joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4186a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4187c0
lea edi, [ebx + 0x38]
mov dword [esp], edi
call fcn.0041af30
cmp esi, dword [ebx + 0x28]
jae 0x418720
mov edx, dword [ebx + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [edx + esi*4], eax
mov eax, dword [ebx + 0x30]
mov byte [eax + esi], 1
mov dword [esp], edi
call fcn.0041af80
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esi + 1]
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
test eax, eax
je 0x4187cc
mov dword [esp + 0x1c], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov edx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], eax
je 0x4187cc
mov ecx, dword [ebx + 0x28]
mov eax, ebp
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
sub eax, ecx
lea ecx, [edx + ecx*4]
shl eax, 2
mov dword [esp], ecx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x28]
mov edx, dword [esp + 0x18]
mov ecx, ebp
mov dword [esp + 4], 0
sub ecx, eax
add eax, edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], eax
jmp 0x4186e8
call fcn.00417900
mov ebx, eax
jmp 0x4186d5
mov dword [esp], edi
call fcn.0041af80
mov eax, 0xc
jmp 0x418710

Function at 0x418850
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418878
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.00417900
test eax, eax
jne 0x41886d
add esp, 0x1c
ret

Function at 0x4188e0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418908
add eax, 0xc
add esp, 0x1c
ret
call fcn.00417900
test eax, eax
jne 0x4188fd
jmp 0x418900
Function at 0x418940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.00417a50
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x418962
call fcn.00417a80
test byte [ebx + 0x20], 0x30
jne 0x41897c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x4189bd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4189fd
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x4189b2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x4189c6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.00417820
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x4189bd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x418a11
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4189de

Function at 0x418a20
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x440af4]
test eax, eax
jne 0x418a30
xor eax, eax
ret
sub esp, 0x1c
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418a70
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x418a60
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x418a54
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x418a56
call fcn.00417900
test eax, eax
jne 0x418a4d
jmp 0x418a54

Function at 0x418a80
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418ac0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x418ab0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.00417900
test eax, eax
jne 0x418a9d
add esp, 0x1c
ret
Function at 0x418bc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x418c30
test byte [ebx + 0x20], 0xc
jne 0x418bf0
mov eax, dword [0x440af4]
test eax, eax
jne 0x418c00
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00416ae0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x418c22
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x418c22
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x418c41
mov dword [esp], esi
call fcn.00416e20
add esp, 0x14
pop ebx
pop esi
ret
call fcn.00417900
mov ebx, eax
test eax, eax
jne 0x418be1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x418c61
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.00416e20
call fcn.00418ad0
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x418cf0
mov dword [esp], eax
call fcn.00419f50
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x418d30
call fcn.00417840
mov eax, dword [0x42b060]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x418d90
test edi, edi
je 0x418d0a
call fcn.00418bc0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x418d68
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0041a070
call fcn.00418bc0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.00417840
mov eax, dword [0x42b060]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x418d80
call fcn.00418bc0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.00418bc0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.00417840
mov eax, dword [0x42b060]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x418cc2
call fcn.00417900
mov ebx, eax
jmp 0x418cc2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x418cde
call fcn.00417900
jmp 0x418d0a
call fcn.00417900
mov ebx, eax
jmp 0x418cbe

Function at 0x41c6f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x41c729
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x41dfe0
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x88
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
movdqu xmm0, xmmword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugsrg_bugs__:_n]
movdqu xmm1, xmmword [0x42c1b0]
movdqu xmm2, xmmword [0x42c1c0]
sub esi, edi
movdqu xmm3, xmmword [0x42c1d0]
movdqu xmm4, xmmword [0x42c1e0]
lea eax, [esi + 0x84]
movups xmmword [ebp - 0x71], xmm1
movdqu xmm5, xmmword [0x42c1f0]
movdqu xmm6, xmmword [0x42c200]
and eax, 0xfffffff0
movups xmmword [ebp - 0x81], xmm0
movups xmmword [ebp - 0x31], xmm5
movups xmmword [ebp - 0x61], xmm2
movups xmmword [ebp - 0x51], xmm3
movups xmmword [ebp - 0x41], xmm4
movups xmmword [ebp - 0x28], xmm6
call fcn.0040c0b0
mov edx, dword [ebp - 0x1d]
sub esp, eax
mov eax, dword [ebp - 0x21]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
movups xmmword [ebx + 0x40], xmm4
movdqu xmm4, xmmword [ebp - 0x31]
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x68]
mov dword [ebx + 0x64], edx
movups xmmword [ebx], xmm0
movups xmmword [ebx + 0x10], xmm1
movups xmmword [ebx + 0x20], xmm2
movups xmmword [ebx + 0x30], xmm3
movups xmmword [ebx + 0x50], xmm4
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov byte [ebx + esi + 0x68], 0
mov dword [esp], ebx
call fcn.0042a008
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x42b0d8], 0
jne 0x41e106
mov byte [0x42b0d8], 1
call fcn.00429490
test eax, eax
je 0x41e0d4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040afa0
mov dword [esp], 2
mov esi, dword [fcn.00416260]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41e0c4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x42c145
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x429ef8
jmp 0x429ef0
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x41e08a
mov dword [esp], 2
call dword [0x42b048]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x429eeb
mov dword [esp], 2
call dword [0x42b048]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x40cc7b
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x434ad7
call fcn.004339e0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004028e9
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004028e9
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004028e9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004028e9
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40d3e4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x434bff
call fcn.004339e0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004029bc
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004029bc
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.004029bc
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.004029bc
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.004029bc
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.004029bc
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.004029bc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40dd71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40dd80
pop dword [ebp - 0x38]
mov eax, 0xc3fbd92d
sub eax, 0xc3bafbad
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3bce3
push 0
mov eax, 0xc0ff3b0b
add eax, 0x3f444525
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4c91
xor esi, esi
add esi, eax
mov edx, 0xabbca4e7
add edx, 0x54882119
add edx, dword [ebp - 0x38]
mov edi, 0x3bfc2e93
add edi, 0xd2db9a16
sub dword [ebp - 0x20], 0x796d898
mov ebx, dword [edx]
xor dword [ebp - 0x1c], 0xd8d9bff9
xor ebx, edi
mov dword [esi], ebx
add dword [ebp - 0x14], ecx
add esi, 0xe014df77
add esi, 0x1feb208d
add edx, 4
loop 0x40dddb
add eax, 0x95c3996a
add eax, 0x6a3d8bad
xor ebx, ebx
add ebx, eax
add eax, 0x9c0e2547
sub eax, 0x9c0e2542
mov ecx, 0x40d1c1eb
sub ecx, 0x4091c1eb
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x412d32
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x412d5f
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x444740]
xor eax, edi
inc esi
cmp esi, edx
jb 0x412d3e
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x4123a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ae14
and dword [ebp - 4], 0
cmp dword [0x422444], 0
mov ebx, eax
jne 0x412454
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412505
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412505
push eax
call fcn.0040ada2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x422444], eax
call esi
push eax
call fcn.0040ada2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x422448], eax
call esi
push eax
call fcn.0040ada2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42244c], eax
call esi
push eax
call fcn.0040ada2
pop ecx
mov dword [0x422454], eax
test eax, eax
je 0x412454
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ada2
pop ecx
mov dword [0x422450], eax
mov eax, dword [0x422450]
cmp eax, ebx
je 0x4124ac
cmp dword [0x422454], ebx
je 0x4124ac
push eax
call fcn.0040ae1d
push dword [0x422454]
mov esi, eax
call fcn.0040ae1d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4124ac
test edi, edi
je 0x4124ac
call esi
test eax, eax
je 0x4124a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4124a3
test byte [ebp - 0xc], 1
jne 0x4124ac
or dword [ebp + 0x10], 0x200000
jmp 0x4124e5
mov eax, dword [0x422448]
cmp eax, ebx
je 0x4124e5
push eax
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x4124e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4124e5
mov eax, dword [0x42244c]
cmp eax, ebx
je 0x4124e5
push eax
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x4124e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x422444]
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x412505
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412507
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x414dc9
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], esi
or edi, ebx
sub ebx, 0xeeeb068b
add eax, 4
sub ecx, 1
and ecx, edi
push edi
mov edi, dword [esp]
add esp, 4
cmp eax, edx
jne fcn.00414dc9
or ecx, ecx
sub ecx, ebx
sub edi, edi
ret
Function at 0x4010f0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x134
mov dword [0x406068], 1
push ebx
push esi
push edi
xor ebx, ebx
push ebp
mov dword [0x406064], ebx
push ebx
call fcn.004015b0
test eax, eax
jne 0x401120
mov eax, 0x15
jmp 0x401314
push 0xff
push 0x406d40
call fcn.004020e6
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x2c], 0
je 0x40126c
xor eax, eax
mov edx, 0x20
cmp byte [esp + ebx + 0x2c], 0x2f
jne case.0x401195.83
inc ebx
movsx esi, byte [esp + ebx + 0x2c]
mov ecx, ebx
sub esi, 0x45
inc ebx
cmp esi, 0x32
ja case.0x401195.83
xor ecx, ecx
mov cl, byte [esi + 0x401360]
jmp dword [ecx*4 + 0x401324]
mov dword [0x406058], 1
mov word [0x40605c], 0x10
jmp case.0x401195.83
mov dword [0x406070], 1
jmp case.0x401195.83
mov edi, 0x406d40
mov ecx, 0x41
rep stosd dword es:[edi], eax
xor esi, esi
cmp byte [esp + ebx + 0x2c], al
je 0x4011ee
mov cl, byte [esp + ebx + 0x2c]
cmp cl, 0x2f
je 0x4011ee
mov byte [esi + 0x406d40], cl
inc ebx
inc esi
cmp byte [esp + ebx + 0x2c], al
jne 0x4011d7
dec esi
cmp byte [esi + 0x406d40], dl
jne 0x401200
dec esi
cmp byte [esi + 0x406d40], dl
je 0x4011f7
cmp byte [esp + ebx + 0x2c], 0x2f
mov byte [esi + 0x406d41], al
jne case.0x401195.83
dec ebx
jmp case.0x401195.83
mov dword [0x406058], 1
jmp case.0x401195.83
mov cl, byte [esp + ebx + 0x2c]
cmp cl, 0x53
je 0x40122a
cmp cl, 0x73
jne 0x401238
mov cl, byte [esp + ebx + 0x2d]
cmp cl, 0x42
je 0x401244
cmp cl, 0x62
je 0x401244
mov dword [0x406060], 1
jmp case.0x401195.83
mov dword [0x406064], 1
jmp case.0x401195.83
mov dword [0x406068], eax
jmp case.0x401195.83
mov dword [0x406054], 2
inc ebx
cmp byte [esp + ebx + 0x2c], al
jne 0x40116d
cmp dword [esp + 0x14c], 0
mov esi, dword [esp + 0x148]
jne 0x40128e
push esi
call fcn.004013a0
test eax, eax
jne 0x40128e
xor eax, eax
jmp 0x401314
mov eax, dword [esp + 0x154]
push eax
push esi
call fcn.00401420
test eax, eax
jne 0x4012a4
xor eax, eax
jmp 0x401314
push str.Setup
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov ebx, eax
push 0
lea eax, [esp + 0x14]
push 0
push 0
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push eax
mov dword [0x406074], esi
call edi
test eax, eax
je 0x40130f
mov esi, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ebx
push ecx
call esi
test eax, eax
jne 0x4012fe
lea eax, [esp + 0x10]
push eax
call ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x10]
push 0
push 0
push 0
push eax
call edi
test eax, eax
jne 0x4012db
mov eax, dword [0x40606c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x134
ret 0x10
Function at 0x401420
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x7f02
mov esi, dword [esp + 0xc]
push 0
mov dword [0x406d34], esi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x406d3c], eax
test eax, eax
jne 0x401447
xor eax, eax
pop esi
ret 8
push 0
push esi
push 0
push 0
push 0
push Ordinal_1
push 0
push Ordinal_1
push 0xcf0000
push str.Rainbow_Technologies_Sentinel
push str.Setup
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x40147f
xor eax, eax
pop esi
ret 8
cmp dword [0x406058], 0
mov eax, 0
jne 0x401491
mov eax, dword [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [0x406058], 0
je 0x4014ce
cmp dword [0x406060], 0
push esi
je 0x4014ba
call fcn.00401cf0
jmp 0x4014bf
call fcn.00401ab0
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 1
pop esi
ret 8
Function at 0x4020f9
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x402160
push ebx
call fcn.004021ec
add esp, 4
test eax, eax
jne 0x402132
mov dword [0x4060a0], 0xf
mov dword [0x40609c], 0xd
jmp 0x4021e3
add bl, 0x40
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10c]
lea ebx, [ebp - 4]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x402172
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4021e3
inc eax
cmp eax, 0x104
ja 0x4021e3
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4021a9
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jg 0x40218e
mov eax, ecx
push eax
call fcn.0040301e
add esp, 4
mov edx, eax
test edx, edx
jne 0x4021ba
mov dword [0x40609c], 0xc
jmp 0x4021e3
cmp eax, dword [ebp + 0x10]
jle 0x4021ba
mov dword [0x40609c], 0x22
jmp 0x4021e3
lea edi, [ebp - 0x10c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x4021e5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40253c
Capabilities:
Terminate process

Disassembly:
mov dword [0x4060e0], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x4060dc], bl
jne 0x402598
cmp dword [0x408168], 0
je 0x402586
mov esi, dword [0x408160]
sub esi, 4
cmp dword [0x408168], esi
ja 0x402586
mov eax, dword [esi]
test eax, eax
je 0x40257b
call eax
sub esi, 4
cmp dword [0x408168], esi
jbe 0x402573
push 0x40601c
push 0x406014
call fcn.004025bb
add esp, 8
push 0x406024
push 0x406020
call fcn.004025bb
add esp, 8
test ebx, ebx
jne 0x4025b8
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
ret