joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push str.urDriveurDrive.exe
push 0x56f128
push str._s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004fa93d
xor eax, eax
add esp, 0x14
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x20c]
push edx
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret

Function at 0x4023d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push str.urOld_
push 0x56f128
push str._s_s
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004fa93d
push str.urDrive_
push 0x56f128
push str._s_s
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.004fa93d
add esp, 0x28
push 0xa
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret

Function at 0x402450
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push str.urNew_
push 0x56f128
push str._s_s
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004fa93d
push str.urDrive_
push 0x56f128
push str._s_s
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.004fa93d
add esp, 0x28
push 0xa
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret

Function at 0x4024d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.urDriveAutoUpdate.exe
push 0x56f128
push str._s_s
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004fa93d
push 0x44
xor esi, esi
lea ecx, [ebp - 0x268]
push esi
push ecx
call fcn.004fbe40
add esp, 0x20
xor eax, eax
lea edx, [ebp - 0x220]
push edx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x268]
push eax
push esi
push esi
push 0x4000000
push esi
push esi
push esi
push str._final
lea ecx, [ebp - 0x210]
push ecx
mov dword [ebp - 0x268], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402581
mov edx, dword [ebp - 0x220]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 1
jmp 0x402586
call fcn.00402a40
mov eax, dword [ebp - 0x220]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0x21c]
push ecx
call edi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fa43b
mov esp, ebp
pop ebp
ret
Function at 0x4025b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push str.urNewupdate.flg
push 0x56f128
push str._s_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004fa93d
add esp, 0x14
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 4]
xor edx, edx
cmp eax, 0xffffffff
setne dl
xor ecx, ebp
mov eax, edx
call fcn.004fa43b
mov esp, ebp
pop ebp
ret

Function at 0x402610
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push str.urDrive_
push 0x56f128
push str._s_s
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004fa93d
push str.urOld_
push 0x56f128
push str._s_s
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.004fa93d
add esp, 0x28
push 0xa
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret
Function at 0x4027a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push str._s.
lea eax, [ebp - 0x418]
push 0x104
push eax
mov dword [ebp - 0x670], edi
mov byte [ebp - 0x669], 0
call fcn.004fa93d
add esp, 0x10
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x674], esi
cmp esi, 0xffffffff
je 0x402992
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x402810
cmp word [ebp - 0x63c], 0x2e
je 0x402919
lea eax, [ebp - 0x63c]
push eax
push edi
push str._s_s
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call fcn.004fa93d
add esp, 0x14
test byte [ebp - 0x668], 0x10
je 0x402878
mov eax, dword [ebp + 0xc]
test al, al
je 0x40286c
push eax
lea edx, [ebp - 0x210]
push edx
call fcn.004027a0
add esp, 8
test eax, eax
jne 0x402994
jmp 0x402919
mov byte [ebp - 0x669], 1
jmp 0x402919
push 0x80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x402970
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402970
mov eax, dword [0x56f388]
mov esi, eax
inc eax
mov dword [0x56f388], eax
mov eax, dword [0x56f384]
mov edx, dword [eax + 0x20]
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4028f5
test esi, esi
jns 0x4028d1
xor esi, esi
jmp 0x4028db
cmp esi, 0x64
jle 0x4028db
mov esi, 0x64
push 0xc8
mov ecx, edi
call fcn.00409ece
mov eax, dword [eax + 0x20]
push 0
push esi
push 0x402
push eax
call ebx
cmp dword [0x56f388], 0x64
jb 0x402908
mov dword [0x56f388], 0
call fcn.00402e40
mov esi, dword [ebp - 0x674]
mov edi, dword [ebp - 0x670]
lea ecx, [ebp - 0x668]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x402810
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
jne 0x402994
cmp byte [ebp - 0x669], 0
jne 0x402992
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x402987
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40295d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa43b
mov esp, ebp
pop ebp
ret
Function at 0x4029b0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x56f358], 0
jg 0x4029ed
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
call fcn.004012e0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
call fcn.004012e0
call fcn.00401360
mov ecx, dword [0x56f330]
call fcn.00402bb0
add eax, dword [ebp + 8]
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0
push 0x10
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret

Function at 0x402bb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x567510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x549e9c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov esi, ecx
mov ecx, dword [0x549ea0]
push 3
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
call edi
push 4
lea ecx, [ebp - 0xc]
push ecx
push 3
and esi, 0x3ff
push esi
call edi
xor esi, esi
mov ecx, dword [esi*4 + 0x568b94]
lea eax, [ebp - 0xc]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402c36
test dx, dx
je 0x402c32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402c36
add eax, 4
add ecx, 4
test dx, dx
jne 0x402c10
xor eax, eax
jmp 0x402c3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402c58
inc esi
cmp esi, 0xc
jl 0x402c02
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa43b
mov esp, ebp
pop ebp
ret
cmp esi, 0xb
jne 0x402c99
mov ecx, 0x549e44
lea eax, [ebp - 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402c8b
test dx, dx
je 0x402c87
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402c8b
add eax, 4
add ecx, 4
test dx, dx
jne 0x402c65
xor eax, eax
jmp 0x402c90
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402c99
mov esi, 0xa
mov ecx, dword [ebp - 4]
pop edi
lea eax, [esi + esi*4]
pop esi
xor ecx, ebp
add eax, eax
pop ebx
call fcn.004fa43b
mov esp, ebp
pop ebp
ret

Function at 0x40944a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00409dd3
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x409483
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00409087
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4094e1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x409505
cmp dword [edi + 0x74], 0
jne 0x409505
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00409dd3
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004094a2
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40a22e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x513480
call fcn.004fb10c
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x40a253
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40a2a5
call fcn.004030ed
push eax
lea ecx, [ebp - 0x10]
call fcn.00401990
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004fb262
push eax
call fcn.00401510
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401670
mov eax, esi
call fcn.004fb1e4
ret 8

Function at 0x411513
Capabilities:
Encode data using xor

Disassembly:
pop edi
pop ds
inc esp
pxor mm2, mm0
test eax, 0xa55c2849
stosd dword es:[edi], eax
pop edi
invalid

Function at 0x4134c4
Capabilities:
Encode data using xor

Disassembly:
adc ah, dl
sahf
or byte [0x77fb6acd], bl
add byte [edx], bl
test al, 0x93
dec edx
cmp bl, ah
test eax, 0x68d0728d
mov ch, 0x2c
mov ecx, edi
outsd dx, dword [esi]
pop ebp
jbe 0x4134ff
or esp, esi
mov cl, 0xa9
sbb dh, byte [edx - 0x1047b475]
xlatb
pop edi
sub byte [edi - 0x12], cl
mov ebx, 0x9c22ab0e
dec edx
das
xchg edi, eax
imul edi, dword [esi - 0x4c852543], 0xd7706f3f
dec esp
cdq
test eax, 0x87eeaeb1
sbb dword [edx + 0x46], ecx
mov esi, 0x13b0346a
xchg edi, eax
salc
lcall 0x9551, 0xb0612522
rcr cl, 1
lodsd eax, dword [esi]
xor al, 0xb6
adc dh, byte [edx + 0x7f]
jb 0x413545
mov edx, 0xaf20e529
mov ah, 0xa5
cmc
cmp esi, dword [ecx]
mov byte [0x9c35f27b], al
and eax, 0x6d50bda5
dec edx
das
invalid
xor esi, edx
xchg esi, eax
popfd
invalid
Function at 0x426d5e
Capabilities:
Encode data using xor

