joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov dword [esp + 0x2c], 0xffa09fa
mov dword [esp + 0x30], 0x3fe0de8
mov dword [esp + 0x34], 0x73401fc
mov dword [esp + 0x38], 0x1be605e0
mov dword [esp + 0x3c], 0x1f1e19e4
mov word [esp + 0x40], 0
mov byte [esp + 0x42], 0
mov eax, 0xa1f90bc2
movzx ecx, byte [esp + eax + 0x5e06f46a]
xor ecx, eax
add ecx, 0xd622c535
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x5e06f46a], cl
inc eax
cmp eax, 0xa1f90bd9
jne 0x435f70
lea eax, [esp + 0x2c]
push eax
call fcn.00439930
add esp, 4
mov dword [0x44ef60], eax
mov dword [esp + 0x28], 0xe79e18ad
test eax, eax
je 0x435fc0
mov dword [esp + 0x28], 0x1b2c8294
mov ebp, 0x3eb4bdc
xor eax, eax
cmp ebp, 0x1b2c8294
setl al
mov eax, dword [eax*4 + 0x443658]
mov ecx, 0x3770dded
xor ecx, dword [0x443660]
add eax, ecx
inc eax
jmp eax
Function at 0x439930
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x232221f0
mov eax, 0x66bad678
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x66bad674]
xor ecx, eax
lea edx, [ecx - 0x1a63059]
mov edi, edx
xor edi, 0xfffffffe
mov esi, edx
or esi, 1
and esi, edi
mov edi, esi
and edi, 0x9b4d6bfd
mov ebx, esi
and ebx, 2
or esi, 2
imul esi, ebx
xor ebx, 2
imul ebx, edi
add esi, ebx
mov edi, esi
and edi, edx
and edx, 0xfe
and ecx, 1
or ecx, edx
or ecx, esi
add ecx, edi
mov byte [esp + eax - 0x66bad674], cl
inc eax
cmp eax, 0x66bad67c
jne 0x439950
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x24], 0
sete cl
jmp dword [ecx*4 + 0x444594]

Function at 0x439d40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x939291a0
mov word [esp + 4], 0
mov eax, 0xa4bf799c
nop
nop
nop
movzx edx, byte [esp + eax + 0x5b408664]
xor edx, eax
mov edi, edx
and edi, 0x800219f1
mov ebx, edx
and ebx, 2
mov esi, ebx
xor esi, 2
imul esi, edi
or edi, 2
imul edi, ebx
xor edx, 0xc8429ff3
add esi, edx
add esi, edi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0x5b408664], dl
inc eax
cmp eax, 0xa4bf79a2
jne 0x439d60
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x444654]
Function at 0x43a8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x3c]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx], 0
lea ecx, [ecx + 2]
jne 0x43a8c0
lea edx, [esi + ecx]
add edx, 0xfffffffe
mov eax, esi
not eax
and eax, edx
add ecx, esi
mov edx, 1
sub edx, ecx
and edx, esi
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43a8f3
mov eax, 0xffffffff
jmp 0x43a8f6
add eax, 0xa
push eax
call fcn.00408680
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [edi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [esi]
test bx, bx
je 0x43a941
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [esi]
add esi, 2
test bx, bx
jne 0x43a930
mov word [edx], 0
mov edx, 3
sub edx, edi
and edx, 2
mov esi, ecx
and esi, 0xfffd
imul esi, edx
and edi, 2
or ecx, 2
imul ecx, edi
lea edx, [ecx + esi]
mov word [esp + 8], dx
add ecx, esi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov ecx, esp
mov edx, 0x74b3c072
movzx edi, byte [ecx]
mov esi, edx
or esi, edi
lea ebx, [edx - 0x74b3c000]
and ebx, edi
not esi
or esi, ebx
add esi, 0x43cca59a
mov edi, esi
and edi, 0x3e
xor esi, 0x3e
lea ebx, [esi + edi*2]
add bl, 0x67
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x74b3c06a
jne 0x43a9c0
mov esi, dword [esp]
mov ecx, dword [0x446f44]
test ecx, ecx
je 0x43aa62
xor edx, edx
mov edi, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xbb9b186e
je 0x43aa20
inc edx
cmp ecx, edx
jne 0x43aa10
jmp 0x43aa62
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43aa62
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0xb
push ecx
push dword [0x446f4c]
mov edi, eax
call fcn.00437050
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00408690
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43aa80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x43aaa0
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov ebx, esi
not ebx
and ebx, ecx
add eax, esi
mov ecx, 1
sub ecx, eax
and ecx, esi
sub ebx, ecx
sar ebx, 1
lea ebp, [ebx + 4]
mov ecx, ebx
and ecx, 1
mov eax, ebp
or eax, 1
add eax, ecx
jns 0x43aadd
mov eax, 0xffffffff
jmp 0x43aadf
add eax, eax
push eax
call fcn.00408680
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43ab21
add esi, 2
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43ab10
mov word [ecx], 0
mov ecx, 3
sub ecx, ebx
and ecx, 2
mov edx, ebp
and edx, 0xfffd
imul edx, ecx
and ebx, 2
or ebp, 2
imul ebp, ebx
lea ecx, [edx + ebp]
mov word [esp + 8], cx
lea ecx, [edx + ebp]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov ecx, esp
mov edx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx]
mov esi, edx
or esi, ebx
lea ebp, [edx - 0x74b3c000]
and ebp, ebx
not esi
or esi, ebp
add esi, 0x43cca59a
mov ebx, esi
and ebx, 0x3e
xor esi, 0x3e
lea ebx, [esi + ebx*2]
add bl, 0x67
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x74b3c06a
jne 0x43abb0
mov esi, dword [esp]
mov ecx, dword [0x446f44]
test ecx, ecx
je 0x43ac44
xor edx, edx
mov ebx, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x1affabda
je 0x43ac10
inc edx
cmp ecx, edx
jne 0x43ac00
jmp 0x43ac44
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43ac44
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 6
push ecx
push dword [0x446f4c]
mov edi, eax
call fcn.00437050
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408690
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ac60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx], 0
lea ecx, [ecx + 2]
jne 0x43ac80
lea edx, [esi + ecx]
add edx, 0xfffffffe
mov eax, esi
not eax
and eax, edx
add ecx, esi
mov edx, 1
sub edx, ecx
and edx, esi
sub eax, edx
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43acb3
mov eax, 0xffffffff
jmp 0x43acb6
add eax, 0xa
push eax
call fcn.00408680
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43ad01
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43acf0
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x504f4e4d
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x20]
mov edx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ecx]
mov esi, edx
or esi, ebx
lea edi, [edx - 0x74b3c000]
and edi, ebx
not esi
or esi, edi
add esi, 0x43cca59a
mov edi, esi
and edi, 0x3e
xor esi, 0x3e
lea ebx, [esi + edi*2]
add bl, 0x67
mov byte [ecx], bl
inc ecx
dec edx
cmp edx, 0x74b3c06a
jne 0x43ad70
mov esi, dword [esp + 0x20]
mov ecx, dword [0x446f44]
test ecx, ecx
je 0x43adf9
xor edx, edx
mov ebx, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x50dc24c7
je 0x43add0
inc edx
cmp ecx, edx
jne 0x43adc0
jmp 0x43adf9
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43adf9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 2
push ecx
push dword [0x446f4c]
mov ebx, eax
call fcn.00437050
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.00408690
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43ae0f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ae20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov eax, esp
mov edx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [eax]
mov ebx, edx
or ebx, ecx
lea esi, [edx - 0x74b3c000]
and esi, ecx
not ebx
or ebx, esi
add ebx, 0x43cca59a
mov ecx, ebx
and ecx, 0x3e
xor ebx, 0x3e
lea ecx, [ebx + ecx*2]
add cl, 0x67
mov byte [eax], cl
inc eax
dec edx
cmp edx, 0x74b3c06a
jne 0x43ae50
mov eax, dword [esp]
mov edx, dword [0x446f44]
test edx, edx
je 0x43aed8
xor ebx, ebx
mov ecx, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x7cde1e50
je 0x43aeb0
inc ebx
cmp edx, ebx
jne 0x43aea0
jmp 0x43aed8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43aed8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 5
push edx
push dword [0x446f4c]
call fcn.00437050
add esp, 0x20
test edi, edi
je 0x43aee2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43aef1
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43af00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov eax, esp
mov ebx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov ebp, ebx
or ebp, edi
lea esi, [ebx - 0x74b3c000]
and esi, edi
not ebp
or ebp, esi
add ebp, 0x43cca59a
mov esi, ebp
and esi, 0x3e
xor ebp, 0x3e
lea ecx, [esi*2]
add ecx, ebp
add cl, 0x67
mov byte [eax], cl
inc eax
dec ebx
cmp ebx, 0x74b3c06a
jne 0x43af30
mov eax, dword [esp]
mov ebx, dword [0x446f44]
test ebx, ebx
je 0x43afc1
xor ebp, ebp
mov edi, dword [0x446f48]
nop
nop
cmp dword [edi + ebp*8], 0xc81e0bf6
je 0x43af90
inc ebp
cmp ebx, ebp
jne 0x43af80
jmp 0x43afc1
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43afc1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x446f4c]
call fcn.00437050
add esp, 0x30
cmp eax, 0x103
jne 0x43b079
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov eax, esp
mov ecx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov edx, ecx
or edx, esi
lea edi, [ecx - 0x74b3c000]
and edi, esi
not edx
or edx, edi
add edx, 0x43cca59a
mov esi, edx
and esi, 0x3e
xor edx, 0x3e
lea edx, [edx + esi*2]
add dl, 0x67
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x74b3c06a
jne 0x43aff0
mov eax, dword [esp]
mov ecx, dword [0x446f44]
test ecx, ecx
je 0x43b071
xor edx, edx
mov edi, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43b050
inc edx
cmp ecx, edx
jne 0x43b040
jmp 0x43b071
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43b071
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x446f4c]
call fcn.00437050
add esp, 0x18
test eax, eax
js 0x43b079
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43b090
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43b08e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov eax, esp
mov ebx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov ebp, ebx
or ebp, edi
lea esi, [ebx - 0x74b3c000]
and esi, edi
not ebp
or ebp, esi
add ebp, 0x43cca59a
mov esi, ebp
and esi, 0x3e
xor ebp, 0x3e
lea ecx, [esi*2]
add ecx, ebp
add cl, 0x67
mov byte [eax], cl
inc eax
dec ebx
cmp ebx, 0x74b3c06a
jne 0x43b0d0
mov eax, dword [esp]
mov ebx, dword [0x446f44]
test ebx, ebx
je 0x43b161
xor ebp, ebp
mov edi, dword [0x446f48]
nop
nop
cmp dword [edi + ebp*8], 0x7e66a1b5
je 0x43b130
inc ebp
cmp ebx, ebp
jne 0x43b120
jmp 0x43b161
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43b161
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push ebx
push dword [0x446f4c]
call fcn.00437050
add esp, 0x30
cmp eax, 0x103
jne 0x43b219
mov dword [esp], 0x504f4e4d
mov dword [esp + 4], 0
mov eax, esp
mov ecx, 0x74b3c072
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
mov edx, ecx
or edx, esi
lea edi, [ecx - 0x74b3c000]
and edi, esi
not edx
or edx, edi
add edx, 0x43cca59a
mov esi, edx
and esi, 0x3e
xor edx, 0x3e
lea edx, [edx + esi*2]
add dl, 0x67
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x74b3c06a
jne 0x43b190
mov eax, dword [esp]
mov ecx, dword [0x446f44]
test ecx, ecx
je 0x43b211
xor edx, edx
mov edi, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4e66b5a3
je 0x43b1f0
inc edx
cmp ecx, edx
jne 0x43b1e0
jmp 0x43b211
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43b211
push 0
push 0
push dword [esp + 0x2c]
push 3
push ecx
push dword [0x446f4c]
call fcn.00437050
add esp, 0x18
test eax, eax
js 0x43b219
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43b227
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebp], 0
lea ebp, [ebp + 2]
jne 0x43b250
lea ecx, [edi + ebp]
add ecx, 0xfffffffe
mov ebx, edi
not ebx
and ebx, ecx
add ebp, edi
mov ecx, 1
sub ecx, ebp
and ecx, edi
sub ebx, ecx
and ebx, 0xfffe
mov word [esp], bx
add ebx, 2
mov word [esp + 2], bx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
mov eax, esp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 8], 0x504f4e4d
mov dword [esp + 0xc], 0
lea eax, [esp + 8]
mov edi, 0x74b3c072
nop
nop
nop
nop
movzx ecx, byte [eax]
mov ebx, edi
or ebx, ecx
lea ebp, [edi - 0x74b3c000]
and ebp, ecx
not ebx
or ebx, ebp
add ebx, 0x43cca59a
mov ecx, ebx
and ecx, 0x3e
xor ebx, 0x3e
lea ecx, [ebx + ecx*2]
add cl, 0x67
mov byte [eax], cl
inc eax
dec edi
cmp edi, 0x74b3c06a
jne 0x43b2d0
mov eax, dword [esp + 8]
mov edi, dword [0x446f44]
test edi, edi
je 0x43b355
xor ebx, ebx
mov ebp, dword [0x446f48]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x2df48de6
je 0x43b331
inc ebx
cmp edi, ebx
jne 0x43b320
jmp 0x43b355
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43b355
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 4
push edi
push dword [0x446f4c]
call fcn.00437050
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405f0a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405f49
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405f49
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405f49
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405f49
cmp dword [ecx + 0x74], 0xe
jbe 0x405f49
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4088be
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40895b
push ebx
push esi
call fcn.00408887
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040881d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408908
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40895a
push edi
push eax
call fcn.004067a0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408928
call fcn.00406750
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408959
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040881d
add esp, 0x20
test eax, eax
jne 0x408947
push edi
call fcn.00406750
jmp 0x40894f
push ebx
call fcn.00406750
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4010c0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4d82d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4010f9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401317
mov esp, ebp
pop ebp
ret
mov ecx, dword [section..data]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x4ad7f8
lea eax, [ebp - 0x318]
push 0x20a
push eax
call fcn.00401060
add esp, 0x14
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401317
mov esp, ebp
pop ebp
ret

Function at 0x401317
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d82d4]
jne 0x401321
repz ret
jmp fcn.00406931

Function at 0x4119ca
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4d82d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407567
and dword [ebp - 0x14], 0
cmp dword [0x4e7414], 0
mov dword [ebp - 0x18], eax
jne 0x411a7d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411b25
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411b25
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4e7414], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4e7418], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4e741c], eax
call edi
push eax
call esi
mov dword [0x4e7424], eax
test eax, eax
je 0x411a7d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4e7420], eax
mov eax, dword [0x4e7420]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411ad6
cmp dword [0x4e7424], ecx
je 0x411ad6
push eax
call esi
push dword [0x4e7424]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411ad6
test ebx, ebx
je 0x411ad6
call edi
test eax, eax
je 0x411acd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411acd
test byte [ebp - 8], 1
jne 0x411ad6
or dword [ebp + 0x10], 0x200000
jmp 0x411b09
mov eax, dword [0x4e7418]
cmp eax, dword [ebp - 0x18]
je 0x411b09
push eax
call esi
test eax, eax
je 0x411b09
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411b09
mov eax, dword [0x4e741c]
cmp eax, dword [ebp - 0x18]
je 0x411b09
push eax
call esi
test eax, eax
je 0x411b09
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4e7414]
call esi
test eax, eax
je 0x411b25
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411b27
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x418825
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
je 0x4189d7
mov edi, dword [ebp + 0xc]
call fcn.0048c243
test eax, eax
je 0x4189d7
push 1
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetMapMode]
push 1
push 0x42c
mov dword [ebp - 0xc], eax
xor esi, esi
call fcn.00401a3a
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x418980
push 0x2010
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x418979
push ebx
push edi
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
mov dword [edi], 0x28
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x418970
push 0x10
push 1
call fcn.00401a3a
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x418970
mov eax, dword [edi + 0x14]
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov ax, word [edi + 4]
mov word [esi + 0xc], ax
mov ax, word [edi + 8]
mov word [esi + 0xe], ax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi], eax
cmp eax, ebx
je 0x418917
movsx eax, word [esi + 0xe]
push eax
movsx eax, word [esi + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x41890b
push dword [esi]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi], ebx
jmp 0x418917
push eax
push dword [esi]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 8], eax
cmp dword [esi + 4], ebx
je 0x418970
mov eax, dword [ebp - 4]
add eax, 0x64
push eax
call fcn.004028f8
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x418970
push ebx
push edi
push eax
push dword [edi + 8]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x418967
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0xcc0020
push ebx
push edi
push dword [ebp - 4]
push eax
push ecx
push ebx
push ebx
push eax
push ecx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 4]
call fcn.00401a00
pop ecx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call fcn.00401a00
pop ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetMapMode]
cmp esi, ebx
je 0x4189d7
cmp dword [esi + 4], ebx
je 0x418999
cmp dword [esi], ebx
jne 0x4189a2
push esi
call fcn.00401a00
pop ecx
xor esi, esi
cmp esi, ebx
je 0x4189d7
mov eax, dword [0x5e8768]
cmp eax, ebx
jne 0x4189b9
call fcn.004439f3
mov dword [0x5e8768], eax
push dword [esi]
mov ebx, eax
call fcn.004439a2
mov ebx, dword [esi]
pop ecx
push esi
push dword [0x5e8768]
call fcn.00443b27
mov eax, dword [esi]
pop ecx
pop ecx
jmp 0x4189d9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret