joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102794b0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x103030c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
call fcn.10278b20
mov edx, eax
add esp, 8
test edx, edx
je 0x10279511
mov ecx, dword [ebp - 0xd8]
sub edx, esi
mov dword [ebx], ecx
mov eax, 0x13
mov ecx, dword [ebp - 0xd4]
pop edi
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1028a262
mov esp, ebp
pop ebp
ret
push 0x102b6c00
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x10279542
movzx edi, byte [eax]
or edi, 0x20
cmp edi, 0x6e
jne 0x10279544
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1028a262
mov esp, ebp
pop ebp
ret
xor edi, edi
push edi
lea eax, [ebp - 0xe4]
push eax
push esi
call fcn.10278a90
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x102795fe
push 0x2e
push esi
call sub.VCRUNTIME140.dll_strchr
mov edx, esi
mov dword [ebp - 0xd4], eax
add esp, 8
lea ecx, [edx + 1]
mov dword [ebp - 0xdc], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10279580
sub edx, dword [ebp - 0xdc]
cmp edx, 0xc8
ja 0x1027952f
test eax, eax
je 0x1027952f
lea edx, [ebp - 0xd0]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x102795a3
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
mov ecx, dword [ebp - 0xd4]
sub ecx, esi
push edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + ecx - 0xd0], al
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.10278a90
mov edx, eax
add esp, 0xc
test edx, edx
je 0x1027952f
mov eax, esi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add edx, eax
test edx, edx
je 0x1027952f
movsd xmm0, qword [ebp - 0xe4]
sub edx, esi
mov ecx, dword [ebp - 4]
mov eax, 3
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop esi
pop ebx
call fcn.1028a262
mov esp, ebp
pop ebp
ret
Function at 0x10279740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0xc], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
mov cl, byte [esi]
movzx eax, cl
test byte [eax + 0x102b77f9], 8
je 0x10279791
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x102b77f9], 8
jne 0x10279781
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x102797a2
mov dword [ebp - 0x14], 1
jmp 0x102797ab
cmp cl, 0x2b
mov dword [ebp - 0x14], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x102798e7
mov al, byte [edx + 1]
cmp al, 0x78
je 0x102797c3
cmp al, 0x58
jne 0x102798e7
movsd xmm2, qword [0x102b6038]
add edx, 2
xor esi, esi
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0x1c], edx
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x18]
jne 0x102797ec
test esi, esi
jne 0x10279842
mov esi, 1
inc edx
jmp 0x102797d0
movzx eax, al
test byte [eax + 0x102b77f9], 0x10
je 0x10279842
mov eax, dword [ebp - 8]
test eax, eax
jne 0x1027980a
cmp byte [ebp - 1], 0x30
jne 0x1027980a
inc dword [ebp - 0xc]
jmp 0x1027983a
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x1e
jg 0x10279839
test byte [ecx + 0x102b77f9], 2
je 0x10279821
add ecx, 0xffffffd0
jmp 0x10279827
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1027983a
inc edi
test esi, esi
je 0x1027983f
dec edi
inc edx
jmp 0x102797d0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
je 0x102798e7
mov eax, dword [ebp - 0x10]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x10279860
cmp al, 0x50
jne 0x102798c2
inc edx
xor ecx, ecx
mov dl, byte [edx]
cmp dl, 0x2d
jne 0x10279872
lea esi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x1027987d
xor eax, eax
xor esi, esi
cmp dl, 0x2b
sete al
inc eax
mov edx, dword [ebp - 0x1c]
add edx, eax
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x102b77f9], 2
je 0x102798e7
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x102b77f9], 2
jne 0x10279893
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x102798cf
xorps xmm1, xmmword [0x102e7310]
push edi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
fldz
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1027ba20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x103030c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], edi
mov cl, byte [edi + 6]
test cl, cl
je 0x1027bb2f
add edi, 0x10
nop dword [eax]
test byte [edi + 8], 0x40
je case.0x1027ba87.10
mov edx, dword [edi]
mov al, byte [edx + 5]
test al, 3
je case.0x1027ba87.10
and al, 0xfc
mov byte [edx + 5], al
movzx eax, byte [edx + 4]
sub eax, 4
cmp eax, 0x22
ja case.0x1027ba87.10
nop dword [eax]
movzx eax, byte [eax + 0x1027bb68]
jmp dword [eax*4 + 0x1027bb48]
mov eax, dword [edx + 8]
test eax, eax
je 0x1027baa5
test byte [eax + 5], 3
je 0x1027baa5
push eax
push esi
call fcn.1027af90
add esp, 8
mov eax, dword [edx + 0xc]
or byte [edx + 5], 4
add eax, 0x18
add dword [esi + 0x10], eax
test byte [edx + 6], 0x40
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
je case.0x1027ba87.10
mov al, byte [ecx + 5]
test al, 3
je case.0x1027ba87.10
and al, 0xfc
mov edx, ecx
mov byte [ecx + 5], al
movzx eax, byte [ecx + 4]
sub eax, 4
cmp eax, 0x22
jbe 0x1027ba80
jmp case.0x1027ba87.10
movzx eax, byte [edx + 7]
or byte [edx + 5], 4
add eax, 0x11
add dword [esi + 0x10], eax
jmp case.0x1027ba87.10
mov eax, dword [edx + 0xc]
or byte [edx + 5], 4
add eax, 0x11
add dword [esi + 0x10], eax
jmp case.0x1027ba87.10
mov eax, dword [esi + 0x4c]
mov dword [edx + 8], eax
jmp 0x1027bb17
mov eax, dword [esi + 0x4c]
mov dword [edx + 0x1c], eax
jmp 0x1027bb17
mov eax, dword [esi + 0x4c]
mov dword [edx + 0x28], eax
jmp 0x1027bb17
mov eax, dword [esi + 0x4c]
mov dword [edx + 0x4c], eax
mov dword [esi + 0x4c], edx
mov eax, dword [ebp - 0x18]
inc ebx
add edi, 0x10
mov cl, byte [eax + 6]
movzx eax, cl
cmp ebx, eax
jl 0x1027ba50
movzx eax, cl
mov ecx, dword [ebp - 4]
inc eax
pop edi
pop esi
xor ecx, ebp
shl eax, 4
pop ebx
call fcn.1028a262
mov esp, ebp
pop ebp
ret

Function at 0x1027c1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
xor eax, dword [ebp + 0x10]
push edi
mov edi, esi
shr edi, 5
inc edi
cmp esi, edi
jb 0x1027c20c
push ebx
mov ebx, dword [ebp + 8]
nop dword [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x1027c1f0
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1027c210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx + 6], 0
mov edx, dword [ebx + 8]
jne 0x1027c255
push esi
mov esi, dword [ebx + 0xc]
xor edx, esi
push edi
mov edi, esi
shr edi, 5
inc edi
cmp esi, edi
jb 0x1027c24c
movzx ecx, byte [ebx + esi + 0xf]
mov eax, edx
shl eax, 5
sub esi, edi
add ecx, eax
mov eax, edx
shr eax, 2
add ecx, eax
xor edx, ecx
cmp esi, edi
jae 0x1027c231
pop edi
mov dword [ebx + 8], edx
mov byte [ebx + 6], 1
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x1028959a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x102895c1
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x102895c4
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10289576
pop esi
leave
ret 8

Function at 0x420060
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x420082
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420089
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420078
mov eax, 1
add ebx, ebx
jne 0x42009b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x420090
jne 0x4200ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420090
xor ecx, ecx
sub eax, 3
jb 0x4200c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x420132
mov ebp, eax
add ebx, ebx
jne 0x4200cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4200d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4200fc
inc ecx
add ebx, ebx
jne 0x4200e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4200dd
jne 0x4200f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4200dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42011c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42010d
jmp 0x42007e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42011c
add edi, ecx
jmp 0x42007e
pop esi
mov edi, esi
mov ecx, 0xc60
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42013a
cmp byte [edi], 2
jne 0x42013a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42013f
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x4201b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2477c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x247f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42016c
mov ecx, edi
jns 0x42019b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x247f8]
or eax, eax
je 0x4201b1
mov dword [ebx], eax
add ebx, 4
jmp 0x420189
call dword [esi + 0x247fc]
popal
jmp 0x4124bf
Function at 0x4011a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
push ebx
push esi
xor esi, esi
push edi
push esi
push 0x8000080
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
jne 0x4011e3
or esi, eax
jmp 0x401304
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0xa0]
push 0x40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4012e7
mov eax, dword [ebp - 0x64]
push esi
add eax, 4
push esi
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
call edi
cmp eax, 0xffffffff
jne 0x40121e
push 0xfffffffffffffffd
jmp 0x4012e9
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x20]
push 0x14
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4012e7
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x180]
push 0xe0
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4012e7
cmp word [ebp - 0x1e], si
mov dword [ebp - 8], esi
jbe 0x40128c
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x60]
push 0x28
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4012e7
movzx eax, word [ebp - 0x1e]
add ebx, dword [ebp - 0x50]
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x401265
push 1
push esi
push esi
push dword [ebp + 8]
call edi
add ebx, eax
xor edx, edx
mov eax, ebx
div dword [ebp - 0x15c]
test edx, edx
je 0x4012b9
mov eax, ebx
xor edx, edx
div dword [ebp - 0x15c]
inc eax
imul eax, dword [ebp - 0x15c]
mov ebx, eax
mov eax, dword [ebp + 0xc]
push esi
push esi
push ebx
push dword [ebp + 8]
mov dword [eax], ebx
call edi
cmp eax, 0xffffffff
je 0x401217
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x38]
push 0x18
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4012ec
push 0xfffffffffffffffe
pop esi
jmp 0x4012fb
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 0xc]
lea eax, [eax + ebx + 0x18]
mov dword [ecx], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401988
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push dword [esp + 0x14]
push esi
push 1
push edi
call fcn.00401d01
add esp, 0x10
cmp eax, esi
jae 0x4019ab
push 0xfffffffffffffffc
pop eax
jmp 0x4019dd
dec esi
js 0x4019db
lea eax, [esi + 1]
mov ecx, dword [0x409e74]
movzx esi, byte [edi]
mov edx, ecx
and edx, 0xff
xor edx, esi
shr ecx, 8
movzx edx, word [edx*2 + 0x409e80]
xor edx, ecx
inc edi
dec eax
mov dword [0x409e74], edx
jne 0x4019b1
xor eax, eax
pop edi
pop esi
ret
Function at 0x403b41
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x407108
cmp edx, dword [eax]
je 0x403b63
add eax, 8
inc ecx
cmp eax, 0x407198
jl 0x403b54
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x407108]
jne 0x403c91
mov eax, dword [0x409cc4]
cmp eax, 1
je 0x403c6b
test eax, eax
jne 0x403b94
cmp dword [0x407054], 1
je 0x403c6b
cmp edx, 0xfc
je 0x403c91
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403bcb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404f90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405080
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403c0e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405080
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4063c0
push edi
call fcn.00405190
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404f90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404fa0
lea eax, [ebp - 0xa0]
push 0x4063a0
push eax
call fcn.00404fa0
push dword [esi + 0x40710c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404fa0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004050fb
add esp, 0x2c
pop edi
jmp 0x403c91
lea eax, [ebp + 8]
lea esi, [esi + 0x40710c]
push 0
push eax
push dword [esi]
call fcn.00405080
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x811004]
jne 0x401010
repz ret
jmp fcn.00401562

Function at 0x409246
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405eb4
and dword [ebp - 4], 0
cmp dword [0x813ac0], 0
mov ebx, eax
jne 0x4092f7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093a8
push eax
call fcn.00405e42
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x813ac0], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x813ac4], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x813ac8], eax
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x813ad0], eax
test eax, eax
je 0x4092f7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x813acc], eax
mov eax, dword [0x813acc]
cmp eax, ebx
je 0x40934f
cmp dword [0x813ad0], ebx
je 0x40934f
push eax
call fcn.00405ebd
push dword [0x813ad0]
mov esi, eax
call fcn.00405ebd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40934f
test edi, edi
je 0x40934f
call esi
test eax, eax
je 0x409346
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409346
test byte [ebp - 0xc], 1
jne 0x40934f
or dword [ebp + 0x10], 0x200000
jmp 0x409388
mov eax, dword [0x813ac4]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409388
mov eax, dword [0x813ac8]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x813ac0]
call fcn.00405ebd
pop ecx
test eax, eax
je 0x4093a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b8e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
push esi
cmp ebx, 0x19f
jne 0x40b8f6
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor esi, esi
cmp ebx, ebp
jle 0x40b931
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
call fcn.0040b8d0
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0x64
mov dword [esp + 8], eax
sub dword [esp + 8], 0x64
mov cl, byte [esp + 8]
xor byte [esi + edi], cl
inc esi
cmp esi, ebx
jl 0x40b900
pop esi
pop ebp
cmp ebx, 0x2d
jne 0x40b94c
mov dword [0x2ecc508], 0xa62e7790
mov dword [0x2ecc50c], 0xffffffff
add esp, 8
ret
Function at 0x406234
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
and dword [0x407b20], 0xffffffac
sbb dword [0x407e1c], 0x20941f1c
sub edi, 0x26297893
push edx
pop dword [0x407c55]
test dword [0x407c15], 0x6795becb
je 0x40628d
or dword [0x407d02], 0x659d8c86
setbe byte [0x407ec1]
push dword [0x407a30]
pop dword [0x407d43]
neg dword [ebp + 0x14]
movzx edi, byte [ebp + 0x18]
inc word [0x407bdd]
setno byte [0x407a41]
sub esi, eax
imul edi, eax
btr edi, 7
call fcn.004164f8
and dword [0x407d28], eax
sbb bx, 0xa5e5
xor edx, dword [0x407a79]
movsx edx, byte [0x407a14]
mul edx
add esi, eax
xor esi, dword [0x407bbb]
je 0x40636a
dec dword [0x407c68]
mov dword [ebp + 0x18], 0x2348aed
test dword [ebp + 0x10], ebx
je 0x40636a
neg dword [ebp + 8]
shr esi, 0x1c
imul eax, edx
call fcn.004142a0
seto dh
shl word [0x407b81], 1
sub dword [0x407cfd], eax
setge byte [0x407b8a]
and eax, 0xffffffab
or dword [ebp + 8], 0x736bc57
push dword [0x407b7d]
pop dword [0x407dba]
mov dword [ebp + 0x10], edx
mov edi, 0x1a
or dword [0x407b75], 0x68143c5c
mov esi, 0x3720cc54
btc edx, eax
imul ebx, dword [ebp + 0x14]
or si, 0x36ce
sub dword [0x407cb6], 0xffffff8c
sub ecx, 2
adc dword [edi*4 + 0x407acd], 0x36
inc dword [ebp + 0x14]
sbb esi, eax
mov esi, dword [edi*4 + 0x407a92]
adc eax, edx
setge byte [ebp + 0x18]
sub ecx, edx
dec edi
jns 0x406323
imul eax, dword [0x407c7d], 0x2c2a2080
popal
pop ebp
ret

Function at 0x40653f
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
shld ecx, eax, 2
mov ebx, 0xc
push dword [ebx + 0x407aca]
push dword [ebx + 0x407d2b]
push edx
call fcn.00406f7b
add esp, 0xc
rcr ecx, 0xb
sub dword [0x407a6e], eax
movsx esi, dx
inc edx
add dh, dl
movzx edx, dx
sub byte [0x407e3d], 0x79
imul eax, dword [ebx + 0x407c09]
add dword [0x407c23], 0x7101d5c9
movzx edi, word [ebp - 0xc]
imul eax
test dx, ax
je 0x4065d3
seto byte [ebp - 0xc]
rcl esi, 1
neg dword [ebx*4 + 0x407b4f]
mov dword [ebx*4 + 0x407c85], 0x70f729db
mov edx, eax
mov edx, dword [0x407d84]
or cx, word [ebx*2 + 0x407c5d]
ror cx, 1
not eax
add dword [ebx*4 + 0x407b52], 0x30
and edi, edx
xor dh, 0x5f
shld edi, edx, 8
dec dword [ebx*4 + 0x407cd6]
sbb esi, dword [ebx*4 + 0x407d9d]
xor dword [ebx*4 + 0x407d7b], eax
call fcn.00415ad5
popal
mov esp, ebp
pop ebp
ret

Function at 0x406f0d
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov cx, dx
mov ebx, 0x7365a6f0
and byte [0x407afe], 0x23
je 0x406f4a
add esi, 0xffffff80
shrd edx, eax, 0x1c
xor dword [0x407d81], 0xffffffe1
or esi, 4
shrd edi, eax, 0
add eax, edx
neg word [0x407df0]
neg byte [0x407da1]
sub dword [0x407e91], 0x7b
mov byte [0x407cae], dl
add dword [0x407d61], 0x3cc82d7d
xor ecx, dword [0x407c6f]
push dword [0x407c9a]
push dword [0x407ada]
xor esi, 0x72
call fcn.00416204
add esp, 8
rcr ebx, 1
popal
ret
Function at 0x411baf
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
sub edx, 0x3b
or ecx, edx
shrd dword [ebp + 0xc], eax, 0xa
mov ebx, dword [ebp + 8]
bt edi, 0x1f
sub dl, byte [0x407955]
xor bh, 0xe7
cmc
call fcn.004064d2
cmp ecx, dword [ebp + 0xc]
ja 0x411c76
xor edi, 3
imul ax, dx, 0xe844
and byte [0x407c07], 0x22
je 0x411c76
inc dword [ebp + 8]
sub dword [0x407d23], eax
mov edi, 0x434e65d9
add dword [0x407abe], 0x60
mov dword [0x407adb], edx
movsx ecx, word [0x407b33]
sar dword [0x407e70], 1
mov edx, 0x37cec913
push dword [0x407b20]
pop dword [0x407b12]
call fcn.004067e9
mov byte [ebp + 0x10], 0xda
shrd ecx, eax, 2
imul esi, eax, 0x19994f47
movzx edx, ax
not edx
or word [ebp + 0x10], 0x9568
jne 0x411c76
add dword [ebp - 4], 0x178b1bd2
adc dword [0x407bd0], 0x17
inc ebx
inc edx
add dword [0x407d25], eax
sar ah, 0
dec esi
add edi, dword [0x407956]
and ebx, edx
mov byte [0x407ea0], 0x2a
movzx esi, dx
popal
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4142f3
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov esi, dword [0x407c9b]
push 0x7faf77e8
pop dword [0x407e4e]
sbb dx, ax
push dword [0x407ec5]
pop dword [ebp + 0x18]
mov ecx, 0x1c
mov edi, 0x407b78
mov esi, 0x407b82
repe cmpsb byte [esi], byte es:[edi]
jne 0x414334
sub edx, 0x3264c0f
and dl, al
or edi, edx
and edx, 0x597572cb
call fcn.004064d2
mov ax, dx
btr ecx, edx
sub eax, 0x38
sub esi, 0xffffffc8
and dword [0x407e15], edx
jne 0x4143f1
imul eax, dword [0x407b91]
sbb ebx, 0xffffffa2
mov dh, dl
adc dword [0x407d21], edx
mov esi, dword [0x407cf4]
mov edi, 0x12
mov si, ax
adc byte [0x407df4], 0xd8
shld esi, edx, 0xa
test word [edi*2 + 0x407d84], ax
je 0x4143f1
adc dword [edi*4 + 0x407d83], 0x639b6c86
add ebx, dword [0x407a88]
mov al, dl
inc ecx
mov ecx, dword [0x407c5e]
setl byte [edi + 0x407e84]
adc dword [0x407c0b], 0x2dd0f23c
xor byte [0x407a36], 0xf4
jne 0x4143f1
mov ebx, 0x51e52677
shr dword [edi*4 + 0x407e6c], 1
call fcn.00406680
neg edx
mov bl, dl
call fcn.0041019a
or ecx, eax
setne al
mov dword [ebp + 8], 0x73a7a00f
xor dword [ebp + 8], 0x91245a3
mov bx, 0xec7f
imul ebx, eax
popal
mov esp, ebp
pop ebp
ret 0x20