Disassembly:
lcall 0x3cb7, 0x8b9b2285
add ch, byte [edx + ebx*2 + 0x5ea7541b]
in al, 0xaf
sbb byte [edi + esi], cl
test dword [edx + 0x7df778ea], edi
dec esp
idiv dword [ebp + 0x4c]
push 0xf445f12
mov cs, ebx
mov dword [esi], ecx
sahf
or dl, al
pop edx
call 0x44f15afd
jae 0x426d75
scasb al, byte es:[edi]
inc esp
rcl dword [ecx + 0x30], 0x59
xchg esp, eax
inc edi
inc esp
pop edx
cmpsb byte [esi], byte es:[edi]
bound ebx, qword [eax - 0xbe7760f]
inc ebx
and dword [ecx + 0x4d415873], 0x78bbe2b5
inc edx
push ss
fld xword [edx + 0x3568405]
dec edi
and edi, esi
and ecx, dword [edx - 0x4bb6b2d1]
xor dword [ebx - 0x6ebd0f98], ebx
cmpsd dword [esi], dword es:[edi]
jp 0x426d86
int3

Function at 0x42bcb2
Capabilities:
Encode data using xor

Disassembly:
dec eax
sahf
push eax
dec edx
shl esi, 1
adc ch, 0xc1
xchg edi, eax
pop ss
mov ebx, 0x7f74c690
hlt
mov bl, 0x97
push edx
test dword [eax + 0x75], ebx
scasd eax, dword es:[edi]
jae 0x42bc5c
push cs
cmc
in eax, dx
test al, 0xe5
mov bl, 0x86
outsb dx, byte [esi]
mov dword [edi - 0x7ec91228], ebp
nop
xchg ebx, eax
hlt
push 0xf8dedbac
in eax, 0x5b
sub eax, 0x5264e742
push eax
add eax, 0x76790cdf
add byte [ebx], al
dec esi
and dh, byte [ebx - 0x78]
jp 0x42bd0e
out 0xae, eax
xchg esp, eax
wait
mov ecx, dword [eax - 0x46222a62]
pop ecx
xor bl, byte [ebp + ecx + 0x4f]
cmp byte [ecx], 0xfb
push edi
scasd eax, dword es:[edi]
push ss
mov esi, 0xe784bd93
mov eax, 0x89acc37b
xor bl, byte [ecx - 0x581fc81f]
sbb dl, byte [esi - 0xbb51166]
cmp esp, dword [ecx + edi*8]
scasd eax, dword es:[edi]
mov al, 0x59
xchg esi, eax
in al, dx
dec esp
xchg ebp, eax
loopne 0x42bc85
push esp
je 0x42bd06
iretd
and eax, 0xbb38b960
mov eax, dword [0xfa47c134]
invalid
Function at 0x42d09e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x9fbe274]
jl 0x42d120
imul edx, dword [ebx], 0xffffff9e
inc esi
mov ch, 0x39
loop 0x42d10c
movsd dword es:[edi], dword [esi]
sub dword [eax - 0x5c81224a], eax
fnstsw word [esi - 0x5d]
mov dh, byte [edx - 0x11]
bound esp, qword [edi + 0x78]
jecxz 0x42d0b4
shl byte [esi + 0x4a], 0xb4
jle 0x42d0ce
cmp eax, 0x8a4b2f4c
sub byte [edx], 0x39
add eax, 0x4b05ed14
dec ebx
mov al, byte [edx + 0x1405392a]
in eax, dx
add eax, 0xf9c79d4b
jns 0x42d0e3
dec ebx
popfd
invalid
mov ch, 0xcb
xor dword [eax - 0x32d4eb77], 0xab5d7e75
pop es
jp 0x42d0f0
or al, 0x13
les ebp, [edx + 0x5e]
adc eax, esp
push 0x5e
sbb eax, 0x4f6224e3
sbb eax, 0x4f6224e3
cli
mov edx, 0x50e44770
jo 0x42d139
in al, 0x50
jle 0x42d0b1
push eax
cmp al, 0x3a
push edi
neg byte [0xf2ed8162]
push es
aad 0x41
mov byte [0x58da1b15], al
and byte [ecx], cl
mov bh, 0x2c
wait
invalid
push ds
stc
adc byte [edi], ah
out dx, eax
mov eax, eax
sbb eax, 0xbda80043
jge 0x42d0c5
mov bl, 0x9b
pop edx
cwde
loopne 0x42d148
jo 0x42d18b
inc ebx
mov ecx, 0xb519f71e
inc ecx
neg dword [ecx]
mov ch, 0x41
je 0x42d0e9
cld
add byte [ecx], dh
sahf
out dx, eax
mov bh, 0xb6
invalid
push edi
mov eax, 0x345692ba
aaa
sub ah, byte [edi - 0xc]
cmc
mov eax, 0xf0836912
ret 0x9644
xchg esp, eax
in eax, 0xca
fbld tbyte [edx + 0x16]
arpl word [ecx - 0x5f], sp
jo 0x42d1f9
test byte [ecx], dl
and eax, 0xa1ece622
sbb dl, byte [0x3134e69d]
cwde
pushal
mov esp, 0x36ec1be2
dec edi
out 0x34, al
xor dword [eax + 0x1be2bc60], ebx
in al, dx
dec edi
mov dword [0xe0ee7c06], eax
test dword [edx + 0xa8c52fc], eax
mov ah, 0x85
sbb eax, edx
xchg ebp, eax
loop 0x42d1a0
push edx
or dword [ebx - 0x6d], esi
les esi, [ecx + edi*2 - 0x794972f1]
fsubrp st(0)
insd dword es:[edi], dx
rol byte [ecx + 0x602cbf1a], 0x9d
push ss
aad 0x71
adc byte [esi], al
push eax

Function at 0x43097a
Capabilities:
Encode data using xor

Disassembly:
idiv dword [ebp + 0x4c]
push 0xf445f12
pop edi
inc esp
jle 0x9e51934d
pop edi
inc esp
jle 0x9e51934d
or dl, al
pop edx
call 0x44f1f6fd
jae 0x430975
scasb al, byte es:[edi]
inc esp
rcl dword [ecx + 0x30], 0x59
xchg esp, eax
inc edi
inc esp
pop edx
cmpsb byte [esi], byte es:[edi]
bound ebx, qword [eax - 0xbe7760f]
inc ebx
and dword [ecx + 0x4d415873], 0x78bbe2b5
inc edx
push ss
fld xword [edx + 0x3568405]
dec edi
and edi, esi
and ecx, dword [edx - 0x4bb6b2d1]
xor dword [ebx - 0x6ebd0f98], ebx
cmpsd dword [esi], dword es:[edi]
jp 0x430986
int3
Function at 0x43dd3b
Capabilities:
Encode data using xor

Disassembly:
pop edi
pop ecx
pop ds
mov al, 0xd5
mov al, byte [0xa4539a96]
mov esi, 0xd51ef85b
lcall 0xcacd, 0xaadaa361
mov dword [0xcacdaada], eax
int 0xca
hlt
insd dword es:[edi], dx
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
out dx, al
lodsb al, byte [esi]
jo 0x43dd25
or ch, ch
lea ebp, [eax - 0x61]
test al, 0x4a
dec edx
fadd st(7)
sar byte [0xda42ea16], cl
arpl word [edx], cx
jae 0x43dd79
rol byte [ebp + 0x38e84dad], cl
insb byte es:[edi], dx
int 0xae
movsb byte es:[edi], byte [esi]
jae 0x43dd28
jne 0x43dd48
jnp 0x43dd13
mov dh, 0x24
mov cl, 0x44
das
adc byte [edx], 0x9f
adc byte [ebp - 0x2066db01], bl
mov byte [edi - 0x55], 0xfa
daa
pushal
and cl, byte [ebx]
mov cl, 0x17
or byte [eax + 0x45], 0xee
push edi
test eax, 0xa5ee14d
mov bh, 0x95
mov eax, 0x98e25b71
in al, 0xef
rol bh, 1
cwde
test dword [ebx], edx
dec esi
add byte [ecx + 0x77c49f45], 0x6d
div dword [esi + ecx*2 - 0x1773d53f]
sahf
not al
invalid

Function at 0x442a96
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0044273a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x442ae0
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00402fee
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00402fbf
jmp 0x442aeb
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004136b2
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x442af1
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00409ef8
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x442b2e
call fcn.0044273a
mov dword [esi + 0xc], 1
jmp 0x442b33
call fcn.0044273a
cmp dword [esi], 0
je 0x442b7c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x442b54
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00402fee
jmp 0x442b66
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004019c0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00402fbf
jmp 0x442ba0
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x442ba0
push dword [esi]
push dword [ebp + 8]
call fcn.004136b2
pop esi
pop ebp
ret 0xc
Function at 0x44c55e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
push str.UxTheme.dll
mov dword [esi], vtable.CMFCBaseVisualManager.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
call fcn.0040487d
pop ecx
mov dword [esi + 0x4c], eax
cmp eax, edi
je 0x44c61a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenThemeData
push eax
call edi
push str.CloseThemeData
push dword [esi + 0x4c]
mov dword [esi + 0x50], eax
call edi
push str.DrawThemeBackground
push dword [esi + 0x4c]
mov dword [esi + 0x54], eax
call edi
push str.GetThemeColor
push dword [esi + 0x4c]
mov dword [esi + 0x58], eax
call edi
push str.GetThemeSysColor
push dword [esi + 0x4c]
mov dword [esi + 0x5c], eax
call edi
push str.GetCurrentThemeName
push dword [esi + 0x4c]
mov dword [esi + 0x60], eax
call edi
push str.GetWindowTheme
push dword [esi + 0x4c]
mov dword [esi + 0x64], eax
call edi
mov ecx, esi
mov dword [esi + 0x68], eax
call fcn.0044bee4
jmp 0x44c62f
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
pop edi
mov eax, esi
pop esi
ret

Function at 0x4cfa58
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x736371bb
cld
jno 0x4cfabb
jae 0x4cfa56
sahf
mov dword [0xa63f4603], eax
lodsd eax, dword [esi]
inc edx
aaa
mul byte [eax]
mov bh, 0xab
std
pop ebp
ror al, cl
jno 0x4cfa54
lock or esi, dword [edx]
or esi, dword [edx]
pop esi
out dx, eax
stosb byte es:[edi], al
arpl word [edi + 0xe96b0dd], ax
and dl, al
push ebx
aam 0xab
pop es
xor bh, dh
jg 0x4cfa6f
mov bl, ah
pushal
inc edi
cmovge ebp, edx
mov ch, 0xd4
inc esp
xor edi, dword [edi - 0x4262b8f1]
stosd dword es:[edi], eax
jge 0x4cfa9b
lds edx, [edi - 0x7cb892a2]
mov dl, 0x96
adc byte [ecx - 0xa], al
fdiv dword [eax]
xor al, 0x3d
dec esp
dec ebp
push eax
adc edx, edx
push edx
mov ecx, ebp
retf
pop esi
insd dword es:[edi], dx
inc edi
xor dword [edx - 0x9beef6a], 0xffffffd8
xor byte [edi + 0x11504d4c], dh
rcl byte [edx - 0x77], cl
jmp 0x6bdd437f
out 0xcd, al
out dx, eax
scasb al, byte es:[edi]
sub esi, ebx
mov cl, byte [esi]
lea ecx, [0x4c1b6a01]
insb byte es:[edi], dx
dec ecx
mov esp, 0xa16cf9f7
mov al, byte [0xd6b9c34a]
pop ebx
insb byte es:[edi], dx
jecxz 0x4cfa89
push es
adc byte [edx], dl
jg 0x4cfae0
dec eax
in eax, dx
sub bl, byte [ebp - 0x713ff3e7]
mov edi, 0x5624ebff
jmp 0x50a52d3e