joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4038f7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040f6], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404650], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045e4], eax
mov dword [0x4040ee], eax
mov dword [0x4045d0], 0x30
mov dword [0x4045d4], 2
jmp 0x40393c
mov dword [0x4045d8], 0x40321a
mov dword [0x4045dc], 0
mov dword [0x4045e0], 0
mov dword [0x4045f8], 0x40454d
mov dword [0x4045f0], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045e8], eax
mov dword [0x4045fc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045ec], eax
push 0x4045d0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040ee]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.lofegaswer_huijd
push str.lisclass
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404648], eax
push 5
push dword [0x404648]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404648]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404600]
jmp 0x403a10
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a02
mov eax, dword [0x404608]
jmp 0x403a2b
call 0x402c21
ret

Function at 0x80039fd
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043a0], 0x30
mov dword [0x80043a8], 0x80032e8
mov dword [0x80043a4], 2
mov dword [0x80043ac], 0
mov dword [0x80043b0], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003a40
mov dword [0x80043b4], eax
mov dword [0x80043c8], 0x80041d4
mov dword [0x80043c0], 0xf
mov dword [0x80040f6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043b8], eax
mov dword [0x80043cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040fe], ebp
mov dword [0x80043bc], eax
push 0x80043a0
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004420], eax
push 0
push dword [0x80040f6]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004418], eax
push 1
push dword [0x8004418]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004418]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003afe
xor edi, edi
lea ebx, [0x80043d0]
jmp 0x8003b16
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003b08
jmp 0x8003b2a
mov eax, dword [0x80043d8]
call 0x80029cd
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402029
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xb]
push ebx
push esi
mov esi, dword [0x420418]
push edi
movzx edi, byte [ebp + 8]
mov byte [ebp - 1], 0
mov dword [ebp - 8], 8
xor edi, 0x54
dec dword [ebp - 8]
imul eax, eax, 0x5a19
mov cl, byte [ebp - 8]
mov bl, byte [ebp + 8]
add eax, edi
lea esi, [esi + eax + 0x5e39]
mov al, byte [ebp + 0xc]
shr al, cl
shr bl, cl
xor edx, edx
mov ecx, 0x3e914e9b
and al, 1
and bl, 1
add bl, al
movzx eax, bl
div ecx
and bl, 1
add esi, eax
mov al, byte [ebp - 1]
add al, al
add al, bl
mov byte [ebp - 1], al
movzx eax, bl
mov edx, eax
imul edx, edx, 0x1b05d9ed
mov ecx, eax
xor ecx, 0x485b
add esi, edx
add esi, ecx
cmp dword [ebp - 8], 0
jne 0x40204d
movzx eax, bl
imul eax, eax, 0x5b91
add esi, eax
mov al, byte [ebp - 1]
pop edi
mov dword [0x420418], esi
pop esi
pop ebx
leave
ret
Function at 0x430d7f
Capabilities:
Check for trap flag exception

Disassembly:
add esi, ebx
sub esi, ebx
pushal
push esi
push edx
nop
mov esi, 0x1373
sub edx, 0x1dba
pop edx
pop esi
call 0x430d99
push eax
ror eax, cl
pop eax
push edi
mov edi, 0xc10e
pop edi
verr bx
pop edx
mov eax, 0x11d
verr cx
pushal
nop
mov ebx, 0xd91
popal
push edi
xor edi, esi
pop edi
add eax, edx
xchg esi, edi
xchg edi, esi
xchg ebx, esi
xchg esi, ebx
push edi
xor edi, esi
pop edi
push eax
verr si
verr si
xor esi, 0x63f9
xor esi, 0x63f9
mov edx, 0
push dword fs:[edx]
push esi
push edx
nop
mov esi, 0x1373
sub edx, 0x1dba
pop edx
pop esi
mov dword fs:[edx], esp
pushal
nop
mov ebx, 0x6691
popal
push esi
xor esi, 0x329b
pop esi
push esi
push edi
pop edi
pop esi
mov ecx, 0
inc ebx
dec ebx
push edi
ror edi, cl
pop edi
div ecx
push edi
mov edi, ebx
pop edi
push esi
xor esi, ebx
pop esi
mov ecx, edx
pushfd
pushfd
popfd
pushfd
add esi, ebx
sub esi, ebx
or dword [esp], 0x100
cmc
cmc
popfd
inc edx
popfd
jmp 0x430e3a
cmp edx, ecx
cmc
cmc
je 0x430e5b
push ebx
push esi
pop esi
pop ebx
push 0x8caf1379
push ebx
ror ebx, cl
pop ebx
mov edx, 0xc12ade99
push ebx
xor ebx, esi
pop ebx
ret
push ecx
sldt ecx
pop ecx
push esi
push ebx
pop ebx
pop esi
xor esi, 0x1890
xor esi, 0x1890
mov ecx, 0
push edx
push edi
add edx, 0x463b
xor edi, 0x3b7b
pop edi
pop edx
push esi
pop esi
verr cx
pop dword fs:[ecx]
push eax
lar eax, esi
pop eax
push esi
ror esi, cl
pop esi
pushal
nop
mov eax, 0x1183
nop
mov ebx, 0x2e8f
popal
pop eax
push ecx
inc ecx
pop ecx
push ebx
ror ebx, cl
pop ebx
add edi, esi
sub edi, esi
popal
jmp 0x430fee
push esi
neg esi
pop esi
push edi
neg edi
pop edi
push ebx
xor ebx, esi
pop ebx
push esi
push edx
inc edx
pop edx
push ebx
mov ebx, 0x51ddc109
pop ebx
pushal
xor esi, edi
popal
push ecx
call fcn.0043113c
pop edi
test byte [ecx - 0x71], cl
sti
adc byte [edx - 0x1e], dh
add ebx, dword [eax + 0x323195a5]
pushfd
sti
outsd dx, dword [esi]
add ecx, dword [ebp + 0x20]
mov esp, 0xd7746c13
hlt

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401207
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401200
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41a300]
add ebx, 0x23f
mov edx, dword [0x41a304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xb06044], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xb06040]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xb06044], 0x3eb
mov dword [0xb06040], eax
mov eax, dword [0xb05f98]
cmove eax, dword [ebp - 0x10]
mov dword [0xb05f98], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xb0603c], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401261
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cc09
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419f20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409660
mov dword [ebp - 0x14], eax
cmp dword [0x461838], esi
jne 0x40ccfc
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40cc89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cddc
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cddc
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cddc
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x461838], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46183c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x461840], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x461848], eax
test eax, eax
je 0x40ccf9
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x461844], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cd21
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cd14
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cd36
push 4
pop eax
jmp 0x40cdde
cmp dword [ebp - 0x14], esi
je 0x40cd36
push dword [0x461838]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cd1b
mov eax, dword [0x461844]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cd94
cmp dword [0x461848], edi
je 0x40cd94
push eax
call ebx
push dword [0x461848]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cd94
test eax, eax
je 0x40cd94
call ecx
test eax, eax
je 0x40cd89
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cd89
test byte [ebp - 8], 1
jne 0x40cd94
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cdc4
mov eax, dword [0x46183c]
cmp eax, edi
je 0x40cdc1
push eax
call ebx
test eax, eax
je 0x40cdc1
call eax
mov esi, eax
test esi, esi
je 0x40cdc1
mov eax, dword [0x461840]
cmp eax, edi
je 0x40cdc1
push eax
call ebx
test eax, eax
je 0x40cdc1
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x461838]
call ebx
test eax, eax
je 0x40cddc
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cdde
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fe7
mov esp, ebp
pop ebp
ret
Function at 0x10018e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10018e13
pop dword [ebp - 0x48]
mov eax, 0xedf81015
add eax, 0x22097dfe
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x418ab
push 0
mov eax, 0x89b3f692
sub eax, 0x79b095b6
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x3f4f67c5
add ecx, 0xc0b0e491
mov ebx, eax
mov edi, 0x1003be00
add edi, dword [ebp - 0x48]
mov edx, 0x7e7ea85d
sub edx, 0xb5f121b0
xor dword [ebp - 0x30], ebx
mov esi, dword [edi]
add dword [ebp - 0x3c], 0xabda591
sub esi, edx
mov dword [ebp - 0x38], 0x66a18602
mov dword [ebx], esi
add ebx, 4
add edi, 4
loop 0x10018e6c
add eax, 0x5efea867
sub eax, 0x5efd843c
mov ebx, eax
add eax, 0xdff7793f
sub eax, 0xdff7793a
mov ecx, 0xfca4f5ba
sub ecx, 0xeca4f5ba
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.10018e04
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.10018e04
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str._system32777.dll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a5f
cmp dword [ebp - 0x118], 0
je 0x401a5f
jmp 0x401ac3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ac3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x438274], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x438290], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43828c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
jmp section..htext
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x412f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x412f9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412f90
mov eax, 1
add ebx, ebx
jne 0x412fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412fa8
jne 0x412fc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412fa8
xor ecx, ecx
sub eax, 3
jb 0x412fd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41304a
mov ebp, eax
add ebx, ebx
jne 0x412fe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413014
inc ecx
add ebx, ebx
jne 0x413000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412ff5
jne 0x413011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412ff5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413025
jmp 0x412f96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413034
add edi, ecx
jmp 0x412f96
pop esi
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x41309c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15330]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x153ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413051
mov ecx, edi
jns 0x413080
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x153f4]
or eax, eax
je 0x413096
mov dword [ebx], eax
add ebx, 4
jmp 0x41306e
call dword [esi + 0x153f0]
mov ebp, dword [esi + 0x153f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4130d0
sub esp, 0xffffff80
jmp 0x403ac6
Function at 0x401207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4182e8]
and dword [ebp - 0x18], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [0x4182ec]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], eax
mov esi, dword [edi]
mov edx, dword [edi + 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], edx
call fcn.00401200
mov ebx, dword [ebp - 0x18]
add ebx, 0x23f
cmp dword [0xae6704], 0x14
jne 0x401265
push 0
lea eax, [ebp - 0x830]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x4182f0]
mov eax, dword [0x4182f4]
push 0x20
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
pop edi
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov eax, esi
mov dword [ebp - 0xc], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xae6704], 0xfa9
mov dword [ebp - 8], eax
mov eax, dword [0xae6700]
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp dword [0xae6704], 0x3eb
mov dword [0xae6700], eax
mov eax, dword [0xae6658]
cmove eax, dword [ebp - 0xc]
mov dword [0xae6658], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov dword [0xae66fc], 0xf4ea3dee
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 4]
sub edx, eax
mov dword [ebp - 0x14], eax
mov eax, edx
mov dword [ebp - 0xc], edx
shl eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
lea eax, [ebx + edx]
and dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov eax, edx
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor dword [ebp - 0x10], eax
cmp dword [0xae6704], 0xb03
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jne 0x401363
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add ebx, 0x61c88647
mov ecx, dword [ebp - 0x24]
sub esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
dec edi
jne 0x401279
mov edi, dword [ebp - 0x2c]
mov dword [edi], esi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c0e2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408890
mov dword [ebp - 0x14], eax
cmp dword [0x441ef8], esi
jne 0x40c1d5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c162
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c2b5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c2b5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c2b5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x441ef8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x441efc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x441f00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x441f08], eax
test eax, eax
je 0x40c1d2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x441f04], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c1fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c1ed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c20f
push 4
pop eax
jmp 0x40c2b7
cmp dword [ebp - 0x14], esi
je 0x40c20f
push dword [0x441ef8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c1f4
mov eax, dword [0x441f04]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c26d
cmp dword [0x441f08], edi
je 0x40c26d
push eax
call ebx
push dword [0x441f08]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c26d
test eax, eax
je 0x40c26d
call ecx
test eax, eax
je 0x40c262
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c262
test byte [ebp - 8], 1
jne 0x40c26d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c29d
mov eax, dword [0x441efc]
cmp eax, edi
je 0x40c29a
push eax
call ebx
test eax, eax
je 0x40c29a
call eax
mov esi, eax
test esi, esi
je 0x40c29a
mov eax, dword [0x441f00]
cmp eax, edi
je 0x40c29a
push eax
call ebx
test eax, eax
je 0x40c29a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x441ef8]
call ebx
test eax, eax
je 0x40c2b5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c2b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403da7
mov esp, ebp
pop ebp
ret