joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4b00
Capabilities:
Encode data using xor

Disassembly:
test byte [ebx - 0x5b3a9776], ch
mov ch, byte [eax - 0x3b]
movsb byte es:[edi], byte [esi]
push eax
pop ebx
mov al, 0xc1
loop 0x5c4a60
mov dh, 0xb3
add eax, 0x2f1c693b
and eax, 0xd242a49f
hlt
scasb al, byte es:[edi]
inc esi
pop ebp
das
jno 0x5c4a5a
dec esp
popal
xor al, 0x5b
jb 0x5c4a58
push cs
lahf
and dword [edi + 0x15], ecx
out 0xbe, eax
retf 0x7cf3
sbb dword [eax], eax
inc esp
idiv dword [ebp + 0x5d]
xor dword [eax + 0x43105330], esi
insb byte es:[edi], dx
lahf
adc byte [esi + 0x40], bh
loop 0x5c4aa4
and esp, 0x26
rcr byte [ebx], 1
test eax, 0xf9f9eb79
enter 0x3084, 0x1c
push esp
test byte [edi], dh
pop es
inc ebx
add byte [0x7f5f752], dh
xor byte [eax + ecx*2], ah
sbb bh, 0x12
pop ss
fst qword [ecx + edi*8 - 0x19]
mov cl, 0x35
test dword [edx + 0x17], edx
mov ch, 0xc9
fcom dword [edi - 1]
mov word [ecx - 0x61], es
ficom dword [edi + 0x31]
xchg byte [edx], al
xor dword [0xe0273536], eax
salc
xchg cl, dl
shl dword [ebx], cl
push es
invalid

Function at 0x605f00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006393f0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606023
push ecx
lea ecx, [esi + 0x18]
call fcn.00625720
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x60603a
push ecx
lea ecx, [esi + 0x24]
call fcn.00625630
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x60ba6f
Capabilities:
Encode data using xor

Disassembly:
sub byte [ecx], ch
sbb al, 0x5e
jmp 0xac4fd7f8
add al, 0x18
jnp 0x60bab7
fcmovnu st(0), st(7)
scasb al, byte es:[edi]
push ds
lodsd eax, dword [esi]
push dword [edi]
pop esp
scasd eax, dword es:[edi]
mov byte [edi], bh
imul ebp, ebp, 0x55a34966
pop esp
dec eax
mov dword [ecx + 0x8b91f86], esp
xor ecx, dword [ebp - 0x80]
or byte [edi], 0xca
aad 0xfb
mul dh
and byte [ecx], bl
jns 0x60ba8c
je 0x60ba54
ror dword [ecx + 0x787880f0], 4
push eax
scasb al, byte es:[edi]
ficomp dword [ebp - 0x74]
cmp dword [eax - 0x3646b1f7], ebp
leave
ljmp 0x2ae1:0x80ea193c
mov edx, 0x4e417b5e
jp 0x60baa8
xchg esi, eax
push edx
lodsd eax, dword [esi]
xor eax, 0x804cc981
pop ecx
imul ebp, edx, 0x9e3ddabc
test al, 0x9e
xor byte [esi], al
lea eax, [edi]
inc ebp
sahf
jno 0x60bb40
sahf
push 0xc28a60f0
dec esi
and eax, 0x299a284b
dec esp
call 0x1a5943d1
fcmovnb st(0), st(1)
mov al, 9
fisttp word [ebp - 0x7fdebec]
mov cl, 0xd1
wait
popal
push es
cmp dword [esi - 0x1da60087], ecx
push 9
xchg ebp, eax
cmp dword [esi], eax
insd dword es:[edi], dx
lahf
inc ebx
adc byte [edx + 0x43], ah
dec ebx
lds ecx, [edi]
ror byte [0x777d7d2c], cl
ja 0x60baad
push ecx
add edx, eax
js 0x60bb7b
push ds
mov word [ebp + 0x17], gs
mov ebx, 0x3586a3ed
leave
mov eax, dword [0xc7249968]
cmc
cmp ecx, dword [edx]
neg dword [ebp + esi + 0x37]
invalid
jmp 0x49b0413e
into
fbstp tbyte [ebp + 0x2159d186]
divps xmm2, xmm1
imul ecx, edx, 0x56f50417
out 0xb7, al
push ds
jae 0x60bb97
mov edi, edi
add ecx, dword [ecx + 0x29]
stosb byte es:[edi], al
mov dword [0x6effb019], eax
inc ebp
sbb byte [esi - 0x4d], dh
dec ebp
jns 0x60bb88
stc
pop ecx
pop ss
sub cl, byte [ecx]
fstp qword [edi]
sub ecx, dword [edx]
mov eax, dword [0x80905648]
dec ecx
mov edx, 0x66685969
mov eax, dword [0xf84dc961]
leave
dec ebp
clc
or ebp, ebp
mov word [eax + 0x26], fs
je 0x60bb4b
jmp 0x2f4b8e87
hlt
Function at 0x64d13d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d15f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d150
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d28d
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d267
test eax, eax
jne 0x64d190
cmp dword [0x654264], 1
je 0x64d267
cmp edx, 0xfc
je 0x64d28d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1c7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dfb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d20a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dfb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6526cc
push edi
call fcn.0064fe80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064db20
lea eax, [ebp - 0xa0]
call dword [edi + 0x50]
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x412b30
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x412bc7
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x412be0
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412bce
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41f988
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41f9e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41f9d2
push 3
push 0x41f9f4
push 0x41f9f4
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41f9f8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f9ef
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x10006807
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10006816
pop dword [ebp - 0x28]
mov eax, 0x10006816
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3cd36
push 0
mov eax, 0x7a3760dd
sub eax, 0x6a35ff9d
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x53ab
xor edi, edi
add edi, eax
mov ebx, 0x10024400
add ebx, dword [ebp - 0x28]
mov esi, 0xee053a72
add esi, 0x49ba0ee5
xor dword [ebp - 0x20], 0x9d21d1f0
mov edx, dword [ebx]
add dword [ebp - 4], 0x9c3f1328
xor edx, esi
add dword [ebp - 0x10], eax
mov dword [edi], edx
sub dword [ebp - 0xc], 0xc3e8ee70
add edi, 4
add ebx, 0xcaa640b6
sub ebx, 0xcaa640b2
loop 0x10006866
add eax, 0x55cde21c
sub eax, 0x55cca09d
xor ebx, ebx
add ebx, eax
add eax, 0x4df4ddb
add eax, 0xfb20b22a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4043d1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push esi
mov esi, ecx
lea eax, [ebp - 0x14]
push edi
xor edi, edi
push eax
lea ecx, [esi + 0xc8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00401be8
test al, al
je 0x404423
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x63], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x67], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x6f], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x73], eax
lea eax, [ebp - 0x98]
push eax
push 0x80
push 0xd
push 0x402
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call fcn.004072c1
cmp edx, edi
ja 0x40445a
cmp eax, edi
jbe 0x404463
mov ecx, dword [esi + 0x40]
mov dword [ecx + 0x5b], eax
mov dword [ecx + 0x5f], edx
pop edi
pop esi
leave
ret
Function at 0x4052a5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0xcc]
call fcn.00401be8
test al, al
je 0x405302
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x28]
mov dword [ecx + 0x84], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0x88], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0x8c], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x90], eax
mov edx, 0x3f2
mov ecx, esi
call fcn.00409b3b
cmp eax, 0xffffffff
jne 0x4053d0
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00415d10
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0x100
push 0xd
push 0x3f2
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 4], 0
lea eax, [ebp - 5]
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x128]
push str._x_:__d__y_:__d__c
push eax
call fcn.004158c4
add esp, 0x14
cmp eax, 2
jne 0x405397
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x9c], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0xa0], eax
jmp 0x4053d0
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x128]
push str.__d__c
push eax
call fcn.004158c4
add esp, 0x10
cmp eax, 1
jne 0x4053d0
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 4]
mov dword [ecx + 0xa0], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x9c], eax
mov edx, 0x3f5
mov ecx, esi
call fcn.00409b3b
cmp eax, 0xffffffff
jne 0x40547c
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00415d10
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0x100
push 0xd
push 0x3f5
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0040455c
test al, al
je 0x40547c
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0xac], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0xa4], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0xa8], eax
pop esi
leave
ret
Function at 0x406396
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, 0x40e
push esi
mov edx, ebx
mov esi, ecx
call fcn.00409b3b
cmp eax, 0xffffffff
jne 0x406419
push edi
mov edi, 0x80
lea eax, [ebp - 0x88]
push edi
push 0
push eax
call fcn.00415d10
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push edi
push 0xd
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 8], 0
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push str.__d__c
push eax
call fcn.004158c4
add esp, 0x10
pop edi
cmp eax, 1
jne 0x406419
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp - 8]
mov dword [ecx + 0xca], eax
pop esi
pop ebx
leave
ret

Function at 0x406f7d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push esi
mov esi, ecx
lea eax, [ebp - 0x14]
push edi
xor edi, edi
push eax
lea ecx, [esi + 0xc8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00401be8
test al, al
je 0x406fcf
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x36], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x3a], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x42], eax
mov ecx, dword [esi + 0x40]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x46], eax
lea eax, [ebp - 0x98]
push eax
push 0x80
push 0xd
push 0x3f2
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call fcn.004072c1
cmp edx, edi
ja 0x407006
cmp eax, edi
jbe 0x40700c
mov ecx, dword [esi + 0x40]
mov dword [ecx + 0x2e], eax
pop edi
pop esi
leave
ret
Function at 0x407e44
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
push edi
push str.DGVOODOOCOMM
push edi
jmp 0x407f24
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push edi
push 0x407
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x407f1d
push 0x5b
pop ecx
mov edx, edi
mov word [ebp + eax - 0x808], cx
inc edi
lea eax, [edx*2 + 2]
movzx ecx, word [eax + str._Running_]
test cx, cx
jne 0x407e87
xor eax, eax
lea ecx, [ebp - 0x806]
lea ecx, [ecx + edx*2]
mov word [ecx], ax
mov eax, 0x400
sub eax, edi
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebx, [edi + eax]
xor edi, edi
test esi, esi
je 0x407f0c
push edi
push edi
push 0x40a
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x407f0c
push 0x20
lea ecx, [ebp - 0x808]
mov eax, edi
pop edx
lea ecx, [ecx + ebx*2]
inc eax
mov word [ecx], dx
lea ecx, [ecx + 2]
movzx edx, word [eax*2 + str.__already_attached_]
test dx, dx
jne 0x407eec
add eax, ebx
xor ecx, ecx
mov word [ebp + eax*2 - 0x808], cx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x808]
push edi
push esi
push eax
call fcn.00407d33
push edi
push str.DGVOODOOCOMM
push esi
push 0xfffffffffffffffd
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x407e61
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push str.RT_CUSTOM
push 0x79
push 0
call edi
test eax, eax
je 0x409102
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0
call ebx
test eax, eax
je 0x409102
push eax
call fcn.00415875
add esp, 4
mov esi, eax
push str.RT_CUSTOM
push 0x79
push 0
call edi
mov edi, eax
test edi, edi
je 0x4090f7
push edi
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x4090f7
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4090f7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4090f7
push ebx
push eax
push esi
call fcn.00415d40
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
ret
push 1
push esi
call fcn.00415858
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x40993d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push edx
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret
Function at 0x409eac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edx
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, dword [ebp + 8]
mov edi, eax
mov ecx, edi
mov esi, dword [edi + 0x88]
call fcn.00409ca0
mov ebx, eax
cmp esi, ebx
je 0x409f03
mov ecx, dword [edi + esi*4]
push 0
call fcn.0040a023
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov ecx, dword [edi + ebx*4]
push 1
call fcn.0040a023
push eax
call esi
mov dword [edi + 0x88], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10005e45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10005e54
pop dword [ebp - 0x50]
mov eax, 0x79e4265e
add eax, 0x961c37f6
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x5edd8193
sub dword [ebp - 0x60], 0x108b3c48
mov dword [ebp - 0x5c], 0xaa4f3e3e
add dword [ebp - 0x5c], 0x87e40e07
mov dword [ebp - 0x58], 0xd1ea85a4
sub dword [ebp - 0x58], 0x859e4176
mov dword [ebp - 0x54], 0xb4ccc224
add dword [ebp - 0x54], 0x4b333ddc
lea eax, [ebp - 0x60]
push eax
mov eax, 0x6614c18d
add eax, 0xa9ed3e77
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x58dbac55
sub dword [ebp - 0x60], 0xe46942ff
mov dword [ebp - 0x5c], 0x8b18f98d
sub dword [ebp - 0x5c], 0x49ac9818
mov dword [ebp - 0x58], 0xf91719e3
add dword [ebp - 0x58], 0x6a585289
mov dword [ebp - 0x54], 0x900a3b8e
add dword [ebp - 0x54], 0x6ff5c472
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x482026b4
add eax, 0xc7e1d94c
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3f94a
push 0
call eax
mov ecx, 0x8614f6a1
sub ecx, 0x8614a353
xor esi, esi
add esi, eax
mov edi, 0xecddeb4d
sub edi, 0xdcdb2f4d
add edi, dword [ebp - 0x50]
mov ebx, 0xe379cb49
sub dword [ebp - 0x20], 0x109c42
mov edx, dword [edi]
xor dword [ebp - 0x24], ecx
add edx, ebx
sub dword [ebp - 0x30], 0x88a5d29f
mov dword [esi], edx
add dword [ebp - 0xc], 0xab180759
add esi, 4
add edi, 0xe5c9e2a7
sub edi, 0xe5c9e2a3
loop 0x10005f72
add eax, 0xc5040e82
sub eax, 0xc502ce77
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc5017784
add ecx, 0x4afe887c
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1000f040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000f04f
pop dword [ebp - 0x50]
mov eax, 0xf8e59a9c
sub eax, 0xe8e4aa4d
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x820c7c24
add dword [ebp - 0x60], 0xcc45c927
mov dword [ebp - 0x5c], 0x8672686e
add dword [ebp - 0x5c], 0xabc0e3d7
mov dword [ebp - 0x58], 0x7f8b7091
add dword [ebp - 0x58], 0xccc0d39d
mov dword [ebp - 0x54], 0x878051b4
sub dword [ebp - 0x54], 0x878051b4
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe8a006ee
sub dword [ebp - 0x60], 0x742d9d98
mov dword [ebp - 0x5c], 0x9411ee63
sub dword [ebp - 0x5c], 0x52a58cee
mov dword [ebp - 0x58], 0x25166a18
add dword [ebp - 0x58], 0x3e590254
mov dword [ebp - 0x54], 0xab1424e3
sub dword [ebp - 0x54], 0xab1424e3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xcbfaf6ee
add eax, 0x4406c972
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3962c
push 0
call eax
mov ecx, 0xc75f5a74
add ecx, 0x38a0e401
mov esi, eax
mov edx, 0x6e51938a
sub edx, 0x5e4f0b8a
add edx, dword [ebp - 0x50]
mov ebx, 0x9bc57fed
sub ebx, 0x474e18f1
xor dword [ebp - 8], esi
mov edi, dword [edx]
sub dword [ebp - 0x20], 0xc6d508e1
xor edi, ebx
sub dword [ebp - 0x1c], ebx
mov dword [esi], edi
sub dword [ebp - 0x20], esi
add esi, 0x2c8376d0
sub esi, 0x2c8376cc
add edx, 0xbe6a6b3f
add edx, 0x419594c5
loop 0x1000f16c
add eax, 0xeca7
mov ebx, eax
add eax, 0xca6651b4
add eax, 0x3599ae51
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x57947791
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x74023bb5
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4027b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40280b
cmp byte [esi + ebx - 1], 0xa
je 0x4027df
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x402870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
lea ecx, [ebp - 0x20]
push ebx
sub esp, 0x3c
mov dword [ebp - 0x20], 0x1fe
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x4028b8
cmp dword [ebp - 0x1c], 1
je 0x4028c8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [edi], 0
je 0x402918
mov eax, edi
add eax, 2
cmp word [eax], 0
jne 0x4028d0
sub eax, edi
add eax, 2
xor ecx, ecx
mov esi, dword [sym.imp.ucrtbase.dll_wcschr]
mov word [edi + eax], cx
jmp 0x4028f8
xor edx, edx
lea edi, [eax + 2]
mov word [eax], dx
mov dword [esp + 4], 0x2c
mov dword [esp], edi
call esi
test eax, eax
jne 0x4028f0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x4028de