joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100027e1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100027a2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18

Function at 0x405a2a
Capabilities:
Terminate process

Disassembly:
call main
jmp 0x405a34
push 0x14
push 0x40a748
call fcn.00405c00
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x40ca80
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x405a7b
cmp eax, edx
jne 0x405a64
xor esi, esi
inc esi
mov edi, esi
jmp 0x405a7e
xor esi, esi
inc esi
cmp dword [0x40ca84], esi
jne 0x405a90
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x405acb
cmp dword [0x40ca84], 0
jne 0x405ac5
mov dword [0x40ca84], esi
push 0x40722c
push 0x40721c
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x405acb
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x405be2
mov dword [0x40c72c], esi
cmp dword [0x40ca84], esi
jne 0x405aee
push 0x407218
push 0x407204
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x40ca84], 2
test edi, edi
jne 0x405afb
xor eax, eax
mov ecx, 0x40ca80
xchg dword [ecx], eax
cmp dword [0x40ca88], 0
je 0x405b1f
push 0x40ca88
call main
pop ecx
test eax, eax
je 0x405b1f
push 0
push 2
push 0
call dword [0x40ca88]
mov eax, dword [sym.imp.MSVCR120.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x405b6e
test cl, cl
je 0x405b3b
test edi, edi
jne 0x405b6e
mov al, byte [esi]
test al, al
je 0x405b4b
cmp al, 0x20
ja 0x405b4b
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405b3b
push ebx
push esi
push 0
push 0x400000
call main
mov dword [0x40c730], eax
cmp dword [0x40c734], 0
jne 0x405bc7
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp cl, 0x22
jne 0x405b7f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120.dll__ismbblead]
pop ecx
test eax, eax
je 0x405b92
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405b2c
cmp dword [0x40c72c], 0
jne 0x405bdb
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x40c730]
mov dword [ebp - 4], 0xfffffffe
call fcn.00405c45
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40ac80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40ad8c
test eax, eax
je 0x40ad8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x425ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x40ad73
lea edi, [eax + 4]
jmp 0x40acd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x40acec
mov dword [ebp - 4], 2
jmp 0x40ad0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x40ad03
mov dword [ebp - 4], 1
jmp 0x40ad0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x40ad83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x40ad46
mov byte [ecx], 0x3d
jmp 0x40ad52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x40ad5d
mov byte [ecx], 0x3d
jmp 0x40ad63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x40acd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x10006be0
cmp edi, esi
jb 0x10006c4b
cmp edi, dword [ebp + 0x10]
ja 0x10006c5e
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x10006be2
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x10006bd0
jmp 0x10006c3f
ja 0x10006be9
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x10006ba5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x10006c20
mov ebx, esi
sub ecx, edx
jns 0x10006c37
jmp 0x10006c41
cmp esi, edi
je 0x10006c72
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x10006c41
xor al, 1
cmp ebx, edi
jne 0x10006c00
jmp 0x10006c41
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x1427e3b8
call fcn.100057a0
add esp, 4
ud2
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x1427e3b8
call fcn.10004ed0
add esp, 4
ud2
mov ecx, 0x142869e4
mov edx, 0x2b
push 0x1427e3a8
call fcn.100053c0
add esp, 4
ud2
Function at 0x100214f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x1199], 0
mov edi, edx
mov esi, ecx
je 0x10021541
mov edx, edi
mov ecx, esp
push 3
push 0
call fcn.100217e0
add esp, 8
movq xmm0, qword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
movd ecx, xmm0
test ecx, ecx
je 0x1002160d
movq qword [esi], xmm0
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
jmp 0x10021640
cmp byte [edi + 0x119a], 0
je 0x10021648
mov dword [esp + 0x14], esi
mov byte [edi + 0x1194], 0xc
xor edi, edi
lea esi, [0x1427f8a1]
lea edx, [0x1427f8a2]
mov eax, 0xfffffff9
mov dword [esp + 0x18], 0
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x100215a5
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x1002169d
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x100215c6
shld dword [esp + 0x18], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10021580
mov ecx, 0x1427f69e
mov edx, 9
xor ebx, 0xe
call fcn.100091f0
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x1427f68c
mov edx, 0x12
cmove edi, esi
call fcn.100091f0
mov ecx, dword [esp + 0x14]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
jmp 0x10021640
movzx ecx, byte [edi + 0x118f]
cmp ecx, 0x10
jae 0x10021689
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], eax
mov dword [esi], 0
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1194], 0xd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
mov ecx, esp
push 2
push 0
call fcn.100217e0
add esp, 8
movq xmm0, qword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
movd ecx, xmm0
test ecx, ecx
jne 0x10021532
movzx ecx, byte [edi + 0x118f]
cmp ecx, 0x10
jb 0x10021619
mov edx, 0x10
push 0x1427f8ac
jmp 0x10021693
mov edx, 0x10
push 0x1427f8bc
call fcn.10004a00
add esp, 4
ud2
mov ecx, 0x142851ac
mov edx, 0xe
push 0x1427ed4c
call fcn.100053c0
add esp, 4
ud2
Function at 0x10025b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x118e], 3
mov edi, edx
mov esi, ecx
jne 0x10025b6a
movzx ecx, byte [edi + 0x1190]
cmp ecx, 0x10
jae 0x10025c62
movzx eax, byte [edi + 0xa8]
mov dword [esi], 0
and al, 1
mov byte [edi + ecx*8], al
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1194], 0xd
jmp 0x10025c5a
lea ecx, [esp + 8]
mov edx, edi
push 0
push 0
call fcn.100217e0
add esp, 8
movq xmm0, qword [esp + 8]
movd eax, xmm0
test eax, eax
je 0x10025ba1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x10025c5a
mov dword [esp], esi
mov byte [edi + 0x1194], 0xc
xor edi, edi
lea esi, [0x1427f865]
lea edx, [0x1427f866]
mov eax, 0xfffffff9
mov dword [esp + 4], 0
nop word cs:[eax + eax]
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x10025bf5
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x10025c76
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x10025c16
shld dword [esp + 4], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10025bd0
mov ecx, 0x1427f69e
mov edx, 9
xor ebx, 0x1a
call fcn.100091f0
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x1427f68c
mov edx, 0x12
cmove edi, esi
call fcn.100091f0
mov ecx, dword [esp]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, 0x10
push 0x1427f890
call fcn.10004a00
add esp, 4
ud2
mov ecx, 0x142851ac
mov edx, 0xe
push 0x1427ed4c
call fcn.100053c0
add esp, 4
ud2
Function at 0x10034550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, ecx
mov ecx, dword [ebp + 0x10]
or eax, dword [ebp + 8]
or esi, edx
mov edx, dword [ebp + 0xc]
and ecx, 0xfffff000
or esi, ecx
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10030320
add esp, 8
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100345a2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], esi
jmp 0x10034679
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], edi
xor edi, edi
lea esi, [0x14283069]
mov ecx, 0xfffffff9
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea eax, [0x1428306a]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, eax
mov eax, ebx
add al, 0xd0
cmp al, 0xa
jb 0x100345f1
or bl, 0x20
mov eax, ebx
add al, 0x9f
cmp al, 6
jae 0x10034681
add bl, 0xa9
mov eax, ebx
mov edx, edi
movzx ebx, al
lea eax, [esi + 1]
shl edx, 4
or ebx, edx
test ecx, ecx
cmove eax, esi
je 0x10034611
shld dword [ebp - 0x18], edi, 4
inc ecx
test esi, esi
mov edi, ebx
jne 0x100345d0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10034632
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
and eax, 0xfff
movzx eax, byte [ecx + eax]
mov byte [edx + 4], al
mov dword [edx], 0
jmp 0x10034679
mov ecx, 0x14286869
mov edx, 0x13
xor ebx, 0x2c7
call fcn.100091f0
mov ecx, 0x14286845
mov edx, 6
mov edi, eax
call fcn.100091f0
mov edx, dword [ebp - 0x10]
test eax, eax
mov ecx, 1
cmove eax, ecx
test edi, edi
cmove edi, ecx
mov dword [edx], edi
mov dword [edx + 4], eax
mov dword [edx + 8], ebx
mov dword [edx + 0xc], 0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x142851ac
mov edx, 0xe
push 0x1427ed4c
call fcn.100053c0
add esp, 4
ud2
Function at 0x403db8
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
xor eax, eax
mov edx, dword [eax*4 + 0x7d4338]
movsx ecx, byte [edx + 0x2a8]
test ecx, ecx
jne 0x403fba
inc eax
cmp eax, 4
jl 0x403dbd
je 0x403f8d
cmp dword [0x7d48a0], 0
jl 0x403f89
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
mov esi, eax
mov edi, dword [esi*4 + 0x7d4338]
cmp dword [edi + 0x2a4], 0
jne 0x403e3e
xor ebp, ebp
mov dword [edi + 0x2ac], ebp
mov dword [edi + 0x2b0], ebp
mov edx, 1
mov byte [edi + 0x2b4], dl
mov byte [edi + 0x2b5], dl
jmp 0x403f70
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
lea ebx, [esp + 0x10]
push ebx
push dword [edi + 0x2a4]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [esi*4 + 0x7d4338]
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x2ac], ecx
mov edx, dword [esp + 0x14]
mov dword [ebx + 0x2b0], edx
test esi, esi
jne 0x403ed2
mov edx, dword [0x7d3ee4]
sub ecx, edx
mov dword [ebx + 0x2ac], ecx
mov ecx, dword [0x7d3ee8]
sub dword [ebx + 0x2b0], ecx
mov ecx, dword [0x7d40a4]
test ecx, ecx
je 0x403eb5
mov eax, dword [ebx + 0x2ac]
imul eax, dword [ebx + 0xc]
cdq
idiv ecx
mov dword [ebx + 0x2ac], eax
mov ecx, dword [0x7d40a8]
test ecx, ecx
je 0x403ed2
mov eax, dword [ebx + 0x2b0]
imul eax, dword [ebx + 0x10]
cdq
idiv ecx
mov dword [ebx + 0x2b0], eax
xor edx, edx
mov byte [ebx + 0x2b4], dl
mov byte [ebx + 0x2b5], dl
mov edx, dword [ebx + 0x2ac]
test edx, edx
jl 0x403efe
mov ecx, dword [ebx + 0x2b0]
test ecx, ecx
jl 0x403efe
cmp edx, dword [ebx + 0xc]
jge 0x403efe
cmp ecx, dword [ebx + 0x10]
jl 0x403f70
mov byte [ebx + 0x2b4], 1
mov ecx, dword [0x7d3ee4]
mov ebp, dword [0x7d3ee8]
mov edi, dword [0x7d40a4]
test edi, edi
je 0x403f28
mov edx, dword [ebx + 0xc]
imul ecx, edx
mov eax, ecx
cdq
idiv edi
mov ecx, eax
mov edi, dword [0x7d40a8]
test edi, edi
je 0x403f3f
mov edx, dword [ebx + 0x10]
imul ebp, edx
mov eax, ebp
cdq
idiv edi
mov ebp, eax
mov edx, dword [ebx + 0x2ac]
mov edi, ecx
neg edi
cmp edx, edi
jl 0x403f69
mov eax, dword [ebx + 0x2b0]
mov edi, ebp
neg edi
cmp eax, edi
jl 0x403f69
add ecx, dword [ebx + 0xc]
cmp edx, ecx
jge 0x403f69
add ebp, dword [ebx + 0x10]
cmp eax, ebp
jl 0x403f70
mov byte [ebx + 0x2b5], 1
inc esi
cmp esi, 4
jl 0x403e0a
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edi, dword [esp + 4]
mov ebp, dword [esp]
add esp, 0x20
ret
mov dword [0x7d48a0], 0xffffffff
push 0x400
push 0x6521a0
call dword [0x5a3440]
add esp, 8
push 0x6520a0
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x403ddf
mov dword [0x7d48a0], eax
push 0x6521a0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x403ddf
Function at 0x410c24
Capabilities:
Get common file path

Disassembly:
push edi
push esi
push ebx
sub esp, 0x108
push 0x105
push 0x64e900
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, 0x64e900
call fcn.004502c0
mov esi, 0x64ea20
mov edi, 0x64e900
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x410c53
mov edx, 0x64ea20
movsx eax, byte [edx]
test eax, eax
je 0x410c90
movzx esi, al
movzx ecx, byte [esi + 0x5860a0]
inc ecx
movsx edi, cl
cmp edi, 2
je 0x410dab
cmp eax, 0x5c
jne 0x410c88
mov byte [edx], 0x3a
inc edx
movsx eax, byte [edx]
test eax, eax
jne 0x410c69
lea edx, [esp + 4]
xor eax, eax
push eax
push eax
push edx
push 0x64eb40
push 0x64e900
call fcn.004596da
add esp, 0x14
mov edi, 0x64eb40
lea edx, [esp + 4]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x410cbe
mov eax, 0x64eb40
call fcn.004502c0
mov edx, 0x64eb40
movsx eax, byte [edx]
test eax, eax
je 0x410d05
movzx esi, al
movzx ecx, byte [esi + 0x5860a0]
inc ecx
movsx edi, cl
cmp edi, 2
je 0x410da3
cmp eax, 0x2f
jne 0x410cfd
mov byte [edx], 0x5c
inc edx
movsx eax, byte [edx]
test eax, eax
jne 0x410cde
mov edi, 0x64eb40
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x410d1c
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x410d14
mov ecx, eax
test ecx, ecx
jle 0x410d4c
xor edx, edx
lea eax, [ecx - 1]
movzx esi, byte [edx + 0x64eb40]
movzx ebx, byte [esi + 0x5860a0]
inc ebx
movsx edi, bl
add edx, edi
cmp edx, eax
jne 0x410d48
cmp byte [edx + 0x64eb40], 0x5c
je 0x410d9c
cmp edx, ecx
jl 0x410d27
xor eax, eax
test eax, eax
jne 0x410d70
mov edi, 0x64eb40
mov edx, 0x7d92bc
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x410d66
xor eax, eax
push eax
push 0x1a
push 0x64ed80
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
push eax
push 5
push 0x64eea0
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0x108
pop ebx
pop esi
pop edi
ret
mov eax, 1
jmp 0x410d4e
add edx, 2
jmp 0x410cfe
add edx, 2
jmp 0x410c89
Function at 0x411118
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
sub esp, 0x38
mov dword [esp], 0x3003
mov dword [esp + 4], 0x417cb8
mov ecx, dword [0x7d3f78]
mov dword [esp + 0x10], ecx
xor edx, edx
mov dword [esp + 0x20], edx
mov eax, dword [0x586788]
mov dword [esp + 0x24], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
push 0x2711
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x41118b
mov eax, 1
add esp, 0x38
pop ebp
ret
lea eax, [esp + 0x28]
push eax
push dword [0x7d451c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x30]
sub edx, dword [esp + 0x28]
movsx eax, dx
mov ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x2c]
movsx ebp, cx
mov edx, dword [0x586788]
xor ecx, ecx
push ecx
push dword [0x7d3f78]
push ecx
push dword [0x7d451c]
push ebp
push eax
push ecx
push ecx
push 0x56000000
push edx
push edx
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x7d4518], eax
test eax, eax
je 0x411181
xor eax, eax
add esp, 0x38
pop ebp
ret

Function at 0x416d64
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x5866d8]
cmp eax, 0x270
jl 0x416e32
xor edx, edx
mov eax, dword [edx*4 + 0x5b4800]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5b4804]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5b4e34]
xor ecx, dword [eax*4 + 0x5605e0]
mov dword [edx*4 + 0x5b4800], ecx
inc edx
cmp edx, 0xe3
jl 0x416d76
cmp edx, 0x26f
jge 0x416dfe
mov eax, dword [edx*4 + 0x5b4800]
and eax, 0x80000000
mov ecx, dword [edx*4 + 0x5b4804]
and ecx, 0x7fffffff
or eax, ecx
mov ecx, eax
shr ecx, 1
and eax, 1
xor ecx, dword [edx*4 + 0x5b4474]
xor ecx, dword [eax*4 + 0x5605e0]
mov dword [edx*4 + 0x5b4800], ecx
inc edx
cmp edx, 0x26f
jl 0x416dbe
mov edx, dword [0x5b51bc]
and edx, 0x80000000
mov eax, dword [0x5b4800]
and eax, 0x7fffffff
or edx, eax
mov ecx, edx
shr ecx, 1
xor ecx, dword [0x5b4e30]
and edx, 1
xor ecx, dword [edx*4 + 0x5605e0]
mov dword [0x5b51bc], ecx
xor eax, eax
lea edx, [eax + 1]
mov dword [0x5866d8], edx
mov eax, dword [eax*4 + 0x5b4800]
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
Function at 0x417b38
Capabilities:
Get file version info

Disassembly:
push edi
push ebp
push ebx
sub esp, 0xc
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x417bd9
test edi, edi
je 0x417bd9
lea ecx, [esp + 8]
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
jbe 0x417bcd
mov dword [esp + 4], eax
push eax
call fcn.0045a030
pop ecx
mov ebx, eax
test ebx, ebx
je 0x417be5
push ebx
push dword [esp + 8]
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x417bc6
mov dword [esp], 0
lea ebp, [esp]
lea ecx, [esp + 4]
push ecx
push ebp
push 0x7d92bc
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x417bc6
mov ecx, dword [esp]
test ecx, ecx
je 0x417bc6
mov ecx, dword [ecx + 8]
mov dword [edi + 4], ecx
mov ebp, dword [esp]
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
push ebx
call fcn.0045a03e
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop edi
ret
push ebx
call fcn.0045a03e
pop ecx
mov eax, 0x80004005
add esp, 0xc
pop ebx
pop ebp
pop edi
ret
mov eax, 0x80070057
add esp, 0xc
pop ebx
pop ebp
pop edi
ret
mov eax, 0x8007000e
add esp, 0xc
pop ebx
pop ebp
pop edi
ret
Function at 0x43434c
Capabilities:
Create directory

Disassembly:
sub esp, 0x110
mov edx, eax
movsx ecx, byte [edx]
test ecx, ecx
je 0x434392
xor ecx, ecx
movsx eax, byte [edx]
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x108], esi
mov esi, edx
mov ebx, ecx
cmp eax, 0x5c
je 0x43439b
mov byte [esp + ebx], al
movsx eax, byte [ebx + esi + 1]
inc ebx
test eax, eax
jne 0x434372
mov ebx, dword [esp + 0x10c]
mov esi, dword [esp + 0x108]
xor eax, eax
add esp, 0x110
ret
push ebx
push esi
call fcn.0045ac87
add esp, 8
test eax, eax
je 0x4343af
movsx eax, byte [ebx + esi]
jmp 0x434377
xor eax, eax
mov byte [esp + ebx], al
lea edx, [esp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movsx eax, byte [ebx + esi]
jmp 0x434377

Function at 0x4353fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edx, edx
mov dword [esp], edx
mov dword [esp + 4], 1
mov byte [ebx], dl
lea eax, [esp]
push eax
push 0xf003f
push edx
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43543f
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
ret
lea edx, [esp + 4]
lea eax, [esp + 0x24]
push eax
push ebx
push edx
push 0
push ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x435466
mov eax, 0xffffffff
add esp, 8
pop ebx
pop ebp
ret
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
pop ebx
pop ebp
ret
Function at 0x43fbac
Capabilities:
Create directory

Disassembly:
push edi
push esi
sub esp, 0x108
mov ecx, eax
lea esi, [esp]
mov edi, 0x64ec60
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x43fbbe
lea edi, [esp]
mov edx, ecx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x43fbd7
lea eax, [esp]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x108
pop esi
pop edi
ret