joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017d0
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x100018e1
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10001697
cmp dword [eax + 0xc], ebx
je 0x1000173a
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.100010f2
wait
cwde
invalid
call fcn.100010f2
pop ecx
mov edx, ss
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x100017a6
add eax, esi
cmp dword [eax], ebx
je 0x100017a6
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x100017a1
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000178b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10001793
cmp edx, ebx
jne 0x100018e1
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001762
add eax, dword [eax + 4]
jmp 0x1000174f
mov dword [ebp + 0xc], ebx
jmp 0x100017b1
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100017c9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100017e7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10001845
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000182c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10001835
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000183f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10001821
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100017ab
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10001892
dec eax
je 0x10001889
sub eax, 3
je 0x10001880
mov dword [ebp - 4], 0x40
jmp 0x100018af
mov dword [ebp - 4], 4
jmp 0x10001895
mov dword [ebp - 4], 0x20
jmp 0x10001895
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100018e1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10001861
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100010f2
pop edi
push ebx
cmp dl, bh
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x100018ed
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
Function at 0x100042a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10018018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov ecx, 0x20a
lea eax, [ebp - 0x41c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x100042c1
mov ecx, 0x20a
lea eax, [ebp - 0x210]
mov byte [eax], 0
inc eax
dec ecx
jne 0x100042d3
push str.PnPData
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionPrintPrinters
lea eax, [ebp - 0x41c]
push str._s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x420]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x41c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000439d
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x424]
push edx
push 0
push str.DeviceInstanceId
push eax
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x428], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004390
lea ecx, [ebp - 0x210]
push ecx
push esi
push str.CheckLocalPrinter:__s__DeviceInstanceId___s_
push 0x40000
call fcn.10004a80
add esp, 0x10
push ebx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10004390
mov edi, 1
mov eax, dword [ebp - 0x420]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.10007480
mov esp, ebp
pop ebp
ret

Function at 0x100066f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareBrotherBrUtilities
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1000674e
mov edx, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push esi
push str.BrLogAPI
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100067b0
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi + 4], 0
jne 0x10006872
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
je 0x1000686f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenA
push eax
call edi
mov ecx, dword [esi + 4]
push str.CloseA
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 4]
push str.TraceWriteA
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
push str.DumpWriteA
push eax
call edi
mov ecx, dword [esi + 4]
push str.OpenW
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 4]
push str.CloseW
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
push str.TraceWriteW
push eax
call edi
mov ecx, dword [esi + 4]
push str.DumpWriteW
push ecx
mov dword [esi + 0x20], eax
call edi
cmp dword [esi + 8], 0
mov dword [esi + 0x24], eax
pop edi
je 0x1000686f
cmp dword [esi + 0xc], 0
je 0x1000686f
cmp dword [esi + 0x10], 0
je 0x1000686f
cmp dword [esi + 0x14], 0
je 0x1000686f
cmp dword [esi + 0x18], 0
je 0x1000686f
cmp dword [esi + 0x1c], 0
je 0x1000686f
cmp dword [esi + 0x20], 0
je 0x1000686f
test eax, eax
jne 0x10006872
xor eax, eax
ret
mov eax, 1
ret

Function at 0x10006910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10018018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
je 0x100069cd
cmp dword [ecx + 4], eax
setne al
test eax, eax
jne 0x100069cd
mov ecx, 0x208
lea eax, [ebp - 0x20c]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x10006950
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.100066f0
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov esi, eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
test esi, esi
jne 0x1000698e
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100069be
mov ecx, 0x208
lea eax, [ebp - 0x20c]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x100069a0
push edi
push str.BrLogAPI.dll
mov eax, 0x104
lea edi, [ebp - 0x20c]
call fcn.100059a0
pop edi
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x20c]
call fcn.100067b0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10007480
mov esp, ebp
pop ebp
ret

Function at 0x10007480
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10018018]
jne 0x1000748a
repz ret
jmp fcn.100083ea
Function at 0x1000f77e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10018018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10009528
and dword [ebp - 0x14], 0
cmp dword [0x10019d9c], 0
mov dword [ebp - 0x18], eax
jne 0x1000f831
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000f8d9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000f8d9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10019d9c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10019da0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10019da4], eax
call edi
push eax
call esi
mov dword [0x10019dac], eax
test eax, eax
je 0x1000f831
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10019da8], eax
mov eax, dword [0x10019da8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000f88a
cmp dword [0x10019dac], ecx
je 0x1000f88a
push eax
call esi
push dword [0x10019dac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000f88a
test ebx, ebx
je 0x1000f88a
call edi
test eax, eax
je 0x1000f881
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000f881
test byte [ebp - 8], 1
jne 0x1000f88a
or dword [ebp + 0x10], 0x200000
jmp 0x1000f8bd
mov eax, dword [0x10019da0]
cmp eax, dword [ebp - 0x18]
je 0x1000f8bd
push eax
call esi
test eax, eax
je 0x1000f8bd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000f8bd
mov eax, dword [0x10019da4]
cmp eax, dword [ebp - 0x18]
je 0x1000f8bd
push eax
call esi
test eax, eax
je 0x1000f8bd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10019d9c]
call esi
test eax, eax
je 0x1000f8d9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000f8db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007480
leave
ret
Function at 0x40164e
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x2d39aec]
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2d39a44]
test esi, esi
je 0x401694
push ebx
xor ebx, ebx
cmp eax, 0x959
jne 0x40167f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.004014f2
add edi, 8
dec esi
je 0x401693
mov eax, dword [0x2d39aec]
jmp 0x401667
pop ebx
pop edi
pop esi
ret 4
Function at 0x40d069
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a36c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404ed5
mov dword [ebp - 0x14], eax
cmp dword [0x4401a0], esi
jne 0x40d15c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d0e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d23c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d23c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d23c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4401a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4401a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4401a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4401b0], eax
test eax, eax
je 0x40d159
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4401ac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d181
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d174
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d196
push 4
pop eax
jmp 0x40d23e
cmp dword [ebp - 0x14], esi
je 0x40d196
push dword [0x4401a0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d17b
mov eax, dword [0x4401ac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d1f4
cmp dword [0x4401b0], edi
je 0x40d1f4
push eax
call ebx
push dword [0x4401b0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d1f4
test eax, eax
je 0x40d1f4
call ecx
test eax, eax
je 0x40d1e9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d1e9
test byte [ebp - 8], 1
jne 0x40d1f4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d224
mov eax, dword [0x4401a4]
cmp eax, edi
je 0x40d221
push eax
call ebx
test eax, eax
je 0x40d221
call eax
mov esi, eax
test esi, esi
je 0x40d221
mov eax, dword [0x4401a8]
cmp eax, edi
je 0x40d221
push eax
call ebx
test eax, eax
je 0x40d221
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4401a0]
call ebx
test eax, eax
je 0x40d23c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d23e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040415b
mov esp, ebp
pop ebp
ret
Function at 0x46645d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x467445
adc dl, dl
pushfd
lea esp, [esp + 4]
jb 0x43f980
pushal
pushfd
jmp 0x43dc77
sets dh
mov dh, 0
mov byte [esp + 4], ch
mov byte [esp + 4], dh
mov word [esp + 8], 0xa254
pushfd
lea esp, [esp + 0x48]
je 0x468560
lea eax, [eax + 0x775b0833]
pushfd
lea eax, [ebx + edx*4]
mov byte [esp], bl
lea esp, [esp + 4]
call fcn.00466e30
call fcn.00468227
movsx ax, dl
seta al
lea ecx, [ecx*2 + 0xb]
push dword [esp + 4]
seto al
bswap ax
mov eax, dword [ebp - 0x20]
mov word [esp], si
pushfd
push 0x7fb9f092
not eax
mov byte [esp], bh
mov byte [esp + 0xc], 0xae
mov al, byte [eax + edi]
mov byte [esp + 8], ah
jmp 0x462f97
stosb byte es:[edi], al
call fcn.00466770
jmp 0x4680aa
setb dh
lea eax, [ebx*8 + 0x2f84ced3]
movsx ax, dl
lea eax, [ebx + edx*4 + 0x400]
mov word [esp + 4], dx
pushfd
jmp 0x46831c
xor dh, dl
stc
clc
stc
test dh, 1
pushal
setge dh
jmp 0x4400ba
lea esp, [esp + 0x4c]
call fcn.00466e30
jmp 0x43e5e1

Function at 0x466760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x47c44401
bt edx, 0xb
cmp al, byte [edi]
jmp 0x4675fb
setno ah
movsx ax, al
movzx ax, bl
lea edi, [edi + 1]
pop eax
push 0x629bd480
mov eax, dword [esp + 0x50]
jmp 0x43b87a

Function at 0x468390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
cmp al, byte [edi]
pushfd
lea edi, [edi + 1]
lahf
lahf
bswap ax
mov eax, dword [esp + 0x50]
mov byte [esp], 0x18
lea esp, [esp + 0x54]
ja 0x43dc81
call fcn.0043f58b

Function at 0x46857e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc al
cmp ebx, 0xe937d8cb
cmp al, byte [edi]
bswap ax
bswap ax
cwde
lea edi, [edi + 1]
sets ah
mov eax, dword [esp + 0x18]
pushfd
pushal
jmp 0x462f9d

Function at 0x5b8ba1
Capabilities:
Encode data using xor

Disassembly:
sbb esi, edx
and eax, 0x7a5e2caf
sub eax, 0x93a32d0a
mov bh, 0x77
scasd eax, dword es:[edi]
sub al, 0x5e
jp 0x5b8bd6
or ch, byte [0x77b793a3]
je 0x5b8bfc
xor eax, 0x6cd3137b
sal dword [ebp - 0x2a5a8ea7], 1
lahf
fild dword [ecx]
jae 0x5b8ba4
in eax, 0x6d
insd dword es:[edi], dx
int 0xf9
movsb byte es:[edi], byte [esi]
push es
mov eax, dword [0x42f678a]
in al, dx
test eax, 0xbd20359
cwde
invalid
or ebx, dword [eax - 0x19310371]
pop edi
cld
into
out 0x5f, al
mov edx, 0x334fb384
push 0x887a92d0
aam 0x9d
lahf
pop ss
test al, 0x35
pop esp
adc eax, 0x410ba9ae
out 0xfb, al
pop eax
loopne 0x5b8bd3
rcl byte [esi - 0x4cca8e7f]
xchg ebp, eax
xchg edi, eax
or byte [edx + edi*4 - 0x2f5e88ae], ch
stc
pop esp
out 0x8d, eax
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x405660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40566f
pop dword [ebp - 0x4c]
mov eax, 0x88534d4c
add eax, 0x77ed0923
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x36fba
push 0
mov eax, 0x418a2dd
add eax, 0xfc283dfb
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3f16
mov esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x4c]
mov edx, 0xaa27f95
add dword [ebp - 0xc], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x28], edx
add ebx, edx
xor dword [ebp - 0x18], 0x3bd7dfc9
mov dword [esi], ebx
mov dword [ebp - 0x44], 0x144607be
add esi, 0x3e20cb06
sub esi, 0x3e20cb02
add edi, 0x937319a0
add edi, 0x6c8ce664
loop 0x4056bc
add eax, 0x1a795b7f
add eax, 0xe58793ac
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x409607
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f19
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x4096b8
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409769
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409769
push eax
call fcn.00405660
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412994], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x4096b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409710
cmp dword [0x4129a0], ebx
je 0x409710
push eax
call fcn.00405660
push dword [0x4129a0]
mov esi, eax
call fcn.00405660
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409710
test edi, edi
je 0x409710
call esi
test eax, eax
je 0x409707
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409707
test byte [ebp - 0xc], 1
jne 0x409710
or dword [ebp + 0x10], 0x200000
jmp 0x409749
mov eax, dword [0x412994]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409749
mov eax, dword [0x412998]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00405660
pop ecx
test eax, eax
je 0x409769
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40976b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40633c
pop dword [ebp - 0xc]
mov eax, 0x3fa5089b
add eax, 0xc09b5aa1
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x6baa4aae
sub dword [ebp - 0x1c], 0x1d580563
mov dword [ebp - 0x18], 0x34b7c18b
add dword [ebp - 0x18], 0xfd7b8aba
mov dword [ebp - 0x14], 0x8a97b78c
add dword [ebp - 0x14], 0xc1b48ca2
mov dword [ebp - 0x10], 0x7222860e
sub dword [ebp - 0x10], 0x7222860e
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x612022d2
add dword [ebp - 0x1c], 0x13524684
mov dword [ebp - 0x18], 0x95036c79
add dword [ebp - 0x18], 0xac68f4fc
mov dword [ebp - 0x14], 0xd6da42d0
sub dword [ebp - 0x14], 0x736ad664
mov dword [ebp - 0x10], 0x3d1e7921
sub dword [ebp - 0x10], 0x3d1e7921
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x84224808
sub eax, 0x83e1d708
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37c09
push 0
call eax
mov ecx, 0xed28d70c
sub ecx, 0xed288a83
mov esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0xc]
mov ebx, 0xfe88c1a
add ebx, 0xd3bc7a33
sub dword [ebp - 4], 0x42ad6d2a
mov edx, dword [edi]
sub dword [ebp - 8], 0x15ffebda
xor edx, ebx
sub dword [ebp - 8], 0x2596c683
mov dword [esi], edx
xor dword [ebp - 4], edx
add esi, 0xe82f8954
sub esi, 0xe82f8950
add edi, 4
loop 0x406453
add eax, 0x124f7
xor ebx, ebx
add ebx, eax
add eax, 0x48f5a691
add eax, 0xb70a5974
mov ecx, 0x2f3a9f64
sub ecx, 0x2efa9f64
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040632d
jmp 0x406676

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx