joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2980f8a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x2980f8b8
pop dword [ebp - 0x18]
mov eax, 0x2980f8b8
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x8a1bde7e
add dword [ebp - 0x28], 0xc43666cd
mov dword [ebp - 0x24], 0x44d98ebd
sub dword [ebp - 0x24], 0x12a64278
mov dword [ebp - 0x20], 0x3c60767f
add dword [ebp - 0x20], 0xfebcdaf
mov dword [ebp - 0x1c], 0x5481b142
sub dword [ebp - 0x1c], 0x5481b142
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd7578753
add eax, 0x522de96d
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x5b2ab4dd
add dword [ebp - 0x28], 0x1947b479
mov dword [ebp - 0x24], 0xd87fca47
add dword [ebp - 0x24], 0x68ec972e
mov dword [ebp - 0x20], 0x7634ee7e
sub dword [ebp - 0x20], 0x12c58212
mov dword [ebp - 0x1c], 0x49a47bc6
sub dword [ebp - 0x1c], 0x49a47bc6
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x82c2dec4
add eax, 0xa6c291f4
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x49b7b
push 0
call eax
mov ecx, 0x4e43
xor ebx, ebx
add ebx, eax
mov esi, 0x29896400
add esi, dword [ebp - 0x18]
mov edx, 0x57360f3c
add edx, 0x9dd218e7
xor dword [ebp - 0x14], ebx
mov edi, dword [esi]
xor dword [ebp - 8], ecx
xor edi, edx
mov dword [ebx], edi
add ebx, 4
add esi, 0x4865ae3c
add esi, 0xb79a51c8
loop 0x2980f9cb
add eax, 0x7f696a2e
add eax, 0x8097c1b1
xor ebx, ebx
add ebx, eax
add eax, 0x454e7307
add eax, 0xbab18cfe
mov ecx, 0xe454cf83
sub ecx, 0xbad4cf83
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401bab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bea
cmp dword [ecx + 0x74], 0xe
jbe 0x401bea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001cb72
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1001cb37
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1001cb32
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
lock add byte [eax], al
lock add byte [eax], al
cmp edx, 0x3000
jne 0x1001cb1c
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1001cb24
cmp edx, ebx
jne 0x1001cc72
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1001caf3
add eax, dword [eax + 4]
jmp 0x1001cae0
mov dword [ebp + 0xc], ebx
jmp 0x1001cb42
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1001cb5a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1001cb78
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1001cbd6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1001cbbd
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1001cbc6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1001cbd0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1001cbb2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1001cb3c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001ccb9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
invalid
invalid
invalid

Function at 0x1001ccf3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, 0x56fffffc
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
invalid
invalid
invalid
cld

Function at 0x1001cd2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call [ecx + 0x50]
push dword [ebp + 0x18]
sbb bh, bh
jne 0x1001cd43
call fcn.1001c448
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
inc eax
cld
invalid
jmp dword [ecx]
mov byte [ebp - 0x3bf], 3
test dword [ecx - 4], eax
invalid
inc dword [ebx]
Function at 0x1001cd9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
sub eax, esi
test dword [esp + edi*8 - 1], eax

Function at 0x1001e175
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
add byte [eax], al
add byte [eax - 0x7ab5b], al
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
invalid
test dword [ebp - 8], ebx

Function at 0x10022309
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov edi, ecx
mov edx, ebx
xor esi, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x1002231d
sub edx, ecx
mov ecx, 0x811c9dc5
sar edx, 1
add edx, edx
je 0x10022346
movzx eax, byte [esi + ebx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, edx
jb 0x10022335
mov edx, dword [edi + 0x14]
mov eax, edx
and eax, ecx
cmp dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
ja 0x1002235e
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4

Function at 0x490569
Capabilities:
Check for software breakpoints

Disassembly:
push eax
call 0x49056f
pop ebx
sub ebx, 0x1a2
mov ecx, 0x163cd
sub ebx, ecx
mov esi, ebx
sub ebx, 0x79000
mov edi, ebx
sub ebx, 0x1000
push edi
push ecx
push esi
call fcn.0049041e
add esp, 0xc
mov ebp, dword [ebx + 0xc0]
lea ebp, [ebx + ebp]
dec ebp
mov cl, byte [ebp]
cmp cl, 0xcc
je 0x4905a1
sub ebp, 9
mov edx, ebx
sub edx, dword [ebx + 0x74]
add dword [ebp], edx
add ebp, 6
add dword [ebp], edx
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, ebx
add esi, dword [edx + 0x10c]
mov edi, dword [edx + 0x104]
mov ecx, 0x20d7a
call fcn.0049053f
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x49062b
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x490626
pushal
test eax, 0x80000000
je 0x490610
and eax, 0x7fffffff
jmp 0x490614
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x4905fb
add esi, 0x14
jmp 0x4905e1
pop edx
mov ebp, ebx
sub ebp, dword [edx + 0x34]
mov esi, dword [edx + 0xa0]
add esi, ebx
cmp esi, ebx
je 0x490675
push edx
mov eax, dword [esi + 4]
or eax, eax
je 0x490674
mov ecx, dword [esi]
add ecx, ebx
add esi, 8
sub eax, 8
shr eax, 1
mov edx, esi
lea edi, [eax + esi]
lea esi, [eax + edi]
xor eax, eax
add al, byte [edx]
adc ah, byte [edi]
test ah, 0x30
je 0x49066c
push eax
and ah, 0xf
add dword [ecx + eax], ebp
pop eax
inc edx
inc edi
cmp edi, esi
jb 0x49065b
jmp 0x49063e
pop edx
pop eax
cmp eax, 0xd0dec0de
je 0x490682
add ebx, dword [edx + 0x28]
jmp ebx
ret 0xc
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x438caa
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
inc esi
sub ecx, 0x1bc51464
sub ecx, esi
call fcn.00438cec
and esi, esi
sub esi, 0x2f7e93b3
add ecx, 1
xor dword [edi], ebx
or ecx, ecx
sub ecx, 0x9b418910
sub ecx, esi
add edi, 1
add esi, 0xbe3d7902
cmp edi, edx
jne fcn.00438caa
push esi
pop ecx
ret
Function at 0x401112
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a8030]
jne 0x40111c
repz ret
jmp fcn.00401d31

Function at 0x409100
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040587e
and dword [ebp - 4], 0
cmp dword [0x4aa790], 0
mov ebx, eax
jne 0x4091b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409262
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409262
push eax
call fcn.0040580c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4aa790], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4aa794], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4aa798], eax
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x4aa7a0], eax
test eax, eax
je 0x4091b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x4aa79c], eax
mov eax, dword [0x4aa79c]
cmp eax, ebx
je 0x409209
cmp dword [0x4aa7a0], ebx
je 0x409209
push eax
call fcn.00405887
push dword [0x4aa7a0]
mov esi, eax
call fcn.00405887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409209
test edi, edi
je 0x409209
call esi
test eax, eax
je 0x409200
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409200
test byte [ebp - 0xc], 1
jne 0x409209
or dword [ebp + 0x10], 0x200000
jmp 0x409242
mov eax, dword [0x4aa794]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409242
mov eax, dword [0x4aa798]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4aa790]
call fcn.00405887
pop ecx
test eax, eax
je 0x409262
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409264
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b130
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x4a8030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2b631cc]
push ebx
mov ebx, dword [0x2b62eec]
push esi
mov esi, dword [0x4a8f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push 0x4a64a0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2b631cc]
mov dword [0x2b62ee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2b631cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret
Function at 0x40b15f
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x4a8030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2b631cc]
push ebx
mov ebx, dword [0x2b62eec]
push esi
mov esi, dword [0x4a8f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b171
push 0x4a64a0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2b631cc]
mov dword [0x2b62ee8], esi
cmp eax, 0x114e
jne 0x40b199
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push str.gavipokucohuj
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2b631cc]
cmp eax, 0x2f
jne 0x40b1bb
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b060
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401112
add esp, 0x428
ret
Function at 0x4aa7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4aa805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x4aa878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4aa83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x4aa86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x4aa86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x4aa831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4aa7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x72724af7
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x790f693e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x417015
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x421dc0
call fcn.00417964
push 1
call fcn.004173af
pop ecx
test al, al
jne 0x416ebe
push 7
call fcn.00417ad7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041737a
mov byte [ebp - 0x24], al
mov eax, dword [0x424890]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x416eb7
test eax, eax
jne 0x416f28
mov dword [0x424890], ecx
push 0x41a404
push 0x41a3ec
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x416f0b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41700f
push 0x41a3e8
push 0x41a3bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x424890], 2
jmp 0x416f2d
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041750c
pop ecx
call fcn.00417acb
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x416f5d
push esi
call fcn.0041747f
pop ecx
test al, al
je 0x416f5d
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00417d06
call esi
call fcn.00417ad1
mov esi, eax
cmp dword [esi], edi
je 0x416f7b
push esi
call fcn.0041747f
pop ecx
test al, al
je 0x416f7b
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00417bec
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00417c1f
test al, al
jne 0x416fb4
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x416fbd
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00417529
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41700f
call fcn.004179aa
ret
call fcn.00416d24
jmp 0x416e9f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40611c
pop dword [ebp - 0x14]
mov eax, 0x1d1e45f7
add eax, 0xe3221b25
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x5495acd5
sub dword [ebp - 0x24], 0x643678a
mov dword [ebp - 0x20], 0x13dc9592
sub dword [ebp - 0x20], 0xe1a9494d
mov dword [ebp - 0x1c], 0x508ee0e0
add dword [ebp - 0x1c], 0xfbbd634e
mov dword [ebp - 0x18], 0xef818316
sub dword [ebp - 0x18], 0xef818316
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xea596f64
sub dword [ebp - 0x24], 0x75e7060e
mov dword [ebp - 0x20], 0x411fc701
sub dword [ebp - 0x20], 0xffb3658c
mov dword [ebp - 0x1c], 0x561e3316
sub dword [ebp - 0x1c], 0xf2aec6aa
mov dword [ebp - 0x18], 0xe6188fa2
add dword [ebp - 0x18], 0x19e7705e
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3708f
push 0
call eax
mov ecx, 0x43e55a26
sub ecx, 0x43e51071
mov esi, eax
mov edi, 0xa6631604
sub edi, 0xa6221604
add edi, dword [ebp - 0x14]
mov ebx, 0xfdd4529
sub ebx, 0x9570568
mov dword [ebp - 0x10], 0x38d1f7f0
mov edx, dword [edi]
sub dword [ebp - 8], 0x7bc119c3
sub edx, ebx
sub dword [ebp - 0xc], 0xad1344c5
mov dword [esi], edx
xor dword [ebp - 0x10], 0x89640078
add esi, 4
add edi, 0xe731118c
add edi, 0x18ceee78
loop 0x406234
add eax, 0x119a7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x100030ea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000312d
push 0x2b
push 0x403de00
push 6
call fcn.1000d2ff
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x1002a2f1]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100013bb
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.1000e3c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10003180
push ebx
call fcn.1000d311
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100031b6
push 0xa8
push 0x403de00
push 6
call fcn.1000d2ff
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100031cd
mov eax, 0x1002a2e8
jmp 0x100031ee
mov eax, dword [ebp - 8]
test eax, eax
je 0x100031e9
push eax
mov ebx, eax
call fcn.10001a05
inc eax
push eax
call fcn.1000d30b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100031ee
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100031ff
push ebx
call fcn.1000d311
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100032d3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
jne 0x10003321
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10003317
push 0x43
push 0x403e09a
push 6
call fcn.1000d2ff
add esp, 0xc
jmp 0x100033f7
push dword [ebp + 8]
call fcn.100033fd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10003371
mov dword [ebp - 4], esp
push 7
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10003367
push 0xbd
push 0x403e09a
push 6
call fcn.1000d2ff
add esp, 0xc
jmp 0x100033f7
push dword [ebp + 8]
call fcn.1000343d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x100033c1
mov dword [ebp - 4], esp
push 5
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x100033b7
push 0x137
push 0x403e09a
push 6
call fcn.1000d2ff
add esp, 0xc
jmp 0x100033f7
mov dword [ebp - 4], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x100033f2
push 0x16f
push 0x403e09a
push 6
call fcn.1000d2ff
add esp, 0xc
jmp 0x100033f7
mov esp, ebp
pop ebp
ret 8