joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100248e1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10024952
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10024934
mov byte [ebp - 0x11], 0
push 0
lea eax, [ebp - 0x11]
push eax
call fcn.10024ac8
pop ecx
pop ecx
jmp 0x1002494d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov edx, 0x488e87e9
mov ecx, dword [ebp - 0x34]
call fcn.10021870
jmp 0x10024ab7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x7983
mov dword [ebp - 0x4c], str.iiwwspizf_grramgn_znnbgm_trvld_kbzlim_twe_rcnxznhoa_duhajsjf_duvzukl_zvxkv_pbpafdrr_ujftzzwo_pcoww_xkib
cmp dword [ebp - 0x24], 0x7c99
jle 0x10024a0f
and dword [ebp - 0x18], 0
jmp 0x10024986
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6f77
jge 0x100249fb
and dword [ebp - 0x1c], 0
jmp 0x1002499c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x64f5
jge 0x100249f9
and dword [ebp - 0x20], 0
jmp 0x100249b2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x79a4
jge 0x100249f7
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10001af4
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.1000e8bf
push eax
call fcn.1004677c
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.1000e8a1
jmp 0x100249ab
jmp 0x10024995
jmp 0x1002497f
push 0xd65
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10024a39
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x10024a37
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x10024a7b
push 0x650
push 0x259a
push 0x52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x76a
push 0x3af
push 0x2420
push 0x15d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x782d
jge 0x10024a91
push dword [ebp - 0x4c]
call fcn.1004677c
pop ecx
jmp 0x10024aad
or dword [ebp - 4], 0xffffffff
jmp 0x10024ab7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025087
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c52c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100251f6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0xc39
mov dword [ebp - 0x3c], str.nzlfksy_gycngk_ptt_oxwxg_wiqj_vbfxedmu_wryuoy_ahnrrhsh_ustczwo_qtfafuyph_cbsgofdn
cmp dword [ebp - 0x28], 0xe18
jle 0x10025187
and dword [ebp - 0x18], 0
jmp 0x100250ef
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7d48
jge 0x10025187
and dword [ebp - 0x1c], 0
jmp 0x10025109
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20ca
jge 0x10025182
and dword [ebp - 0x20], 0
jmp 0x1002511f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7783
jge 0x10025180
and dword [ebp - 0x24], 0
jmp 0x10025135
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1fcd
jge 0x1002517e
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10001af4
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000e8bf
push eax
call fcn.1004677c
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.1000e8a1
jmp 0x1002512e
jmp 0x10025118
jmp 0x10025102
jmp 0x100250e8
push 0x5260
push dword [ebp - 0x30]
push 0x6f21
push 0x6515
push dword [ebp - 0x34]
push 0x73d3
push 0x3374
push dword [ebp - 0x38]
push 1
push 0x3e9d
call fcn.10025263
add esp, 0x28
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0xa64
jge 0x100251ce
push dword [ebp - 0x3c]
call fcn.1004677c
pop ecx
jmp 0x100251ea
or dword [ebp - 4], 0xffffffff
jmp 0x100251f4
jmp 0x10025252
lea eax, [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10025231
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x1002522f
push 0
push 0xc27
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10025252
mov byte [ebp - 0x11], 0
push 0x29be
lea eax, [ebp - 0x11]
push eax
push 0x4608
push 0x6333
push 0
call fcn.10032c10
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003453a
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
push esi
mov byte [ebp - 4], dl
mov esi, ecx
je 0x10034584
cmp byte [ebp + 0x10], 0
je 0x1003457c
push 1
push 0x691d
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
push eax
push 0x5007
push 0x3f0
push 0x3b0b
xor dl, dl
xor cl, cl
call fcn.1003443b
add esp, 0x18
jmp 0x1003459e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1003459e
test dl, dl
je 0x10034595
mov eax, dword [ebp + 0x14]
movzx ecx, byte [eax]
mov eax, dword [ebp + 0x18]
add dword [eax], ecx
jmp 0x1003459e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [esi]
mov dword [ecx], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10037410
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10037427
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10037449
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100d8c64
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100d8ff0
jl 0x10037457
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100d9294
jl 0x10037497
mov ecx, dword [0x100d9fe0]
xor ecx, dword [0x100d8c64]
and ecx, edi
xor ecx, dword [0x100d9fe0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100d8c60], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100d9294]
mov dword [0x100d9620], eax
pop esi
ret

Function at 0x10037545
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0xa6318529
xor eax, eax
mov dword [ebp - 8], 0x9beb0647
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], 2
mov dword [ebp - 8], eax
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 8], eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10037583
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
inc dword [ebp - 8]
push 0x7901
push 0x156b9
call fcn.1003319e
pop ecx
pop ecx
call eax
mov esp, ebp
pop ebp
ret
Function at 0x1003a4e7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x1003a50d
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003a517
push 0x5574
push 0
push ecx
mov ecx, 0x5cf1
call fcn.1003975d
add esp, 0xc
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop ebp
ret

Function at 0x1003a519
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c818
call fcn.1005b550
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1003a5f4
push 0x4eab
push 1
push ecx
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x11]
push 0x4035
call fcn.10038b37
mov dword [ebp - 0x20], 0x1626
add esp, 0x10
cmp dword [ebp - 0x20], 0x19f3
jle 0x1003a5bc
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10075c58
xor eax, edi
cdq
push edx
push eax
call fcn.1000ed7e
inc esi
cmp esi, 0x1cb0
jl 0x1003a577
inc ebx
cmp ebx, 0x229b
jl 0x1003a575
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x26f
jl 0x1003a56c
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x8a6
jl 0x1003a567
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x146c
jge 0x1003a5d8
mov edx, str.adamxvvvb_ioyved_snit_pnderiza
mov ecx, 0x10075c58
call fcn.1001381a
jmp 0x1003a5f9
mov eax, dword [ebp + 0xc]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003af3c
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x1005c840
call fcn.1005b550
sub esp, 0x40
push ebx
push esi
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x28], 0x166c
cmp dword [ebp - 0x28], 0x511
push edi
mov dword [ebp - 0x10], esp
jge 0x1003afb3
push 0x100d8844
push 0x10076dbc
push str._d__d
call fcn.100461eb
add esp, 0xc
cmp dword [0x10076dbc], 1
jle 0x1003af96
cmp dword [0x100d8844], 0
jne 0x1003af96
push str.No_solution
call fcn.10046996
pop ecx
push dword [0x100d8844]
push 0x100639fc
call fcn.1004677c
push 0x1006396a
call fcn.10046996
add esp, 0xc
cmp byte [ebp - 0x18], 0
je 0x1003b102
mov dword [ebp - 0x28], 0x131f
cmp dword [ebp - 0x28], 0x1481
jle 0x1003aff2
xor esi, esi
mov edi, esi
mov ebx, 0x15d9
mov eax, edi
mov ecx, 0x10075c58
cdq
push edx
push eax
call fcn.1000ed7e
dec edi
dec ebx
jne 0x1003afd6
inc esi
cmp esi, 0x22bb
jl 0x1003afcf
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x10f8
jge 0x1003b00e
mov edx, str.sgp_xpkksajqo_xcy_ecg_cibo_xqk_ffz_caia_gdlj_vhun_vttq_udoxztme_brrq
mov ecx, 0x10075c58
call fcn.1001381a
mov esi, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
cmp dword [esi], 4
jl 0x1003b181
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x9f6d4a0d
push eax
push edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0xc8fbfc75
push eax
push ecx
push esi
push 0x48e3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 7
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 1
push eax
push ecx
mov dword [ebp - 0x2c], 0xffffffff
lea edx, [ebp - 0x30]
push 1
mov ecx, ebx
call fcn.100395d1
add esp, 0x28
mov dword [ebp - 0x1c], 0
jmp 0x1003b0ef
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0x32da3bb1
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0
jne 0x1003b0b6
mov eax, dword [esi]
mov eax, dword [edi]
xor edx, edx
mov eax, dword [ebx]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [edi]
mov eax, dword [ebp - 0x30]
add ecx, 0x7ddc
cmp ecx, eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
sete dl
sub eax, edx
sub ecx, eax
mov eax, 0x934eca66
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x37
jl 0x1003b098
inc dword [esi]
cmp dword [esi], 4
jge 0x1003b02a
jmp 0x1003b181
mov dword [ebp - 0x28], 0x49c2
cmp dword [ebp - 0x28], 0x4a1b
jle 0x1003b168
push 1
push 0x972
push 0x1929
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x48]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b143
mov eax, dword [eax]
push eax
call fcn.1004677c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1000f813
inc edi
cmp edi, 0x70fc
jl 0x1003b128
inc esi
cmp esi, 0x44b2
jl 0x1003b126
mov eax, dword [ebp + 0x14]
inc dword [eax]
cmp dword [ebp - 0x28], 0x476a
jge 0x1003b181
push str.ffbeo_elc_ivnus_mpmahg
call fcn.1004677c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403228
push 0x4020c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x404164], 0xffffffff
mov dword [0x404168], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x404160]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40415c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x40416c], ecx
call fcn.004020b0
mov eax, dword [0x40411c]
test eax, eax
jne 0x401f51
push 0x4020a0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00402080
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x404158]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x404154]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40205f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x401fc5
cmp al, 0x22
jne 0x401fb7
cmp byte [esi], 0x22
jne 0x401fce
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x401fde
cmp al, 0x20
ja 0x401fde
inc esi
mov dword [ebp - 0x74], esi
jmp 0x401fce
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x401fff
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x402004
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x402044
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x401fce
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40205f

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x79c758bc
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x45cd4c15
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4ab1b3]
shl eax, 2
mov dword [0x4ab1b7], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0049f94c
pop edx
call fcn.0049ec88
call fcn.0049f950
push 0
call fcn.004a0be4
pop ecx
push 0x4ab15c
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4ab1bb], eax
push 0
jmp fcn.004a7ad8
Function at 0x406ca4
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x406cc4
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x406cab
cmp dword [eax], 0x11
jbe 0x406ce0
mov dword [eax], 0x11
jmp 0x406cd3
dec dword [eax]
cmp dword [eax], 0
je 0x406ce0
mov edx, dword [eax]
cmp dword [eax + edx*4], 0
je 0x406cd1
ret

Function at 0x407570
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x4075b8
mov eax, 1
jmp 0x407590
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x407586
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, ebx
push edx
add eax, edi
push eax
call fcn.0049fbe4
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40761e
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jbe 0x4075f7
mov eax, 1
jmp 0x4075cf
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x4075c5
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
shl eax, 2
add edx, esi
push edx
add eax, edi
push eax
call fcn.0049fbe4
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x40761e
mov eax, dword [ebx]
test eax, eax
jbe 0x40760a
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x40760a
dec eax
test eax, eax
ja 0x4075fd
mov dword [edi], eax
test eax, eax
jbe 0x40761e
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x407610
pop edi
pop esi
pop ebx
ret
Function at 0x408e60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff790
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x35], dl
mov ebx, eax
mov eax, 0x4abc84
call fcn.004a0204
cmp byte [ebx + 0x763d], 0
mov eax, dword [ebx + 0x13cc]
je 0x408e9e
cmp byte [eax + 0x28e9], 0
jne 0x408e9e
cmp byte [ebx + 0x7638], 0
je 0x408eaf
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
mov eax, edx
jmp 0x409059
mov word [ebp - 0x24], 8
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040fcbc
inc dword [ebp - 0x18]
xor edx, edx
mov word [ebp - 0x24], 0x14
movzx eax, word [ebx + 0x4f18]
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebx + 0x4f1c]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.00409f94
mov eax, ebx
call fcn.004054dc
cmp byte [ebp - 0x35], 0
je 0x408f2c
push pe_nt_image_headers32
lea edx, [ebp - 0x238]
push edx
push dword [0x4cfe40]
call sub.USER32.DLL_GetWindowTextA
mov eax, 0x34a
call fcn.00413388
call fcn.004781d0
call fcn.004774b8
push 0x638
push 0
lea edx, [ebp - 0x870]
push edx
call fcn.0049fc54
add esp, 0xc
mov ecx, dword [ebx + 0x4ee8]
sub ecx, 0x76
je 0x408f5a
sub ecx, 3
je 0x408f94
dec ecx
je 0x408fa6
jmp 0x408fdf
test byte [ebx + 0x4f14], 0x20
jne 0x408f82
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040fd28
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
jmp 0x409059
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.0040875c
jmp 0x408fdf
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00409060
jmp 0x408fdf
push 0x4abb70
lea eax, [ebx + 0x5c80]
push eax
call fcn.0049fd88
add esp, 8
test eax, eax
sete dl
and edx, 1
test dl, dl
je 0x408fd8
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.004092a4
jmp 0x408fdf
mov byte [ebp - 0x23a], 1
cmp byte [ebp - 0x35], 0
je 0x408ff5
lea eax, [ebp - 0x238]
call fcn.004781d0
call fcn.004774b8
test esi, esi
je 0x40900a
push esi
mov edi, esi
lea esi, [ebp - 0x870]
mov ecx, 0x18e
rep movsd dword es:[edi], dword [esi]
pop esi
cmp byte [ebp - 0x23a], 0
je 0x40903f
cmp byte [ebp - 0x35], 0
je 0x40903f
mov eax, 0x2a9
call fcn.00413388
push eax
add ebx, 0x17
push ebx
call fcn.00480d50
add esp, 8
mov eax, 0x4bb2e4
mov edx, 1
call fcn.0042ecec
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040fd28
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409818
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40983b
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x40984c
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x40985b
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x409868
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.0041113c
test eax, eax
je 0x409895
test esi, esi
je 0x409895
cmp word [esi], 0
je 0x409895
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x4098ac
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4098c5
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4098c5
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x409933
mov dword [ebx + 4], edi
test esi, esi
je 0x4098fa
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00411488
jmp 0x409903
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x40991a
push dword [ebp - 4]
lea ecx, [ebx + 0x17]
push ecx
call fcn.0049fdd4
add esp, 8
jmp 0x409929
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.004111a0
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.00409a64
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8