joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10029456
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10029445
jg 0x100293b0
test edx, edx
je 0x10029445
nop dword [eax]
call fcn.1002da50
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10029404
jg 0x100293c7
test esi, esi
je 0x10029404
cmp ebx, eax
jg 0x100293d7
jl 0x100293d1
cmp edi, esi
jae 0x100293d7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1004a210
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10029429
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x1002943f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x100293b0
jl 0x1002943f
test edi, edi
jne 0x100293b0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10029478
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1002947a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x100294f8
jg 0x1002948d
test esi, esi
je 0x100294f8
test eax, eax
jl 0x100294dc
jg 0x10029497
test ebx, ebx
je 0x100294dc
cmp edi, eax
jg 0x100294a7
jl 0x100294a1
cmp esi, ebx
jae 0x100294a7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.1004a210
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x100294f8
jg 0x100294df
test esi, esi
je 0x100294f8
jmp 0x100294df
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x100294f8
push eax
push esi
push 1
push edx
call fcn.1004f487
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10029510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10029542
jl 0x10029535
test ecx, ecx
jne 0x10029542
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10029602
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1002da70
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100295ae
jg 0x1002956d
test esi, esi
je 0x100295ae
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10029585
mov eax, dword [esp + 0x10]
jl 0x1002957f
cmp eax, esi
jae 0x10029585
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1004a210
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100295cf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100295eb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10029554
jl 0x100295eb
test ecx, ecx
jne 0x10029554
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10029641
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10029641
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1004a210
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x100296b0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x10029667
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10029699
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10050715
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x100296c4
cmp edi, eax
ja 0x10029675
test ecx, ecx
je 0x100296b0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10050715
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10029a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10082054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10029a60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10029a9c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10029a9c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10029b84
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10029ac4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10029af7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1004cbdc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10029b57
sub eax, 1
je 0x10029b57
sub eax, 2
jne 0x10029b84
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.1004cbdc
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10029b74
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1004f487
add esp, 0x10
cmp edi, eax
jne 0x10029b84
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10029a87
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10048931
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10082054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002d31a
cmp byte [esi + 0x3d], 0
je 0x1002d31a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002d308
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1002d2d0
sub eax, 1
je 0x1002d2d4
sub eax, 2
jne 0x1002d308
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002d2f1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1004f487
add esp, 0x10
cmp edi, eax
jne 0x1002d308
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048931
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10048931
mov esp, ebp
pop ebp
ret

Function at 0x1002eec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ca60
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10048944
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100349e1
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002efc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ca60
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10048944
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100349e1
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100350f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10082054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x1003511d
xor eax, eax
jmp 0x10035179
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x1003514a
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x1003514a
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x10035200
cmp dword [edi + 0x4c], 0
je 0x10035173
mov ecx, edi
call fcn.10035033
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x10035189
push dword [edi + 0x4c]
push ebx
call fcn.10034c52
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x10035178
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10048931
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x1006f1ac]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x100351d3
sub eax, 1
je 0x100351d3
dec eax
sub eax, 1
jne 0x10035173
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x10035165
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x100351f0
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.1004f487
add esp, 0x10
cmp esi, eax
jne 0x10035173
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x10035173
mov ax, bx
jmp 0x10035178
Function at 0x1005dcb9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005d96a

Function at 0x1005dcc4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005daf4

Function at 0x10063d7e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100639fb
Function at 0x4011d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.00401cec
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x40b216
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.00401cec
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x40b216
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
mov eax, 0
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
mov eax, 0
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x40126a
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x401292
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x40128c
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x4012ab
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push dword [ebp - 0xc]
call fcn.00401377
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4012f3
push ebx
call fcn.00401cda
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x401308
mov ebx, dword [ebp - 4]
push ebx
call fcn.00401cda
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.00401cda
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402000
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x402069
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00401ee0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x4041d3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030c9
and dword [ebp - 4], 0
cmp dword [0x40c758], 0
mov ebx, eax
jne 0x404284
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404335
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40986c
push edi
call esi
test eax, eax
je 0x404335
push eax
call fcn.00403057
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40c758], eax
call esi
push eax
call fcn.00403057
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40c75c], eax
call esi
push eax
call fcn.00403057
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40c760], eax
call esi
push eax
call fcn.00403057
pop ecx
mov dword [0x40c768], eax
test eax, eax
je 0x404284
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403057
pop ecx
mov dword [0x40c764], eax
mov eax, dword [0x40c764]
cmp eax, ebx
je 0x4042dc
cmp dword [0x40c768], ebx
je 0x4042dc
push eax
call fcn.004030d2
push dword [0x40c768]
mov esi, eax
call fcn.004030d2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4042dc
test edi, edi
je 0x4042dc
call esi
test eax, eax
je 0x4042d3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4042d3
test byte [ebp - 0xc], 1
jne 0x4042dc
or dword [ebp + 0x10], 0x200000
jmp 0x404315
mov eax, dword [0x40c75c]
cmp eax, ebx
je 0x404315
push eax
call fcn.004030d2
pop ecx
test eax, eax
je 0x404315
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404315
mov eax, dword [0x40c760]
cmp eax, ebx
je 0x404315
push eax
call fcn.004030d2
pop ecx
test eax, eax
je 0x404315
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40c758]
call fcn.004030d2
pop ecx
test eax, eax
je 0x404335
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404337
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40603e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40bec8]
jne 0x406048
repz ret
jmp fcn.00407765
Function at 0x403480
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x4034e9
cmp edx, 0x40
jb 0x4034e0
movaps xmm2, xmmword [0x40f1c0]
lea ecx, [esi + 0x20]
push edi
mov edi, edx
and edi, 0xffffffc0
nop
movups xmm0, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x40]
add eax, 0x40
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
xorps xmm0, xmm2
movups xmmword [ecx - 0x50], xmm0
movups xmm0, xmmword [ecx - 0x40]
xorps xmm0, xmm2
movups xmmword [ecx - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x30]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
cmp eax, edi
jl 0x4034a0
pop edi
cmp eax, edx
jge 0x4034e9
nop
xor byte [esi + eax], 0x3a
inc eax
cmp eax, edx
jl 0x4034e0
mov eax, 1
pop esi
ret

Function at 0x40685d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x40e078]
test eax, eax
je 0x40689c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40689c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40689c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40689c
cmp dword [ecx + 0x74], 0xe
jbe 0x40689c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406f70
Capabilities:
Get process heap force flags

Disassembly:
call fcn.00406f20
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x406f9a
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x406fa6
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x406fb0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.00406f20
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x406fda
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x408b90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [0x40e078]
test eax, eax
je 0x408bec
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408bec
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408bec
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408bec
cmp dword [ecx + 0x74], 0xe
jbe 0x408bec
cmp dword [ecx + 0xe8], 0
je 0x408bec
push dword [ebp + 8]
call fcn.00408a60
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x411ee0
call fcn.00408830
add esp, 8
cmp dword [ebp - 8], 0
jne 0x408c21
push dword [ebp + 8]
call fcn.00408a20
mov esp, ebp
pop ebp
ret
Function at 0x408c60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [0x40e078]
test eax, eax
je 0x408cbc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408cbc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408cbc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408cbc
cmp dword [ecx + 0x74], 0xe
jbe 0x408cbc
cmp dword [ecx + 0xe8], 0
je 0x408cbc
push dword [ebp + 8]
call fcn.00408a60
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x411ee0
call fcn.00408830
add esp, 8
cmp dword [ebp - 8], 0
jne 0x408cf1
push dword [ebp + 8]
call fcn.00408a20
mov esp, ebp
pop ebp
ret

Function at 0x408d40
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x408d6a
mov eax, 2
pop ebp
ret
push esi
call fcn.00406f20
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x408d8a
jmp dword [eax*4 + 0x408dc0]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call fcn.0040936f
mov dword [eax], 0x16
call fcn.004093b0
or eax, 0xffffffff
pop esi
pop ebp
ret