joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404430
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x78
push esi
push edi
call fcn.00404d30
call fcn.00401890
push 0
call dword [sym.imp.msvcrt.dll__time64]
push eax
call dword [sym.imp.msvcrt.dll_srand]
mov esi, dword [esp + 0x90]
mov edi, dword [esp + 0x8c]
push esi
push edi
call fcn.00403a80
push esi
push edi
call fcn.00401010
mov eax, dword [esi]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4044a9
mov ecx, dword [esi]
push 0x44fc0c
push 0x44fb00
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x40449e
cmp eax, 0x104
jbe 0x4044c8
pop edi
mov eax, 0x3c
pop esi
add esp, 0x78
ret
mov edx, dword [sym.imp.msvcrt.dll__pgmptr]
mov byte [0x44fc03], 0
mov eax, dword [edx]
push eax
push 0x104
push 0x44fb00
call fcn.00407bb0
push 0x40f430
push 0x44fb00
lea ecx, [esp + 0x48]
call fcn.00407000
lea ecx, [esp + 0x40]
call fcn.00406930
lea ecx, [esp + 0x40]
test al, al
jne 0x4044fc
call fcn.00406910
pop edi
mov eax, 0x42
pop esi
add esp, 0x78
ret
push ebx
push 0x44fc10
push 0x104
mov dword [0x44fc04], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call fcn.00404e30
call fcn.00401f40
push esi
push edi
call fcn.00403ca0
mov esi, dword [0x44f9f0]
push esi
call fcn.00401d40
add esp, 0xc
mov edi, 1
mov ebx, eax
lea ebx, [ebx]
cmp ebx, 0x63
jne 0x404551
push 0
call fcn.004064c0
add esp, 4
jmp 0x404538
mov edx, dword [0x44f9e0]
test edx, edx
je 0x40459e
mov eax, dword [0x44f9e4]
test eax, eax
jne 0x40459e
mov ecx, dword [0x433ac8]
push ecx
push esi
call fcn.00404660
add esp, 8
test eax, eax
jne 0x404593
push eax
push edi
push eax
push esi
call fcn.00401b20
add esp, 0x10
test eax, eax
jne 0x404593
mov dword [0x44f9e4], edi
lea ebx, [eax + 0x63]
jmp 0x404540
push 0xffffffffffffffff
push esi
call fcn.00404bc0
add esp, 8
mov edi, dword [0x44f9e8]
mov edx, dword [0x433b50]
push edx
call fcn.004019a0
add esp, 4
cmp edi, 0xffffffff
je 0x4045c4
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00401860
push esi
call fcn.00403ef0
mov eax, dword [0x44f9ec]
add esp, 4
test eax, eax
je 0x40462f
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
push 0xfffffffffffffff6
call esi
push 0xfffffffffffffff5
mov edi, eax
call esi
mov esi, dword [0x4339c8]
mov ecx, esi
mov dword [esp + 0x10], 0
lea ebp, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x404600
push 0
lea edx, [esp + 0x14]
push edx
sub ecx, ebp
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 0
lea eax, [esp + 0x14]
push eax
push 0x31
lea ecx, [esp + 0x20]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
pop ebp
push 0x44f7c8
call fcn.00401da0
push 0x44f7c8
call fcn.00404b30
add esp, 8
lea ecx, [esp + 0x44]
call fcn.00406910
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x78
ret
Function at 0x404996
Capabilities:
Terminate process

Disassembly:
call fcn.0040e190
jmp 0x40da97
push 0x58
push 0x42f748
call fcn.0040e064
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x450458
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x40daf7
cmp eax, esi
jne 0x40daea
xor esi, esi
inc esi
mov ebx, esi
jmp 0x40dafa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40dad1
xor esi, esi
inc esi
mov eax, dword [0x450454]
cmp eax, esi
jne 0x40db0d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x40db3c
mov eax, dword [0x450454]
test eax, eax
jne 0x40db36
mov dword [0x450454], esi
push 0x40f400
push 0x40f3f0
call fcn.00404fc6
pop ecx
pop ecx
test eax, eax
je 0x40db3c
jmp 0x40dc64
mov dword [0x450118], esi
mov eax, dword [0x450454]
cmp eax, esi
jne 0x40db60
push 0x40f3ec
push 0x40f24c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x450454], 2
test ebx, ebx
jne 0x40db6c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x45045c], 0
je 0x40db90
push 0x45045c
call fcn.0040dec4
pop ecx
test eax, eax
je 0x40db90
push 0
push 2
push 0
call dword [0x45045c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40dbec
test al, al
je 0x40dbaa
cmp dword [ebp - 0x1c], 0
jne 0x40dbec
mov al, byte [esi]
test al, al
je 0x40dbba
cmp al, 0x20
ja 0x40dbba
inc esi
mov dword [ebp - 0x20], esi
jmp 0x40dbaa
test byte [ebp - 0x3c], 1
je 0x40dbc6
movzx eax, word [ebp - 0x38]
jmp 0x40dbc9
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x450114], eax
cmp dword [0x450108], 0
jne 0x40dc40
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x40dbfb
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x40dc0e
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x40db97
cmp dword [0x450118], 0
jne 0x40dc4f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x450114]
jmp 0x40dc70
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0040e0a9
ret
Function at 0x404b30
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x20
mov ecx, 0x1e
lea eax, [esp]
jmp 0x404b40
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x404b40
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404b56
sub eax, edx
mov edi, eax
lea ebx, [edi + 2]
push ebx
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
push ebx
mov esi, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [esi + edi], 0
mov byte [esi + edi + 1], 0
lea ecx, [esp + 0x10]
mov eax, 0x414
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 3
mov word [esp + 0x24], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x404d30
Capabilities:
Terminate process

Disassembly:
call fcn.004070d0
mov eax, dword [0x433d60]
push eax
call dword [0x44fd54]
push eax
call fcn.00405ab0
mov ecx, dword [0x433d58]
push 0
push 0
push 0
push 0x400
push 0x6801
push 0x80
push 0x8004
push 1
push ecx
push 0x64
push str.gsj8mPhKZR_rIyuaos.bKQ00_hT_I1Jllh2lK8Y_Noz_rfRcmk96ryV__q_SAJyRV_fC_o_At__16EM_F4_6_.b_
call fcn.0040bd80
add esp, 0x30
test al, al
jne 0x404d8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x40
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x404e30
Capabilities:
Create directory
Get common file path
Get file attributes
Set current directory
Terminate process

Disassembly:
sub esp, 0x120
push ebx
push ebp
push esi
push edi
mov ecx, 0x105
lea eax, [esp + 0x28]
xor ebx, ebx
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x404e45
lea eax, [esp + 0x28]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebp, dword [sym.imp.msvcrt.dll_rand]
mov edi, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 3
cmp edi, 0x104
jae 0x404e7d
mov byte [esp + edi + 0x28], bl
xor esi, esi
cmp esi, 0xe
jge 0x404ea1
call ebp
xor edx, edx
div dword [0x43398c]
mov ecx, dword [0x433988]
inc esi
cmp esi, 0xe
mov dl, byte [edx + ecx]
mov byte [esp + esi + 0x17], dl
jl 0x404e84
mov byte [esp + 0x25], bl
mov eax, 0x105
lea ecx, [esp + 0x28]
mov edi, edi
cmp byte [ecx], bl
je 0x404ebc
inc ecx
sub eax, 1
jne 0x404eb0
jmp 0x404f02
cmp eax, ebx
je 0x404f02
mov edx, 0x105
sub edx, eax
mov ecx, 0x105
sub ecx, edx
lea eax, [esp + edx + 0x28]
je 0x404efb
lea edi, [esp + 0x18]
lea esi, [ecx + edx + 0x7ffffefa]
sub edi, eax
cmp esi, ebx
je 0x404ef7
mov dl, byte [edi + eax]
cmp dl, bl
je 0x404ef7
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x404ee1
jmp 0x404efb
cmp ecx, ebx
jne 0x404efc
dec eax
mov edi, dword [esp + 0x14]
mov byte [eax], bl
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x404f21
push ebx
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x404f35
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x39
mov dword [esp + 0x10], eax
jl 0x404e71
jmp 0x404f49
lea edx, [esp + 0x28]
push edx
push 0x104
push 0x44f7c8
call fcn.00407bb0
push 0x44f7c8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x404f64
push 0x3b
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add esp, 0x120
ret
Function at 0x4067e0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40680b
cmp dword [esp + 0x1c], 2
jne 0x40680b
cmp dword [esp + 0x10], 6
jae 0x406822
call fcn.00406760
mov ecx, dword [esp + 0xa4]
mov dword [ecx], eax
xor eax, eax
add esp, 0xa0
ret
push esi
lea edx, [esp + 4]
push edx
push 8
mov esi, 0x80004005
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x42f648]
test eax, eax
je 0x4068a1
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push eax
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x14
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [0x42f644]
test eax, eax
je 0x406896
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
mov ecx, dword [esp + 0xa8]
test ecx, ecx
je 0x406896
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0xa0
ret

Function at 0x406940
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 7
push SHDefExtractIconA
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x406971
mov eax, 0xffffffc9
pop esi
ret 4
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x406993
mov eax, 0xffffffca
pop esi
ret 4
push edi
push 0
push 0
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4069b1
lea eax, [edi - 0x35]
pop edi
pop esi
ret 4
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4069cc
pop edi
mov eax, 0xffffffcc
pop esi
ret 4
add eax, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x4074c0
Capabilities:
Read file via mapping
Set environment variable

Disassembly:
sub esp, 0x40
push 0
push 0x10
push 0
push 0x8000040
lea eax, [esp + 0x10]
push eax
push 0xffffffffffffffff
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x44fd4c], eax
test eax, eax
je 0x40759b
push esi
push edi
push 0x10
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0
push esi
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xffffffff
call edi
push eax
call edi
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [esi], 0xffffffff
je 0x40757c
mov ecx, dword [0x44fd4c]
push ecx
push 0x40f440
lea edx, [esp + 0x1c]
push 0x32
push edx
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x10
test eax, eax
jle 0x40757c
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
mov eax, esi
pop esi
add esp, 0x40
ret
mov edx, dword [0x44fd4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x44fd4c], 0
xor eax, eax
pop esi
add esp, 0x40
ret
xor eax, eax
add esp, 0x40
ret

Function at 0x4075b0
Capabilities:
Query environment variable
Read file via mapping

Disassembly:
sub esp, 0x34
push 0x32
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x4075ee
lea edx, [esp]
push edx
call dword [sym.imp.msvcrt.dll_atoi]
add esp, 4
mov dword [0x44fd4c], eax
test eax, eax
je 0x4075ee
push 0x10
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add esp, 0x34
ret
xor eax, eax
add esp, 0x34
ret
Function at 0x407af0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x18]
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [0x44fc04]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.00406e40
test al, al
jne 0x407b26
xor eax, eax
add esp, 0xc
ret
push esi
push edi
mov edi, dword [esp + 0x18]
push 0
push 0x80
push 1
push 0
push 7
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407b81
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
push edx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407b7a
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 8]
je 0x407b89
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
add esp, 0xc
ret

Function at 0x408570
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, 0x5e6ea9af
mul ebp
shr edx, 0xb
imul edx, edx, 0x15b0
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ebx, ebp
movzx ecx, di
shr edi, 0x10
sub ebx, edx
test esi, esi
jne 0x4085a6
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
ret
test ebp, ebp
je 0x408696
mov edi, edi
xor edx, edx
cmp ebx, 7
jbe 0x40860c
lea eax, [edx + 7]
lea ebx, [ebx]
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
add eax, 8
add edi, ecx
add edx, 8
add esi, 8
cmp eax, ebx
jb 0x4085c0
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov eax, ebx
sub eax, edx
cmp eax, 2
jl 0x40864b
mov eax, ebx
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
lea edx, [edx + eax*2]
lea esp, [esp]
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add dword [esp + 0x18], ecx
add ecx, ebp
add dword [esp + 0x14], ecx
add esi, 2
sub eax, 1
jne 0x408630
cmp edx, ebx
jae 0x408657
movzx edx, byte [esi]
add ecx, edx
add edi, ecx
inc esi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add eax, edx
add edi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
sub dword [esp + 0x1c], ebx
mov ebx, 0x15b0
jne 0x4085b0
mov eax, edi
pop edi
pop esi
shl eax, 0x10
pop ebp
add eax, ecx
pop ebx
ret
Function at 0x1000c638
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000c677
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000c677
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000c677
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000c677
cmp dword [ecx + 0x74], 0xe
jbe 0x1000c677
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000ea80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000eaad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000eaad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10011974
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10011a11
push ebx
push esi
call fcn.10011a14
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001187a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100119be
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011a10
push edi
push eax
call fcn.10011e00
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100119de
call fcn.10010230
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10011a0f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001187a
add esp, 0x20
test eax, eax
jne 0x100119fd
push edi
call fcn.10010230
jmp 0x10011a05
push ebx
call fcn.10010230
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48a004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x48bcdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48bcdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48bce0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48bce4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x48bcec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x48bce8], eax
mov eax, dword [0x48bce8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x48bcec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x48bcec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x48bce0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x48bce4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48bcdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x485c20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x485c41
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x485c96
push esi
jmp 0x485c50
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.00485c10
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x485c50
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x485cb1
mov dword [0x2b89ef8], 0xa62e7790
mov dword [0x2b89efc], 0xffffffff
add esp, 8
ret
Function at 0x1347800
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x1347813
mov esi, 1
mov edx, 0x134eab8
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x134eae0
jl 0x1347850
mov eax, 1
mov byte [0x134c8b8], 0x63
mov byte [0x134da1b], 0
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x134c8b8], bl
mov byte [ebx + 0x134d9b8], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x1347890
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x134c8b8]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x134c9b8], ecx
rol ecx, 8
mov dword [esi*4 + 0x134cdb8], ecx
rol ecx, 8
mov dword [esi*4 + 0x134d1b8], ecx
rol ecx, 8
mov dword [esi*4 + 0x134d5b8], ecx
movzx ecx, byte [esi + 0x134d9b8]
test ecx, ecx
je 0x13479bf
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x13479c8
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x134dab8], eax
rol eax, 8
mov dword [esi*4 + 0x134deb8], eax
rol eax, 8
mov dword [esi*4 + 0x134e2b8], eax
rol eax, 8
mov dword [esi*4 + 0x134e6b8], eax
inc esi
cmp esi, 0x100
jl 0x1347905
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret