joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4197fa
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xd
pop esi
xor ebx, ebx
mov dword [ebp - 0x51c], ecx
push 0x103
lea eax, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
push ebx
push eax
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x110]
mov edi, 0x104
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.004237c0
pop ecx
pop ecx
test eax, eax
je 0x419a1d
mov byte [eax], bl
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.004237c0
pop ecx
pop ecx
test eax, eax
je 0x419a1d
push str.ExtraInfo.ini
mov byte [eax], bl
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.0042392d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
call edi
test eax, eax
jne 0x41992b
lea eax, [ebp - 0x514]
mov dword [ebp - 0x518], 1
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x514], 0x104
push eax
lea eax, [ebp - 0x518]
mov byte [ebp - 0x110], bl
push eax
push str.Install
push str.SoftwareTencentQQ2009
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp byte [ebp - 0x110], bl
je 0x419a1d
push str.ExtraInfo.ini
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0042392d
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call edi
neg eax
sbb eax, eax
and eax, 0xfffffff3
add esi, eax
jne 0x419a1d
push 0x3ff
lea eax, [ebp - 0x50f]
mov byte [ebp - 0x510], bl
push ebx
push eax
call fcn.0041e3e0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push 0x400
lea eax, [ebp - 0x510]
push eax
push 0x444bb4
push str.Item2
push str.Main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, eax
test ebx, ebx
je 0x419a1a
test bl, 1
jne 0x419a1a
mov edi, ebx
shr edi, 1
push ebx
mov dword [ebp - 0x514], edi
call fcn.0041dad6
push edi
push 0
push eax
mov dword [ebp - 0x518], eax
call fcn.0041e3e0
add esp, 0x10
xor esi, esi
test ebx, ebx
je 0x4199d4
mov edi, dword [ebp - 0x518]
push edi
lea eax, [ebp - 0x510]
add eax, esi
push str._02x
push eax
call fcn.00423712
add esp, 0xc
add esi, 2
inc edi
cmp esi, ebx
jb 0x4199af
mov edi, dword [ebp - 0x514]
mov ebx, dword [ebp - 0x518]
lea eax, [ebp - 0x514]
and dword [ebp - 0x514], 0
mov edx, edi
push ecx
push ecx
push eax
mov ecx, ebx
call fcn.00419151
push ebx
mov esi, eax
call fcn.0041f5a6
push dword [ebp - 0x514]
push esi
push dword [ebp - 0x51c]
call fcn.0041e470
push esi
call fcn.0041e2e4
add esp, 0x20
xor esi, esi
jmp 0x419a1d
push 5
pop esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x419a6a
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call fcn.004197fa
xor ebx, ebx
test eax, eax
je 0x419b31
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], ebx
push eax
push 0x201
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SoftwareSogouExplorer
push 0x80000002
call ebx
cmp dword [ebp - 0x114], 0
je 0x419acf
lea edx, [ebp - 0x114]
mov ecx, esi
call fcn.00419a30
test eax, eax
je 0x419b2f
and dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
push 0x201
push 0
push str.SoftwareSogouExplorer
push 0x80000001
call ebx
cmp dword [ebp - 0x114], 0
je 0x419b0a
lea edx, [ebp - 0x114]
mov ecx, esi
call fcn.00419a30
test eax, eax
je 0x419b2f
push esi
xor ebx, ebx
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push esi
push str._sSogouExplorer
push 0x104
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
jmp 0x419b31
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
push ebx
push eax
call fcn.0041e3e0
add esp, 0xc
lea edx, [ebp - 0x110]
mov ecx, esi
call fcn.00419d12
test al, al
jne 0x419b62
push 0xc
pop eax
jmp 0x419bcf
push esi
push str._sSogouExplorer.exe
push 0x104
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x419b5d
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], ebx
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], ebx
push eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x114], ebx
push eax
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x120], ebx
lea ecx, [ebp - 0x110]
call fcn.00419c28
add esp, 0xc
cmp dword [ebp - 0x114], 5
sbb eax, eax
and eax, 0xc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x419c28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x44], ecx
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
jne 0x419c71
xor al, al
jmp 0x419d02
push esi
push edi
call fcn.0041e2f8
mov esi, eax
pop ecx
test esi, esi
je 0x419cca
push esi
push edi
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x419cca
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], ebx
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ebx
push eax
push 0x444e50
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x419cca
push 0x34
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push eax
call fcn.0041e470
add esp, 0xc
cmp dword [ebp - 0x38], 0xfeef04bd
sete al
mov bl, al
push esi
call fcn.0041e38a
pop ecx
pop esi
test bl, bl
je 0x419c6a
mov ecx, dword [ebp - 0x30]
mov eax, ecx
mov edx, dword [ebp - 0x40]
shr eax, 0x10
mov dword [edx], eax
mov edx, dword [ebp - 0x44]
movzx eax, cx
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
shr eax, 0x10
mov dword [edx], eax
movzx eax, cx
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x419d12
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x284
mov eax, dword [0x4524c8]
xor eax, esp
mov dword [esp + 0x280], eax
push ebx
push esi
push edi
push 0x103
lea eax, [esp + 0x185]
mov byte [esp + 0x184], 0
mov edi, ecx
mov ebx, edx
push 0
push eax
mov dword [esp + 0x1c], edi
call fcn.0041e3e0
push edi
push str._s
lea eax, [esp + 0x194]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
and dword [esp + 0x5c], 0
lea eax, [esp + 0x60]
push 0x13c
push 0
push eax
call fcn.0041e3e0
add esp, 0x28
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jne 0x419daa
xor al, al
jmp 0x419e9e
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
jmp 0x419dc0
xor eax, eax
cmp byte [esp + 0x6c], 0x2e
je 0x419e3d
test byte [esp + 0x40], 0x10
je 0x419e3d
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x6c]
push eax
call fcn.00419ecf
lea eax, [esp + 0x6c]
push eax
push edi
push str._s_sSogouExplorer.dll
push 0x104
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x419e3d
xor eax, eax
mov ecx, dword [esp + eax + 0x18]
cmp dword [esp + eax + 0x28], ecx
ja 0x419e29
jb 0x419e3d
add eax, 4
cmp eax, 0x10
jl 0x419e13
jmp 0x419e3d
lea esi, [esp + 0x28]
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419dbe
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
call fcn.00419683
cmp dword [eax + 0x14], 0x10
jb 0x419e6e
mov eax, dword [eax]
push eax
push edi
push str._s_sSogouExplorer.dll
push 0x104
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea ecx, [esp + 0x28]
push 0
push 1
call fcn.00402015
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x41a0a4
Capabilities:
Create pipe
Create process on windows
Get process image filename
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x224]
push esi
push edi
push 0x500000
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x224], 0xc
push eax
xor edi, edi
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], edi
push eax
mov esi, ecx
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x220], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41a27d
push edi
push 1
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x41a27d
push 0x44
pop edi
push edi
lea eax, [ebp - 0x278]
push 0
push eax
call fcn.0041e3e0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 0x278], edi
xor edi, edi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 0x24c], 0x100
call fcn.0041e3e0
add esp, 0x18
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x278]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push edi
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41a1b5
push dword [ebp - 0x214]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x210]
call esi
push 8
jmp 0x41a27f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x234]
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
push dword [ebp - 0x230]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
push 4
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x210]
call esi
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
push 0
push eax
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
mov esi, eax
call edi
push dword [ebp - 0x214]
call edi
test esi, esi
je 0x41a279
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp + 0xc]
jne 0x41a279
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00422d99
pop ecx
pop ecx
test eax, eax
je 0x41a275
lea esi, [eax + 2]
push esi
call fcn.00422fd9
pop ecx
mov ecx, esi
call fcn.0041d326
cmp eax, 0xe63b8692
jne 0x41a275
xor eax, eax
inc eax
jmp 0x41a280
xor eax, eax
jmp 0x41a280
push 9
jmp 0x41a27f
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret 8
Function at 0x41a2b6
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov dword [0x455240], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 0x455240
push 0x41a293
push edi
push edi
mov dword [0x455244], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x455244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x455240]
mov dword [0x455244], edi
pop edi
ret

Function at 0x41a323
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0xc]
mov ecx, esi
call fcn.00419a6a
test eax, eax
jne 0x41a423
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41a423
push dword [ebp + 8]
call fcn.0041e3c2
pop ecx
mov dword [ebx + 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041eeeb
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebx + 4]
push 0x44b920
inc ecx
mov dword [ebx + 8], eax
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov eax, dword [ebx + 4]
lea esi, [eax*2 + 0xc]
push esi
call fcn.0041eeeb
add esp, 0x14
mov edi, eax
push 0xc
push ebx
push edi
call fcn.0041e470
mov ecx, dword [ebx + 4]
lea eax, [edi + 0xc]
add esp, 0xc
add ecx, ecx
push ecx
push dword [ebx + 8]
push eax
call fcn.0041e470
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push 0x40
push str.wujian_fjh0fsafdf190u_rsali_fsi_sdil_saf_fas3__fwad_19840718_fs
push eax
push esi
push edi
call fcn.0041900b
add esp, 0x14
mov esi, eax
push edi
call fcn.0041e2e4
pop ecx
test esi, esi
je 0x41a41f
cmp dword [ebp - 4], 0
je 0x41a41f
call fcn.0041a2b6
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41a407
push edi
push dword [ebp - 4]
push esi
call fcn.00419f80
jmp 0x41a412
push dword [ebp - 4]
mov ecx, ebx
push esi
call fcn.0041a0a4
push esi
mov edi, eax
call fcn.0041e2e4
pop ecx
mov eax, edi
jmp 0x41a426
push 4
jmp 0x41a425
push 0xc
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b5dc
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edx
push 0x10
pop edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x11c], ecx
cmp edi, edx
je 0x41b618
cmp edi, 0xc
je 0x41b618
cmp edi, 8
cmovne edi, edx
mov dword [ebp + 0xc], edi
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [ecx], edi
mov esi, ebx
lea ecx, [eax - 8]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
test ecx, ecx
js 0x41b6ae
lea eax, [ecx + 8]
shr eax, 3
mov dword [ebp - 0x114], eax
mov edi, eax
shl eax, 3
mov dword [ebp - 0x10c], eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [ebp + esi*4 - 0x104], ecx
movzx ecx, byte [edx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edx + 7]
shl eax, 0x18
add edx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x100], ecx
add esi, 2
dec edi
jne 0x41b64b
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x110], esi
sub eax, dword [ebp - 0x10c]
je 0x41b724
mov eax, dword [ebp - 0x108]
mov ecx, ebx
and eax, 7
mov esi, ebx
add edx, eax
dec eax
cmp eax, 7
ja case.default.0x41b6cb
jmp dword [eax*4 + 0x41b808]
dec edx
movzx ecx, byte [edx]
shl ecx, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or ecx, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
dec edx
movzx eax, byte [edx]
or ecx, eax
dec edx
movzx esi, byte [edx]
shl esi, 0x18
dec edx
movzx eax, byte [edx]
shl eax, 0x10
or esi, eax
dec edx
movzx eax, byte [edx]
shl eax, 8
or esi, eax
movzx eax, byte [edx - 1]
or esi, eax
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x104], esi
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x108]
lea edi, [edi*2 + 2]
add eax, 3
xor ecx, ecx
cdq
inc ecx
and edx, 3
lea esi, [edx + eax]
mov edx, dword [ebp - 0x11c]
sar esi, 2
mov dword [edx + 4], 0xb7e15163
cmp edi, ecx
jle 0x41b763
mov eax, dword [edx + ecx*4]
sub eax, 0x61c88647
mov dword [edx + ecx*4 + 4], eax
inc ecx
cmp ecx, edi
jl 0x41b752
cmp edi, esi
mov dword [ebp - 0x108], ebx
mov eax, esi
mov ecx, ebx
cmovg eax, edi
imul eax, eax, 3
mov dword [ebp - 0x10c], eax
mov eax, ebx
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], eax
jle 0x41b7f5
add ecx, dword [ebp - 0x108]
add ecx, dword [edx + eax*4 + 4]
rol ecx, 3
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [ebp + ebx*4 - 0x104]
add eax, dword [ebp - 0x108]
mov dword [ebp - 0x114], ecx
add ecx, dword [ebp - 0x108]
add eax, dword [ebp - 0x114]
and ecx, 0x1f
rol eax, cl
xor ecx, ecx
mov dword [ebp + ebx*4 - 0x104], eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x110]
inc eax
cmp eax, edi
cmovge eax, ecx
inc ebx
cmp ebx, esi
mov dword [ebp - 0x110], eax
cmovge ebx, ecx
dec dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x114]
jne 0x41b78b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x41bb29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x54], ecx
push 0x40
pop edx
mov eax, edi
mov dword [ebp - 0x50], edi
shr eax, 2
cmp eax, edx
cmovg eax, edx
push eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x44]
push ecx
push eax
call fcn.0041e470
xor ebx, ebx
add esp, 0xc
mov edx, ebx
mov esi, ebx
cmp dword [ebp - 0x48], edx
jle 0x41bbc4
mov edi, dword [ebp - 0x48]
mov al, byte [esi + 0x4481d4]
xor byte [ebp + edx - 0x44], al
inc esi
cmp esi, 8
jge 0x41bbc1
mov al, byte [ebp + edx - 0x44]
mov ecx, edx
mov byte [ebp - 0x49], al
and ecx, 0x80000007
jns 0x41bb96
dec ecx
or ecx, 0xfffffff8
inc ecx
movzx eax, al
shl eax, cl
mov dword [ebp - 0x48], ecx
test eax, eax
jne 0x41bbb6
mov cl, byte [ebp + 0xc]
sub cl, byte [ebp - 0x48]
mov al, byte [ebp - 0x49]
add cl, 8
shr al, cl
test al, al
mov al, bl
je 0x41bbb8
mov al, 1
mov byte [ebp + edx - 0x44], al
inc edx
cmp edx, edi
jl 0x41bb70
mov edi, dword [ebp - 0x50]
mov ecx, edi
shr edi, 1
and ecx, 1
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], ecx
mov eax, ecx
test ecx, ecx
je 0x41bc0e
mov ecx, ebx
mov esi, ebx
mov edx, ebx
test edi, edi
je 0x41bc0a
mov edi, dword [ebp - 0x54]
mov al, byte [ecx + 0x4481d4]
xor byte [edi + edx], al
inc esi
mov edi, dword [ebp - 0x50]
cmp esi, dword [ecx*4 + 0x449d30]
jle 0x41bc02
inc ecx
cmp ecx, 8
jge 0x41bc07
mov esi, ebx
inc edx
cmp edx, edi
jb 0x41bbe1
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41bc77
cmp edi, 0x10
jb 0x41bc3e
cmp edi, 0x62
ja 0x41bc43
mov edi, dword [ebp - 0x54]
mov ebx, 0x449cf4
mov ecx, dword [ebx]
mov esi, dword [ebx - 4]
add ebx, 8
mov al, byte [ecx + edi]
mov dl, byte [esi + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
cmp ebx, 0x449d34
jl 0x41bc20
jmp 0x41bc67
cmp edi, 0x62
jbe 0x41bc6f
mov edi, dword [ebp - 0x54]
mov ebx, 0x449c74
mov ecx, dword [ebx]
mov esi, dword [ebx - 4]
add ebx, 8
mov al, byte [ecx + edi]
mov dl, byte [esi + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
cmp ebx, 0x449cf4
jl 0x41bc4b
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov edi, dword [ebp - 0x50]
test eax, eax
je 0x41bbd7
push 0x10
pop eax
mov cl, byte [ebp + ebx - 0x44]
xor cl, 0x32
mov byte [ebx + 0x453710], cl
inc ebx
cmp ebx, eax
jl 0x41bc7a
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x455270], eax
xor ecx, ebp
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret
Function at 0x41d295
Capabilities:
Encode data using xor

Disassembly:
push 0xc
mov eax, 0x43da26
call fcn.00423c0f
mov edi, edx
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x18], esi
call fcn.004014a4
push eax
lea ecx, [ebp - 0x10]
call fcn.004012ba
mov dword [ebp - 4], esi
test edi, edi
je 0x41d306
push edi
call fcn.0041e3c2
pop ecx
test al, 1
jne 0x41d306
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov ecx, edi
call fcn.0041c8bb
mov edi, eax
test edi, edi
je 0x41d306
mov dword [0x455274], 0x120
cmp dword [ebp - 0x14], esi
jbe 0x41d2f6
xor byte [esi + edi], 0x2a
inc esi
cmp esi, dword [ebp - 0x14]
jb 0x41d2ec
push edi
lea ecx, [ebp - 0x10]
call fcn.00410a47
push edi
call fcn.0041e38a
pop ecx
mov esi, dword [ebp - 0x10]
lea ecx, [esi - 0x10]
call fcn.004110bc
add eax, 0x10
lea ecx, [esi - 0x10]
mov dword [ebx], eax
call fcn.0040153a
mov eax, ebx
call fcn.00423bdd
ret

Function at 0x41d326
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
push ebx
call fcn.0041e3c2
mov esi, eax
xor edx, edx
add esi, esi
mov edi, edx
pop ecx
test esi, esi
jle 0x41d356
movzx ecx, byte [edi + ebx]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x44a4c0]
inc edi
cmp edi, esi
jl 0x41d33e
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret

Function at 0x41d809
Capabilities:
Create thread

Disassembly:
xor eax, eax
cmp dword [0x455288], eax
jbe 0x41d815
inc eax
ret
push 0x455288
push eax
push 0x2710
push 0x41d604
push eax
push eax
mov dword [0x455294], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [0x455290], eax
test eax, eax
setne cl
mov eax, ecx
ret
Function at 0x434c2e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4524c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00425c47
mov dword [ebp - 0x14], eax
cmp dword [0x454ee8], esi
jne 0x434d21
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x434cae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x434e01
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x434e01
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x434e01
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x454ee8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x454eec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x454ef0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x454ef8], eax
test eax, eax
je 0x434d1e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x454ef4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x434d46
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x434d39
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x434d5b
push 4
pop eax
jmp 0x434e03
cmp dword [ebp - 0x14], esi
je 0x434d5b
push dword [0x454ee8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x434d40
mov eax, dword [0x454ef4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x434db9
cmp dword [0x454ef8], edi
je 0x434db9
push eax
call ebx
push dword [0x454ef8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x434db9
test eax, eax
je 0x434db9
call ecx
test eax, eax
je 0x434dae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x434dae
test byte [ebp - 8], 1
jne 0x434db9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x434de9
mov eax, dword [0x454eec]
cmp eax, edi
je 0x434de6
push eax
call ebx
test eax, eax
je 0x434de6
call eax
mov esi, eax
test esi, esi
je 0x434de6
mov eax, dword [0x454ef0]
cmp eax, edi
je 0x434de6
push eax
call ebx
test eax, eax
je 0x434de6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x454ee8]
call ebx
test eax, eax
je 0x434e01
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x434e03
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e2e9
mov esp, ebp
pop ebp
ret