joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c15e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002bf27
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002c18e
xor eax, eax
jmp 0x1002c2d1
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1002bf65
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002c1b6
xor eax, eax
jmp 0x1002c2d1
push 0x34a6
push 0x2fb7
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002bfd4
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1002c1df
xor eax, eax
jmp 0x1002c2d1
push 1
push 0x670f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.1002bda4
add esp, 0x1c
push dword [ebp + 8]
push dword [ebp - 4]
push 0x5829
push 0x57d4
push 0x569a
push 0x7995
push 0
push 0x41c7
push dword [ebp - 8]
call fcn.100243dc
add esp, 0x24
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002c256
lea eax, [ebp - 4]
push eax
push 0x5b63
push 0x1d3c
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.1002c069
add esp, 0x14
push dword [ebp - 4]
call fcn.1002b8e1
pop ecx
test eax, eax
jne 0x1002c267
xor eax, eax
jmp 0x1002c2d1
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002c0f1
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002c2b9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002c293
xor eax, eax
jmp 0x1002c2d1
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002c2ac
xor eax, eax
jmp 0x1002c2d1
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002c124
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002c2ca
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002c2ce
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10041ecd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10041f3d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, ecx
push eax
mov ecx, dword [ebp - 0x28]
call fcn.1004698d
jmp 0x10041f4a
push 0x2279
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10074126
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007e38c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100638fa
mov dword [ebp - 0x14], eax
cmp dword [0x1066b114], esi
jne 0x10074219
push 0x800
push esi
push 0x10007b2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100741a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100742f9
push esi
push esi
push 0x10007b2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100742f9
push 0x10007b44
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100742f9
push eax
call ebx
push 0x10007b50
push edi
mov dword [0x1066b114], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b60
push edi
mov dword [0x1066b118], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b74
push edi
mov dword [0x1066b11c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066b124], eax
test eax, eax
je 0x10074216
push 0x10007b90
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066b120], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007423e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10074231
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10074253
push 4
pop eax
jmp 0x100742fb
cmp dword [ebp - 0x14], esi
je 0x10074253
push dword [0x1066b114]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10074238
mov eax, dword [0x1066b120]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100742b1
cmp dword [0x1066b124], edi
je 0x100742b1
push eax
call ebx
push dword [0x1066b124]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100742b1
test eax, eax
je 0x100742b1
call ecx
test eax, eax
je 0x100742a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100742a6
test byte [ebp - 8], 1
jne 0x100742b1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100742e1
mov eax, dword [0x1066b118]
cmp eax, edi
je 0x100742de
push eax
call ebx
test eax, eax
je 0x100742de
call eax
mov esi, eax
test esi, esi
je 0x100742de
mov eax, dword [0x1066b11c]
cmp eax, edi
je 0x100742de
push eax
call ebx
test eax, eax
je 0x100742de
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066b114]
call ebx
test eax, eax
je 0x100742f9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100742fb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005f775
mov esp, ebp
pop ebp
ret
Function at 0x4207ec
Capabilities:
Encode data using xor

Disassembly:
cmc
pop ds
fimul word [edi]
mov ebp, 0xcbdf11b2
mov bl, 0xc7
jmp 0x420831
in eax, dx
daa
push esp
jae 0x420891
pushal
or al, 0x96
sub esi, dword [ecx + 0x40]
pop esp
int 0x8c
inc esi
out dx, eax
mov dh, 0x62
push ds
inc ebx
repne stosd dword es:[edi], eax
inc esp
jns 0x42085c
invalid
rcl ebx, cl
pop eax
dec eax
or cl, bh
invalid
push esi
cmc
mov cl, 0x94
push 0x5b
xchg bl, dl
call 0xcbfa6885
mov dword [0xb392b331], eax
stc
std
add byte [ebx], 0x9c
adc dl, byte [edx + 0x13893f31]
or al, 0xe2
fistp word [edi + 0x723cbc38]
cmp al, 0x72
jb 0x4208de
pop ds
pop ds
dec ecx
jmp 0x4208e1
xchg esi, eax
outsb dx, byte [esi]
mov bl, 0x7b
dec eax
salc
dec eax
clc
cmpsb byte [esi], byte es:[edi]
loop 0x420948
ffreep st(4)
loope 0x4208c6
pop edi
add ebx, ebp
out 0x15, al
xor esp, edx
pop esi
sub edi, dword [edi + 0x401f5396]
add dword [ebp - 0x71], edi
adc dh, dl
or byte [ebp - 0x12a5ca18], al
mov ah, 0x10
in eax, 0xac
pop ebp
jbe 0x4208b6
das
loope 0x4208c1
jo 0x4208fc
mov bh, 0x36
jmp 0x420942
add eax, 0x12ee03f4
in eax, 0xca
cmpsb byte es:[esi], byte es:[edi]
jns 0x4208b5
in eax, dx
invalid
ret 0xf624
inc esp
imul ebp, dword [edi + 0x16], 0x7e745d4e
je 0x4209c8
fistp dword [edi]
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x6b9d3b73]
scasb al, byte es:[edi]
pop es
bound esi, qword [ecx + 0x1677087e]
cmpsb byte [esi], byte es:[edi]
mov bh, 0xa3
push cs
xchg esp, eax
mov ah, 0xfe
mov al, 0x95
xchg dword [eax + 0x5c4e9671], eax
jecxz 0x4209c5
push edi
adc byte [ecx + 0x15286f00], bh
lodsb al, byte [esi]
jecxz 0x420934
test byte [edi], al
jge 0x4209cf
test eax, 0x25d47491
invalid
out 0x7a, al
xor dword [ebx - 5], edi
jp 0x4209f8
jnp 0x4209c4
sti
sbb edx, esi
jbe 0x4209cb
xor byte [edi + edi + 0x674fe26b], bl
inc eax
aas
imul esp, edx, 0x4f
inc eax
popal
sub al, 0xb4
int 0xbf
push eax
hlt
aad 0xfb
push edi
push 0xcba1d6ad
test byte [esi], 0x4f
loope 0x420a82
sbb dword [eax - 0xa], eax
jns 0x420a30
retf
sbb ax, word [ecx + 0x2d77f6b7]
inc ebx
fadd dword [ecx + 0x1768aee5]
fisttp word [0x2b9fa740]
pop ebx
cmpsd dword [esi], dword es:[edi]
invalid
adc cl, 0xc1
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x443d18
Capabilities:
Encode data using xor

Disassembly:
jno 0x443d7e
salc
sar byte [eax], cl
cmpsb byte [esi], byte es:[edi]
sub dword [esi - 0x67], edx
pop edi
sbb byte [ecx + ecx*8], al
mov esi, 0x60029e18
andnps xmm6, xmmword [ebx]
aaa
mov word [ecx - 0xaa7c380], fs
sub bl, byte [ebp + 0x6b28ed8f]
sbb al, 0xaf
sub ah, dh
fsub dword [edx - 0xa]
cld
cmp al, 0x9a
mov bh, byte [esi + esi*2]
clc
jb 0x443d35
popfd
invalid
or al, 0xc
sbb ah, byte [esi - 0x3d]
lea esi, [edx + 0x717dd5b2]
sbb al, 0x91
jns 0x443db5
xchg ebp, eax
mov dword [esi + 0x7aee1c2d], esp
nop
push 0xcf985640
add al, 0x4a
and al, 0x7d
jo fcn.00443d18
pop edi
sar byte [ecx], cl
xor al, byte [edi]
into
std
sbb dl, 0xa5
int 0xd5
pushal
mov eax, 0x39a7b4cb
shl bh, 1
xor dword [edx + 0x5c9bc2d3], esp
mov ah, 0xa7
cmp eax, edx
out 0x31, eax
mov byte [0x5c9bc2d3], al
dec edx
mov al, bl
jne 0x443dfd
invalid
popfd
test al, 0x72
fidiv word [eax]
cmp byte [ebx - 0xf], cl
push ebp
inc ecx
pop es
ja 0x443e1b
mov esp, dword [ecx]
stosb byte es:[edi], al
stc
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
adc edx, dword [edi]
invalid
insd dword es:[edi], dx
and eax, 0xb3ddb8b4
sub dword [ebp - 9], 0xa023fcb9
ljmp 0x1b37
pop esi
mov ch, al
outsb dx, byte [esi]
or al, ah
in eax, 0x86
salc
mov byte [eax - 0xc07bd3f], ch
wait
sbb bl, byte [ecx]
inc esi
rcr dword [ebp - 0x938a6d0], cl
mov eax, dword [0x159fcefa]
fld qword [esi + 0x1755eb38]
popfd
and dword [edi], 0xd31c445
dec edx
mov esp, dword [ebp + 0x7ada4855]
fadd qword [eax - 0x75]
sar esi, 0xe4
mov edx, 0xa1427c4d
cdq
xchg esi, eax
aas
retf 0x86ea

Function at 0x79ae18
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ecx + 0xd], ebp
jnp 0x79ae8d
dec edi
std
push ecx
call dword [ebx]
sbb edi, dword [ecx - 0x1a]
in eax, 0x68
mov byte [0x9739342f], al
mov ebx, 0xa0715d57
mov ecx, dword [eax - 0x29f7a449]
loop 0x79ae99
pop es
push ecx
cmp dword [ebx + 0xa], edx
add al, 0xcb
jmp dword [ebp - 0xb]
cmp byte [edx], bl
and eax, 0xf0edb88a
push edi
stc
push ebp
aam 0x98
sbb eax, 0x35
neg dword [edi + 0x14f4eeae]
lcall 0x270d, 0xede9483e
push esp
push ebx
xchg edi, eax
aam 0x1e
mov ebp, 0x7a7453c2
mov ds, word [ebp + 0x38]
cmpsb byte [esi], byte es:[edi]
pop esp
sbb dword [ecx + 0x29f34fb4], ecx
fsub qword [eax + edi*2 - 0x72ca007d]
mov esi, 0x2a77b16f
xchg esi, eax
cmc
add al, 9
cmp al, 0x23
invalid
Function at 0x92c1d0
Capabilities:
Encode data using xor

Disassembly:
clc
outsd dx, dword [esi]
or al, 0x9f
mov ecx, 0x83fa3741
jle 0x92c220
mov edi, 0x50c13594
pop esp
bound edx, qword [eax + 0x27]
cmc
or dword [edi], 0x7e
wait
inc eax
lea ecx, [edx + 0x23d21e19]
sub dword [0xef930a76], ecx
out 0xed, eax
xchg edi, eax
hlt
cld
jns 0x92c25b
enter 0x8ed, 0xffffffffffffffe7
lahf
jne 0x92c245
dec esp
inc ebx
test byte [eax + 0x6418bdeb], dh
stosb byte es:[edi], al
adc eax, 0xaa347c48
idiv ebp
loop 0x92c215
xor byte [edi + 0x78], 0xd0
out 0x9b, al
xor byte [esi + 0x1577a050], 0x7f
fisub dword [edx]
stosb byte es:[edi], al
adc eax, 0xaa22da7f
fldenv [edi + 0x34]
fild dword [ebx + 0x7d26387b]
int1
cmp dword [ebx + 0x38], 0x26
jge 0x92c23c
invalid
xlatb
and ebx, ebx
enter 0xfffffffffffffe10, 0xffffffffffffffa0
or ch, ch
mov cl, 0xa9
mov al, byte [0xa9b1ed08]
push 0x3db7a007
fldcw word [ebx - 0xf1e6ac2]
jae 0x92c2dc
xchg ebx, eax
dec ebp
leave
or byte [edi + edi*8], dl
fmul st(0), st(0)
stc
xor eax, 0xae776584
and ebx, dword [edx + 0x7fc77613]
std
pop esp
inc cl
pop esp
outsb dx, byte [esi]
and byte [ebp + 0x3d], ah
jg 0x92c255
mov al, 0xd7
adc eax, 0x44ffbc2c
outsb dx, byte [esi]
fcom dword [ebx - 0x6d203eff]
call 0xb4ae8116
adc edi, dword [ecx + 0x37562ec0]
fist word [edx + 0x1bbe77e8]
mov ah, 0x13
mov ecx, 0x37562ec0
test al, 0x7c
and dh, byte [ebx]
jbe 0x92c298
mov eax, 0xe72550d6
pop ds
mov dword [0xd4a31295], eax
inc ecx
mov ch, 0xce
invalid
wait
stosd dword es:[edi], eax
mov edx, 0xcd4dd332
out 0x43, eax
cmp esp, esp
inc edx
ret 0x4eff
Function at 0xa9235c
Capabilities:
Encode data using xor

Disassembly:
invalid
in eax, 0xc4
sti
jbe 0xa92269
imul esi, dword [esi], 0xffffff99
sub byte [eax + 0x45], 0xdb
popfd
invalid
aad 0x11
dec edi
or eax, 0xb7e39bff
jge 0xa922d8
or dword [esp + ebx*4 - 0x4eb3e582], ebx
sub edx, dword [ebx - 0x503aa8b6]
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
adc esp, dword [edi - 0x16]
or eax, 0xdbe02ebe
enter 0x488c, 0xffffffffffffff9a
out dx, eax
enter 0x37cc, 0xffffffffffffffaa
push cs
mov word [0x9931c61d], ss
rol dword [ebx], 0xa
xchg edx, eax
mov ah, 1
int 0xf1
push 0x1e885ae3
jecxz 0xa923b2
mov byte [esi], bl
sub dh, byte [ecx - 0x756a796c]
or dh, dl
mov esi, 0x9b6c9bd7
xchg esp, eax
xchg byte [ebp - 0x410df576], dl
xlatb
wait
insb byte es:[edi], dx
wait
push eax
pop ebx
test eax, 0x88cb237
mov cl, 0xe5
scasb al, byte es:[edi]
insb byte es:[edi], dx
cwde
inc edi
rol bl, cl
in eax, 0xc6
je 0xa92356
insb byte es:[edi], dx
mov edi, 0x1c400ef6
fbld tbyte [eax + 0xf]
mov dword [0x9d8a1378], eax
xchg edi, eax
lahf
test eax, 0x74975628
je 0xa92381
pushal
bt dword [eax + 0x13], edi
mov bl, byte [ebp - 0x56d96069]
sub byte [esi - 0x69], dl
je 0xa92405
out dx, eax
lds edx, [eax]
movsd dword es:[edi], dword [esi]
xchg edi, eax
jo 0xa9231c
or eax, 0x3393437e
fst st(2)
invalid
or esp, dword [esp + ebx*4 - 0x5c]
fmul dword [ecx + 0x1fcb8a9e]
outsd dx, dword [esi]
cmp eax, 0x179852cf
xor byte [edi + 0x31aa737c], ah
sbb al, 0xc0
je 0xa92392
int 0xa1
test dword [edi + 0x78890c62], edx
sal byte [esi + ebp], cl
xor al, 0x2e
loopne 0xa923d5
add dword [ebx], edx
pop eax
aam 0x69
into
push edi
ficomp word es:[eax]
stosb byte es:[edi], al
jno 0xa9242a
mov ecx, 0xcefc9cc4
into
add al, 0x87
jne 0xa9240a
popal
and eax, dword [esi - 0x3d]
invalid
cli
xor byte [ecx], ch
or ebx, ebp
mov ebx, 0xd2088c92
dec ecx
scasd eax, dword es:[edi]
mov ebx, 0xf94346d1
rol byte [eax - 0x57045edf], cl
push ds
and byte [ebp + 0x8a8365d], al
sar byte [ebx - 0x5c], cl
jo 0xa92478
xchg ebx, eax
and al, 0x99
cdq
and byte [ebx], al
sub eax, 0x3f6459b
push edi
inc ecx
mov cl, byte [esi]
sub ecx, ecx
adc dl, byte [edi]
out dx, eax
mov cl, 0xbf
ret 0x75b8
scasb al, byte es:[edi]
shr dword ss:[edi], cl
dec ebp
loope 0xa924df
invalid
arpl word [ebx - 0x37], ax
adc dh, byte [ebx]
pop edi
add ecx, dword [ebx - 0x62]
movsb byte es:[edi], byte [esi]
aas
invalid

Function at 0x14a9083
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.014a900c
ficomp dword [ebp - 0x1d]
jae 0x14a9094
in eax, 0x50
add byte [edi - 0x2d089fe9], al
pushal
not edx
mov ax, bx
popal
pushfd
mov word [esp + 1], si
jmp 0x14cc3ca
add ch, cl
dec ebx
fstp xword [esi + 0x6ad5884d]
invalid
lodsb al, byte [esi]
invalid
Function at 0x14aa7d1
Capabilities:
Hash data with md5

Disassembly:
call fcn.014aa751
inc ebp
adc eax, 0x424648d
jmp 0x14cd90b
jmp 0x14aa7ca
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x14ad2a6
Capabilities:
Encode data using xor

Disassembly:
pushal
mov si, di
popal
pushal
mov byte [esp + 0x15], ch

Function at 0x14c2005
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.014ccc5e
fadd dword [ebx]
invalid
pushal
bswap si
bswap cx
popal
push cx
mov byte [esp], cl
mov byte [esp], cl
lea esp, [esp + 1]
lea esp, [esp]
mov byte [esp], cl
push ebx
mov byte [esp + 1], ah
mov dword [esp], edi
push word [esp + 1]
jmp 0x14c204a
pop word [esp + 2]
lea esp, [esp + 1]
lea esp, [esp + 4]
pushal
jmp 0x14c20da
mov bx, word [esp]
xchg ecx, ebp
popal
pushfd
mov dword [esp], ebp
pushfd
push word [esp + 7]
lea esp, [esp + 6]
mov word [esp + 1], ax
pop word [esp]
pushfd
mov dword [esp], ecx
mov word [esp + 2], cx
jmp 0x14c218b
push dword [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0x14a9de2

Function at 0x15238a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x15238e0
mov edi, dword [esp + 0x14]
cmp edi, 2
jl 0x15238e0
xor ecx, ecx
test edi, edi
jle 0x15238db
mov dl, byte [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, ecx
and eax, 3
mov al, byte [eax + ebx]
xor al, byte [ecx + esi]
inc ecx
xor al, dl
cmp ecx, edi
mov byte [ecx + esi - 1], al
mov dl, al
jl 0x15238c2
pop ebx
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x15238f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x1523933
mov edi, dword [esp + 0x14]
cmp edi, 2
jl 0x1523933
xor eax, eax
test edi, edi
jle 0x152392e
mov dl, byte [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov cl, byte [eax + esi]
mov ebx, eax
and ebx, 3
mov bl, byte [ebx + ebp]
xor bl, cl
xor bl, dl
mov byte [eax + esi], bl
inc eax
cmp eax, edi
mov dl, cl
jl 0x1523913
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x1523940
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor al, al
test esi, esi
je 0x152396c
mov edx, dword [esp + 0xc]
cmp edx, 2
jl 0x152396c
xor ecx, ecx
test edx, edx
jle 0x1523968
lea ebx, [ebx]
xor al, byte [ecx + esi]
inc ecx
cmp ecx, edx
jl 0x1523960
not al
pop esi
ret
xor al, al
pop esi
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4a21b3]
shl eax, 2
mov dword [0x4a21b7], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004977d8
pop edx
call fcn.00496ae0
call fcn.004977dc
push 0
call fcn.00498a70
pop ecx
push 0x4a215c
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4a21bb], eax
push 0
jmp fcn.0049f894
Function at 0x406c88
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x406ca8
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x406c8f
cmp dword [eax], 0x11
jbe 0x406cc3
mov dword [eax], 0x11
jmp 0x406cb7
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x406cc3
cmp dword [eax + edx*4], 0
je 0x406cb5
ret

Function at 0x4074fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x407543
mov eax, 1
jmp 0x40751c
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x407512
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.00497a70
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4075a8
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x407581
mov eax, 1
jmp 0x40755a
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x407550
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.00497a70
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x4075a8
mov eax, dword [ebx]
test eax, eax
jbe 0x407594
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x407594
dec eax
test eax, eax
ja 0x407587
mov dword [edi], eax
test eax, eax
jbe 0x4075a8
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x40759a
pop edi
pop esi
pop ebx
ret
Function at 0x408d80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff790
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x35], dl
mov ebx, eax
mov eax, 0x4a2c84
call fcn.00498090
cmp byte [ebx + 0x6e3d], 0
mov eax, dword [ebx + 0x13cc]
je 0x408dbe
cmp byte [eax + 0x20e9], 0
jne 0x408dbe
cmp byte [ebx + 0x6e38], 0
je 0x408dcf
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
mov eax, edx
jmp 0x408f63
mov word [ebp - 0x24], 8
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.0040f104
inc dword [ebp - 0x18]
xor edx, edx
mov word [ebp - 0x24], 0x14
movzx eax, word [ebx + 0x4718]
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebx + 0x471c]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, ebx
xor edx, edx
call fcn.00409e1c
mov eax, ebx
call fcn.004054fc
cmp byte [ebp - 0x35], 0
je 0x408e4c
push pe_nt_image_headers32
lea edx, [ebp - 0x238]
push edx
push dword [0x4c4e30]
call sub.USER32.DLL_GetWindowTextA
mov eax, 0x34a
call fcn.004125b4
call fcn.00474850
call fcn.00473b88
mov edx, dword [ebx + 0x46e8]
sub edx, 0x76
je 0x408e64
sub edx, 3
je 0x408e9e
dec edx
je 0x408eb0
jmp 0x408ee9
test byte [ebx + 0x4714], 0x20
jne 0x408e8c
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040f170
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
jmp 0x408f63
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00408694
jmp 0x408ee9
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.00408f6c
jmp 0x408ee9
push 0x4a2b70
lea eax, [ebx + 0x5480]
push eax
call fcn.00497c14
add esp, 8
test eax, eax
sete dl
and edx, 1
test dl, dl
je 0x408ee2
lea ecx, [ebp - 0x870]
mov dl, byte [ebp - 0x35]
mov eax, ebx
call fcn.004091c4
jmp 0x408ee9
mov byte [ebp - 0x23a], 1
cmp byte [ebp - 0x35], 0
je 0x408eff
lea eax, [ebp - 0x238]
call fcn.00474850
call fcn.00473b88
test esi, esi
je 0x408f14
push esi
mov edi, esi
lea esi, [ebp - 0x870]
mov ecx, 0x18e
rep movsd dword es:[edi], dword [esi]
pop esi
cmp byte [ebp - 0x23a], 0
jmp 0x408f49
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040f170
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x409753
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x409764
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x409773
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x409780
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.00410420
test eax, eax
je 0x4097ad
test esi, esi
je 0x4097ad
cmp word [esi], 0
je 0x4097ad
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x4097c4
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4097dd
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4097dd
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40984b
mov dword [ebx + 4], edi
test esi, esi
je 0x409812
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00410760
jmp 0x40981b
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x409832
push dword [ebp - 4]
lea ecx, [ebx + 0x17]
push ecx
call fcn.00497c60
add esp, 8
jmp 0x409841
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.00410474
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.00409960
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8