joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x405a12
pop dword [ebp - 0x3c]
mov eax, 0x405a12
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb0b0465d
add dword [ebp - 0x4c], 0x9da1feee
mov dword [ebp - 0x48], 0x93584072
add dword [ebp - 0x48], 0x9edb0bd3
mov dword [ebp - 0x44], 0x7f9a3087
sub dword [ebp - 0x44], 0x334dec59
mov dword [ebp - 0x40], 0xaa6b0d9e
sub dword [ebp - 0x40], 0xaa6b0d9e
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x221132e1
sub eax, 0x21d0b1dd
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xdee60143
sub dword [ebp - 0x4c], 0x6a7397ed
mov dword [ebp - 0x48], 0x194274d5
add dword [ebp - 0x48], 0x2829eca0
mov dword [ebp - 0x44], 0x7511e95
add dword [ebp - 0x44], 0x5c1e4dd7
mov dword [ebp - 0x40], 0xfe36d235
add dword [ebp - 0x40], 0x1c92dcb
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x397dc
push 0
call eax
mov ecx, 0x520b
xor esi, esi
add esi, eax
mov edx, 0xb03d087b
add edx, 0x5009db85
add edx, dword [ebp - 0x3c]
mov edi, 0x5e077daf
add dword [ebp - 0x38], 0x7d989eb6
mov ebx, dword [edx]
mov dword [ebp - 0x1c], 0x7ede9aa3
sub ebx, edi
xor dword [ebp - 0x18], 0x14b6e7b0
mov dword [esi], ebx
add dword [ebp - 0x24], eax
add esi, 0xf1ae7953
sub esi, 0xf1ae794f
add edx, 4
loop 0x405b20
add eax, 0x8e09223
add eax, 0xf720a8dc
mov ebx, eax
add eax, 5
mov ecx, 0xaea1f038
add ecx, 0x519e0fc8
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x41abcb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x41abda
pop dword [ebp - 0x48]
mov eax, 0x41abda
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3cd00
push 0
mov eax, 0xb2028af4
add eax, 0x4e3fc62c
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xd255323a
sub ecx, 0xd254e8d7
xor edi, edi
add edi, eax
mov ebx, 0xecf1e05e
add ebx, 0x13514da2
add ebx, dword [ebp - 0x48]
mov esi, 0x71f306c2
add esi, 0x4481bb23
mov dword [ebp - 0x40], 0xf2b0a84c
mov edx, dword [ebx]
xor dword [ebp - 0x44], edi
sub edx, esi
sub dword [ebp - 0x30], 0x23bfa3f8
mov dword [edi], edx
xor dword [ebp - 8], ecx
add edi, 0x85c851b2
sub edi, 0x85c851ae
add ebx, 4
loop 0x41ac36
add eax, 0xf56e0d5e
sub eax, 0xf56cf4ff
mov ebx, eax
add eax, 0x5c980a4f
sub eax, 0x5c980a4a
mov ecx, 0x539d49cb
add ecx, 0xaca2b635
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x421f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4233c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x423413
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x42f098
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.00402454
push eax
call fcn.00401d5b
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4233d9
pop ebx
pop esi
pop ebp
ret

Function at 0x423416
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401f47
push 0xc
call fcn.0040626e
pop ecx
test eax, eax
je 0x42344d
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call section..bss
jmp 0x42344f
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x47b220
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.0042339a
mov edx, 0x47b220
add edx, 0x188
mov esi, 0x430020
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00403359
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004062ac
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40bdc8
pop dword [ebp - 8]
mov eax, 0x9deb1f3b
add eax, 0x62559e8d
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8f4a3538
add dword [ebp - 0x18], 0xbf081013
mov dword [ebp - 0x14], 0xdd6e4bd
sub dword [ebp - 0x14], 0xdba39878
mov dword [ebp - 0x10], 0x73ebbd57
add dword [ebp - 0x10], 0xd86086d7
mov dword [ebp - 0xc], 0xd36296d8
add dword [ebp - 0xc], 0x2c9d6928
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc1460f61
sub eax, 0xc1053f0d
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x80a2a03a
sub dword [ebp - 0x18], 0xc3036e4
mov dword [ebp - 0x14], 0x38894409
sub dword [ebp - 0x14], 0xf71ce294
mov dword [ebp - 0x10], 0x4294ee9a
sub dword [ebp - 0x10], 0xdf25822e
mov dword [ebp - 0xc], 0x15bc47c
add dword [ebp - 0xc], 0xfea43b84
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x32208d1
add eax, 0xfd1ec77b
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3769e
push 0
call eax
mov ecx, 0x445e6f1
add ecx, 0xfbba58a2
mov ebx, eax
mov esi, 0x2a1ab79e
add esi, 0xd626f862
add esi, dword [ebp - 8]
mov edx, 0xe93f86f2
add edx, 0x7c7b674f
xor dword [ebp - 4], esi
mov edi, dword [esi]
add edi, edx
xor dword [ebp - 4], edi
mov dword [ebx], edi
mov dword [ebp - 4], 0xd2b37f53
add ebx, 0x58673abf
add ebx, 0xa798c545
add esi, 4
loop 0x40beea
add eax, 0xc4e218f5
sub eax, 0xc4e127d6
mov ebx, eax
add eax, 0x8226c08
add eax, 0xf7dd93fd
mov ecx, 0x8ad58893
sub ecx, 0x8a958893
invalid
invalid
clc
invalid
invalid
Function at 0x78bb1eb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78bbe5b0]
jne 0x78bb1ebd
repz ret
jmp fcn.78bb557c

Function at 0x78bb3c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x78bb3c2f
pop dword [ebp - 0x2c]
mov eax, 0x78bb3c2f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe97958f9
add dword [ebp - 0x3c], 0x64d8ec52
mov dword [ebp - 0x38], 0xe81ed29
sub dword [ebp - 0x38], 0xdc4ea0e4
mov dword [ebp - 0x34], 0xb35f700e
add dword [ebp - 0x34], 0x98ecd420
mov dword [ebp - 0x30], 0x3e234847
add dword [ebp - 0x30], 0xc1dcb7b9
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd5736f9e
add dword [ebp - 0x3c], 0x9efef9b8
mov dword [ebp - 0x38], 0xba96e619
add dword [ebp - 0x38], 0x86d57b5c
mov dword [ebp - 0x34], 0x193f6efb
add dword [ebp - 0x34], 0x4a2ffd71
mov dword [ebp - 0x30], 0x8cf3a404
add dword [ebp - 0x30], 0x730c5bfc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfc76caa7
add eax, 0x7c4345c1
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cc5e
push 0
call eax
mov ecx, 0xf692863b
sub ecx, 0xf6923cf9
xor ebx, ebx
add ebx, eax
mov edi, 0x3ecdfd5f
sub edi, 0xc611c75f
add edi, dword [ebp - 0x2c]
mov edx, 0x2497901a
sub edx, 0xd0a1206
add dword [ebp - 0x1c], esi
mov esi, dword [edi]
xor esi, edx
xor dword [ebp - 0x28], 0x773f8ee
mov dword [ebx], esi
xor dword [ebp - 0x20], edx
add ebx, 4
add edi, 0x513f482c
sub edi, 0x513f4828
loop 0x78bb3d49
add eax, 0x88f2650f
add eax, 0x770eb2cc
xor ebx, ebx
add ebx, eax
add eax, 0xf8662506
add eax, 0x799daff
mov ecx, 0x3ee271eb
sub ecx, 0xc62871eb
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40f5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f608
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f606
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40f61a
add edi, dword [ebp - 4]
cmp edi, ebx
jb 0x40f5d1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push 0x356
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutil_fileutil.cpp
call fcn.0040fa20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40f7a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40f897
cmp eax, 0x104
jae 0x40f897
lea eax, [ebp - 0x414]
push eax
push 0
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40f822
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f810
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0x53
jmp 0x40f8b9
mov ecx, dword [ebp + 0x10]
xor eax, eax
test ecx, ecx
je 0x40f833
cmp ecx, 0x7fffffff
jbe 0x40f838
mov eax, 0x80070057
test eax, eax
js 0x40f8c5
test ecx, ecx
je 0x40f86e
mov edx, 0x7ffffffe
lea edi, [ebp - 0x414]
sub edx, ecx
sub edi, esi
lea eax, [edx + ecx]
test eax, eax
je 0x40f86e
movzx eax, word [edi + esi]
test ax, ax
je 0x40f86e
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x40f853
test ecx, ecx
lea eax, [esi - 2]
pop edi
cmovne eax, esi
xor edx, edx
test ecx, ecx
pop esi
mov word [eax], dx
mov eax, 0x8007007a
cmovne eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412b32
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40f8ac
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
push esi
push 0x4e
push str.c:_buildagentwork1198dd0165ef29c7projects_third_partydutildirutil.cpp
call fcn.0040fa20
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00412b32
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10067c8
Capabilities:
Send data
Send data on socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x10067f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x1006809
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi + esi*4]
shl esi, 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10067db
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10

Function at 0x45ca00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x435015
lea edi, [esi - 0x34015]
push edi
jmp 0x45ca1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45ca21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45ca10
mov eax, 1
add ebx, ebx
jne 0x45ca33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45ca28
jne 0x45ca44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ca28
xor ecx, ecx
sub eax, 3
jb 0x45ca58
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45caca
mov ebp, eax
add ebx, ebx
jne 0x45ca63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45ca70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45ca94
inc ecx
add ebx, ebx
jne 0x45ca80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45ca75
jne 0x45ca91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ca75
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45cab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45caa5
jmp 0x45ca16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45cab4
add edi, ecx
jmp 0x45ca16
pop esi
mov edi, esi
mov ecx, 0x17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45cad2
cmp byte [edi], 0xe
jne 0x45cad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45cad7
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45cb46
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c244]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c318]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45cb04
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c320]
or eax, eax
je 0x45cb40
mov dword [ebx], eax
add ebx, 4
jmp 0x45cb21
call dword [esi + 0x5c31c]
mov ebp, dword [esi + 0x5c324]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45cb7a
sub esp, 0xffffff80
jmp 0x433fa0
Function at 0x29a010c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x29a010d6
pop dword [ebp - 0x3c]
mov eax, 0xd46fa30f
sub eax, 0xaacf9239
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x15eac14a
add dword [ebp - 0x4c], 0x38678401
mov dword [ebp - 0x48], 0x757a3e99
add dword [ebp - 0x48], 0xbcb90dac
mov dword [ebp - 0x44], 0x6e79baca
sub dword [ebp - 0x44], 0x222d769c
mov dword [ebp - 0x40], 0xaaac104c
add dword [ebp - 0x40], 0x5553efb4
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd3e63b9
sub dword [ebp - 0x4c], 0x98cbfa63
mov dword [ebp - 0x48], 0x13cdfcd0
add dword [ebp - 0x48], 0x2d9e64a5
mov dword [ebp - 0x44], 0x31bfdcac
sub dword [ebp - 0x44], 0xce507040
mov dword [ebp - 0x40], 0x541d2064
sub dword [ebp - 0x40], 0x541d2064
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x8542c1f9
add eax, 0xa45e7e4b
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3548f
push 0
call eax
mov ecx, 0x33fd
mov ebx, eax
mov esi, 0x29a22000
add esi, dword [ebp - 0x3c]
mov edi, 0x54ed8e7e
sub edi, 0x9a16c5c9
xor dword [ebp - 0x10], esi
mov edx, dword [esi]
mov dword [ebp - 0x2c], 0x49cc66d
sub edx, edi
sub dword [ebp - 0x24], 0x885f6623
mov dword [ebx], edx
xor dword [ebp - 0x38], 0x99ce1080
add ebx, 0xa371a3d
add ebx, 0xf5c8e5c7
add esi, 0x24f11fc5
add esi, 0xdb0ee03f
loop 0x29a011e7
add eax, 0xc45f609
add eax, 0xf3baccbe
xor ebx, ebx
add ebx, eax
add eax, 0xebb93399
add eax, 0x1446cc6c
mov ecx, 0x1e6decf9
sub ecx, 0xf4cdecf9
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10013a33
pop dword [ebp - 0x3c]
mov eax, 0x10013a33
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x42379eb9
sub dword [ebp - 0x4c], 0xf3e5596e
mov dword [ebp - 0x48], 0xa9651c9e
add dword [ebp - 0x48], 0x88ce2fa7
mov dword [ebp - 0x44], 0x36f5541a
sub dword [ebp - 0x44], 0xeaa90fec
mov dword [ebp - 0x40], 0x4514cc61
add dword [ebp - 0x40], 0xbaeb339f
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x6193882b
add eax, 0xae6e3855
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x679134a5
sub dword [ebp - 0x4c], 0xf31ecb4f
mov dword [ebp - 0x48], 0x93d75e95
sub dword [ebp - 0x48], 0x526afd20
mov dword [ebp - 0x44], 0x7b697c7
sub dword [ebp - 0x44], 0xa4472b5b
mov dword [ebp - 0x40], 0xcf46a356
sub dword [ebp - 0x40], 0xcf46a356
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3813d
push 0
call eax
mov ecx, 0x1fb8cabf
add ecx, 0xe0477feb
xor edi, edi
add edi, eax
mov ebx, 0x10026800
add ebx, dword [ebp - 0x3c]
mov esi, 0xa178bb1e
add dword [ebp - 0x30], 0xd97d793a
mov edx, dword [ebx]
add dword [ebp - 0x30], edi
add edx, esi
xor dword [ebp - 0x24], 0xad805eb7
mov dword [edi], edx
mov dword [ebp - 0x20], 0xe3bedec0
add edi, 0xa67b8a90
sub edi, 0xa67b8a8c
add ebx, 4
loop 0x10013b41
add eax, 0x3034d55e
add eax, 0xcfcc481d
xor ebx, ebx
add ebx, eax
add eax, 0xed577b2c
add eax, 0x12a884d9
mov ecx, 0x1dd367fa
add ecx, 0xf22c9806
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x50a555f6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
ret 8

Function at 0x50a55610
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.vsansi.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop esi
ret 0xc

Function at 0x50a5563c
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.vsansi.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x50a55647
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x50a59526
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x50a59535
pop dword [ebp - 0x1c]
mov eax, 0x50a59535
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xa1cfbf0c
sub dword [ebp - 0x2c], 0x537d79c1
mov dword [ebp - 0x28], 0x5ad22c2e
add dword [ebp - 0x28], 0xd7612017
mov dword [ebp - 0x24], 0xa8ebd35a
sub dword [ebp - 0x24], 0x5c9f8f2c
mov dword [ebp - 0x20], 0x2564c061
sub dword [ebp - 0x20], 0x2564c061
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xc716cd61
sub eax, 0x7671bcd9
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x807c2be9
add dword [ebp - 0x2c], 0xf3f63d6d
mov dword [ebp - 0x28], 0xe480d8e6
add dword [ebp - 0x28], 0x5ceb888f
mov dword [ebp - 0x24], 0xc5bd3f8f
add dword [ebp - 0x24], 0x9db22cdd
mov dword [ebp - 0x20], 0x2d4dc189
add dword [ebp - 0x20], 0xd2b23e77
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x5aa796ec
sub eax, 0xa028618
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x389b5
push 0
call eax
mov ecx, 0xeb9dafc3
add ecx, 0x14629b31
xor ebx, ebx
add ebx, eax
mov esi, 0x50a6b000
add esi, dword [ebp - 0x1c]
mov edx, 0x1d0f17ea
sub edx, 0x7cbcacbe
xor dword [ebp - 4], ecx
mov edi, dword [esi]
add edi, edx
xor dword [ebp - 4], 0x7f9d326f
mov dword [ebx], edi
add dword [ebp - 0x14], ecx
add ebx, 4
add esi, 4
loop 0x50a5964e
add eax, 0x11ea3
xor ebx, ebx
add ebx, eax
add eax, 0x6dc55afe
add eax, 0x923aa507
mov ecx, 0xcf553dd5
sub ecx, 0x7eb03dd5
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x50a5ecd6
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ebx, ecx
mov edi, 0x200
push edi
mov ecx, esi
call fcn.50a54cdd
push edi
push eax
push dword [ebx + 0x28]
call dword [sym.imp.vsansi.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.50a54849
mov ecx, esi
call fcn.50a5e7b4
mov ecx, esi
call fcn.50a5e761
pop edi
pop esi
pop ebx
ret 4
Function at 0x50a60737
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.vsansi.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x50a6074f
test al, 0x10
jne 0x50a6074f
xor eax, eax
inc eax
jmp 0x50a60751
xor eax, eax
ret 4

Function at 0x50a62168
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.50a62151
and byte [esi + 0xc], 0
mov eax, 0x50a50000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x50a621c2
cmp dword [ebp - 0x18], 5
jb 0x50a621da
jmp 0x50a621d6
cmp dword [ebp - 0xc], 1
jne 0x50a621da
cmp dword [ebp - 0x18], 4
ja 0x50a621d6
jne 0x50a621da
cmp dword [ebp - 0x14], 0
jbe 0x50a621da
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x50a64080
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x406110
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x614e20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1774
call fcn.005e7330
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x7e4]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xcf0]
mov dword [ebp - 0x14], esi
test eax, eax
mov dword [ebp - 4], 0
push 0x7cf
je 0x406198
mov ecx, dword [esi + 0xcec]
lea eax, [ebp - 0x1784]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4061ac
lea edx, [ebp - 0x7e4]
push 0x7d0
lea eax, [ebp - 0x1784]
push edx
push eax
call fcn.00405640
add esp, 0xc
jmp 0x4061ac
mov edx, dword [esi + 0xcec]
lea ecx, [ebp - 0x7e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x7e4]
push 0x7d0
push eax
mov ecx, esi
call fcn.00405dc0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret