joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418830
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44dc4d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x462040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov edx, ecx
lea ecx, [ebp - 0x10]
call fcn.00422e60
add esp, 4
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x41886f
mov eax, dword [esi + 4]
jmp 0x418874
mov eax, 0x459254
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test esi, esi
je 0x418893
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
jne 0x418893
push ecx
mov ecx, esi
call fcn.0041b960
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 9], 0
je 0x419b26
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x419b32
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x419ae5
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
je 0x419ae5
mov ecx, dword [esi + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx]
call dword [eax + 4]
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [esi + 9]
push edi
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x419b34
push 0xffffffffffffffff
push str.WriteFile__
mov ecx, esi
call fcn.004185d0
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push str.Bad_implementation
call fcn.004185d0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x419d40
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44de65
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x462040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
push ecx
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.00422e60
add esp, 4
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x419d87
mov eax, dword [esi + 4]
jmp 0x419d8c
mov eax, 0x459254
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov ebx, eax
test esi, esi
je 0x419db4
mov ecx, edi
lock xadd dword [esi], ecx
dec ecx
jne 0x419db4
push ecx
mov ecx, esi
call fcn.0041b960
cmp ebx, 0xffffffff
je 0x419dbe
test bl, 0x10
jne 0x419e1f
mov ebx, dword [ebp - 0x14]
mov edx, ebx
push ecx
lea ecx, [ebp - 0x14]
call fcn.00422e60
add esp, 4
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x419de2
mov eax, dword [esi + 4]
jmp 0x419de7
mov eax, 0x459254
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x419e0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x419e33
mov ecx, ebx
call fcn.00418830
test al, 0x10
je 0x419e33
test esi, esi
je 0x419e1f
lock xadd dword [esi], edi
dec edi
jne 0x419e1f
push ecx
mov ecx, esi
call fcn.0041b960
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x419e46
lock xadd dword [esi], edi
dec edi
jne 0x419e46
push ecx
mov ecx, esi
call fcn.0041b960
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44df40
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x462040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
or ebx, 0xffffffff
mov dword [ebp - 0x10], 0
test edx, edx
jne 0x41a3fe
lea ecx, [ebp - 0x18]
call fcn.0041bc90
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
cmp ecx, edx
je 0x41a3e6
mov dword [ebp - 0x10], edx
mov dword [eax], 0
test ecx, ecx
je 0x41a3e6
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
jne 0x41a3e6
push ecx
call fcn.0041b960
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41a421
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
jne 0x41a421
push ecx
call fcn.0041b960
jmp 0x41a421
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a403
push str.unknown
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
sub ecx, esi
push eax
push ecx
push edx
lea ecx, [ebp - 0x10]
call fcn.0041c980
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x41a42d
lock inc dword [esi]
jmp 0x41a42f
xor esi, esi
mov dword [ebp - 4], 0
mov eax, dword [0x4644d0]
test eax, eax
jne 0x41a48f
mov eax, dword [0x464914]
push ecx
add eax, 4
mov byte [ebp - 4], 0
push 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00418cc0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00418790
lea ecx, [ebp - 0x28]
mov dword [0x4644d0], eax
call fcn.00419860
mov eax, dword [0x4644d0]
test eax, eax
jne 0x41a48f
test esi, esi
je 0x41a48b
mov eax, ebx
lock xadd dword [esi], eax
dec eax
jne 0x41a48b
push ecx
mov ecx, esi
call fcn.0041b960
xor edi, edi
jmp 0x41a4d4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push 0
push ecx
test esi, esi
je 0x41a4c3
push dword [esi + 8]
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x14]
mov eax, ebx
lock xadd dword [esi], eax
dec eax
jne 0x41a4d4
push ecx
mov ecx, esi
call fcn.0041b960
jmp 0x41a4d4
push 0
push 0x459254
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41a4e8
lock xadd dword [ecx], ebx
dec ebx
jne 0x41a4e8
push ecx
call fcn.0041b960
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422050
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, ecx
push edi
mov edi, dword [ebp]
test edi, edi
je 0x4220f7
test byte [edi + 0xc], 2
je 0x42206d
mov eax, dword [edi + 0x1c]
pop edi
pop ebp
pop ecx
ret
mov edx, dword [edi + 4]
push esi
mov esi, dword [edi + 8]
mov dword [esp + 0xc], 0
cmp esi, 4
ja 0x4220a3
push esi
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00434180
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x1c], eax
mov ecx, dword [ebp]
pop esi
pop edi
or dword [ecx + 0xc], 2
pop ebp
pop ecx
ret
mov ecx, esi
xor eax, eax
sar ecx, 2
test ecx, ecx
je 0x4220c6
push ebx
xor ebx, ebx
shl eax, 7
shr ebx, 0x19
or eax, ebx
xor eax, dword [edx]
add edx, 4
mov ebx, eax
sub ecx, 1
jne 0x4220b1
pop ebx
and esi, 3
je 0x4220e8
mov ecx, eax
nop dword [eax]
shr ecx, 0x19
lea edx, [edx + 1]
shl eax, 7
or eax, ecx
movzx ecx, byte [edx - 1]
xor eax, ecx
mov ecx, eax
sub esi, 1
jne 0x4220d0
mov dword [edi + 0x1c], eax
mov ecx, dword [ebp]
pop esi
pop edi
pop ebp
or dword [ecx + 0xc], 2
pop ecx
ret
pop edi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x42ff00
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xorps xmm0, xmm0
movups xmmword [ebp], xmm0
movq qword [ebp + 0x10], xmm0
movups xmmword [ebp + 0x30], xmm0
movq qword [ebp + 0x40], xmm0
nop
movlpd qword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 0x38], xmm0
nop
lock inc dword [esp + 0x10]
nop
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
rdtsc
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 8], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 0x10], xmm0
nop
lock inc dword [esp + 0x10]
nop
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x20]
push eax
mov dword [ebp + 0x20], 1
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 1
mov dword [ebp + 0x2c], 0
call esi
rdtsc
push 5
mov edi, eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
call esi
mov esi, dword [esp + 0x18]
sub esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sbb ecx, dword [esp + 0x24]
push ecx
push esi
push dword [esp + 0x34]
rdtsc
push dword [esp + 0x34]
sub eax, edi
sbb edx, ebx
push edx
push eax
call fcn.00430130
mov dword [ebp + 0x18], eax
add esp, 0x18
mov dword [ebp + 0x1c], edx
rdtsc
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 8], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
movq xmm0, qword [esp + 0x10]
movq qword [ebp], xmm0
nop
lock inc dword [esp + 0x10]
nop
nop
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0x10]
movq qword [ebp + 0x10], xmm0
nop
lock inc dword [esp + 0x10]
nop
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43213f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43217e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43217e
cmp dword [ecx + 0x74], 0xe
jbe 0x43217e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x442d68
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x442d82
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x442d99
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x442df1
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.00445bf7
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x442df1
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x442df1
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x442df1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x442deb
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x442ded
xor bl, bl
mov al, bl
jmp 0x442df3
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x444c2b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x444cc8
push ebx
push esi
call fcn.00444bf4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00443c96
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x444c75
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x444cc7
push edi
push eax
call fcn.00441a90
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x444c95
call fcn.0043f7b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x444cc6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00443c96
add esp, 0x20
test eax, eax
jne 0x444cb4
push edi
call fcn.0043f7b0
jmp 0x444cbc
push ebx
call fcn.0043f7b0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x444ccb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x444cdc
pop esi
ret
push ebx
push edi
push esi
call fcn.00444bf4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00441a90
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x444d04
push ebx
push esi
push edi
call fcn.00434180
add esp, 0xc
push 0
call fcn.0043f7b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x44545b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444f77

Function at 0x44bb00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44bb2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44bb2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408930
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
add edi, edi
add esi, edi
call fcn.00408953
sub edi, edi
xor dword [eax], ebx
dec esi
inc eax
add esi, esi
cmp eax, ecx
jne fcn.00408930
mov esi, 0xd5224c32
ret
Function at 0xd29a090
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push esi
push edi
mov edi, ecx
push 0x90
push edi
mov dword [ebp - 0x41c], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
or word [ebx + 0xe], 1
push 0
push 0
push 0xf0
push 0x93
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0xd29a0ef
or word [ebx + 0xe], 2
jmp 0xd29a0f8
mov ecx, 0xfffd
and word [ebx + 0xe], cx
push 0
push 0
push 0x147
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x150
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 8], eax
cmp eax, 0xaea2
jne 0xd29a1bc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x94
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [ebp - 0x20c]
call fcn.0d2c3e73
test eax, eax
je 0xd29a2b4
mov eax, dword [ebx + 4]
test eax, eax
je 0xd29a168
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xd29a171
mov ecx, dword [ebp - 0x41c]
sub eax, edx
lea edx, [ecx + 0x6c]
mov ecx, dword [ecx + 0x7c]
push edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
call fcn.0d29f000
mov dword [ebx + 4], eax
test eax, eax
jne 0xd29a1bc
push edi
call fcn.0d29dc60
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x81
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xa
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.msvcrt.dll_wcstol]
mov edx, dword [ebp - 0x418]
movzx ecx, word [edx]
add esp, 0xc
test cx, cx
je 0xd29a229
cmp cx, 0x20
je 0xd29a210
cmp cx, 9
jne 0xd29a223
add edx, 2
mov dword [ebp - 0x418], edx
movzx ecx, word [edx]
test cx, cx
jne 0xd29a204
jmp 0xd29a229
cmp word [edx], 0
jne 0xd29a28c
cmp eax, 0x7fff
ja 0xd29a28c
push 0
push 0
push 0xf0
push 0x9c
push edi
mov word [ebx + 0xc], ax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0xd29a26c
or word [ebx + 0xe], 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
mov edx, 0xfffb
and word [ebx + 0xe], dx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xaec9
call fcn.0d29fa20
push 0x30
push 0
lea ecx, [ebp - 0x414]
push ecx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret 4
Function at 0xd2a7d20
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
test ebx, ebx
je 0xd2a7d3f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
jmp 0xd2a7d41
xor eax, eax
mov ecx, dword [ebp + 0x18]
and ecx, 4
cmp dword [ebp + 0x14], 0
jne 0xd2a7d53
lea edx, [ebp - 4]
mov dword [ebp + 0x14], edx
test ebx, ebx
je 0xd2a7dee
test eax, eax
je 0xd2a7dee
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0xd2a7d6d
mov eax, esi
push edi
mov edi, eax
test ecx, ecx
je 0xd2a7da6
lea esi, [eax + eax]
lea eax, [esi + 1]
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
test eax, eax
jne 0xd2a7db4
push 0xd273d38
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, esi
jl 0xd2a7dac
mov edi, esi
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0xd2a7dd5
mov ecx, dword [ecx]
push 0
push 0
push esi
push ecx
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, esi
jg 0xd2a7de0
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], esi
jg 0xd2a7de0
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0xd2be3ad
Capabilities:
Encode data using xor

Disassembly:
call 0xd2be326
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0xd2be356
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0xd2be372
xor edx, 0
jmp 0xd2be37d
xor edx, edx
jmp 0xd2be394
jmp 0xd2be3a0
xor eax, eax
push 0x8427d7c0
call 0xd2be3ad
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0xd2be3e9
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0xd2be3c2
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0xd2be400
add eax, 0
jno 0xd2be405
add esi, 0
ret 0x10
Function at 0xd2bf16e
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0xd2bf190
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0xd2bf332
cmp edi, dword [ebp + 0x10]
jb 0xd2bf332
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.0d2bec5a
inc edi
jmp 0xd2bf219
jmp 0xd2bf226
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0d2bec5a
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0d2bec5a
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0xd2bf27a
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0xd2bf25e
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.0d2bf2a8
add dword [eax], 0x39
jle 0xd2bf284
sub al, 0xf5
mov ch, al
call fcn.0d2bf2bd
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0xd2c0f95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0xd2c0fab
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0xd2c0fbc
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.0d2c0ffd
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx