joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4057aa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edi, edi
push dword [0x413d64]
call fcn.004058d6
pop ecx
test eax, eax
je 0x4057c2
pop ecx
jmp eax
push 2
call fcn.00409fa7
pop ecx
pop ebp
jmp fcn.00405682

Function at 0x405df8
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, dword [edi*8 + 0x412190]
je 0x405e1e
inc edi
cmp edi, 0x17
mov dword [ebp - 4], edi
jb 0x405e0c
cmp edi, 0x17
jae 0x405f9e
push 3
call fcn.0040b2ef
pop ecx
cmp eax, 1
je 0x405f6c
push 3
call fcn.0040b2ef
test eax, eax
pop ecx
jne 0x405e51
cmp dword [0x412004], 1
je 0x405f6c
cmp ebx, 0xfc
je 0x405f9e
mov ebx, 0x314
push str.Runtime_Error__n_nProgram:
mov edi, 0x413d78
push ebx
push edi
call fcn.0040b287
add esp, 0xc
test eax, eax
je 0x405e87
push esi
push esi
push esi
push esi
push esi
call fcn.00405682
sub esp, 0xffffffec
push 0x104
mov esi, 0x413d91
push esi
push 0
mov byte [0x413e95], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405ecb
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040b287
add esp, 0xc
test eax, eax
je 0x405ecb
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00405682
add esp, 0x14
push esi
call fcn.0040ad00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405f10
push esi
call fcn.0040ad00
add esi, 0xffffffc5
push 3
mov ecx, 0x41408c
add eax, esi
push 0x40f8c4
sub ecx, eax
push ecx
push eax
call fcn.0040b1d2
add esp, 0x14
test eax, eax
je 0x405f10
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00405682
add esp, 0x14
jmp 0x405f12
xor esi, esi
push 0x40f8c0
push ebx
push edi
call fcn.0040b15e
sub esp, 0xfffffff4
test eax, eax
je 0x405f32
push esi
push esi
push esi
push esi
push esi
call fcn.00405682
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x412194]
push ebx
push edi
call fcn.0040b15e
sub esp, 0xfffffff4
or eax, eax
je 0x405f57
push esi
push esi
push esi
push esi
push esi
call fcn.00405682
sub esp, 0xffffffec
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
call fcn.0040aff5
add esp, 0xc
jmp 0x405f9e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, esi
je 0x405f9e
cmp ebx, 0xffffffff
je 0x405f9e
push 0
lea eax, [ebp - 8]
push eax
lea esi, [edi*8 + 0x412194]
push dword [esi]
call fcn.0040ad00
pop ecx
push eax
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406340
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
mov eax, 0x5a4d
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp word [edx], ax
je 0x406356
pop ebp
xor eax, eax
ret
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x406352
mov eax, 0x10b
xor edx, edx
cmp word [ecx + 0x18], ax
pop ebp
sete dl
mov eax, edx
ret
Function at 0x406380
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov edi, edi
mov edx, esp
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
push ebx
push esi
movzx esi, word [ecx + 6]
xor ebp, ebp
push edi
or esi, esi
jbe 0x4063bd
mov edi, dword [edx + 0xc]
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x4063b5
mov ebx, dword [eax + 8]
add ebx, edx
cmp edi, ebx
jb 0x4063bf
inc ebp
sub eax, 0xffffffd8
cmp ebp, esi
jb 0x4063a5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407e9f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x407ecc
call fcn.00405812
push edi
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
call fcn.004057aa
sub esp, 0xffffffec
jmp 0x407fc3
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x407fc3
test al, 0x40
jne 0x407fc3
test al, 2
je 0x407eee
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x407fc3
or eax, 1
test eax, 0x10c
mov dword [esi + 0xc], eax
jne 0x407f04
push esi
call fcn.0040a14d
pop ecx
jmp 0x407f09
