joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42ab71
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4382c0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x4382c0]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
call fcn.00401aa0
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x40b8a2
push esi
mov ecx, ebx
call fcn.00401440
jmp 0x40ba5a
add ecx, 0xfffffff0
call fcn.00402410
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x248], 0
cmp dword [esi - 0xc], 0
jle 0x40b925
push 0x25
push esi
call fcn.004177f3
add esp, 8
test eax, eax
je 0x40b921
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x40b921
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.004101e0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 1
call fcn.00401440
mov byte [esp + 0x248], 0
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b91d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
jl 0x40b973
push 0x4336e8
push esi
call fcn.004178a1
mov edi, eax
add esp, 8
test edi, edi
je 0x40b973
sub edi, esi
sar edi, 1
cmp edi, 0xffffffff
je 0x40b973
cmp dword [esi - 0xc], 0
jl 0x40b9b7
push 0x4336e8
push esi
call fcn.004178a1
add esp, 8
test eax, eax
je 0x40b9b7
sub eax, esi
sar eax, 1
test eax, eax
jle 0x40b9b7
dec edi
js 0x40b9ad
cmp edi, dword [esi - 0xc]
jg 0x40b9ad
cmp word [esi + edi*2], 0x3a
je 0x40b9b7
lea ecx, [esp + 0x1c]
call fcn.00405d30
push dword [esp + 0x1c]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, dword [esp + 0x20]
je 0x40b9d6
cmp eax, dword [esp + 0x24]
jbe 0x40b9c9
mov al, byte [esp + 0x13]
mov byte [esp + 0x13], al
push 0x4352b4
lea eax, [esp + 0x17]
push eax
call fcn.00418fbb
push 0x80070057
call fcn.00401010
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00401440
mov esi, dword [esp + 0x14]
jmp 0x40ba35
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
call fcn.00405f80
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00406a40
mov edi, eax
push 1
push 0x4336e8
mov ecx, edi
mov byte [esp + 0x250], 2
call fcn.004025b0
push dword [esi - 0xc]
mov ecx, edi
push esi
call fcn.004025b0
push edi
mov ecx, ebx
call fcn.00401440
mov byte [esp + 0x248], 0
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ba35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x248], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ba5a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00416717
mov esp, ebp
pop ebp
ret 8
Function at 0x40c6b0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ad30
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4382c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
add ecx, 0x10
mov dword [ebp - 0x2c], ecx
lea eax, [ecx + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ecx + 0x30]
mov dword [ebp - 0x28], eax
lea eax, [ecx + 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x24], eax
call fcn.0040c240
mov dword [ebp - 4], 0
xor edi, edi
xor edx, edx
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebx]
cmp esi, dword [ebx + 4]
je 0x40c821
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi]
je 0x40c815
cmp esi, edx
jae 0x40c7a7
cmp edi, esi
ja 0x40c7a7
mov ebx, esi
sub ebx, edi
sar ebx, 2
cmp edx, eax
jne 0x40c799
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jae 0x40c799
sub edx, edi
sar edx, 2
mov ecx, 0x3fffffff
sub ecx, edx
cmp ecx, 1
jb 0x40c873
inc edx
sub eax, edi
sar eax, 2
mov dword [ebp - 0x14], edx
mov edx, eax
shr edx, 1
mov ecx, 0x3fffffff
sub ecx, edx
cmp ecx, eax
jae 0x40c77c
xor eax, eax
jmp 0x40c77e
add eax, edx
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jae 0x40c787
mov eax, ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.00402530
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
test edx, edx
je 0x40c7a2
mov ecx, dword [edi + ebx*4]
mov dword [edx], ecx
mov ebx, dword [ebp - 0x24]
jmp 0x40c80c
cmp edx, eax
jne 0x40c804
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jae 0x40c804
sub edx, edi
sar edx, 2
mov ecx, 0x3fffffff
sub ecx, edx
cmp ecx, 1
jb 0x40c873
sub eax, edi
sar eax, 2
lea ebx, [edx + 1]
mov edx, eax
shr edx, 1
mov ecx, 0x3fffffff
sub ecx, edx
cmp ecx, eax
jae 0x40c7e7
xor eax, eax
jmp 0x40c7e9
add eax, edx
cmp eax, ebx
jae 0x40c7ef
mov eax, ebx
push eax
lea ecx, [ebp - 0x20]
call fcn.00402530
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
test edx, edx
je 0x40c80c
mov ecx, dword [esi]
mov dword [edx], ecx
mov ecx, dword [ebp + 8]
add edx, 4
mov dword [ebp - 0x1c], edx
add esi, 4
cmp esi, dword [ebx + 4]
jne 0x40c724
lea ecx, [ebp - 0x20]
cmp ebx, ecx
je 0x40c834
mov ecx, dword [ebx]
mov dword [ebx], edi
mov dword [ebx + 4], edx
mov edi, ecx
mov dword [ebx + 8], eax
test edi, edi
je 0x40c841
push edi
call fcn.00416712
add esp, 4
mov edi, dword [ebp - 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [eax], 0
call esi
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.vector_T__too_long
call fcn.00416373
int3
Function at 0x40e480
