joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42399b
Capabilities:
Encode data using xor

Disassembly:
sub bh, ch
cmp ch, cl
push edi
popal
cld
sbb byte [ecx - 0x5fb21d97], ch
rcl dword [ecx - 0x77da8723], cl
mov eax, dword [0x35fe8b0f]
salc
xchg edi, eax
mov ch, 0x5d
vpmulhw ymm1, ymm6, ymm5
loop 0x4239a8
lea edi, [bx + si + 3]
jno 0x423a1b
or byte [edx - 0x18aa50ba], bl
in al, dx
aaa
cmp dword [ecx], edx
adc edi, dword [ebx]
pop es
dec ecx
aas
mov eax, 0xebfb7b59
mov ah, 0x1d
mov dh, byte [0xf05eb322]
leave
bound esi, qword [ebx]
rcr byte [edx], 1
sub bl, byte [edx - 0x6de38535]
cmp eax, 0xcd7d0dfa
pop es
ror dl, 1
pop ss
lodsd eax, dword [esi]
sahf
mov byte [eax], ah
jae 0x423a4d
stosb byte es:[edi], al
dec ecx
xor cl, ch
jb 0x423a18
test dword [0xffff8012], ebx
invalid
out 0xca, al
invalid
sbb esi, dword [edi + ebp*2]
xchg esi, eax
or dword [eax + 0x74], eax
push ebx
cmc
mov dword [0x5d721dbe], eax
mov edi, 0xe6b8e9
dec ecx
inc ecx
in al, dx
in eax, dx
cmp dword [ebp - 0x3727eee8], esi
invalid
push 0x5f
lcall 0x80be, 0xcef4ba73
insd dword es:[edi], dx
fdivr st(4)
mov edx, 0xd330fed1
pop es
jnp 0x423adc
xor al, byte [ebp + 0x23]
dec ebx
cmp cl, byte [ebp + esi*4 - 0x57]
sbb ebp, dword [ebp + 0x3e]
int1
xor eax, 0xbb7e7ab2
scasb al, byte es:[edi]
out 0xa6, al
xchg byte [eax], al
ljmp 0x1adc
xor eax, dword [ecx]
mov dword [ebp + 0x6d], ebp
sti
lodsb al, byte [esi]
sub edx, dword [eax - 0x56]
lds esi, [ebx + 0x40]
sbb eax, edx
add eax, 0xeeedf44b
cmp eax, 0x244262bc
jb 0x423b16
cmp esp, dword [ecx + 0x251693a8]
clc
stc
mov edx, 0x6548f050
jge 0x423afc
and eax, 0x50baf9f8
invalid
cmp edx, 0xffffffc9
pop es
pop ds
btc dword [esi], ebx
xlatb
pop esp
mov byte [di - 0x48], bh
fimul dword [ecx]
and dword [edx - 0x38], 0xed26050e
push 0xffffffffffffffa3
jbe 0x423b6c
push ebx
adc eax, 0xe14f2d26
int1
std
mov bl, 0x1c
aas
out 0x99, eax
dec ebp
push ss
xor ecx, dword [edi]
daa
or eax, 0x6b9bae61
dec esp
leave
mov word [edx], fs
sbb eax, 0x414f0c49
leave
into
pop esi
out dx, al
jp 0x423b80
pop ebp
or dword [edi + 0x7e88b2db], ecx
cmp byte [edx + 0x6d], bl
dec edx
int 0xee
mov dword gs:[0x3d39c950], eax
sbb al, 0xba
or esi, dword [esi + 0x61]
fld qword [esi]
fnstenv [ecx - 0x36]
cmp eax, 0x9e71be2a
jnp 0x423b16
test eax, 0xea627c92
mov dword [0xe78db224], eax
cmp al, 0xe2
invalid
xchg edx, eax
jl 0x423bd2
ljmp 0x3ce7:0x8db224a3
out 0xc9, al
inc esi
jmp 0x423b56
aas
movsb byte es:[edi], byte [esi]
inc ebp
rcr dword [ecx - 5], 0x35
or bh, byte [ecx]
adc ch, dl
adc eax, dword [ebx + 0xfb2fe66]
xchg ebx, ebp
or bl, byte [ebx + ebp + 0x2bf15d08]
sub esi, dword [esi]
xchg ecx, eax
stosd dword es:[edi], eax
mov al, byte [0x7e1753fa]
lahf
sti
xlatb
adc ebp, dword [edi + 0x37]
lds eax, [edx]
aaa
pushfd
lcall 0x17db, 0xb934ffa0
cld
cmp bl, ch
out 0xbd, eax
Function at 0x43c190
Capabilities:
Encode data using xor

Disassembly:
ror dword [edi - 0x2567ba8], 1
ficom dword [esi + eax*8 + 0x78]
pushal
sbb esi, ebx
invalid
stosd dword es:[edi], eax
mov esi, 0x3c4a2e12
fnstsw word [ebx + 0x62]
cmp al, 0xdd
jnp 0x43c1fb
cmp dh, byte [edx]
adc al, 0xdd
pushal
jns 0x43c195
mov cl, 2
xor ah, byte [ebx + 0x4c0d6d0b]
aad 0x8d
call 0xef51d3d6
mov dword [0xdebad61a], eax
scasb al, byte es:[edi]
mov byte [0x4418f3d], al
mov ah, 9
pop ss
add byte [edx + 0x39], bl
sbb dword [esi + 0x1f1b02bc], esi
dec ebp
in eax, 0x41
and dh, byte [ebp + 0x30]
mov ah, 0x77
xchg esp, eax
ja 0x43c164
rcr dl, 0x81
pop ebp
xor dword [0xb923b4d0], esp
cmp dl, byte [esp + eax - 0x5be78fd7]
cmp byte [eax], bl
adc al, 0x2f
mov edx, 0x233668b1
xor ch, byte [ecx]
std
loope 0x43c1ce
insb byte es:[edi], dx
sar dword [eax], cl
aaa
and al, 0x22
dec edx
arpl word [edi - 1], cx
pop ebp
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x37], ecx
aaa
or al, 0x22
in al, 0x12
lds esi, [eax - 0x7c]
cmpsd dword [esi], dword es:[edi]
pop ebp
xchg edx, eax
xor ch, byte [ecx + 0x247a946d]
test al, 0xf3
pop ss
pushfd
test ah, bh
clc
pop es
sub eax, 0xb327b2e
jbe 0x43c203
bound edx, qword [edi]
push ds
in al, 0xae
mov al, byte [0xb66233d3]
xor dl, ch
or al, byte [ebx]
int1
mov ds, word [ebx + 0x23]
cmp ah, byte [edx + 0x58]
ficom dword [ecx]
out dx, eax
mov byte [esi + ebp*4 + 0x1fc2fe52], 0x32
outsb dx, byte [esi]
xchg esp, eax
and edi, dword cs:[edx]
and ch, byte [ebx + 0x14]
sub al, 0x32
pop ss
mov bl, dl
xor al, byte [eax]
sub al, 0xb
inc edi
cmp esi, dword [esi]
sbb dword [edx], edi
sub dword [ebx], esi
nop
fimul word [eax + 0x791063e9]
and byte [edx - 0x50], bh
cmp edx, eax
dec esp
inc esi
test ebp, esp
fiadd dword [eax]
popal
adc al, 0xac
cld
sbb eax, dword [edx]
adc bh, byte [edx]
cmp dword [0x5a60a609], eax
cmp byte [edx], bl
add dh, byte [edi]
test eax, 0xf9a65fa7
mov esp, 0x96603831
mov cl, 0x18
and dh, byte [edx]
clc
xchg esp, eax
and al, 0xdc
nop
hlt

Function at 0x44f83b
Capabilities:
Encode data using xor

Disassembly:
sub dl, ah
imul ecx, dword [eax + 3], 0xfcdaffb1
shr edi, cl
jmp 0x44f84c
insb byte es:[edi], dx
sub byte [eax + 0x54e154a1], 0xc2
cmpsd dword [esi], dword es:[edi]
paddusb mm2, qword [bp + si + 0x5ad0]
dec edx
loope 0x44f861
mov eax, 0xeaa5e711
arpl si, ax
mov dl, 0x23
pop esi
add al, 0xd3
in eax, 0xb3
mov dh, 0x1a
mov ch, 0xf1
xchg dword [ebp - 0x2be8fd17], esp
sar byte [edx + 0x77e47106], cl
push es
jno 0x44f862
ja 0x44f8ae
xor esi, dword [ebp + 0x2b]
out 0xa5, eax
Function at 0x451a6b
Capabilities:
Encode data using xor

Disassembly:
sal esi, 0xd1
fild word [ebx + 0x1c]
xchg edx, eax
add al, 0xc2
inc esp
sti
or ecx, dword [ecx - 0x245644fc]
mov eax, dword [0xa833185]
imul ecx, edx, 0x556bc4fc
adc dword [eax + 0x6fe1debb], 0x237500c0
mov ebx, 0xc06fe1de
add byte [ebp + 0x23], dh
mov ebx, 0xc06fe1de
add byte [ebp + 0x23], dh
add byte [ecx - 0x7bc7e8b8], dl
mov bl, 0x89
wait
xlatb
mov esi, 0x2861539a
xor eax, dword [ebx]
pushal
mov dword [0x42d143c9], eax
adc al, 0x7f
mov ebp, ebp
sbb esi, dword [ebx - 0x4e]
and ebp, dword [edx]
daa
xor al, 0xc3
sub dl, bl
salc
cld
jecxz 0x451a4d
jecxz 0x451ae5
call 0xbc4dc6a6
fld qword [esi - 0x74]
jecxz 0x451aae
or al, byte [eax + 0x41]
in al, 0xe2
jmp 0x24a8735a
adc dl, byte [ebx - 0x74d014bd]
mov eax, dword [0x47c2d2f1]
aas
xor al, 0x22
inc edx
loope 0x451b24
xchg ebp, eax
xchg byte [eax - 0x7b], al
lodsd eax, dword [esi]
aam 0xf
cmp al, 0xad
mov ch, 0xb7
jmp 0x451b2d
stosb byte es:[edi], al
adc esp, ebx
xor eax, 0x86855806
mov bh, byte [edi - 0x4cee70c7]
mov edi, 0xb3118f39
adc eax, 0x51035303
das
out 0xdf, al
mov dh, 0xa1
inc ecx
xchg ebp, eax
invalid

Function at 0x456942
Capabilities:
Encode data using xor

Disassembly:
dec ecx
lodsb al, byte [esi]
or ch, byte [ebp - 0x66]
popfd
xor eax, 0xecfcb3b6
jecxz 0x456941
mov edx, dword [ecx + 0x4f]
dec eax
ret

Function at 0x4655bb
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc al, 0x88
cmp eax, 0x9de132c
xchg bl, al
mov edx, 0x904a2a93
inc ebx
invalid

Function at 0x47c7bb
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
insd dword es:[edi], dx
add al, 0x81
stosd dword es:[edi], eax
pop ecx
cmpsd dword [esi], dword es:[edi]
xor byte [esi - 0x7f], ah
or ebx, dword [ecx - 0x2eaa7486]
mov edx, 0x2e5a6c1
cdq
inc esi
xchg edx, eax
push ds
cmp ebp, 0x676dae1c
adc edx, dword [eax - 0x500779bb]

Function at 0x49886d
Capabilities:
Encode data using xor

Disassembly:
xor edx, dword [edx - 0x6c054037]
mov esp, edi
mov ebx, 0xfdbafd9a
lcall 0x4e32, 0x96fdbafd
or dword [esi - 0x65024503], ebp
mov ebp, 0xff9abdfa
mov ecx, 0x723097f1
aaa
nop
leave
ret 0xa9b0
invalid
test al, 0x92
dec ebx
jne 0x4987df
cwde
cmp byte [esp - 0x530a0662], 0x96
invalid
xchg edi, eax
dec esi
ja 0x498812
cdq
cmp dword [ebx - 0x43d645e], 0xffffffa2
wait
test eax, esi
stosd dword es:[edi], eax
xchg edx, eax
dec ebx
jb 0x49882c
xchg edx, eax
mov esi, dword [edx - 0xc346d55]
stosb byte es:[edi], al
xchg ebx, eax
mov dh, byte [ebx + 0x744a93aa]
lodsd eax, dword [esi]
xchg esp, eax
lea esi, [ebp + ebp*4 - 0x530a326c]
xchg ebp, eax
invalid
Function at 0x4bb65d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43d0
cmp edx, dword [eax]
je 0x4bb67f
add eax, 8
inc ecx
cmp eax, 0x4c4460
jl 0x4bb670
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43d0]
jne 0x4bb7ad
mov eax, dword [0x4c8d64]
cmp eax, 1
je 0x4bb787
test eax, eax
jne 0x4bb6b0
cmp dword [0x4c42fc], 1
je 0x4bb787
cmp edx, 0xfc
je 0x4bb7ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb6e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc040
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc4d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb72a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc4d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0a34
push edi
call fcn.004be3a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc040
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc050
lea eax, [ebp - 0xa0]
push 0x4c0a14
push eax
call fcn.004bc050
push dword [esi + 0x4c43d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc050
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be314
add esp, 0x2c
pop edi
jmp 0x4bb7ad
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43d4]
push 0
push eax
push dword [esi]
call fcn.004bc4d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5d7701
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xb7cb913]
mov esi, 0x64a7e514
sub esi, dword [edi]
pop esp
outsd dx, dword [esi]
daa
fld dword [edx - 0xa]
xlatb
cmp eax, 0xe374abda
lcall 0x25a6, 0xe2bf1885
je 0x5d7729
leave
ror dword [esi - 0x25], 1
into
test dword [ecx - 0x74b65679], ebx
mov ah, 0x37
push esi
enter 0xffffffffffff85e4, 0xffffffffffffff9d
js 0x5d76f6
sbb bh, byte [eax - 0x44]
push edx
mov dword [0xdca37407], ecx
leave
fmul st(1), st(0)
xchg esp, eax
mov edi, 0xc58e8ffc
xor cl, byte [esi]
inc ebp
cmp bh, byte cs:[ebx]
add eax, 0x886d1625
adc al, 0x4b
sub dl, al
pop eax
lodsb al, byte [esi]
loope 0x5d773e
nop
and eax, 0x2d18d2a6
or dword [edx], ebx
add byte [edi + ebx - 0x688d0e3f], bl
int1
jb 0x5d76b7
inc esi
xchg dword [esi], edi
insd dword es:[edi], dx
pop ds
lodsb al, byte [esi]
inc ebp
pop esp
xchg byte [0xd7732fd6], al
add eax, 0xd7732fd6
fidiv dword [esi - 0x40]
xor al, 0xd6
jg 0x5d771e
hlt
dec edi
push ds
or ecx, dword [esi + 0x6c]
stosb byte es:[edi], al
mov eax, dword [0x2d690bed]
cmp eax, 0x2bcf7e11
pushal
pop edi
jle 0x5d771d
sub esp, dword [eax + 0x5f]
mov ch, 0x5e
dec ebp
xchg esp, eax
sub byte [edi + 0xa], dh
inc ecx
jge 0x5d774c
push ds
sbb byte [edx + ebx*4 - 5], ch
mov bl, bl
xor eax, 0xfaf14f61
pop eax
rcl dword [ecx - 0x6b], 0x62
pop esp
fcmovnb st(0), st(4)
fsub st(2), st(0)
mov esi, 0x1bdd727
test eax, 0xc9898ca8
sahf
inc esp
into
sbb byte [edx - 0x26], bl
sbb esi, dword [ecx - 0x2a]
dec ebp
in al, dx
fbstp tbyte [0xd67fb73]
mov ch, 0x68
push ebx
sub al, 0x58
or byte [ebx - 0x7a3036c9], bh
shl byte [ecx], cl
mov ss, esi
loope 0x5d7743
in al, dx
jmp 0x5d77e6
add byte [edi - 0x77], cl
and dword [ebx + 0x1dd48a2d], ecx
adc byte [0x26ef6db2], bh
rcr dword [ebp - 0x1f], 0x99
popal
test dword [edx], esp
sar al, cl
cmp dl, dh
jmp 0x5d7859
and al, 0x83
les eax, [eax + edx*2]
Function at 0x40107e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x4ac6c8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4ac6cc]
xor esi, esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.00401077
mov eax, dword [0x4ac6d0]
add dword [ebp - 0xc], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x4ac6d4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
jmp 0x4010ce
xor esi, esi
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, ebx
shl eax, 4
cmp dword [0x4bb914], 0xc
mov dword [ebp - 4], eax
jne 0x4010f8
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x4bb914]
cmp eax, 0xfa9
jne 0x401114
mov dword [0x4bb910], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401133
push str.fahubizavojijalaho
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x4bb868], esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, ebx
add eax, ebx
shr edx, cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [0x4bb90c], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, edx
sub edi, eax
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov esi, edi
shr esi, cl
add eax, edi
mov dword [ebp - 0x18], eax
add esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
cmp dword [0x4bb914], 0xb03
jne 0x4011ac
push str.juyuzuwedikicezosofuxodesir
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
xor dword [ebp - 4], esi
sub ebx, dword [ebp - 4]
add dword [ebp - 0xc], 0x61c88647
dec dword [ebp - 0x1c]
jne 0x4010cc
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ebx
pop ebx
leave
ret 4
Function at 0x4073d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ab83c]
jne 0x4073da
repz ret
jmp fcn.0040b7df

Function at 0x40b1cd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d67
and dword [ebp - 4], 0
cmp dword [0x4b0904], 0
mov ebx, eax
jne 0x40b27e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b32f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b32f
push eax
call fcn.00405cf5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b0904], eax
call esi
push eax
call fcn.00405cf5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b0908], eax
call esi
push eax
call fcn.00405cf5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b090c], eax
call esi
push eax
call fcn.00405cf5
pop ecx
mov dword [0x4b0914], eax
test eax, eax
je 0x40b27e
push 0x4a7f28
push edi
call esi
push eax
call fcn.00405cf5
pop ecx
mov dword [0x4b0910], eax
mov eax, dword [0x4b0910]
cmp eax, ebx
je 0x40b2d6
cmp dword [0x4b0914], ebx
je 0x40b2d6
push eax
call fcn.00405d70
push dword [0x4b0914]
mov esi, eax
call fcn.00405d70
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2d6
test edi, edi
je 0x40b2d6
call esi
test eax, eax
je 0x40b2cd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2cd
test byte [ebp - 0xc], 1
jne 0x40b2d6
or dword [ebp + 0x10], 0x200000
jmp 0x40b30f
mov eax, dword [0x4b0908]
cmp eax, ebx
je 0x40b30f
push eax
call fcn.00405d70
pop ecx
test eax, eax
je 0x40b30f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b30f
mov eax, dword [0x4b090c]
cmp eax, ebx
je 0x40b30f
push eax
call fcn.00405d70
pop ecx
test eax, eax
je 0x40b30f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b0904]
call fcn.00405d70
pop ecx
test eax, eax
je 0x40b32f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b331
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404710
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40476b
cmp byte [esi + ebx - 1], 0xa
je 0x40473f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405fc4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x404bd0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x404c6b
cmp ax, 9
je 0x404c58
cmp ax, 0x20
je 0x404c58
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x404cc0
cmp ax, 0x22
je 0x404cd0
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x404c6b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x404c10
test edi, 1
jne 0x404c10
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x404c58
cmp ax, 0x20
je 0x404c58
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x404ce8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x404c2b
and dword [ebp - 0x6c], 1
jne 0x404c24
xor edi, 1
jmp 0x404c2b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x404c84

Function at 0x404d00
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x4010cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x816004]
jne 0x4010d6
repz ret
jmp fcn.004016e5

Function at 0x4056ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x816004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004044d5
and dword [ebp - 0x14], 0
cmp dword [0x818b38], 0
mov dword [ebp - 0x18], eax
jne 0x40575e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405806
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405806
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x818b38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x818b3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x818b40], eax
call edi
push eax
call esi
mov dword [0x818b48], eax
test eax, eax
je 0x40575e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x818b44], eax
mov eax, dword [0x818b44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4057b7
cmp dword [0x818b48], ecx
je 0x4057b7
push eax
call esi
push dword [0x818b48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4057b7
test ebx, ebx
je 0x4057b7
call edi
test eax, eax
je 0x4057ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4057ae
test byte [ebp - 8], 1
jne 0x4057b7
or dword [ebp + 0x10], 0x200000
jmp 0x4057ea
mov eax, dword [0x818b3c]
cmp eax, dword [ebp - 0x18]
je 0x4057ea
push eax
call esi
test eax, eax
je 0x4057ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4057ea
mov eax, dword [0x818b40]
cmp eax, dword [ebp - 0x18]
je 0x4057ea
push eax
call esi
test eax, eax
je 0x4057ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x818b38]
call esi
test eax, eax
je 0x405806
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405808
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010cc
leave
ret
Function at 0x80ba50
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x80ba64
call fcn.0080b9d0
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x80ba57
pop esi
cmp ebx, 0x2d
jne 0x80ba7e
mov dword [0xc09b98], 0xa62e7790
mov dword [0xc09b9c], 0xffffffff
ret

Function at 0x80ba80
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x816004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x816db8]
push ebx
mov ebx, dword [0xc09b8c]
push edi
mov edi, dword [0xc0770c]
call fcn.0080ba20
cmp dword [0xc09b8c], 0x2f
jne 0x80baed
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0080ba50
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010cc
add esp, 0x24
ret
Function at 0x25819d18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x25819d27
pop dword [ebp - 8]
mov eax, 0x4837add3
add eax, 0xdd49ef54
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x9ab98799
add dword [ebp - 0x18], 0xb398bdb2
mov dword [ebp - 0x14], 0xe6df4c07
add dword [ebp - 0x14], 0x4b54003e
mov dword [ebp - 0x10], 0x5fce012c
add dword [ebp - 0x10], 0xec7e4302
mov dword [ebp - 0xc], 0xd86e486c
sub dword [ebp - 0xc], 0xd86e486c
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x11b1ab9a
sub dword [ebp - 0x18], 0x9d3f4244
mov dword [ebp - 0x14], 0xde58ce22
sub dword [ebp - 0x14], 0x9cec6cad
mov dword [ebp - 0x10], 0x415961b0
sub dword [ebp - 0x10], 0xdde9f544
mov dword [ebp - 0xc], 0xda3e5784
add dword [ebp - 0xc], 0x25c1a87c
and eax, 0xffe89d8d
invalid
call dword [ebx + 0x50]
mov eax, 0x156f683
add eax, 0x242ad9fd
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3d4fb
push 0
call eax
mov ecx, 0x1bd5090
add ecx, 0xfe42fa79
xor esi, esi
add esi, eax
mov edx, 0x2ab571c0
sub edx, 0x532dbc0
add edx, dword [ebp - 8]
mov ebx, 0x6d3044df
sub ebx, 0x615321bf
add dword [ebp - 4], 0x2fc7d73d
mov edi, dword [edx]
add dword [ebp - 4], 0x2f629d82
xor edi, ebx
xor dword [ebp - 4], ebx
cld
invalid
invalid
dec dword [ecx - 0x37a7ec2]
invalid
invalid
invalid
fst qword [edx + edi*2 + 0x4c6815f]
add byte [eax], al
add byte [ecx + 0x4c2], al
add dl, ah
invalid
add eax, 0x11ef7
xor ebx, ebx
add ebx, eax
add eax, 0x15e3388c
add eax, 0xea1cc779
mov ecx, 0x90796a1e
add ecx, 0x950695e2
add ecx, dword [ebp - 8]
call ebx
leave
ret