mov eax, dword [esi + 8]
mov dword [esi], eax
push dword [esi + 0x18]
push dword [esi + 8]
push esi
call fcn.00408689
pop ecx
push eax
call fcn.0040858c
mov dword [esi + 4], eax
add esp, 0xc
cmp eax, edi
je 0x407fb3
cmp eax, 0xffffffff
je 0x407fb3
test byte [esi + 0xc], 0x82
jne 0x407f88
push esi
call fcn.00408689
cmp eax, 0xffffffff
pop ecx
je 0x407f73
push esi
call fcn.00408689
cmp eax, 0xfffffffe
pop ecx
je 0x407f73
push esi
call fcn.00408689
push esi
sar eax, 5
lea edi, [eax*4 + 0x414820]
call fcn.00408689
and eax, 0x1f
pop ecx
pop ecx
shl eax, 6
add eax, dword [edi]
jmp 0x407f78
mov eax, 0x4127a0
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x407f88
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x407fa6
mov eax, dword [esi + 0xc]
test al, 8
je 0x407fa6
test eax, 0x400
jne 0x407fa6
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x407fc6
neg eax
sbb eax, eax
and eax, 0x10
sub eax, 0xfffffff0
or dword [esi + 0xc], eax
mov dword [esi + 4], edi
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
Function at 0x409dda
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov eax, dword [0x414328]
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor edi, edi
cmp eax, ebx
jne 0x409e26
call esi
mov edi, eax
cmp edi, ebx
je 0x409e0c
mov dword [0x414328], 1
jmp 0x409e2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x409e21
push 2
pop eax
mov dword [0x414328], eax
jmp 0x409e26
mov eax, dword [0x414328]
cmp eax, 1
jne 0x409eb0
cmp edi, ebx
jne 0x409e42
call esi
mov edi, eax
cmp edi, ebx
jne 0x409e42
xor eax, eax
jmp 0x409f0c
mov eax, edi
cmp word [edi], bx
je 0x409e57
inc eax
inc eax
cmp word [eax], bx
jne 0x409e49
inc eax
inc eax
cmp word [eax], bx
jne 0x409e49
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub eax, edi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x409ea5
push eax
call fcn.0040ac02
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x409ea5
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
or eax, eax
jne 0x409ea2
push dword [ebp - 4]
call fcn.00403a12
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x409f0c
cmp eax, 2
je 0x409eb9
cmp eax, ebx
jne 0x409e3b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x409e3b
cmp byte [edi], bl
je 0x409ed7
inc eax
cmp byte [eax], bl
jne 0x409ecd
inc eax
cmp byte [eax], bl
jne 0x409ecd
sub eax, edi
inc eax
push eax
mov dword [ebp - 8], eax
call fcn.0040ac02
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x409ef6
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x409e3b
push dword [ebp - 8]
push edi
push esi
call fcn.004090e0
sub esp, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aff5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov ebx, ebx
add esp, 0xffffffec
push esi
push edi
push ebx
call fcn.004058cd
mov esi, eax
and dword [ebp - 4], 0
cmp dword [0x414374], 0
jne 0x40b0a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
or ebx, ebx
je 0x40b157
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push ebx
call edi
test eax, eax
je 0x40b157
push eax
call fcn.0040585b
mov dword [esp], str.GetActiveWindow
push ebx
mov dword [0x414374], eax
call edi
push eax
call fcn.0040585b
mov dword [esp], str.GetLastActivePopup
push ebx
mov dword [0x414378], eax
call edi
push eax
call fcn.0040585b
mov dword [esp], str.GetUserObjectInformationA
push ebx
mov dword [0x41437c], eax
call edi
push eax
call fcn.0040585b
or eax, eax
pop ecx
mov dword [0x414384], eax
je 0x40b0a6
push str.GetProcessWindowStation
push ebx
call edi
push eax
call fcn.0040585b
pop ecx
mov dword [0x414380], eax
mov eax, dword [0x414380]
cmp eax, esi
je 0x40b0fe
cmp dword [0x414384], esi
je 0x40b0fe
push eax
call fcn.004058d6
push dword [0x414384]
mov edi, eax
call fcn.004058d6
mov ebx, eax
or edi, edi
pop ecx
pop ecx
je 0x40b0fe
test ebx, ebx
je 0x40b0fe
call edi
test eax, eax
je 0x40b0f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call ebx
or eax, eax
je 0x40b0f5
test byte [ebp - 0xc], 1
jne 0x40b0fe
or dword [ebp + 0x10], 0x200000
jmp 0x40b137
mov eax, dword [0x414378]
cmp eax, esi
je 0x40b137
push eax
call fcn.004058d6
test eax, eax
pop ecx
je 0x40b137
call eax
or eax, eax
mov dword [ebp - 4], eax
je 0x40b137
mov eax, dword [0x41437c]
cmp eax, esi
je 0x40b137
push eax
call fcn.004058d6
pop ecx
test eax, eax
je 0x40b137
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x414374]
call fcn.004058d6
pop ecx
test eax, eax
je 0x40b157
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b159
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40e14c
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor esi, esi
push edi
push 1
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.00409faf
mov dword [ebp - 0x18], eax
and eax, edx
sub esp, 0xfffffff0
mov dword [ebp - 0x14], edx
cmp eax, 0xffffffff
je 0x40e1d4
push 2
push esi
push esi
push dword [ebp + 8]
call fcn.00409faf
mov ecx, eax
and ecx, edx
sub esp, 0xfffffff0
cmp ecx, 0xffffffff
je 0x40e1d4
mov edi, dword [ebp + 0xc]
sub edi, eax
mov ebx, dword [ebp + 0x10]
sbb ebx, edx
js 0x40e269
jg 0x40e1ad
cmp edi, esi
jbe 0x40e269
mov esi, 0x1000
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40e1e0
call fcn.00405812
mov dword [eax], 0xc
call fcn.00405812
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.0040e302
pop ecx
pop ecx
mov dword [ebp - 8], eax
test ebx, ebx
jl 0x40e200
jg 0x40e1fc
cmp edi, esi
jb 0x40e200
mov eax, esi
jmp 0x40e202
mov eax, edi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00408738
sub esp, 0xfffffff4
cmp eax, 0xffffffff
je 0x40e24c
cdq
sub edi, eax
sbb ebx, edx
js 0x40e223
jg 0x40e1f2
test edi, edi
ja 0x40e1f2
mov edi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040e302
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x40e2d2
call fcn.00405825
cmp dword [eax], 5
jne 0x40e261
call fcn.00405812
mov dword [eax], 0xd
or edi, 0xffffffff
mov dword [ebp - 0xc], edi
jmp 0x40e226
cmp ebx, esi
jg 0x40e2de
jl 0x40e273
cmp edi, esi
jae 0x40e2de
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409faf
and eax, edx
sub esp, 0xfffffff0
cmp eax, 0xffffffff
je 0x40e1d4
push dword [ebp + 8]
call fcn.0040c8e6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
and eax, edx
cmp eax, 0xffffffff
jne 0x40e2de
call fcn.00405812
mov dword [eax], 0xd
call fcn.00405825
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov edi, dword [ebp - 0x10]
and edi, dword [ebp - 0xc]
cmp edi, 0xffffffff
je 0x40e1d4
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00409faf
and eax, edx
sub esp, 0xfffffff0
cmp eax, 0xffffffff
je 0x40e1d4
xor eax, eax
jmp 0x40e1db

Function at 0x40e593
Capabilities:
Get geographical location

Disassembly:
push ebp
mov eax, dword [0x412008]
mov edi, edi
mov ebp, esp
add esp, 0xfffffff4
xor eax, ebp
mov dword [ebp - 4], eax
push 6
lea eax, [ebp - 0xc]
push eax
push 0x1004
push dword [ebp + 8]
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
or eax, eax
jne 0x40e5c6
or eax, 0xffffffff
jmp 0x40e5d0
lea eax, [ebp - 0xc]
push eax
call fcn.0040e790
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004033e4
leave
ret
Function at 0x401aae
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetServicesKMSServerServiceParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, 0x4091d8
test eax, eax
jne 0x401bb4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
push 0x409158
push ebx
push ebx
push str.Windows
push dword [esp + 0x28]
mov edi, 0x80
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x409058
push ebx
push ebx
push str.Office2010
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x4090d8
push ebx
push ebx
push str.Office2013
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
push ebx
push str.Port
push dword [esp + 0x28]
mov dword [esp + 0x28], 0xc
call esi
push 4
pop edi
lea eax, [esp + 0x10]
push eax
push 0x4091e8
push ebx
push ebx
push str.ActivatedMachines
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x4091e4
push ebx
push ebx
push str.ActivationInterval
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
lea eax, [esp + 0x10]
push eax
push 0x4091ec
push ebx
push ebx
push str.RenewalInterval
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call esi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.CRTDLL.dll__wtoi
pop ecx
cmp eax, 1
jb 0x401bc7
cmp eax, 0xffff
jbe 0x401bd5
mov esi, str.1688
mov edi, 0x4091d8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x4091e8]
push 0x32
pop ecx
cmp eax, 0x19
jb 0x401be6
cmp eax, ecx
jbe 0x401bec
mov dword [0x4091e8], ecx
mov eax, dword [0x4091e4]
mov ecx, 0xa8c0
cmp eax, 0xf
jb 0x401bff
cmp eax, ecx
jbe 0x401c09
mov dword [0x4091e4], 0x78
mov eax, dword [0x4091ec]
cmp eax, 0xf
jb 0x401c17
cmp eax, ecx
jbe 0x401c21
mov dword [0x4091ec], 0x2760
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x409030
mov dword [esp + 0x20], 0x401996
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409e0c
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00403520
mov eax, dword [ebp - 0x18]
call fcn.00403520
mov eax, dword [ebp - 0x1c]
call fcn.00403520
xor eax, eax
push ebp
push 0x409f10
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00403530
push eax
mov eax, dword [ebp - 0x18]
call fcn.00403530
mov edx, eax
mov eax, dword [0x40c650]
pop ecx
call fcn.00409d94
pop ecx
test al, al
je 0x409ef5
mov eax, dword [ebp - 0x1c]
call fcn.004048ec
test al, al
je 0x409e86
mov eax, dword [ebp - 0x1c]
call fcn.00403530
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
push ebp
push 0x409eda
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.00403530
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409ee4
mov eax, dword [ebp - 0x10]
call fcn.00404520
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f17
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403140
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x40d283
Capabilities:
Check for software breakpoints

Disassembly:
adc ecx, esi
pop eax
xlatb
fst dword [edx - 0x6dfbe2f0]
add al, 0x92
pop ecx
push esp
cmp eax, 0x91338aae
xor ecx, dword [0x545f56fc]
aas
int3
mov ah, 0x2a
cwde
mov ebx, 0x13f93f74
sub byte [0x73e4f994], 0x5d
xchg ecx, eax
cmp dword [ecx + 0x2e], ecx
and byte [esi - 0xb], cl
shr dword [ecx - 0x10c23b20], 1
lcall 0xab58, 0xdde11d77
cdq
rcr byte [edi + 0x6d3faac4], 0x22
insb byte es:[edi], dx
xor ebp, edi
sub eax, 0x3737e092
or byte [esp + edx*2], bh
push esp
jle 0x40d26f
je 0x40d301
int1
pop ds
loope 0x40d267
clc
mov dh, 0xb4
inc edx
add bl, byte [edi + ecx*8 + 0x529715cc]
insb byte es:[edi], dx
out dx, eax
test byte [edi - 0x29], bl
add edi, ebp
push 0xffffffffffffff8f
mov gs, word [edx + edx]
push esi
xlatb
lodsb al, byte ss:[esi]
int3
cmp dword [edx], 0xdb97dfff
daa
jbe 0x40d29a
fist dword [esi + 0x4ae70536]
push ss
push esi
mov edx, 0x9656d380
pop edx
cmp al, 0xcc
xchg ebx, eax
pop edi
loop 0x40d2b9
inc edi
test dl, ch
fcmovnu st(0), st(4)
mov esp, dword [ecx]
cdq
cwde
daa
or bl, bh
adc edx, dword [edx + 0x3b]
or al, byte [edx - 0x6ddc47f]
xchg ebp, eax
retf

Function at 0x40f183
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x8fe771ee
inc esp
shl dword [esi + 0x53], 1
outsb dx, byte [esi]
xchg ebx, eax
pushal
bound ebp, qword [esi]
mov dl, 8
les esp, [ebx - 0x64]
pop ebp
adc eax, 0xad89dd50
xchg edx, eax
out dx, al
push eax
xor dword [eax - 0x28cdff55], edi
invalid
Function at 0x420733
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
out dx, eax
cmpsd dword [esi], dword es:[edi]
jbe 0x42079c
xchg byte [ecx - 0x2aa8d46c], al
adc eax, 0xc7a9ee4e
pop ds
jp 0x420796
not ecx
push es
fstp st(3)
xor dword [ecx], ebp
cdq
xchg ecx, eax
imul esp, dword [eax + 0x31f54e9a], 0xffffffa7
cli
fld qword [ecx + 0x74f901f]
or edx, dword [ecx + 0x1866917]
or esp, dword [ecx + 0x4f]
mov cl, 0x40
nop
xchg edx, eax
xor al, 0xf3
add ecx, dword [edi]
xlatb
cli
aas
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
stc
movsb byte es:[edi], byte [esi]
and esi, eax
add al, bh
xor dword [esi - 0x405f1503], edi
hlt
scasb al, byte es:[edi]
out dx, al
and al, 0x99
add al, 0x2d
mov al, byte [0x886ba821]
loope 0x4207fa
test al, 0x6b
mov cl, ah
pop ecx
or byte [edi - 0x6f], 0xec
cmp esi, dword [ebp + 0x7e]
inc edi
push es
sub byte [esp + ebp*4 + 0x25], bh
jae 0x4207c9
xor al, byte [eax - 0x1c29650f]
xor edi, dword [edi + 0x11a268f]
cmpsd dword [esi], dword es:[edi]
sub edi, dword [eax + 0x7ec500b3]
xchg ecx, eax
jg 0x42082d
mov al, dl
or bl, byte [esi + 0x6f4a4205]
daa
sahf
add eax, 0x276f4a42
mov dl, 0x50
inc edx
popal
jecxz 0x420794
iretd
pushfd
invalid
loopne 0x420811
mov bl, 0xec
test byte [ebp + 0x41], ah
push ss
insb byte es:[edi], dx
pop ebx
pop ds
fistp qword [ebx]
jp 0x42082f
daa
add ebx, ecx
jo 0x420864
mov dh, 0x4c
mov esp, 0x4938ded7
movsd dword es:[edi], dword [esi]
int1
adc byte [ecx], al
mov dh, 0x47
invalid
push ebx
add dword [edx - 0x49], eax
int1
mov bh, 0xf1
xor dword [esi + esi*8 - 0x50fd2239], esp
jb 0x42087e
mov cl, 0xa9
xchg edi, eax
aaa
loope 0x4207f3
and edx, dword [esi + 0x41d26ca8]
pushal
div dword [ebp + 2]
arpl di, bp
cwde
outsd dx, dword [esi]
popal
pop edi
fnstenv [edx - 0x1372205d]
in eax, 0x73
adc al, 0x92
cmp dword [ebp - 0x5442dbd7], edi
mov dword [0x56c109d1], eax
jl 0x4208c7
xor dh, al
jb 0x42082a
sub byte [ecx], al
pushal
and byte [edx], ch
and dword [edx - 0x3e], ebp
push 0xffffffffffffffc2
ret 0xe1bc
mov esp, 0x345f57e1
in eax, 0x56
aas
xchg edi, eax
sbb dh, dh
mov esp, 0x4c83f077
pop es
pop esi
mov al, byte [0xf583b60b]
ja 0x420870
or dword [edi + eax + 0x5e], 0xffffffa0
or esi, dword [esi + 0x1f06f583]
mov dh, 0x83
cmc
push es
pop ds
and edx, dword [edi + 0x39ba0020]
sub byte [edi - 0x3d], bl
imul esp, dword [esi], 0x47
mov ecx, 0x49060031
loop 0x420871
mov ah, 0x47
push eax
ja 0x420886
sbb esi, dword [edx]
inc ebp
or edi, ecx
adc dword [edi + 0x60414222], edx
push ss
test edx, esp
jmp [ecx]
bnd jne 0x4208e4
pop ss
add dword [ebx - 0x37], 0x655b431
iretd
out 0xe6, eax
add al, 0x22
jno 0x31882186
daa
mov edx, 0xde5f1dc4
lodsd eax, dword [esi]
xor edi, esi
lock xor byte [edx - 0x2b], 0xf9
stosb byte es:[edi], al
pushal
fist word [ebp + 0x60374c9f]
xlatb
or dword [ebp - 0x30], ebx
jb 0x42091a
mov esi, 0xf9d13e15
xor al, 0xc5
invalid
sbb ebp, dword [edi + 0x311110d6]
invalid

Function at 0x420dc3
Capabilities:
Encode data using xor

Disassembly:
fcomp dword [edi - 0x77ba477]
call 0xb3512364
invalid
Function at 0x496483
Capabilities:
Encode data using xor

Disassembly:
imul byte cs:[esi - 0x76141373]
xor dword [ecx - 0x62], edi
fucomi st(5)
salc
loop 0x4964ee
pop es
mov ecx, 0x8dc4e56c
wait
fdivr dword [edi]
outsd dx, dword [esi]
hlt
invalid