joyce8/EMBER2024-capa huggingface dataset:
Function at 0x907e5ad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09010f42
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e632
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09010f42
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e649
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e6a5
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e698
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.09010f42
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09010f42
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907e741
sub dword [ebp - 0x13d8], 1
jne 0x907e737
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x907e681
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.09010f42
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09010f42
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.09010f42
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09010f42
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.09010f42
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.09010f42
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.09010f42
int3
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40596d
pop dword [ebp - 0x18]
mov eax, 0x40596d
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x54a67558
add dword [ebp - 0x28], 0xf9abcff3
mov dword [ebp - 0x24], 0x2b8a835e
sub dword [ebp - 0x24], 0xf9573719
mov dword [ebp - 0x20], 0xc79c4d12
sub dword [ebp - 0x20], 0x7b5008e4
mov dword [ebp - 0x1c], 0xa9f662c8
sub dword [ebp - 0x1c], 0xa9f662c8
lea eax, [ebp - 0x28]
push eax
mov eax, 0x8e413f2b
add eax, 0x71ff3135
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc89a9f5f
sub dword [ebp - 0x28], 0x54283609
mov dword [ebp - 0x24], 0xc1cb3c01
add dword [ebp - 0x24], 0x7fa12574
mov dword [ebp - 0x20], 0x322f98fe
sub dword [ebp - 0x20], 0xcec02c92
mov dword [ebp - 0x1c], 0x5f9a911c
add dword [ebp - 0x1c], 0xa0656ee4
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa30086a
add eax, 0xf6106896
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x397fb
push 0
call eax
mov ecx, 0x39e20278
sub ecx, 0x39e1af57
mov edx, eax
mov edi, 0x3c71e72e
add edi, 0xc3cf18d2
add edi, dword [ebp - 0x18]
mov esi, 0xc62b7eae
add dword [ebp - 8], 0xcd441b21
mov ebx, dword [edi]
sub dword [ebp - 0xc], 0x365b0233
xor ebx, esi
mov dword [ebp - 0x10], 0xf05f591b
mov dword [edx], ebx
mov dword [ebp - 0xc], 0x4e114a21
add edx, 0xa52f8910
add edx, 0x5ad076f4
add edi, 4
loop 0x405a84
add eax, 0x13f57
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf03c85c2
add ecx, 0x10037a3e
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x409120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
salc
push edi
push eax
lea edx, [ebp - 0x2c]
push ecx
push edx
call fcn.00406a4a
mov eax, dword [ebp + 3]
mov ecx, dword [ebp + 8]
inc ecx
mov esi, 0x70
les eax, [ebx - 0x7b]
fsubr dword [edi]
inc eax
add byte [ebp - 0x3b277afc], cl
inc eax
add cl, dl
push ecx
inc dword [eax + 0x41]
mov dl, byte [eax]
clc
and bh, bh
mov al, byte [eax + 1]
or byte [ebx], cl
push ebp
mov byte [ecx], al
inc ecx
lea eax, [eax + edi]
test al, 0xc4
sub al, byte [eax]
mov byte [ecx], 0x20
xchg esi, eax
mov dl, byte [eax]
mov byte [ecx - 0x76], dl
push eax
add dword [ecx - 0x12], eax
mov byte [ecx], dl
mov bh, byte [edi]
add dword [ecx - 0x78], eax
add dword [ebx - 0x8667bd9], ecx
add dword [ecx - 0x3a], 0x26
and byte [ecx + 4], al
xor dword [ecx - 0x2077cf35], 0xfffffff7
inc ebp
loopne 0x4091d9
mov byte [ecx], dl
inc ecx
out 0xf7, eax
mov esi, 0x4412001
cwde
add dl, 0x30
mov byte [ecx], al
mov ecx, edx
fadd qword [ecx + 0x11]
adc dword [ecx - 0x67], eax
lcall 0x45d, 0x7001c6fe
imul eax, dword [eax + 0x5d8830a6], 0xffffffdc
inc ebp
fadd dword [ecx + 0x31]
xor bh, bh
cdq
idiv esi
mov byte [ecx], 0x7d
inc ecx
pop ebx
xor byte [eax + 0x17730c2], al
inc ecx
mov byte [eax], ch
inc ecx
dec ecx
mov al, 0xec
in al, dx
cwde
pop esi
add eax, dword [eax]
add dh, al
add dword [eax], esp
inc ecx
invalid
Function at 0x405d43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x405d52
pop dword [ebp - 0x20]
mov eax, 0x405d52
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x704682f7
sub dword [ebp - 0x30], 0x21f43dac
mov dword [ebp - 0x2c], 0xaa197aff
add dword [ebp - 0x2c], 0x8819d146
mov dword [ebp - 0x28], 0x2afeea90
sub dword [ebp - 0x28], 0xdeb2a662
mov dword [ebp - 0x24], 0x7332a246
sub dword [ebp - 0x24], 0x7332a246
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf6d9d186
sub dword [ebp - 0x30], 0x82676830
mov dword [ebp - 0x2c], 0xc6c74a5c
add dword [ebp - 0x2c], 0x7aa51719
mov dword [ebp - 0x28], 0xae491800
add dword [ebp - 0x28], 0xb526546c
mov dword [ebp - 0x24], 0x2a355613
sub dword [ebp - 0x24], 0x2a355613
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xe5cbf342
add eax, 0x1a747dce
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35b19
push 0
call eax
mov ecx, 0x42fc
mov edi, eax
mov ebx, 0x436000
add ebx, dword [ebp - 0x20]
mov edx, 0x2a9fa74f
add dword [ebp - 4], eax
mov esi, dword [ebx]
add dword [ebp - 4], edi
sub esi, edx
xor dword [ebp - 4], 0x1b8becd0
mov dword [edi], esi
add edi, 0x20b48634
add edi, 0xdf4b79d0
add ebx, 0xac623816
add ebx, 0x539dc7ee
loop 0x405e58
add eax, 0x2c558d37
add eax, 0xd3ab718c
mov ebx, eax
add eax, 5
mov ecx, 0x5769f906
sub ecx, 0x5729f906
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x663c2020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x663c207b
cmp byte [esi + ebx - 1], 0xa
je 0x663c204f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x663c3118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x405a12
pop dword [ebp - 8]
mov eax, 0xe6a47cda
add eax, 0x199bdd38
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc6f91d34
add dword [ebp - 0x18], 0x87592817
mov dword [ebp - 0x14], 0x6f9a0bba
sub dword [ebp - 0x14], 0x3d66bf75
mov dword [ebp - 0x10], 0x3c024f71
sub dword [ebp - 0x10], 0xefb60b43
mov dword [ebp - 0xc], 0x21255f78
sub dword [ebp - 0xc], 0x21255f78
lea eax, [ebp - 0x18]
push eax
mov eax, 0x2b2124d6
sub eax, 0x2ae0a3d2
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x859e76e4
add dword [ebp - 0x18], 0xeed3f272
mov dword [ebp - 0x14], 0xd09c67cc
sub dword [ebp - 0x14], 0x8f300657
mov dword [ebp - 0x10], 0x930a7f6a
sub dword [ebp - 0x10], 0x2f9b12fe
mov dword [ebp - 0xc], 0xb683dba8
sub dword [ebp - 0xc], 0xb683dba8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3939c
push 0
call eax
mov ecx, 0x50fb
mov edx, eax
mov ebx, 0x900be7f9
add ebx, 0x703afc07
add ebx, dword [ebp - 8]
mov esi, 0x7913a267
add esi, 0x477a2987
xor dword [ebp - 4], 0x63c258b2
mov edi, dword [ebx]
sub dword [ebp - 4], 0xe4a4f459
xor edi, esi
add dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 4], ebx
add edx, 0x680f7d3f
add edx, 0x97f082c5
add ebx, 4
loop 0x405b29
add eax, 0x8f415002
add eax, 0x70bfe6bd
mov ebx, eax
add eax, 0x74ff7643
sub eax, 0x74ff763e
mov ecx, 0xf679a9dd
sub ecx, 0xf639a9dd
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret

Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.10019e5b
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x405a71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40d9fb
call fcn.0040c9ff
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x415350]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x405be2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x405be2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405be2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405be2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x405b5b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x405bd4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x405bd4
mov ecx, 0x1234
cmp cx, ax
jne 0x405bd4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x405bae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x405ac9
mov eax, edi
call fcn.0040c9ba
ret 4

Function at 0x406474
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
mov dword [ebp - 4], ecx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call main
add esi, esi
mov ebx, eax
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
push esi
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, 0x25c
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push str.labels
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push ebx
call fcn.0040c6a6
mov eax, dword [ebp + 0xc]
pop ecx
pop esi
pop ebx
leave
ret 0xc
Function at 0x408053
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x408062
pop dword [ebp - 0x28]
mov eax, 0x408062
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x38ec9
push 0
mov eax, 0xf1387b1f
add eax, 0xf0865a9
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x6cdb4ec8
sub ecx, 0x6cdb0521
xor edi, edi
add edi, eax
mov ebx, 0x6b4533ad
add ebx, 0x94fc6453
add ebx, dword [ebp - 0x28]
mov edx, 0x503cd483
add dword [ebp - 4], ecx
mov esi, dword [ebx]
add dword [ebp - 0x14], 0x6d04cb6
xor esi, edx
mov dword [edi], esi
sub dword [ebp - 0xc], 0x36c530cd
add edi, 0xbd393d07
add edi, 0x42c6c2fd
add ebx, 0xc3c4e6de
add ebx, 0x3c3b1926
loop 0x4080b8
add eax, 0x1196f
xor ebx, ebx
add ebx, eax
add eax, 0x15258259
add eax, 0xeada7dac
mov ecx, 0x93c99dad
sub ecx, 0x93899dad
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10005963
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10005972
pop dword [ebp - 0x38]
mov eax, 0xdabdbdfd
add eax, 0x35429b75
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xf01c77e9
add dword [ebp - 0x48], 0x5e35cd62
mov dword [ebp - 0x44], 0x82ab43f3
add dword [ebp - 0x44], 0xaf880852
mov dword [ebp - 0x40], 0x57f0a501
add dword [ebp - 0x40], 0xf45b9f2d
mov dword [ebp - 0x3c], 0xc2946563
sub dword [ebp - 0x3c], 0xc2946563
lea eax, [ebp - 0x48]
push eax
mov eax, 0x6b9b44d5
sub eax, 0x5b92d4a1
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x23090ae
add dword [ebp - 0x48], 0x7241d8a8
mov dword [ebp - 0x44], 0xc0381138
sub dword [ebp - 0x44], 0x7ecbafc3
mov dword [ebp - 0x40], 0x5eb14f3
add dword [ebp - 0x40], 0x5d845779
mov dword [ebp - 0x3c], 0x734fb772
sub dword [ebp - 0x3c], 0x734fb772
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3f19f
push 0
call eax
mov ecx, 0x4d11
xor edx, edx
add edx, eax
mov edi, 0x100b9000
add edi, dword [ebp - 0x38]
mov esi, 0x7476a54b
sub esi, 0x5bee4838
add dword [ebp - 0x1c], 0xf4de482c
mov ebx, dword [edi]
add ebx, esi
xor dword [ebp - 0x18], edx
mov dword [edx], ebx
sub dword [ebp - 0x34], 0xfafb6784
add edx, 4
add edi, 4
loop 0x10005a85
add eax, 0x9e0a84d1
sub eax, 0x9e095dba
xor ebx, ebx
add ebx, eax
add eax, 0xa260217d
sub eax, 0xa2602178
mov ecx, 0x9b1667ce
sub ecx, 0x8b1667ce
add ecx, dword [ebp - 0x38]
call ebx
leave
ret