joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edx, 0x1c
ja case.default.0x51f6d1
push ebx
mov ebx, ecx
mov ecx, eax
sub esp, 0x18
jmp dword [edx*4 + 0x8ad680]
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnQueryAccount_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnEnsureAccountCancellation_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnQueryAccountInformation_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnGetVerificationCode_clicked__
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp], eax
call method.LoginDialog.on_cmbLauguage_activated_int_
sub esp, 4
add esp, 0x18
pop ebx
ret
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnHelp_Recharge_2_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnHelp_2_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnHelp_Select_2_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnUpdateVIP_Recharge_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnHelp_Recharge_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnHelp_Select_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnBack_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnChange_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnActivationVIP_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnCancle_U_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnCancle_Recharge_clicked__
mov eax, dword [ebx + 4]
mov dword [esp], eax
call method.LoginDialog.on_ldtPhoneEmail_textChanged_QString_const_
sub esp, 4
jmp 0x51f730
mov eax, dword [ebx + 4]
mov dword [esp], eax
call method.LoginDialog.on_ldtEmailOrPhone_textChanged_QString_const_
sub esp, 4
jmp 0x51f730
mov eax, dword [ebx + 4]
mov dword [esp], eax
call method.LoginDialog.on_ldtAccount_F_textChanged_QString_const_
sub esp, 4
jmp 0x51f730
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnHelp_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnTestServers_clicked__
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp], eax
call method.LoginDialog.on_cmbRemoteServers_currentIndexChanged_int_
sub esp, 4
jmp 0x51f730
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp], eax
call method.LoginDialog.onLanguageIndexChanged_int_
sub esp, 4
jmp 0x51f730
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnUpdateVIP_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnEnsureReset_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnRegister_clicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.onCancelClicked__
add esp, 0x18
pop ebx
jmp method.LoginDialog.on_pbnLogin_clicked__
mov eax, dword [ebx + 4]
mov dword [esp], eax
call method.LoginDialog.on_cbxAreacode_currentIndexChanged_QString_const_
sub esp, 4
jmp 0x51f730
repz ret

Function at 0x5302f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xc
add esp, 0xc
jmp sym._private_AES_set_decrypt_key
Function at 0x530300
Capabilities:
Encrypt data using aes
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
add esp, 0xc
jmp sym._private_AES_set_encrypt_key
Function at 0x532300
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x24], 0
jne 0x532350
mov dword [esp + 0x24], sym._AES_decrypt
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
pop eax
pop ebx
pop esi
jmp sym._CRYPTO_cbc128_decrypt
mov dword [esp + 0x24], sym._AES_encrypt
pop edx
pop ebx
pop esi
jmp sym._CRYPTO_cbc128_encrypt

Function at 0x533b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x8fdba0]
test esi, esi
jle 0x533c30
mov edi, dword [0x8fdba4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x533b54
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x533bd5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x533b40
mov dword [esp], eax
mov ebx, eax
call sym.___mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x533c57
mov eax, dword [0x8fdba4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x8fdba4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x533c37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x533bce
sub eax, 4
and eax, 0xfffffffb
jne 0x533be0
add dword [0x8fdba0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x8fdba4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x533bce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
xor esi, esi
jmp 0x533b5e
mov eax, dword [0x8fdba4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
mov esi, esi
lea edi, [edi]
Function at 0x534090
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x8fdbb8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x8fdbb0]
sub esp, 4
test ebx, ebx
je 0x5340e5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x5340de
test esi, esi
je 0x5340de
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x5340c0
mov dword [esp], 0x8fdbb8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x534670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x5347fc
mov eax, dword [esp + 0x3c]
add eax, 1
lea edx, [eax*4]
cmp eax, 0x20000000
mov eax, 0xffffffff
cmovb eax, edx
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov edx, dword [esp + 0x3c]
mov edi, eax
test edx, edx
je 0x53478c
xor ebx, ebx
nop
lea esi, [esi]
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + ebx*4]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sym.operator_new___unsigned_int_
mov ecx, dword [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
mov dword [edi + ebx*4], esi
add ebx, 1
cmp dword [esp + 0x3c], ebx
jne 0x5346e0
lea eax, [edi + ebx*4]
mov dword [eax], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.qMain_int__char_
mov esi, eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x5347e8
mov eax, dword [edi]
test eax, eax
je 0x5347e8
xor ebx, ebx
jmp 0x5347d7
mov eax, dword [edi + ebx*4]
test eax, eax
je 0x5347e8
mov dword [esp], eax
add ebx, 1
call sym.operator_delete___void_
cmp dword [esp + 0x3c], ebx
jne 0x5347d0
mov dword [esp], edi
call sym.operator_delete___void_
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov esi, 0xffffffff
jmp 0x5347f0
Function at 0x5357c0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x535813
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x535800
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x535890
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call sym.___pformat_emit_float
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call sym.___pformat_putc
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp sym.___pformat_int.isra.0
mov eax, dword [0x5d565c]
cmp eax, 0xffffffff
je 0x5358c5
test eax, eax
je 0x5358b5
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x53581b
mov dword [0x5d565c], 0
call sym.__get_output_format
test al, 1
mov edx, 3
jne 0x53589e
jmp 0x5358a3
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sym._getenv
test eax, eax
je 0x5358ab
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
ja 0x5358ab
mov dword [0x5d565c], 1
jmp 0x53589e
Function at 0x5b81c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4086d9
pop dword [ebp - 0x2c]
mov eax, 0x31ca900c
sub eax, 0x318a0933
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x23a95ddf
add dword [ebp - 0x3c], 0x2aa8e76c
mov dword [ebp - 0x38], 0xcfeb32b
add dword [ebp - 0x38], 0x2534991a
mov dword [ebp - 0x34], 0xb6e8692a
sub dword [ebp - 0x34], 0x6a9c24fc
mov dword [ebp - 0x30], 0x310f9c2b
add dword [ebp - 0x30], 0xcef063d5
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x63698fe9
add dword [ebp - 0x3c], 0x1108d96d
mov dword [ebp - 0x38], 0xee51866c
sub dword [ebp - 0x38], 0xace524f7
mov dword [ebp - 0x34], 0x6e7d241c
sub dword [ebp - 0x34], 0xb0db7b0
mov dword [ebp - 0x30], 0xc391fdb0
add dword [ebp - 0x30], 0x3c6e0250
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xff2b9085
sub eax, 0xfeeac039
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1dd
push 0
call eax
mov ecx, 0x4a63
mov ebx, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x2c]
mov edi, 0xf24dec6b
sub edi, 0x379ca48d
sub dword [ebp - 0xc], ecx
mov esi, dword [edx]
add dword [ebp - 0x28], 0xdbcf27c2
xor esi, edi
sub dword [ebp - 0x28], edi
mov dword [ebx], esi
mov dword [ebp - 0x14], 0x6a0458d1
add ebx, 4
add edx, 0xc3fcaa4f
sub edx, 0xc3fcaa4b
loop 0x4087ea
add eax, 0x11c5f
mov ebx, eax
add eax, 0xa23a32c0
add eax, 0x5dc5cd45
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40128c
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and esp, 0xfffffff0
mov eax, 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.004029e0
call sym.___main
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 4
jle 0x4012bc
jmp 0x40133e
mov dword [ebp - 8], 1
mov eax, 4
sub eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jle 0x4012d2
jmp 0x4012e9
sub esp, 0xc
push 0x401280
call sym._printf
add esp, 0x10
lea eax, [ebp - 8]
inc dword [eax]
jmp 0x4012c3
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
add eax, eax
dec eax
cmp dword [ebp - 0xc], eax
jle 0x4012fd
jmp 0x401314
sub esp, 0xc
push 0x401281
call sym._printf
add esp, 0x10
lea eax, [ebp - 0xc]
inc dword [eax]
jmp 0x4012f0
sub esp, 0xc
push 0x401283
call sym._printf
add esp, 0x10
sub esp, 0xc
push 0x401285
call sub.msvcrt.dll_system
add esp, 0x10
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x4012b1
mov eax, 0
leave
ret
Function at 0x402820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [0x403070]
test eax, eax
je 0x40283d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x61616161
push eax
mov dword [ebp - 0x44], 0x61616161
mov dword [ebp - 0x40], 0x61616161
mov dword [ebp - 0x3c], 0x61616161
mov dword [ebp - 0x38], 0x61616161
mov dword [ebp - 0x34], 0x61616161
mov dword [ebp - 0x30], 0x61616161
mov dword [ebp - 0x2c], 0x61616161
mov byte [ebp - 0x28], 0
call sub.KERNEL32.dll_FindAtomA
add esp, 0xc
test ax, ax
jne 0x402994
sub esp, 0xc
xor esi, esi
lea ebx, [ebp - 0x78]
push 0x14
call sym._malloc
lea ecx, [ebp - 0xa8]
mov dword [0x403070], eax
add esp, 0x10
mov dword [eax], 0
mov edx, eax
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 4], sym._abort
mov dword [eax + 8], sym._abort
mov edi, ecx
test eax, eax
jne 0x402980
lea ecx, [ebp - 0xa7]
mov byte [ebp - 0xa8], 0x30
cmp ecx, edi
jbe 0x4028fb
lea esi, [esi]
dec ecx
inc esi
mov al, byte [ecx]
mov byte [ebx], al
inc ebx
cmp ecx, edi
ja 0x4028f0
mov eax, 0x20
mov byte [ebx], 0
sub eax, esi
push edi
lea edx, [ebp - 0x48]
push eax
push 0x61
push edx
call sym._memset
add esp, 0x10
xor edx, edx
cmp edx, esi
jae 0x402936
nop
lea esi, [esi]
mov eax, edx
sub eax, esi
cmp byte [ebp + edx - 0x78], 0x30
je 0x402975
mov cl, 0x41
inc edx
mov byte [ebp + eax - 0x28], cl
cmp edx, esi
jb 0x402920
sub esp, 0xc
lea eax, [ebp - 0x48]
mov byte [ebp - 0x28], 0
push eax
call sub.KERNEL32.dll_AddAtomA
add esp, 0xc
mov edx, dword [0x403070]
lea eax, [edx + 4]
mov dword [0x403074], eax
lea eax, [edx + 8]
mov dword [0x403078], eax
lea eax, [edx + 0xc]
add edx, 0x10
mov dword [0x40307c], eax
mov dword [0x403080], edx
jmp 0x402835
mov cl, 0x61
jmp 0x40292d
mov eax, edx
and eax, 1
add eax, 0x30
mov byte [ecx], al
inc ecx
shr edx, 1
jne 0x402980
jmp 0x4028e9
lea edx, [ebp - 0x48]
push ebx
and eax, 0xffff
push 0x21
push edx
push eax
call sub.KERNEL32.dll_GetAtomNameA
xor edx, edx
pop ecx
lea esi, [esi]
cmp byte [ebp + edx - 0x48], 0x61
setne al
add eax, 0x30
mov byte [ebp + edx - 0x48], al
inc edx
cmp edx, 0x1f
jbe 0x4029b0
push eax
lea eax, [ebp - 0x48]
push 2
push 0
push eax
call sym._strtoul
add esp, 0x10
mov dword [0x403070], eax
jmp 0x402949
Function at 0x4018bb
Capabilities:
Read .ini file

Disassembly:
push ebx
push 0x13
push edi
push esi
call sub.KERNEL32.DLL_GetPrivateProfileIntA
cmp eax, 1
jbe 0x4018cc
xor eax, eax
xchg ecx, eax
jecxz 0x4018de
push ecx
push ecx
push ebp
push dword [0x413bb1]
call sub.USER32.DLL_CheckDlgButton
pop ecx
add cl, 0x30
mov eax, 0x413c0e
mov dword [eax], ecx
push ebx
push eax
push edi
push esi
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret

Function at 0x401a7e
Capabilities:
Hide graphical window

Disassembly:
movzx eax, word [0x4092df]
bsf ecx, eax
btr eax, ecx
mov ecx, dword [esp + 0xc]
bts eax, ecx
mov word [0x4092df], ax
push 0
push dword [esp + 0xc]
call sub.USER32.DLL_ShowWindow
mov eax, dword [esp + 4]
push eax
push eax
push 9
push eax
call sub.USER32.DLL_ShowWindow
call sub.USER32.DLL_SetForegroundWindow
call sub.USER32.DLL_SetActiveWindow
ret 0xc

Function at 0x401abe
Capabilities:
Delete file
Get file size

Disassembly:
pushal
push 0
push 0x4072db
call sub.KERNEL32.DLL__lcreat
mov ecx, dword [edi + 0x48]
mov dword [ebp - 8], eax
inc eax
jne 0x401aea
push 0x10
push dword [0x4092d7]
push ecx
push dword [ebp + 8]
call sub.USER32.DLL_MessageBoxA
stc
popal
ret 0xc
mov esi, dword [esp + 0x24]
add esi, 0x18
xor edi, edi
mov edx, dword [esp + 0x28]
cmp edi, edx
je 0x401b06
add esi, dword [ebp - 4]
xor eax, eax
lodsb al, byte [esi]
add esi, eax
inc edi
jmp 0x401af7
mov edx, dword [esp + 0x24]
mov edi, esi
sub edi, edx
push edi
push edx
push dword [ebp - 8]
call sub.KERNEL32.DLL__lwrite
inc eax
jne 0x401b4e
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax + ecx*4 + 0x4c]
push 0x10
push dword [0x4092d7]
push eax
push dword [ebp + 8]
call sub.USER32.DLL_MessageBoxA
push 0x4072db
call sub.KERNEL32.DLL_DeleteFileA
stc
popal
ret 0xc
add esi, dword [ebp - 4]
xor eax, eax
lodsb al, byte [esi]
add esi, eax
sub ebx, edi
sub ebx, dword [ebp - 4]
sub ebx, eax
dec ebx
push ebx
push esi
push dword [ebp - 8]
call sub.KERNEL32.DLL__lwrite
inc eax
je 0x401b1b
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetFileSize
xchg esi, eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x104
mul dword [esp + 0x2c]
lea ebx, [eax + 0x4132ce]
push ebx
push 0x4072db
call sub.MAIN32.DLL_RenameFileA
cmp esi, 0x24
ja 0x401ba3
push ebx
call sub.KERNEL32.DLL_DeleteFileA
clc
popal
ret 0xc
Function at 0x403faa
Capabilities:
Get file size

Disassembly:
mov edi, esi
pushal
push 0
push ebx
call sub.KERNEL32.DLL__lopen
mov edi, eax
inc eax
jne 0x403fd2
mov eax, dword [esp + 0x14]
push 0x10
push dword [0x4092d7]
push eax
push dword [ebp + 8]
call sub.USER32.DLL_MessageBoxA
popal
stc
ret
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
or eax, eax
jne 0x403fe9
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esi + 0x78]
jmp 0x403fbe
mov dword [esp + 0x10], eax
mov ebx, eax
shr eax, 3
inc eax
inc eax
shl eax, 3
push eax
push 0x42
call sub.KERNEL32.DLL_LocalAlloc
or eax, eax
jne 0x404011
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [esi + 0x80]
jmp 0x403fbe
mov dword [esp + 0x1c], eax
mov dword [0x413a5a], eax
push eax
call sub.KERNEL32.DLL_LocalLock
mov dword [0x413a56], eax
mov dword [esp + 4], eax
xchg esi, eax
push ebx
push esi
push edi
call sub.KERNEL32.DLL__lread
inc eax
pushfd
push edi
call sub.KERNEL32.DLL_CloseHandle
popfd
jne 0x404058
push esi
call sub.KERNEL32.DLL_LocalUnlock
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_LocalFree
mov eax, dword [esp + 0x14]
add eax, 4
jmp 0x403fbe
clc
popal
ret

Function at 0x40474f
Capabilities:
Delete file

Disassembly:
pushal
push 2
push ebx
call sub.KERNEL32.DLL__lopen
mov dword [ebp - 4], eax
inc eax
jne 0x4047c9
push 0
push dword [esp + 0x14]
call sub.KERNEL32.DLL__lcreat
mov dword [ebp - 4], eax
inc eax
jne 0x404779
mov eax, dword [esp + 0x1c]
mov eax, dword [edi + eax*4 + 0x28]
jmp 0x4047af
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.00401966
push 0x18
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL__lwrite
inc eax
jne 0x40482b
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x10]
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [esp + 0x1c]
mov eax, dword [edi + eax*4 + 0x30]
push 0x10010
push dword [0x4092d7]
push eax
push dword [0x413bb5]
call sub.USER32.DLL_MessageBoxA
stc
popal
ret
dec eax
push 0x18
push esi
push eax
call sub.KERNEL32.DLL__lread
mov ebx, dword [esp + 0x1c]
inc eax
jne 0x4047e8
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [edi + ebx*4 + 0x38]
jmp 0x4047af
push ebx
push esi
call fcn.00401a43
je 0x40481f
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push 0x10014
push dword [0x4092d7]
push dword [edi + ebx*4 + 0x40]
push dword [0x413bb5]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x40475e
stc
popal
ret
push 2
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL__llseek
clc
popal
ret

Function at 0x40482e
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x413bb5]
push dword [esp + 4]
push eax
push dword [esp + 0x10]
push eax
call sub.USER32.DLL_GetDlgItem
push 0
push eax
call sub.USER32.DLL_ShowWindow
call sub.USER32.DLL_GetDlgItem
push 5
push eax
call sub.USER32.DLL_ShowWindow
ret 8
Function at 0x406178
Capabilities:
Encode data using xor

Disassembly:
enter 0x50, 0
pushal
lea edi, [ebp - 0x28]
mov eax, 0x12345678
mov dword [ebp - 4], eax
mov dword [edi], eax
mov dword [edi + 4], 0x23456789
mov dword [edi + 8], 0x3456789a
mov dword [edi + 0xc], 0x456789ab
mov dword [edi + 0x10], 0x56789abc
mov dword [edi + 0x14], 0x6789abcd
mov dword [edi + 0x18], 0x789abcde
mov eax, 0x89abcdef
mov dword [edi + 0x1c], eax
mov dword [ebp - 8], eax
lea edi, [ebp - 0x50]
push edi
xor eax, eax
push 9
pop ecx
rep stosd dword es:[edi], eax
pop edi
mov esi, 0x413082
push edi
lodsb al, byte [esi]
stosb byte es:[edi], al
or al, al
jne 0x4061d1
pop esi
push 0x1f
pop ebx
push esi
lodsb al, byte [esi]
mov edi, esi
mov ecx, ebx
xor byte [edi], al
rol dword [edi], cl
inc edi
loop 0x4061e1
dec ebx
jne 0x4061dc
pop esi
lea edi, [ebp - 0x28]
push 8
pop ecx
push esi
lodsd eax, dword [esi]
xor dword [edi], eax
add edi, 4
loop 0x4061f3
pop esi
push 8
pop ecx
push esi
lodsd eax, dword [esi]
xor dword [ebp - 4], eax
xor dword [ebp - 8], eax
loop 0x406200
pop esi
xor eax, eax
push 0x1f
pop ecx
mov al, byte [ecx + 0x40936b]
mov ebx, dword [ebp + eax*4 - 0x28]
mov dword [ecx*4 + 0x4139ae], ebx
dec ecx
jns 0x40620f
mov esi, dword [ebp + 8]
xor edi, edi
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push 0x1f
pop ebx
add edx, 0x1010101
add ecx, 0x1010104
adc ecx, 0
push ebx
mov eax, edx
add eax, dword [ebx*4 + 0x4139ae]
mov ebx, eax
shr ebx, 0x10
add ebx, dword [0x413bed]
mov ebx, dword [ebx*2 + 0x20002]
and eax, 0xffff
add eax, dword [0x413bed]
mov eax, dword [eax*2]
shrd eax, ebx, 0x10
rol eax, 0xb
xchg ecx, edx
xor edx, eax
pop ebx
dec ebx
jns 0x406240
xor dword [esi + edi*8], ecx
xor dword [esi + edi*8 + 4], edx
inc edi
cmp edi, dword [ebp + 0xc]
jne 0x40622e
popal
leave
ret 8

Function at 0x421008
Capabilities:
Encode data using xor

Disassembly:
pushal
pushfd
call 0x421008
in eax, 0x5d
sub ebp, 0x401007
mov eax, 0xda09a240
mov esi, 0x401029
add esi, ebp
mov ecx, 0x17b
nop
xor dword [esi], eax
inc esi
inc esi
inc esi
inc esi
loop 0x421021
sti
mov byte [0x29409a09], al
cli
pushal
hlt