joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d08
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x40cc94]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x40c019], 0
jne 0x402d64
mov eax, dword [0x40e174]
call fcn.00403f94
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c099
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x40c019], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [esp + 0x19], 0
mov dword [esp + 4], 1
test bl, bl
je 0x402dbe
and dword [esp + 8], 0xbfffffff
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
or dword [esp + 4], 0x40000000
mov ecx, esp
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x402e12
or dword [esp + 8], 0x40000000
and dword [esp + 8], 0xfffffffe
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c0c0
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x403e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x403e75
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00403fac
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x403ebb
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x403f0c
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x403f89
mov eax, dword [ebx + 4]
test eax, eax
je 0x403f24
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.00406ad4
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.00406878
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.00406b54
mov edx, edi
mov eax, ebx
call fcn.004045e8
test al, al
jne 0x403f65
mov edx, edi
mov eax, ebx
call fcn.00404620
mov edx, edi
mov eax, ebx
call fcn.00404460
mov ebx, eax
mov eax, edi
call fcn.0040688c
test ebx, ebx
je 0x403f89
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.0040688c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4041a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x404206
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x404217
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x404206
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x4041be
cmp dword [esp], 0
je 0x4041be
xor ebx, ebx
cmp dword [esp], 0
je 0x404261
lea eax, [esp + 4]
push eax
push 0x40cc24
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404261
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x404257
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x405960
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x405953
cmp dword [eax + 0xc], ebx
je 0x4059f6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
inc ebp
or al, 0xe8
inc edi
cli
invalid
jmp edx
pop ss
mov bh, 0x6f
cmp dword [ebp + 0xc], ebx
jne 0x405982
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x405b9d
add byte [eax], al
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x405996
mov dword [ebp + 0x10], edi
jmp 0x40599b
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.004053ae
dec ecx
pcmpeqw mm1, mm6
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je fcn.004059e4
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x4059bf
and eax, 0xffff
push eax
jmp 0x4059c3
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405373
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x405b9d
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x4059a4
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x405945
call fcn.004053ae
leave
clc
xor esi, ecx
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x405a62
add eax, esi
cmp dword [eax], ebx
je 0x405a62
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x405a5d
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x405a47
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x405a4f
cmp edx, ebx
jne 0x405b9d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x405a1e
add eax, dword [eax + 4]
jmp 0x405a0b
mov dword [ebp + 0xc], ebx
jmp 0x405a6d
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x405a85
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x405aa3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405b01
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x405ae8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405af1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405afb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405add
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x405a67
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x4059e4
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x405953
cmp dword [eax + 0xc], ebx
je 0x4059f6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
inc ebp
or al, 0xe8
inc edi
cli
invalid
jmp edx
pop ss
mov bh, 0x6f
cmp dword [ebp + 0xc], ebx
jne 0x405982
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x405b9d
add byte [eax], al
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x405996
mov dword [ebp + 0x10], edi
jmp 0x40599b
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.004053ae
dec ecx
pcmpeqw mm1, mm6
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je fcn.004059e4
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x4059bf
and eax, 0xffff
push eax
jmp 0x4059c3
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405373
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x405b9d
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x4059a4
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x405945
call fcn.004053ae
leave
clc
xor esi, ecx
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x405a62
add eax, esi
cmp dword [eax], ebx
je 0x405a62
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x405a5d
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x405a47
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x405a4f
cmp edx, ebx
jne 0x405b9d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x405a1e
add eax, dword [eax + 4]
jmp 0x405a0b
mov dword [ebp + 0xc], ebx
jmp 0x405a6d
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x405a85
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x405aa3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405b01
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x405ae8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405af1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405afb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405add
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x405a67
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x406ca8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405373
add esp, 0xc
invalid
invalid
Function at 0x409440
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7a2
mov eax, 0x41b23c
call fcn.0040695c
mov dword [0x41b224], eax
test eax, eax
jne 0x409491
push 0
push 0x41b23c
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7a2
mov eax, 0x41b23c
call fcn.0040695c
mov dword [0x41b224], eax
test eax, eax
jne 0x409491
mov eax, 0x40ccb8
mov edx, 9
call fcn.0040666c
push 0x41b23c
mov eax, 0x6e
call fcn.00402874
push eax
call fcn.00402e2c
add esp, 8
mov eax, 1
ret
xor eax, eax
ret

Function at 0x409620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40eb00], 0
jg 0x40963e
dec dword [0x40eb00]
xor eax, eax
mov dword [0x41b138], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41b138], 0
jg 0x409693
push dword [0x41b154]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41b130]
call fcn.00406a08
mov dword [0x41b138], eax
test eax, eax
jne 0x409678
xor edx, edx
or eax, 0xffffffff
mov dword [0x41b138], edx
pop esi
pop ebx
ret
add dword [0x41b15c], 0x2000
mov edx, dword [0x41b130]
mov dword [0x41b134], edx
call fcn.004094e4
mov ecx, dword [0x40f124]
test byte [ecx + 0x14], 1
je 0x4096ca
mov esi, dword [0x41b138]
mov ebx, dword [0x41b134]
jmp 0x4096c1
call fcn.0040a890
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040a8b4
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x4096ad
dec dword [0x41b138]
mov ecx, dword [0x41b134]
inc dword [0x41b134]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x40a8b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41b348]
push ebx
mov ecx, edx
mov ebx, dword [0x41b128]
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ebx + ecx*4]
xor ecx, edx
mov dword [0x41b348], ecx
and ecx, 0xff
add dword [0x41b34c], ecx
imul edx, dword [0x41b34c], 0x8088405
inc edx
mov dword [0x41b34c], edx
shr edx, 0x18
mov ecx, dword [0x41b350]
xor edx, ecx
mov ebx, dword [0x41b128]
and edx, 0xff
shr ecx, 8
mov edx, dword [ebx + edx*4]
xor edx, ecx
mov dword [0x41b350], edx
pop ebx
ret
Function at 0x40aafc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x40ab10
xor eax, eax
jmp 0x40ac08
call fcn.0040aaf4
xor ebx, 0xffffffff
cmp edi, 8
jb 0x40abe5
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40ab21
test edi, edi
je 0x40ac03
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x40abe9
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x401788
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x40183e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40a5b4
call sub.kernel32.dll_InitializeCriticalSection
cmp byte [0x40a035], 0
je 0x4017b6
push 0x40a5b4
jmp loc.00420cbb
mov eax, 0x40a5d4
call fcn.0040114c
mov eax, 0x40a5e4
call fcn.0040114c
mov eax, 0x40a610
call fcn.0040114c
push 0xff8
push 0
call sub.kernel32.dll_LocalAlloc
mov dword [0x40a60c], eax
cmp dword [0x40a60c], 0
je 0x40181d
jmp loc.0041c939
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401845
cmp byte [0x40a035], 0
je 0x40183d
push 0x40a5b4
call sub.kernel32.dll_LeaveCriticalSection
ret

Function at 0x40184c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x40a5ac], 0
je 0x401929
xor edx, edx
push ebp
push 0x401922
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x40a035], 0
je 0x40187e
push 0x40a5b4
jmp loc.004205b1
mov byte [0x40a5ac], 0
mov eax, dword [0x40a60c]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x40a60c], eax
mov ebx, dword [0x40a5d4]
jmp 0x4018b1
jmp fcn.0041c28e
pop ebx
pop ebp
ret

Function at 0x402838
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4028d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4028b0
xor eax, eax
push ebp
push 0x4028a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4028ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4028b0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409018], ax
mov esp, ebp
pop ebp
ret

Function at 0x404f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
jmp fcn.0041e40c

Function at 0x405008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405079
lea eax, [ebp - 0x10c]
call fcn.00403094
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x43ccdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ccdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43cce0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43cce4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x43ccec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x43cce8], eax
mov eax, dword [0x43cce8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x43ccec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x43ccec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x43cce0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x43cce4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ccdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x437a90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x437ab1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x437b06
push esi
jmp 0x437ac0
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.00437a80
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x437ac0
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x437b21
mov dword [0x2b3aef8], 0xa62e7790
mov dword [0x2b3aefc], 0xffffffff
add esp, 8
ret
Function at 0x40b890
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40ba5e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b8bb
mov eax, 0x7000000
jmp 0x40b8c3
test eax, eax
je 0x40ba39
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00461500
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x5d71e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40ba51
cmp ecx, 0x21
jae 0x40ba45
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045b160
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0045b230
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x5403f0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x540458]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40ba14
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5404a0]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004615e0
mov eax, ecx
mov ecx, 0x21
call fcn.00461690
nop
call fcn.00460140
jmp fcn.0040b890