joyce8/EMBER2024-capa huggingface dataset:
Function at 0x109364
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.000142e0
mov eax, esi
call fcn.0001417c
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.00012ca4
cmp byte [ebp - 1], 0
jne 0x1093d7
mov eax, esi
call fcn.0001417c
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x1093f0
sub al, 2
jb 0x1093f7
jmp 0x1093fc
mov ebx, 2
jmp 0x1093fc
mov ebx, 1
mov eax, esi
call fcn.0001417c
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x1094de
test edi, edi
jle 0x109458
mov eax, esi
call fcn.0001417c
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.0001417c
mov byte [eax + ebx - 1], 0
jmp 0x1094d2
test edi, edi
jge 0x10949e
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.0001417c
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x1094d2
mov eax, esi
call fcn.0001417c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.0001417c
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x109414
mov al, byte [ebp - 1]
sub al, 1
jb 0x1094ee
sub al, 2
jb 0x109527
jmp 0x10956e
cmp edi, 2
jne 0x1094f4
dec ebx
mov eax, ebx
sub eax, 2
jl 0x10956e
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.0001417c
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x1c439c]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x109504
jmp 0x10956e
cmp edi, 2
jne 0x10952d
dec ebx
test ebx, ebx
jle 0x109569
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.0001417c
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x1c43a0]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x109539
jmp 0x109569
inc ebx
mov eax, esi
call fcn.0001417c
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x10955c
mov eax, esi
mov edx, ebx
call fcn.000142e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10fde4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x10fed9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00013d80
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x34], eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.0016a3f0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x24]
call fcn.00013d80
lea eax, [ebx + 0x38]
mov edx, dword [ebp + 8]
call fcn.00013d80
mov eax, dword [ebx + 4]
cmp dword [eax + 0xc], 0
jne 0x10fe7b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xc4]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xbc]
lea ecx, [ebp - 0xc]
pop edx
call fcn.000793b0
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x10]
cmp dword [eax + 8], 0
jne 0x10fec3
mov edx, dword [ebx + 4]
mov edx, dword [edx + 0xc]
mov eax, dword [ebx + 8]
mov dword [eax + 4], edx
mov edx, dword [ebx + 4]
mov edx, dword [edx + 0x10]
mov dword [eax + 0x90], edx
mov edx, dword [ebx + 4]
mov edx, dword [edx + 0x14]
mov dword [eax + 0x94], edx
mov edx, dword [ebx + 4]
mov edx, dword [edx + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebx + 4]
mov edx, dword [edx + 0x1c]
mov dword [eax + 0x14], edx
mov edx, dword [ebx + 4]
mov edx, dword [edx + 0x20]
mov dword [eax + 0x28], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10fee0
lea eax, [ebp - 4]
call fcn.00013d2c
ret
Function at 0x195608
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov eax, dword [0x1c48f8]
call fcn.00012794
mov dword [ebp - 0x10], eax
xor ebx, ebx
push ebp
push 0x1956e3
push dword fs:[ebx]
mov dword fs:[ebx], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00023030
mov eax, dword [ebp - 4]
call fcn.0002303c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x1956cd
push dword [0x1c48fc]
push dword [0x1c48f8]
mov eax, dword [ebp - 4]
call fcn.0002303c
push eax
mov eax, dword [ebp - 4]
call fcn.00023020
pop edx
xchg edx, eax
sub eax, edx
cdq
push edx
push eax
call fcn.00032010
push edx
push eax
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
call fcn.00032010
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, ecx
dec eax
test eax, eax
jl 0x1956c4
inc eax
mov bl, byte [ebp - 8]
xor bl, byte [edx]
and ebx, 0xff
mov esi, dword [0x1c4bc4]
mov ebx, dword [esi + ebx*4]
mov esi, dword [ebp - 8]
shr esi, 8
xor ebx, esi
mov dword [ebp - 8], ebx
inc edx
dec eax
jne 0x1956a1
sub dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jg 0x195651
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1956ea
mov eax, dword [ebp - 0x10]
call fcn.000127ac
ret
Function at 0x196c4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x197232
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 0
push 0
push 2
mov edx, 0x197244
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xc]
push 0
push 4
mov edx, dword [0x1c50d0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, 0x197250
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jl 0x196cc9
mov eax, dword [ebp - 4]
call fcn.00021968
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x196cd4
mov eax, dword [ebp - 4]
call fcn.00021968
mov dword [ebp - 0x1c], eax
push 0
push 4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ecx, 0x75d6ee39
mov dl, 1
mov eax, dword [0xd10f8]
call fcn.000d1150
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x196dca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00021968
mov esi, eax
dec esi
test esi, esi
jl 0x196db4
inc esi
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00196bc0
mov edx, dword [eax + 0x14]
lea eax, [ebp - 0x34]
call fcn.00013dc4
mov eax, dword [ebp - 0x34]
mov edx, 0x197250
call fcn.000140bc
je 0x196daa
mov eax, dword [ebp - 0x34]
call fcn.00013fac
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
test edi, edi
jle 0x196d7d
mov ebx, 1
mov eax, dword [ebp - 0x3c]
call fcn.000d1240
mov edx, dword [ebp - 0x34]
xor al, byte [edx + ebx - 1]
push eax
lea eax, [ebp - 0x34]
call fcn.0001417c
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec edi
jne 0x196d5c
push 0
push 4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp dword [ebp - 0x10], 0
jle 0x196daa
mov eax, dword [ebp - 0x10]
cdq
push edx
push eax
mov eax, dword [ebp - 0x34]
call fcn.00014170
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0xc]
inc dword [ebp - 0x14]
dec esi
jne 0x196d20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x196dd1
mov eax, dword [ebp - 0x3c]
call fcn.00013004
ret
Function at 0x40380d
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
pop ds
and al, bh
or byte [edx], al
add ah, byte [ecx]
and ah, byte [eax]
xor byte [edx + 0x40242382], al
push eax
add byte [edx + 0x70602625], 0x82
and byte [0x82706026], 0xb5
adc dword [eax - 0x18], esp
and byte [esi], al
push es
push 0x606a060
insb byte es:[edi], dx
jb 0x403803
inc eax
pop es
pop es
jbe 0x4038a2
and al, 7
or byte [eax - 0x556ec65e], al
inc ecx
or dword [edi + 0xb], esp
or esi, dword [bx + di - 0x79ef]
jo 0x4037c3
or byte [edx], bl
adc eax, 0x23ed22a8
and al, 0x6a
dec eax
add al, byte [edx]
and eax, 0x1855826
test dword [ecx], eax
test dword [ecx], eax
sub ch, byte [edx - 0x43]
cmp al, byte gs:[ebx + 0x67]
aam 0x35
pop es
inc edi
test al, 0xb0
aas
jns 0x403893
test byte [edx + 0x78], bl
jo 0x4037fa
jg 0x4038dc
xor eax, 0x6c322724
insb byte es:[edi], dx
aad 0x20
sbb eax, 0x2475eeca
out 0x11, al
push edx
and esi, dword [0x76c16d70]
mov byte [0xfb950f00], bl
inc eax
insb byte es:[edi], dx
js 0x403866
fmul dword [edx + eax]
jmp 0x78dc8e07
jle 0x4038dc
pushfd
js 0x4038fe
add al, 0x20
jp 0x40389e
ror byte [ecx + eax*4], 1
adc dword [ecx], edx
adc al, 0xcb
adc dword [ebx + ecx*8], edx
adc dl, 0xa5
xor bl, al
add esi, dword [esi + esi]
push eax
jo 0x4038a4
inc edi
inc edi
push es
movsd dword es:[edi], dword [esi]
mov bl, 0x1c
test eax, 0x2441d853
push ds
retf
sbb al, 0x1d
shl al, 1
add dword [ecx + 0xf01f1e], 0x21208282
adc byte [eax], ah
add byte [edx + 0x4e302322], 0xa4
aam 0x9f
push eax
enter 0x4904, 0x4b
mov al, byte [0xe5be486d]
push 0xfffffffffffffff2
jbe 0x403885
in eax, 0x6a
bnd jbe 0x403885
call 0xf7283770
lodsb al, byte [esi]
sbb eax, 0xfab36461
out 0xd9, al
push esi
invalid

Function at 0x438cb6
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ecx
add ebx, eax
and eax, ebx
call fcn.00438cf2
mov ebx, eax
sub ebx, 0x81b376bc
dec eax
xor dword [edi], ecx
mov ebx, 0xb7db71e1
inc edi
sub ebx, 0x84319348
or eax, ebx
dec ebx
cmp edi, edx
jne fcn.00438cb6
mov ebx, 0x4e333f1b
inc ebx
sub eax, ebx
ret
Function at 0x408940
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
sub esi, esi
mov edi, edi
call fcn.00408972
and esi, edi
mov esi, 0xe04dedfb
xor dword [ecx], eax
sub edi, esi
sub esi, 1
inc ecx
add esi, 0x5d4e0366
cmp ecx, ebx
jne fcn.00408940
ret
Function at 0x420aeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov al, byte [0x4c6283]
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], al
push 0x8000
push esi
mov edi, edx
call fcn.00424836
pop ecx
push eax
call fcn.00424664
cmp dword [edi + 0xc], 0xb
mov ebx, eax
pop ecx
pop ecx
je 0x456703
lea ecx, [ebp - 0x18]
call fcn.004140cd
mov ecx, edi
call fcn.00404d37
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call fcn.0041402a
push dword [ebp - 0x18]
push 0x492ca8
push esi
call fcn.00424a35
add esp, 0xc
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
jne 0x456723
lea ecx, [ebp - 0x18]
call fcn.00411cb6
mov edi, dword [ebp - 8]
push esi
call fcn.00424bfa
pop ecx
cmp ebx, 0xffffffff
je 0x420b89
push ebx
push esi
call fcn.00424836
pop ecx
push eax
call fcn.00424664
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4000
jmp 0x420b71
push esi
mov ecx, edi
call fcn.00468b80
push eax
push 1
call fcn.00468b3d
push eax
call fcn.004249b3
add esp, 0x10
mov edi, eax
jmp 0x420b64
mov ecx, edi
call fcn.00404d37
mov eax, dword [edi + 8]
push dword [eax]
call dword [0x490244]
jmp 0x420b59

Function at 0x486ff4
Capabilities:
Encode data using xor

Disassembly:
in al, 0xb4
sub esi, ebx
dec ebp
dec ebp
push esi
xor esi, ecx
push esi
jg 0x486ff7
push ecx
and edx, dword [edx - 0x6d05006f]
pushal
invalid
Function at 0x487f80
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x3d
cwde
and dl, byte [edx + edx*4 - 0x3311ba6]
leave
lds ecx, [edi + 0x5ad75e70]
xchg esi, eax
mov edx, 0x53f4c85f
push esp
or edx, dword [ebx]
fadd dword [ebp + 0x18fa3342]
wait
cmp byte [ebp + eax*4 + 0x47], bh
mov dword [0xc99ee0c4], eax
mov byte [0x9808c361], al
pop esp
scasb al, byte es:[edi]
mov edx, 0x74b53c28
push eax
cdq
mov cs, esp
mov edx, 0x7aa7bc76
shr dword [ebx + 0x3e], cl
push cs
push edx
dec ebp
fdivr qword [eax + 0x2d410118]
test al, 5
cmp al, byte [edx]
shr byte [ebx], 0xc5
push esi
pop eax
das
aam 0x59
loope 0x487ff3
sti
mov bl, 0xe0
fld qword ss:[ebp - 0xb16228]
push dword [ebx - 0x13]
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
cdq
inc ecx
xchg ecx, eax
test al, 0x8b
push eax
inc ecx
jmp 0x48804c
wait
sub eax, 0x2e170765
xchg ecx, eax
movsd dword es:[edi], dword [esi]
xchg esp, eax
dec ecx
jge 0x487fc6
cmp dword [edx + 0x33ad414f], edx
aam 0xfa
invalid
aam 0x78
cmp dword [edx + 0x48], edx
fcomp dword [edx - 0x41]
sbb al, 0x71
lodsd eax, dword [esi]
jecxz 0x488058
invalid
cli
xchg edx, eax
pushal
push 0xffffffffffffff9a
test dword [eax + 0x5f5ad503], eax
jecxz 0x48806b
dec ebx
push 0xfc0b4131
cld
sbb al, 0x26
and eax, 0x7967110e
lea ecx, [di]
mov al, byte [0x382f84ca]
movsb byte es:[edi], byte [esi]
mov byte [esp + ecx*2 - 0x784e1caa], dl
jns 0x4880db
lea ecx, [0x2f84caa0]
cmp byte [eax + ecx*4 - 0x1ca9b36c], ah
mov cl, 0x87
jne 0x4880a9
stosb byte es:[edi], al
jae 0x4880f8
fisttp qword [esi + esi*4 - 0x2d56e52a]
inc eax
or eax, 0x3006400
or al, 0
push ds
push 0x7c062968
dec esp
retf 0xbfa1
retf 0xfedd
lahf
ret 0xae20
ja 0x4880b3
sub ecx, dword [eax + 0x42]
dec ecx
and al, 0xfe
in eax, 0x4a
mov al, byte [0x25464348]
push edx
in al, 0x6d
loopne 0x488071
xchg byte [ebp - 0x25], bl
mov bh, 0xe8
sub esi, edi
dec ebp
test dword [ebp + 0x1f], 0x4628ac20
out 0x77, al
lea edi, [eax - 0x755ee2b9]
pop ds
and byte [eax + ebp - 0x728819ba], ch
mov eax, 0x8aa11d47
inc ecx
ja 0x4880d9
sbb bh, byte [edx]
sahf
imul edi, dword [edi + 0x7ef3dfba], 0xffffffb6
jg 0x4880d3
std
salc
jnp 0x488137
sti
test al, 0xdf
mov ecx, 0x4ee633a8
jb 0x4880bf
rep outsd dx, dword [esi]
cdq
int1
neg dword [0x41da8a5e]
add edx, dword [ecx]
mov edx, 0x6f142626
pop es
les ebx, [ebx - 0x31]
fidivr word [esi - 0x38838113]
fstp qword [edi + ebp*4 - 0x554a4962]
xchg esi, eax
les eax, [ebx + 0xcd0ff55]
loopne 0x488151
adc dword [edi + esi + 0x10ed70ad], esi
xchg esp, eax
or byte [ebp - 0x6b], dh
sbb eax, 0x83485cfd
mov dl, 0xe7
aaa
stc
cmp edi, esp
adc byte [eax + ecx - 0x2e26a8b], dl
pop esp
dec eax
xor dword [edx + 0x39f937e7], 0xffffffe7
push ecx
jmp 0x6cc7d192
int3
Function at 0x4031a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040207d
and dword [ebp - 4], 0
cmp dword [0x40b668], 0
mov ebx, eax
jne 0x403254
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403305
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403305
push eax
call fcn.0040200b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b668], eax
call esi
push eax
call fcn.0040200b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b66c], eax
call esi
push eax
call fcn.0040200b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b670], eax
call esi
push eax
call fcn.0040200b
pop ecx
mov dword [0x40b678], eax
test eax, eax
je 0x403254
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040200b
pop ecx
mov dword [0x40b674], eax
mov eax, dword [0x40b674]
cmp eax, ebx
je 0x4032ac
cmp dword [0x40b678], ebx
je 0x4032ac
push eax
call fcn.00402086
push dword [0x40b678]
mov esi, eax
call fcn.00402086
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4032ac
test edi, edi
je 0x4032ac
call esi
test eax, eax
je 0x4032a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4032a3
test byte [ebp - 0xc], 1
jne 0x4032ac
or dword [ebp + 0x10], 0x200000
jmp 0x4032e5
mov eax, dword [0x40b66c]
cmp eax, ebx
je 0x4032e5
push eax
call fcn.00402086
pop ecx
test eax, eax
je 0x4032e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4032e5
mov eax, dword [0x40b670]
cmp eax, ebx
je 0x4032e5
push eax
call fcn.00402086
pop ecx
test eax, eax
je 0x4032e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b668]
call fcn.00402086
pop ecx
test eax, eax
je 0x403305
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403307
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407220
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x80
push 0
push 0
push 0xfffffe70
push 0xfffffe70
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x407250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x80
push 0
push 0
push 0xfffffe70
push 0xfffffe70
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x68
mov edx, dword [ebp + 8]
push edx
call fcn.00401000
add esp, 8
mov eax, 1
pop ebp
ret
Function at 0x403d4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403d59
pop dword [ebp - 0x28]
mov eax, 0x403d59
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x39d09
push 0
mov eax, 0xe65c41be
sub eax, 0xe61b60f6
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4cfa
xor edi, edi
add edi, eax
mov esi, 0x9ca35f05
add esi, 0x639e38fb
add esi, dword [ebp - 0x28]
mov ebx, 0x2a3f05c7
sub ebx, 0x8bbb5527
xor dword [ebp - 4], 0x846a6ea8
mov edx, dword [esi]
sub dword [ebp - 0x1c], 0xcafe982a
sub edx, ebx
xor dword [ebp - 0x14], edi
mov dword [edi], edx
xor dword [ebp - 0x14], 0xb10ed829
add edi, 0x5421a16
sub edi, 0x5421a12
add esi, 0x1bc76232
add esi, 0xe4389dd2
loop 0x403daf
add eax, 0x1f5deb20
add eax, 0xe0a33b9b
mov ebx, eax
add eax, 0x82a4ebe4
sub eax, 0x82a4ebdf
mov ecx, 0xb73bf353
add ecx, 0x49040cad
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1006a660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c8e4c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10205ac8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x14], 0
je 0x1006a6d4
mov dword [ebx], 0x1004496c
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x50], 0x100448d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebx]
lea esi, [ebx + 4]
push 0
push esi
mov dword [ebp - 0x10], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x100448d8
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
add ecx, ebx
call fcn.10075830
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], 0x10044968
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], 0x100448e8
call fcn.101b44b7
mov esi, eax
add esp, 4
test esi, esi
je 0x1006a753
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 3
call fcn.1019fa64
add esp, 4
mov dword [esi + 4], eax
jmp 0x1006a755
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], 0x10044928
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006a7e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c8e70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10205ac8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x100448e8
call fcn.101b44b7
mov esi, eax
add esp, 4
test esi, esi
je 0x1006a840
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1019fa64
add esp, 4
mov dword [esi + 4], eax
jmp 0x1006a842
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1006ab10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c8ef8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10205ac8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0
mov byte [ebx + 0xc], 0
mov dword [ebx], 0x100447d4
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
lea edi, [ebx + 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
mov dword [edi], 0x10044720
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
push 0x20
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.101b44b7
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, ebx
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov word [edi + 0x30], 0
mov dword [ebx], 0x10044830
mov dword [edi], 0x1004484c
mov dword [ebx + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4