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b180
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4382c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp eax, 0x7fffffff
jbe 0x40e4d5
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x11], al
push 0x4352b4
lea eax, [ebp - 0x11]
push eax
call fcn.00418fbb
push eax
push dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jns 0x40e4f7
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x12], al
push 0x4352b4
lea eax, [ebp - 0x12]
push eax
call fcn.00418fbb
cmp eax, dword [esi + 4]
je 0x40e51f
cmp eax, dword [esi + 8]
jbe 0x40e515
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x13], al
push 0x4352b4
lea eax, [ebp - 0x13]
push eax
call fcn.00418fbb
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00405f80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e5d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b14b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4382c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
push edx
push 0
push 0x410
mov dword [ebp - 0x234], 0
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40e634
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x40e6d7
push dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
lea ecx, [ebp - 0x228]
call fcn.0040ecd0
add esp, 4
lea eax, [ebp - 0x230]
push eax
push 4
lea eax, [ebp - 0x22c]
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40e6bb
xor eax, eax
push 0x104
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x22c]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x40e6bb
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.00405860
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x228], 0
jne 0x40e6e9
push dword [ebp - 0x224]
call dword [ebp - 0x220]
jmp 0x40e6e9
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x228], 0
jne 0x40e6d7
push dword [ebp - 0x224]
call dword [ebp - 0x220]
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416717
mov esp, ebp
pop ebp
ret
Function at 0x40e8c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b118
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4382c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
push eax
push 0x40e710
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
cmp esi, edx
je 0x40e94c
mov eax, dword [esi + 4]
test eax, eax
je 0x40e978
push eax
push dword [ebx]
call fcn.00417334
add esp, 8
test eax, eax
jne 0x40e93f
push esi
mov ecx, edi
call fcn.0040ea50
mov edx, dword [ebp - 0x18]
add esi, 0x14
cmp esi, edx
jne 0x40e921
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x40e966
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00407b90
push dword [ebp - 0x1c]
call fcn.00416712
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401010
int3

Function at 0x40f210
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push esi
push 0
push 0
push 0x8004
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40f236
mov eax, esi
pop esi
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
push 0x435294
lea eax, [ebp + 8]
push eax
call fcn.00418fbb
int3
Function at 0x410080
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4382c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0
push 0
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x41010e
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x410129
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x11], al
push 0x4352b4
lea eax, [ebp - 0x11]
push eax
call fcn.00418fbb
push ecx
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebp - 0x2c]
call fcn.00410200
push dword [ebp - 0x24]
mov edi, dword [ebp - 0x2c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x410167
cmp eax, dword [ebp - 0x24]
ja 0x410167
cmp eax, dword [ebp - 0x28]
je 0x41015d
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], eax
call fcn.00405f80
push edi
mov ecx, esi
call fcn.00405860
jmp 0x410179
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
test edi, edi
je 0x410186
push edi
call fcn.00417164
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410320
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4382c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp ecx, 0xffffffff
je 0x410393
lea eax, [ebp - 0x50]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x410366
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416717
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
test ecx, ecx
jg 0x410376
jl 0x4103ce
test eax, eax
jb 0x4103ce
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [esi], 0
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416717
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40]
push eax
push dword [edx]
call fcn.004182c9
add esp, 8
test eax, eax
jne 0x4103b3
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
test ecx, ecx
jg 0x410376
jl 0x4103ce
jmp 0x410372
call fcn.0041816c
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.00416717
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x41]
mov byte [ebp - 0x41], al
push 0x4352b4
lea eax, [ebp - 0x41]
push eax
call fcn.00418fbb
int3
Function at 0x410950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b3d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4382c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x24], edi
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 8]
call fcn.00407750
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4109e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
add ecx, edi
adc edx, 0
cmp edx, dword [ebx + 4]
ja 0x410a1b
jb 0x410a07
cmp ecx, dword [ebx]
jae 0x410a1b
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x11], al
push 0x4352b4
lea eax, [ebp - 0x11]
push eax
call fcn.00418fbb
lea eax, [ebp - 0x2c]
mov dword [ebx], ecx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebx + 4], edx
call fcn.00407750
mov eax, dword [ebp - 0x1c]
cmp edi, eax
jbe 0x410a47
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x12], al
push 0x4352b4
lea eax, [ebp - 0x12]
push eax
call fcn.00418fbb
sub eax, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
add esi, edi
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00407750
cmp dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x24]
ja 0x4109a8
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x41318b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004131a0
Function at 0x422ae2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4382c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041d4d9
mov dword [ebp - 0x14], eax
cmp dword [0x43a8c0], edi
jne 0x422bd3
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x422b60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x422cb3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x422cb3
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x422cb3
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x43a8c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x43a8c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x43a8c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43a8d0], eax
test eax, eax
je 0x422bd0
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43a8cc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x422bf8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422beb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x422c0d
push 4
pop eax
jmp 0x422cb5
cmp dword [ebp - 0x14], edi
je 0x422c0d
push dword [0x43a8c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x422bf2
mov eax, dword [0x43a8cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x422c6b
cmp dword [0x43a8d0], esi
je 0x422c6b
push eax
call ebx
push dword [0x43a8d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x422c6b
test eax, eax
je 0x422c6b
call ecx
test eax, eax
je 0x422c60
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x422c60
test byte [ebp - 8], 1
jne 0x422c6b
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x422c9b
mov eax, dword [0x43a8c4]
cmp eax, esi
je 0x422c98
push eax
call ebx
test eax, eax
je 0x422c98
call eax
mov edi, eax
test edi, edi
je 0x422c98
mov eax, dword [0x43a8c8]
cmp eax, esi
je 0x422c98
push eax
call ebx
test eax, eax
je 0x422c98
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x43a8c0]
call ebx
test eax, eax
je 0x422cb3
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x422cb5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416717
leave
ret
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000e9bf
pop dword [ebp - 0x30]
mov eax, 0xe20125c
add eax, 0x1e0d763
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x4f107f5e
add dword [ebp - 0x40], 0xff41c5ed
mov dword [ebp - 0x3c], 0x96eb6e29
sub dword [ebp - 0x3c], 0x64b821e4
mov dword [ebp - 0x38], 0xac120139
sub dword [ebp - 0x38], 0x5fc5bd0b
mov dword [ebp - 0x34], 0xf1811e25
add dword [ebp - 0x34], 0xe7ee1db
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x67071255
sub dword [ebp - 0x40], 0xf294a8ff
mov dword [ebp - 0x3c], 0xca3f5f9b
add dword [ebp - 0x3c], 0x772d01da
mov dword [ebp - 0x38], 0xf0b596f1
add dword [ebp - 0x38], 0x72b9d57b
mov dword [ebp - 0x34], 0x2d9be038
add dword [ebp - 0x34], 0xd2641fc8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xfa53f2f9
sub eax, 0xea5262c1
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39c41
push 0
call eax
mov ecx, 0xc62b495b
add ecx, 0x39d50b78
mov edx, eax
mov ebx, 0x10022800
add ebx, dword [ebp - 0x30]
mov esi, 0x315f18aa
add esi, 0x2027dca3
sub dword [ebp - 0x1c], 0xbb25aa8b
mov edi, dword [ebx]
xor dword [ebp - 4], 0xcaf3183
sub edi, esi
mov dword [ebp - 4], 0x5c68174a
mov dword [edx], edi
add dword [ebp - 0x18], ebx
add edx, 0xc87dbc4b
add edx, 0x378243b9
add ebx, 0x5b406a36
add ebx, 0xa4bf95ce
loop 0x1000ead6
add eax, 0x7dd6208a
add eax, 0x822b2595
xor ebx, ebx
add ebx, eax
add eax, 0x8335e752
sub eax, 0x8335e74d
mov ecx, 0xfff0a40f
add ecx, 0x100f5bf1
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret