joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e7290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dl, ah
pop edi
js 0x5e7295
mov dword [ebp - 0x90], eax
movzx esi, word [eax]
add eax, 2
cmp byte [ecx + 0x14], 0
mov dword [ebp + 0xc], eax
jne 0x5e72bd
call fcn.00585f4e
jmp 0x5e72ab
lahf
in al, dx
stc
invalid
push 0x18
push esi
call 0x5f64c6
pop ecx
pop ecx
test dword [eax], edi
mov al, 0xe6
movzx esp, byte [esi - 0x17c89e8]
sub eax, 0xcb83d575
salc
push esi
jb 0x5e7341
cmp esi, 0x2b
aam 0x35
mov edx, dword [ebp + 0xc]
movzx esi, word [edx]
add edx, 0xffffffd9
mov dword [esp + ecx + 0x558b0319], edx
or al, 0xc7
push 0xffffff74
cmp al, byte [eax]
add byte [eax], al
mov eax, 0x8100ff10
xbegin 0x64b6fe
add dl, dh
xor dword [edi - 0x5a], ebp
sldt word [eax]
dec ecx
inc ebp
insd dword es:[edi], dx
invalid
aam 0x70
jnp fcn.005e7339
add bh, al
mov al, dl
out 0xa, al
add byte [eax], al
invalid

Function at 0x5fcf22
Capabilities:
Accept command line arguments

Disassembly:
xor ecx, ebp
shr eax, 1
outsd dx, dword [esi]
add al, 0xfd
inc dword [edi - 0x3d]
mov word [sym.imp.KERNEL32.dll_GetCommandLineA], ss
mov dword [0xf1cbca], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x6fcb38], eax
mov al, 1
rcl byte [edi + edi*8], cl
adc al, 0xff
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push edi
xor edi, edi
cmp word [edx], di
je 0x5fcf6c
push esi
in eax, dx
or dword [ebp - 0x7499fd8f], 1
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x5fcf51
sub ecx, dword [esi]
sar ecx, 1
pushfd
adc al, 0x4a
add edx, 2
bound di, dword [edx]
jne 0x5fcf4c
pop esi
lea eax, [edx + 2]
pop edi
pop ebp
ret
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4030ca
pop dword [ebp - 0x30]
mov eax, 0x70c2795a
sub eax, 0x70824890
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd348401e
add dword [ebp - 0x40], 0x7b0a052d
mov dword [ebp - 0x3c], 0xcf21019a
add dword [ebp - 0x3c], 0x63124aab
mov dword [ebp - 0x38], 0x1af7fe52
add dword [ebp - 0x38], 0x315445dc
mov dword [ebp - 0x34], 0x38e2aa87
sub dword [ebp - 0x34], 0x38e2aa87
lea eax, [ebp - 0x40]
push eax
mov eax, 0xb85738d8
add eax, 0x47e9482c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x537e431
sub dword [ebp - 0x40], 0x90c57adb
mov dword [ebp - 0x3c], 0xf7468419
sub dword [ebp - 0x3c], 0xb5da22a4
mov dword [ebp - 0x38], 0xbeb1bff5
sub dword [ebp - 0x38], 0x5b425389
mov dword [ebp - 0x34], 0x484e221b
add dword [ebp - 0x34], 0xb7b1dde5
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37658
push 0
call eax
mov ecx, 0xa15d4ddc
sub ecx, 0xa15d0439
mov ebx, eax
mov esi, 0x454200
add esi, dword [ebp - 0x30]
mov edi, 0x62fa4dd8
sub edi, 0x5d63479d
xor dword [ebp - 0x28], 0x2dfc8dc1
mov edx, dword [esi]
sub dword [ebp - 0x2c], esi
add edx, edi
sub dword [ebp - 0x28], ecx
mov dword [ebx], edx
add dword [ebp - 4], eax
add ebx, 0x257a82f
add ebx, 0xfda857d5
add esi, 0x61b10978
sub esi, 0x61b10974
loop 0x4031e1
add eax, 0x7d8e07a1
add eax, 0x827311be
mov ebx, eax
add eax, 0x809fd917
sub eax, 0x809fd912
mov ecx, 0xdcf96517
add ecx, 0x23469ae9
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x55fa66b4
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x37546b9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40d09a
pop dword [ebp - 0x48]
mov eax, 0x1ad5ca0b
sub eax, 0x1a94f971
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x395f6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x6a8cc81a
add ecx, 0x95738072
mov esi, eax
mov edx, 0x2c0ae818
sub edx, 0x2bc9ac54
add edx, dword [ebp - 0x48]
mov edi, 0x7d76cc70
sub edi, 0x64814875
sub dword [ebp - 0x14], edi
mov ebx, dword [edx]
sub dword [ebp - 0x1c], 0x49f279d6
xor ebx, edi
add dword [ebp - 0x44], 0x6a5baf52
mov dword [esi], ebx
mov dword [ebp - 0x18], 0xd1f2f14f
add esi, 0x73a98c6b
sub esi, 0x73a98c67
add edx, 0x78b984a6
sub edx, 0x78b984a2
loop 0x40d0f4
add eax, 0xb46ca0ac
add eax, 0x4b947457
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401ab4
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x130
mov esi, esp
mov eax, 0xfffffefb
test eax, eax
je 0x401ad9
mov byte [esi + eax + 0x120], 0
inc eax
jmp 0x401aca
lea edi, [esi + 0x1b]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
je 0x401b52
sub esp, 0x1c
movaps xmm0, xmmword [0x4210f0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
and dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x401b52
mov edi, eax
push 0x18
pop eax
call fcn.0041b5d8
mov eax, esp
and eax, 0xfffffff0
mov esp, eax
mov byte [eax], 1
movaps xmm0, xmmword [0x421100]
movups xmmword [eax + 4], xmm0
mov word [eax + 0x14], 0x4f
lea ecx, [esi + 0x10]
push 0xa
push 0x16
push eax
push ecx
push edi
call sub.ntdll.dll_NtSetInformationFile
test eax, eax
je 0x401b5c
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x1c
movaps xmm0, xmmword [0x4210f0]
movups xmmword [esp + 4], xmm0
lea eax, [esi + 0x1b]
mov dword [esp], eax
and dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x401b52
mov edi, eax
push 4
pop eax
call fcn.0041b5d8
mov eax, esp
and eax, 0xfffffff0
mov esp, eax
mov dword [esi + 0xc], eax
mov byte [esi + 0xc], 0
mov eax, dword [esi + 0xc]
mov byte [eax], 1
push 0xd
push 1
push eax
lea eax, [esi + 0x10]
push eax
push edi
call sub.ntdll.dll_NtSetInformationFile
xor ebx, ebx
test eax, eax
jne 0x401b52
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x1b]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
test eax, eax
sete bl
jmp 0x401b52
Function at 0x419c0e
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [esp + 4]
and eax, 0xf
jmp dword [eax*4 + 0x421370]
Function at 0x41b750
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x41b761
jmp dword [eax*4 + 0x421ab0]
cmp dword [0x4583cc], 0
je 0x41b85d
push 0x4583d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4583e8]
test edi, edi
je 0x41b852
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b7ab
mov edi, dword [edi + 8]
test edi, edi
je 0x41b852
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x41b7a0
test esi, esi
je 0x41b7a0
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x41b7a0
cmp dword [0x4583cc], 0
jne 0x41b7da
push 0x4583d0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4583cc], 1
jmp case.default.0x41b761
call fcn.0041afa0
jmp case.default.0x41b761
cmp dword [0x4583cc], 0
je case.default.0x41b761
push 0x4583d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4583e8]
test edi, edi
je 0x41b8a3
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41b837
mov edi, dword [edi + 8]
test edi, edi
je 0x41b8a3
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x41b830
test esi, esi
je 0x41b830
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x41b830
push 0x4583d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4583cc]
cmp eax, 1
jne case.default.0x41b761
mov eax, dword [0x4583e8]
test eax, eax
je 0x41b882
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x41b870
mov dword [0x4583e8], 0
mov dword [0x4583cc], 0
push 0x4583d0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x41b761
push 0x4583d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41b9e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x421004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x41ba46
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x41ba46
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x41ba46
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x41ba46
mov edx, dword [esp + 0xc]
sub edx, dword [0x421004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x41ba36
add esi, 0x28
dec ecx
je 0x41ba46
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x41ba30
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x41ba30
mov eax, esi
pop esi
pop edi
ret
Function at 0x403970
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42bd48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x64]
test eax, eax
jne 0x403a1a
mov eax, dword [0x437df8]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00424345
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.00424394
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.004242f1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403a01
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x403a01
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x64], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0042407f
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x403a30
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x403a92
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x403ca0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x403d92
lea ecx, [esp + 0x10]
push ecx
push str..htm
push 0x80000000
mov ecx, edi
call fcn.00403a30
test eax, eax
jne 0x403d92
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x80000000
mov ecx, edi
call fcn.00403a30
test eax, eax
jne 0x403d92
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.00411540
mov esi, eax
add esp, 8
test esi, esi
jne 0x403d63
lea eax, [esp + 0x10]
push 0x436458
push eax
call fcn.004114c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x403d63
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x403d66
mov byte [esi], 0
push 0x436454
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x41e320
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00412c80
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41e3eb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41e3eb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41e39e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41e3a9
or bh, 8
and edi, 0x8000000
je 0x41e3c4
mov eax, dword [0x43edfc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41e3eb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41e7eb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41e80f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41e82a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x42175e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x421796
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004243bc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00424394
jmp 0x4217a2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x422f33
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x422f75
call fcn.0042a3ee
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x422f75
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x422f6c
xor eax, eax
jmp 0x422f7d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00422f83
pop edi
pop esi
pop ebx
ret 4

Function at 0x42b09c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42b0ca
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b0e8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042b002
jmp 0x42b0e8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42b0e8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042b002
test edi, edi
mov eax, edi
jne 0x42b0d2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10012bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10012c07
pop dword [ebp - 0x48]
mov eax, 0x8f34dfdf
sub eax, 0x7f33b3d8
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xfd5535e
add dword [ebp - 0x58], 0x3e7cf1ed
mov dword [ebp - 0x54], 0xcbae536c
sub dword [ebp - 0x54], 0x997b0727
mov dword [ebp - 0x50], 0xb4bf10a4
sub dword [ebp - 0x50], 0x6872cc76
mov dword [ebp - 0x4c], 0x217915f5
sub dword [ebp - 0x4c], 0x217915f5
lea eax, [ebp - 0x58]
push eax
mov eax, 0x3ddadbe1
add eax, 0xd2272423
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x906e8808
add dword [ebp - 0x58], 0xe403e14e
mov dword [ebp - 0x54], 0xc336d6f2
add dword [ebp - 0x54], 0x7e358a83
mov dword [ebp - 0x50], 0xbe7cd3fe
add dword [ebp - 0x50], 0xa4f2986e
mov dword [ebp - 0x4c], 0x921281cd
add dword [ebp - 0x4c], 0x6ded7e33
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3c152
push 0
call eax
mov ecx, 0x4518
mov esi, eax
mov edx, 0xd14978
sub edx, 0xf0ce8d78
add edx, dword [ebp - 0x48]
mov ebx, 0x71b2ba21
add ebx, 0x5e76c869
add dword [ebp - 0x10], 0x89c60695
mov edi, dword [edx]
add dword [ebp - 0x20], ebx
add edi, ebx
sub dword [ebp - 0x28], ecx
mov dword [esi], edi
xor dword [ebp - 8], 0x7693003c
add esi, 0xf7db0b2f
add esi, 0x824f4d5
add edx, 4
loop 0x10012d1e
add eax, 0xff8ff86
add eax, 0xf00807ad
mov ebx, eax
add eax, 0xa4d603b7
sub eax, 0xa4d603b2
mov ecx, 0x1dade727
add ecx, 0xf25218d9
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x43db68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43db68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43db6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43db70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x43db78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x43db74], eax
mov eax, dword [0x43db74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x43db78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x43db78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x43db6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x43db70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43db68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x43b030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x2c1b55c]
push ebx
mov ebx, dword [0x2c1b280]
push esi
mov esi, dword [0x43bf60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c1b55c]
mov dword [0x43dd0c], esi
cmp eax, 0x114e
jne 0x40afbb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2c1b55c]
cmp eax, 0x2f
jne 0x40afdb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret