx, dword [ebp + 0x10]

Function at 0x419903
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [edi + 0xc], 0x40
push ebx
push 0x4c
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push ebx
test al, 8
jne 0x41990d
cmp dword [0x438008], 1
jne 0x419925
mov eax, edi
not eax
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
call fcn.00416b74
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jb 0x41992b
jmp 0x419959
mov eax, dword [eax + 4]
inc byte [eax + 0x438164]
lea ecx, [ebp - 4]
call fcn.0040984c
add esp, 0x10
push dword [esi + 0x1c]
call edi
test eax, eax
jne 0x419965
movzx eax, word [ebp - 4]
and eax, dword [ebp + 0xc]
cmp byte [ebp - 0xc], 0
jne 0x419965
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
cmp esi, edi
jb 0x419987
mov ecx, 0x17e0
mov edx, ecx
sar edx, 5
shl eax, 6
lea eax, [ecx + eax + 0x24]
mov cl, byte [eax]
cmp cl, bl
jne 0x419992
mov eax, dword [esp + 4]
ret
Function at 0x41a02d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x438368]
xor eax, ebp
mov dword [ebp - 0xb4], eax
push eax
push dword [ebp + 0x18]
push ebx
push esi
test dword [ebp + 0x10], edi
je 0x41a033
mov eax, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x1ab8]
push eax
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
shr edx, 0x1f
add ecx, ecx
cmp eax, ecx
jb 0x41a055
mov edx, dword [ebp - 0x1014]
or edx, dword [ebp - 0x1010]
jne 0x41a08d
cmp dword [0x43822c], edi
jne 0x41a08d
mov dword [esi + 0xc], edi
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
jge 0x41a07d
inc edi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
inc eax
cmp dword [ebp + 0xc], ebx
jbe 0x41a088
call fcn.004325c8
add esp, 4
pop ebp
ret

Function at 0x41a672
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and eax, 0xfff7ffff
and ecx, eax
mov eax, esp
and eax, 0xfffff000
cmp ecx, eax
jae 0x41a680
lea esi, [edi + 0x426510]
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
mov edi, 0x100
jle 0x41a6b2
mov eax, esi
neg eax
add eax, dword [ebp - 0x50]
cmp dword [ebp - 0x60], edx
jne 0x41a69c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x41a6b8

Function at 0x41ee94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x4383c0]
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx]
mov esi, dword [eax + 0xc]
cmp esi, 0xfffffffe
je 0x41eeba
test eax, eax
jne 0x41eed2
movzx eax, word [ebp - 4]
cmp byte [ebp - 8], bl
jne 0x41eeba
pop edi
mov dword [0x438390], eax
mov eax, dword [ebp + 8]
pop esi
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx + esi*8]
mov edi, dword [ecx + 4]
mov dword [edx + 8], ecx
mov dword [edx + 4], edi
mov dword [ecx + 4], edx
mov ecx, dword [edx + 4]
cmp ecx, dword [edx + 8]
je 0x41ef10
lea eax, [ebp - 0x438]
push eax
push 0x51
push esi
call fcn.004249e8
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
ja 0x41ef31
test byte [ebp - 4], 1
je 0x41eeff
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
cmp ebx, 0xfffffffe
jne 0x41eeff
and dword [eax + 4], 0xfffffffe
mov eax, dword [0x43815c]
push dword [eax + 0x10]
push dword [ebp + 8]
call fcn.00423b42
add esp, 8
movzx eax, al
jmp 0x41ef25