joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64006120
Capabilities:
Enumerate services

Disassembly:
push 0xffffffffffffffff
push 0x64023069
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6402c09c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
sub edi, edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x28], edi
call dword [0x6402c06c]
mov eax, dword [0x6402d560]
mov edx, dword [eax + 0xc]
mov ecx, 0x6402d560
call edx
mov ebx, dword [esp + 0x68]
add eax, 0x10
mov dword [ebx], eax
push 4
push edi
mov dword [esp + 0x68], edi
push edi
mov dword [esp + 0x34], 1
call fcn.6400e560
call eax
cmp eax, edi
mov dword [esp + 0x1c], eax
je 0x64006314
mov ebp, dword [sym.imp.advapi32.dll_EnumServicesStatusW]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x2c]
push ecx
push 0x24
lea edx, [esp + 0x44]
push edx
push 3
push 0x13f
push eax
mov dword [esp + 0x40], edi
call ebp
push eax
pop esi
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, edi
je 0x640061cf
cmp eax, 0xea
jne 0x64006214
mov esi, dword [esp + 0x24]
add esi, 0x24
sub ecx, ecx
push esi
pop eax
push 0x24
pop edx
nop
nop
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.64011d1d
add esp, 4
push eax
pop edi
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
push esi
push edi
push 3
push 0x13f
push eax
call ebp
jmp 0x64006218
mov edi, dword [esp + 0x2c]
xor ebp, ebp
cmp dword [esp + 0x18], ebp
jbe 0x64006310
mov ecx, dword [edi]
push ecx
lea ecx, [esp + 0x18]
call fcn.640025a0
mov dword [esp + 0x60], 1
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov esi, esp
push eax
call fcn.640028b0
add eax, 0x10
add esp, 4
cmp byte [esp + 0x70], 0
mov dword [esi], eax
je 0x64006269
call fcn.64004dd0
add esp, 4
test al, al
jne 0x64006275
jmp 0x640062db
call fcn.64003e50
add esp, 4
test al, al
jne 0x640062db
push 0x64027f08
push 4
push 0x64027f34
call fcn.64006890
add esp, 0xc
push eax
push ebx
pop ecx
call fcn.64002670
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.64003150
add esp, 8
mov byte [esp + 0x60], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
push ebx
pop ecx
call fcn.640029f0
mov byte [esp + 0x60], 1
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
or edx, edx
jg 0x640062db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x60], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
or edx, edx
jg 0x64006300
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 1
sub edi, 0xffffffdc
cmp ebp, dword [esp + 0x18]
jb 0x64006224
mov eax, dword [esp + 0x1c]
push eax
call fcn.6400e5f0
call eax
push ebx
pop eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x6400b120
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2f34
call fcn.64017df0
mov eax, dword [0x6402c09c]
xor eax, esp
mov dword [esp + 0x2f30], eax
push ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push esi
push edi
sub edi, edi
push edi
push edi
push 3
push edi
push 3
push edi
push 0x64028014
push 0x12
push 0x6402803c
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov byte [esp + 0x37], 0
call fcn.64006b80
add esp, 0xc
push eax
call fcn.6400df80
call eax
push eax
pop esi
cmp esi, 0xffffffff
jne 0x6400b19b
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2f30]
xor ecx, esp
call fcn.6401257c
mov esp, ebp
pop ebp
ret
sub eax, eax
push 0x2710
lea edx, [esp + 0x82c]
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call fcn.64012c00
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x834]
push ecx
push 0xc
lea edx, [esp + 0x38]
push edx
push 0x2d1400
push esi
call fcn.6400e2b0
call eax
or eax, eax
je 0x6400b254
mov eax, dword [esp + 0x838]
push edi
lea edi, [esp + 0x444]
lea ecx, [esp + 0x82c]
call fcn.6400afb0
mov eax, dword [esp + 0x844]
add esp, 4
push 1
lea edi, [esp + 0x5c]
lea ecx, [esp + 0x82c]
call fcn.6400afb0
mov ecx, dword [esp + 0x1c]
add esp, 4
push edi
pop eax
push eax
call fcn.64002810
lea ecx, [esp + 0x440]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.64002810
mov byte [esp + 0x13], 1
sub edi, edi
sub eax, eax
push edi
lea edx, [esp + 0x24]
push edx
push 0x28
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push 0x700a0
push esi
mov dword [esp + 0x50], edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
call fcn.6400e2b0
call eax
or eax, eax
je 0x6400b2b0
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x2f3c]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.6401257c
mov esp, ebp
pop ebp
ret
Function at 0x6400c3b0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x800
push ebx
push ebp
sub ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
push eax
pop edx
and dl, 0x80
neg dl
lea esi, [eax + eax]
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
sbb edx, edx
and edx, 0x1b
sub edx, esi
sub edx, eax
and edx, 0xff
add ecx, 1
cmp ecx, 0x100
push edx
pop eax
jl 0x6400c3c0
pushfd
xor eax, eax
inc eax
popfd
mov ecx, 0x6402e968
jmp 0x6400c400
push eax
pop edx
and dl, 0x80
neg dl
mov dword [ecx], eax
sbb edx, edx
and edx, 0x1b
shl eax, 1
sub edx, eax
and edx, 0xff
add ecx, 4
cmp ecx, 0x6402e990
push edx
pop eax
jl 0x6400c400
mov byte [0x6402e068], 0x63
mov byte [0x640301f3], 0
pushfd
xor ebx, ebx
inc ebx
popfd
mov ecx, dword [esp + ebx*4 + 0x10]
shl ecx, 1
shl ecx, 1
lea edx, [esp + 0x80c]
sbb edx, ecx
mov eax, dword [edx]
push eax
pop ecx
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
sub eax, ecx
push ecx
pop edx
sar edx, 7
shl ecx, 1
or edx, ecx
and edx, 0xff
sub eax, edx
push edx
pop ecx
shl edx, 1
sar ecx, 7
or ecx, edx
and ecx, 0xff
sub eax, ecx
push ecx
pop edx
sar edx, 7
shl ecx, 1
or edx, ecx
sub edx, 0x63
and edx, 0xff
sub eax, edx
mov byte [ebx + 0x6402e068], al
mov byte [eax + 0x64030190], bl
add ebx, 1
cmp ebx, 0x100
jl 0x6400c438
sub ecx, ecx
lea esp, [esp]
movzx edx, byte [ecx + 0x6402e068]
push edx
pop eax
and al, 0x80
neg al
lea esi, [edx + edx]
sbb eax, eax
and eax, 0x1b
sub eax, esi
and eax, 0xff
push eax
pop esi
sub eax, edx
shl eax, 8
sub eax, edx
shl eax, 8
sub eax, edx
shl eax, 8
sub eax, esi
mov dword [ecx*4 + 0x6402fd90], eax
rol eax, 8
mov dword [ecx*4 + 0x6402f990], eax
rol eax, 8
mov dword [ecx*4 + 0x6402f590], eax
rol eax, 8
mov dword [ecx*4 + 0x6402f190], eax
movzx eax, byte [ecx + 0x64030190]
or eax, eax
je 0x6400c561
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x6400c569
xor ebp, ebp
sub ebx, ebx
sub edi, edi
sub edx, edx
shl edx, 8
sub edx, edi
shl edx, 8
sub edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x6402ed90], edx
rol edx, 8
mov dword [ecx*4 + 0x6402e990], edx
rol edx, 8
mov dword [ecx*4 + 0x6402e568], edx
rol edx, 8
mov dword [ecx*4 + 0x6402e168], edx
add ecx, 1
cmp ecx, 0x100
jl 0x6400c4b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x6400f350
Capabilities:
Create thread

Disassembly:
cmp byte [0x6402d4c0], 0
jne 0x6400f3b6
push esi
push edi
push str.692pg0y44cw
mov byte [0x6402d4c0], 1
call dword [sym.imp.kernel32.dll_LoadLibraryW]
push 0x640242d8
push 0xb
push 0x640242cc
push eax
pop esi
call fcn.64006890
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
add esp, 0xc
push eax
push esi
call edi
push 0x640242a4
push 0x19
push 0x64024288
mov dword [0x6402d4b8], eax
call fcn.64006890
add esp, 0xc
push eax
push esi
call edi
pop edi
mov dword [0x6402d4bc], eax
pop esi
jmp 0x640116c0
ret
push 0
push 0
push 0
push 0x64011630
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
ret

Function at 0x64010690
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x64021c78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6402c09c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
call fcn.64010660
add esp, 4
mov eax, dword [eax]
push eax
push 0
mov dword [esp + 0x1c], 0
call fcn.640064f0
push eax
call dword [sym.imp.kernel32.dll_CreateMutexW]
push eax
pop esi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
or edx, edx
jg 0x64010702
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or esi, esi
jne 0x64010719
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
push 0
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or eax, eax
sete al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x640120b4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x6402d57c]
call fcn.640143ef
or eax, eax
pop ecx
je 0x640120ca
pop ebp
jmp eax
push 2
call fcn.64014304
pop ecx
pop ebp
jmp fcn.64011fb8

Function at 0x6401257c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6402c09c]
jne 0x64012586
repz ret
jmp fcn.640156cc

Function at 0x640147ad
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push edi
push 0x64024c24
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
pop edi
or edi, edi
jne 0x640147c8
call fcn.64014498
sub eax, eax
pop edi
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.FlsAlloc
push edi
call esi
push str.FlsGetValue
push edi
mov dword [0x6402d5ac], eax
call esi
push str.FlsSetValue
push edi
mov dword [0x6402d5b0], eax
call esi
push str.FlsFree
push edi
mov dword [0x6402d5b4], eax
call esi
cmp dword [0x6402d5ac], 0
mov esi, dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [0x6402d5b8], eax
je 0x64014828
cmp dword [0x6402d5b0], 0
je 0x64014828
cmp dword [0x6402d5b4], 0
je 0x64014828
or eax, eax
jne 0x6401484c
mov eax, dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [0x6402d5b0], eax
mov eax, dword [sym.imp.kernel32.dll_TlsFree]
mov dword [0x6402d5ac], 0x6401445d
mov dword [0x6402d5b4], esi
mov dword [0x6402d5b8], eax
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x6402c234], eax
je 0x6401492c
push dword [0x6402d5b0]
push eax
call esi
or eax, eax
je 0x6401492c
call fcn.64015bf6
push dword [0x6402d5ac]
call fcn.64014378
push dword [0x6402d5b0]
mov dword [0x6402d5ac], eax
call fcn.64014378
push dword [0x6402d5b4]
mov dword [0x6402d5b0], eax
call fcn.64014378
push dword [0x6402d5b8]
mov dword [0x6402d5b4], eax
call fcn.64014378
add esp, 0x10
mov dword [0x6402d5b8], eax
call fcn.6401994f
or eax, eax
je 0x64014927
push fcn.64014623
push dword [0x6402d5ac]
call fcn.640143ef
pop ecx
call eax
cmp eax, 0xffffffff
mov dword [0x6402c230], eax
je 0x64014927
push 0x214
push 1
call fcn.64015810
push eax
pop esi
or esi, esi
pop ecx
pop ecx
je 0x64014927
push esi
push dword [0x6402c230]
push dword [0x6402d5b4]
call fcn.640143ef
pop ecx
call eax
or eax, eax
je 0x64014927
push 0
push esi
call fcn.640144d5
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
sub eax, eax
inc eax
jmp 0x6401492e
call fcn.64014498
sub eax, eax
pop esi
pop edi
ret
Function at 0x640183e7
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x6402da88]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
sub ebx, ebx
sub esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x64018430
call edi
push eax
pop esi
cmp esi, ebx
je 0x64018417
mov dword [0x6402da88], 1
jmp 0x64018439
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x6401842b
mov eax, ebp
mov dword [0x6402da88], eax
jmp 0x64018430
mov eax, dword [0x6402da88]
cmp eax, 1
jne 0x640184bd
cmp esi, ebx
jne 0x6401844c
call edi
push eax
pop esi
cmp esi, ebx
jne 0x6401844c
sub eax, eax
jmp 0x64018515
cmp word [esi], bx
push esi
pop eax
je 0x64018461
add eax, ebp
cmp word [eax], bx
jne 0x64018453
add eax, ebp
cmp word [eax], bx
jne 0x64018453
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sbb eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x640184b2
push ebp
call fcn.640157d0
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x640184b2
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
or eax, eax
jne 0x640184ae
push dword [esp + 0x10]
call fcn.64013396
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
push ebx
pop eax
jmp 0x64018515
cmp eax, ebp
je 0x640184c5
cmp eax, ebx
jne 0x64018445
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
push eax
pop esi
cmp esi, ebx
je 0x64018445
cmp byte [esi], bl
je 0x640184e3
inc eax
cmp byte [eax], bl
jne 0x640184d9
inc eax
cmp byte [eax], bl
jne 0x640184d9
sbb eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.640157d0
push eax
pop edi
cmp edi, ebx
pop ecx
jne 0x64018501
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
jmp 0x64018445
push ebp
push esi
push edi
call fcn.64013f20
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
push edi
pop eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x6401a5f5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
sub esi, esi
sub edi, edi
cmp ebx, dword [edi*8 + 0x6402ca78]
je 0x6401a610
inc edi
cmp edi, 0x17
jb 0x6401a601
cmp edi, 0x17
jae 0x6401a790
push ebp
push 3
call fcn.6401d6b3
cmp eax, 1
pop ecx
je 0x6401a75c
push 3
call fcn.6401d6b3
or eax, eax
pop ecx
jne 0x6401a644
cmp dword [0x6402d5a0], 1
je 0x6401a75c
cmp ebx, 0xfc
je 0x6401a78f
push str.2v05oukrsw5mv1_n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6402dbf0
push ebp
call fcn.64013eb8
add esp, 0xc
or eax, eax
je 0x6401a67a
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
push 0x104
mov esi, 0x6402dc09
push esi
push 0
mov byte [0x6402dd0d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
or eax, eax
jne 0x6401a6be
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.64013eb8
add esp, 0xc
or eax, eax
je 0x6401a6be
sub eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.64011fb8
add esp, 0x14
push esi
call fcn.64013cc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x6401a703
push esi
call fcn.64013cc0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6402df04
push 0x6402533c
sbb ecx, eax
push ecx
push eax
call fcn.6401b746
add esp, 0x14
or eax, eax
je 0x6401a703
sub esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
jmp 0x6401a705
sub esi, esi
push 0x64025338
push ebx
push ebp
call fcn.6401b68e
add esp, 0xc
or eax, eax
je 0x6401a725
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
push dword [edi*8 + 0x6402ca7c]
push ebx
push ebp
call fcn.6401b68e
add esp, 0xc
or eax, eax
je 0x6401a747
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.6401d4f6
add esp, 0xc
jmp 0x6401a78f
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x6401a78f
cmp ebp, 0xffffffff
je 0x6401a78f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x6402ca7c]
push dword [esi]
call fcn.64013cc0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x6401aa90
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
cmp word [ecx], 0x5a4d
je 0x6401aa9e
sub eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x6401aa9b
sub ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
push ecx
pop eax
ret

Function at 0x6401aac0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
sub edx, edx
or esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x6401aafc
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x6401aaf2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x6401aafe
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x6401aae2
sub eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x6401d4f6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.640143e6
sub ebx, ebx
cmp dword [0x6402df7c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x6401d5cc
push 0x640264c0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
je 0x6401d6ac
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x6401d6ac
push eax
call fcn.64014378
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6402df7c], eax
call esi
push eax
call fcn.64014378
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6402df80], eax
call esi
push eax
call fcn.64014378
mov dword [0x6402df84], eax
lea eax, [ebp - 0xc]
push eax
call fcn.640159ef
or eax, eax
pop ecx
pop ecx
je 0x6401d59a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.64011fb8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x6401d5cc
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.64014378
cmp eax, ebx
pop ecx
mov dword [0x6402df8c], eax
je 0x6401d5cc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.64014378
pop ecx
mov dword [0x6402df88], eax
mov eax, dword [0x6402df88]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x6401d651
cmp dword [0x6402df8c], ecx
je 0x6401d651
push eax
call fcn.640143ef
push dword [0x6402df8c]
push eax
pop esi
call fcn.640143ef
cmp esi, ebx
pop ecx
pop ecx
push eax
pop edi
je 0x6401d651
cmp edi, ebx
je 0x6401d651
call esi
cmp eax, ebx
je 0x6401d61e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
or eax, eax
je 0x6401d61e
test byte [ebp - 0x18], 1
jne 0x6401d651
lea eax, [ebp - 0x10]
push eax
call fcn.64015a26
or eax, eax
pop ecx
je 0x6401d639
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.64011fb8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x6401d648
or dword [ebp + 0x10], 0x200000
jmp 0x6401d68c
or dword [ebp + 0x10], 0x40000
jmp 0x6401d68c
mov eax, dword [0x6402df80]
cmp eax, dword [ebp - 8]
je 0x6401d68c
push eax
call fcn.640143ef
cmp eax, ebx
pop ecx
je 0x6401d68c
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x6401d68c
mov eax, dword [0x6402df84]
cmp eax, dword [ebp - 8]
je 0x6401d68c
push eax
call fcn.640143ef
cmp eax, ebx
pop ecx
je 0x6401d68c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6402df7c]
call fcn.640143ef
cmp eax, ebx
pop ecx
je 0x6401d6ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x6401d6ae
sub eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e1b7
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40e13b
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40e136
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40e120
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40e128
cmp edx, ebx
jne 0x40e276
dec esi
add dword [eax], eax
invalid
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40e0f7
add eax, dword [eax + 4]
jmp 0x40e0e4
mov dword [ebp + 0xc], ebx
jmp 0x40e146
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40e15e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40e17c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40e1da
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40e1c1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40e1ca
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40e1d4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40e1b6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40e140
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40ef2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040da87
jb 0x40efaa
jmp 0xf9157505
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.0040d9f8
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
cld
invalid
invalid
call dword [ebp - 0x6e4]
call fcn.0040da87
mov esi, 0x838bce3e
movsd dword es:[edi], dword [esi]
add cl, bh
invalid