joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410123
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410149
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x410149
xor al, al
jmp 0x41015d
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x413385
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x4133bb
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x4133ae
cmp esi, ecx
jae 0x41349e
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x413434
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x4282f8]
xor ecx, eax
or ecx, edx
jmp 0x413484
cmp edi, 6
jbe 0x413484
cmp edx, 4
jne 0x413484
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4133cd
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x413fca
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x41fc0a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f8ac

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10
Function at 0x46463b
Capabilities:
Encode data using xor

Disassembly:
pushal
inc edx
push eax
add al, dl
mov ch, 0xb8
lahf
pop ebx
cmp byte [ecx], 0xb2
mov fs, esp
sbb al, 0x93
imul esi, dword [ecx], 0x1a
cmp eax, 0xa45eb1a4
loopne 0x464643
invalid

Function at 0x46d910
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
xchg byte [eax + 0x77], dh
or byte [esi], bh
cmp al, 0x41
invalid

Function at 0x4b472a
Capabilities:
Encode data using xor

Disassembly:
sub eax, dword [edi + 0x450be95b]
iretd
aas
and al, 0x4b
das
cmp ebx, dword [edi - 0x62]
add ebp, dword [ebx + ecx + 0x4224a7b9]
mov al, 0x89
inc eax
invalid
mov ds, word [ebx - 0x4c015c11]
mov byte [0x27032b6f], al
wait
jae 0x4b46f4
pop es
xchg bh, dl
jae 0x4b46e7
add eax, 0x193d7730
test dword [ebp + ebx*4 + 0x1b], edi
fidiv word [esi]
mov byte [ecx], ch
jbe 0x4b4750
xchg edi, eax
mov byte [ebp + 0x15], ah
mov esp, 0x1efc6577
adc eax, 0xfc6577bc
push ds
invalid
Function at 0x55e9bd
Capabilities:
Encode data using xor

Disassembly:
fst qword [ebp - 0x672dc3d2]
retf
out 0x8d, eax
pop ds
or ah, byte [esi + 2]
sbb eax, 0x5623af6f
jecxz 0x55e994
or al, 0xcb
push 0x45
mov ch, 0xf3
lahf
lahf
sti
mov edi, 0x7c85252b
pop eax
xor al, cl
inc edi
mov bl, 0xfc
xor edi, ebp
dec edx
sar byte [ebx - 0x240f4e49], 1
and dword [esi + 0x3b], esp
wait
inc ecx
jno 0x55e9cf
in al, dx
aas
sbb byte [ebx + esi*8 - 0x46], 0x35
inc eax
mov edx, 0x54100902
cmp byte [edx - 0x15], 0x3f
or eax, 0xef95de85
mov ebx, 0xac1b03fa
sbb byte [esi + 0x7f], dl
add al, 0x89
xchg esp, eax

Function at 0x585e78
Capabilities:
Encode data using xor

Disassembly:
fst dword [esi + 0x41e9a53a]
mov bl, 0x62
leave
ret
sub dword [edi + 0x63d56351], ebx
pushal
mov al, byte [0x5365c095]
jp 0x585e7d
arpl word [eax - 0x60], sp
xchg ebp, eax
shl byte [ebp + 0x53], 0x7a
div dword [esi + 0x44007660]
mov dh, 0x60
jbe 0x585e8a
inc esp
inc edx
jno 0x585e3c
and byte [esi - 0x20], ah
nop
enter 0x7ecc, 0xffffffffffffffcc
and byte [ebx + edi*8 - 0x507c9ea1], bh
movsb byte es:[edi], byte [esi]
sbb eax, 0x751473b6
rcr byte [ebp + 0x1d], 1
push esi
pop edx
xor edi, dword [edi - 0x25]
pop es
mov dl, 0x16
in al, 0x26
xchg esp, eax
in al, 0x84
sal dword [edi + ebp*8], 0x54
lds ebx, [ecx + 0xa]
xchg ebp, eax
mov al, 0x74
jne 0x585ea3
lodsb al, byte [esi]
jmp 0x585ee6
movsd dword es:[edi], dword [esi]
invalid

Function at 0x5934a0
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
xchg byte [eax + 0x16], al
inc eax
ficom dword [ecx]
lahf
daa
or edx, dword [esi]
and esi, edi
ror dword [ebx], 1
mov bh, 0x1b
push 0x7588d209
in eax, dx
mov dword [0xe9575411], eax
jne 0x5934ce
mov dword [ebx - 0x16], eax
jne 0x59349f
fsubr qword [esi]
add byte [0x7eb4f0e3], dh
add byte cs:[0x7eb4f0e3], dh
and eax, 0x9c101ac0
pushfd
and esi, eax
bound ecx, qword [edx - 0x80]
xor ch, dh
aaa
sar byte [edx + 0x73db2f98], 0xc0
outsb dx, byte [esi]
wait
fsub dword [edx + 0x7c6eae94]
salc
adc al, byte [0x754bfdfe]
cmp ebx, ebx
push 0x3a
cmp byte [esi], ch
mov byte [ebp*2 + 0x201ca0b5], dl
jb 0x5934c2
adc byte [edx + 0x42942878], al
mov dh, 0x55
xchg ecx, eax
jp 0x593534
add ah, cl
wait
sar bl, cl
test byte [esi - 0xfe35cd0], ah
rcl byte [0xfca4a0c7], cl
xchg esp, eax
mov esp, 0x2bac3745
invalid
xor al, 0xf0
jl 0x59358d
push esp
cmp dword [ecx*4 - 0x569db3ed], edi
mov dh, 0x9d
call 0xac78b1ec
dec edx
and dword ss:[esi - 0x1ae92b15], ebp
invalid
inc esp
mov bl, 0xa2
pop es
invalid

Function at 0x594c7f
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x2bb01854
or byte [ebp - 0x29fe7582], bh
push eax
sub esi, dword [ecx + 8]
popal
sbb eax, eax
lahf
cmc
sahf
in eax, dx
out 0x8b, al
push ebp
mov ebx, 0x7f7eeb3
out dx, al
test dword [edi], 0x16db4f23
out dx, al
test dword [edi], 0x16db4f23
lodsb al, byte [esi]
and dword [esi - 0x4dfd4b3], esp
add ebx, ebx
adc dword [esp + esi*8 - 0x459920ac], esi
xlatb
cmc
stc
test dword [ecx + 7], edx
clc
xor edx, dword [ebp - 0x48]
test dword [ecx + 0x37], esp
pop eax
xor ebp, dword [eax - 0x29]
push ecx
push eax
xchg edi, eax
sub dword [eax], ebx
jle 0x594c64
ja 0x594cc1
mov esi, 0x40d6125a
hlt
retf
Function at 0x5db3ca
Capabilities:
Encode data using xor

Disassembly:
mov dword [0xac509078], eax
je 0x5db3f4
cdq
sahf
fcom dword [eax + 0x7e]
les esi, [edx + 0x11fa7005]
mov byte [eax], al
fdiv dword [eax - 0x2697cd8b]
xor ch, byte [eax - 0x27]
push 0xffffffffffffff80
sbb byte [eax + edi], al
call dword [ebp + 0x41]
sbb byte [edi + 0x846d0ae], al
rol byte [esi + 8], 1
loopne 0x5db3d2
fstp st(0)
adc byte [esi - 0x2bd31790], dl
fcom dword [eax]
xchg esi, eax
jo 0x5db3e2
sub al, 0xd4
cmp al, 0x92
sar dword [eax - 0x6b], cl
jle 0x5db443
btc dword [esi], 0xd2
sub eax, edi
aas
cmp edx, esi
or cl, byte [edx - 0x36]
push cs
adc dword [ebp + 0x75], ebp
mov eax, 0xc92cccf0
xchg esi, eax
sbb esi, dword [edx + 0x45]
pushal
mov al, byte [0xa166fb56]
push esi
sti
mov ax, word [0x4efb47b4]
std
lodsd eax, dword [esi]
push eax
inc ebp
sbb al, 0xb0
movsd dword es:[edi], dword [esi]
jo 0x5db3f0
sbb cl, al
and edi, edx
add dword [ebx + 0x7d], esi
and al, 0xad
sub dword [ebx + 0x6b], ebx
cmp dl, byte [esi + 0x7c]
dec esi
xchg dword [eax + edi], edx
pushfd
pushfd
xchg di, ax
or al, 0x16
popal
mov edi, 0xf2fdc417
cdq
sbb eax, 0x4f5b169
add eax, 0x5da74c0
fst dword [0x40f60ee9]
push 0x4443208f
clc
xor al, 0x74
sub byte [edx - 0x6e8cbdea], bl
dec eax
sub cl, ah
xchg ebx, eax
in al, dx
mov al, 0xe3
add byte [eax + 0x6b], ch
clc
adc dword [ebp - 0x6dc73a4a], eax
test byte [eax + 0x4c], bl
pop edx
loope 0x5db451
xor al, 0x6e
and al, 0xa0
mov esi, 0x720c328c
enter 0xfffffffffffffc6a, 0x75
mov edx, 0xa17d2aaf
adc dword [bx + si], 0xffffffe4
insd dword es:[edi], dx
hlt
Function at 0x60a7ad
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax - 0x7d], dl
in al, dx
adc byte [ebx + 0x56], dl
push edi
mov eax, dword [0x590630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x10]
add esi, dword [eax + 0xc]
mov edx, dword [edi + 0x290]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0x470
xor ebx, ebx
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebx
call dword [0x540884]
mov eax, dword [esp + 0x30]
cmp esi, eax
jge 0x60a803
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, eax
jle 0x60a80d
mov esi, eax
call fcn.00623088
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x60a827
push 0x80004005
call fcn.006047c1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push ebx
mov eax, esi
cdq
push 0x7d8200
push edx
push eax
mov dword [esp + 0x38], ebx
call 0x71bbd1
mov dword [esp + 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [esp + 0x1c], edx
fild qword [esp + 0x18]
and eax, 0x80000000
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
fild qword [esp + 0x18]
sub esp, 8
lea ecx, [esp + 0x1c]
fchs
faddp st(1)
fld qword [0x56dfe8]
fmul st(1), st(0)
fmulp st(1)
fstp qword [esp]
push 0x56b964
push ecx
call fcn.006057b1
mov esi, dword [esp + 0x24]
add esp, 0x10
push esi
lea ecx, [edi + 0x21c]
call fcn.006205da
mov edx, dword [esp + 0x34]
lea eax, [esi - 0x10]
mov dword [edx], ebx
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x60a8d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8

Function at 0x63a89b
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebp - 0x61], dh
adc eax, 0x78c5023e
pop esi
cwde
scasb al, byte es:[edi]
je 0x63a8a7
dec dword [eax]
inc esi
invalid
or byte [esi - 2], al
and byte [ebx - 0x3c80bc3c], ah
xor edi, 0x8a7d8e26
xchg ecx, eax
cmp esp, dword [ebx - 0xa59a136]
stc
mov al, byte [ebx]
imul ecx, dword [0xc58b891d], 0xfb6e3c7b
pop esp
out dx, eax
push esp
fdivr st(3)
cmp ch, bh
push ds
sbb dword [eax], edi
xchg esi, eax
pop esi
xor dword [esi + 0xf50efb], esp
inc edi
out dx, eax
js 0x63a8cd
pushfd
cmp ebx, dword [edx + 0x4d]
push cs
xor cl, ch
test dword [esi - 0x6104224e], edi
nop
invalid
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3f225cce
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x579619d
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6f460005
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xfb4266a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x45c700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x435015
lea edi, [esi - 0x34015]
push edi
jmp 0x45c71a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c710
mov eax, 1
add ebx, ebx
jne 0x45c733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c744
jne 0x45c763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c763
dec eax
add ebx, ebx
jne 0x45c750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45c728
add ebx, ebx
jne 0x45c75f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45c7b5
xor ecx, ecx
sub eax, 3
jb 0x45c77b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c7ea
sar eax, 1
mov ebp, eax
jmp 0x45c786
add ebx, ebx
jne 0x45c786
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c754
inc ecx
add ebx, ebx
jne 0x45c794
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c754
add ebx, ebx
jne 0x45c7a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c796
jne 0x45c7b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c796
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c7d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c7c6
jmp 0x45c716
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c7d4
add edi, ecx
jmp 0x45c716
pop esi
mov edi, esi
mov ecx, 0x3b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c7f2
cmp byte [edi], 0x91
jne 0x45c7f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c7f7
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45c866
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c244]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c2cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c824
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c2d4]
or eax, eax
je 0x45c860
mov dword [ebx], eax
add ebx, 4
jmp 0x45c841
call dword [esi + 0x5c2d0]
mov ebp, dword [esi + 0x5c2d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c89a
sub esp, 0xffffff80
jmp 0x434380

Function at 0x430003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x407839
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4186c8]
jne 0x407843
repz ret
jmp fcn.00409a3a

Function at 0x40b01f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040793c
and dword [ebp - 4], 0
cmp dword [0x419e08], 0
mov ebx, eax
jne 0x40b0d0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b181
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b181
push eax
call fcn.004078ca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419e08], eax
call esi
push eax
call fcn.004078ca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419e0c], eax
call esi
push eax
call fcn.004078ca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419e10], eax
call esi
push eax
call fcn.004078ca
pop ecx
mov dword [0x419e18], eax
test eax, eax
je 0x40b0d0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004078ca
pop ecx
mov dword [0x419e14], eax
mov eax, dword [0x419e14]
cmp eax, ebx
je 0x40b128
cmp dword [0x419e18], ebx
je 0x40b128
push eax
call fcn.00407945
push dword [0x419e18]
mov esi, eax
call fcn.00407945
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b128
test edi, edi
je 0x40b128
call esi
test eax, eax
je 0x40b11f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b11f
test byte [ebp - 0xc], 1
jne 0x40b128
or dword [ebp + 0x10], 0x200000
jmp 0x40b161
mov eax, dword [0x419e0c]
cmp eax, ebx
je 0x40b161
push eax
call fcn.00407945
pop ecx
test eax, eax
je 0x40b161
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b161
mov eax, dword [0x419e10]
cmp eax, ebx
je 0x40b161
push eax
call fcn.00407945
pop ecx
test eax, eax
je 0x40b161
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419e08]
call fcn.00407945
pop ecx
test eax, eax
je 0x40b181
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b183
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c9e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x41804c], 0x1e87
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x40e4aa]
mov dh, byte [eax + 0x40e47b]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x40ca02
lea eax, [ebp - 0x24]
mov dword [0x41804c], 0x1579
mov dword [ebp - 0x34], eax
call fcn.0040ceb6
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.0040c8b8
mov ecx, dword [0x41804c]
add ecx, 0xffffe209
mov dword [0x41804c], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x40cb2a
mov eax, dword [ebp - 0x38]
mov dword [0x418050], 0x2144
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.0040d05a
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x418050], 0xfffff8da
mov dword [ecx + 0xd0], 0x4550
mov dword [0x41804c], 0xfffff0f0
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x14], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x58], ecx
mov esi, dword [0x41804c]
add esi, 0x1007
mov dword [0x41804c], esi
add ecx, 0x1493
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x40cb21
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret