joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 0xeb]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 1
push eax
xor edi, edi
call esi
mov edx, dword [ebp]
mov ebx, eax
mov eax, dword [edx + 0x30]
mov ecx, ebp
call eax
movzx ecx, al
push ecx
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 0xeb]
push 0xcf
push edx
call esi
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
test esi, esi
je 0x417003
mov eax, dword [0x424d88]
mov dword [esp + 0x20], eax
lea eax, [esi + 1]
push eax
lea edi, [esp + 0x24]
call fcn.00401ec0
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ebx, [esp + 0x20]
mov edi, esi
call fcn.00402190
cmp esi, 0xffffffff
mov esi, dword [esp + 0x20]
jne 0x416fcd
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov dword [esi - 8], edi
mov eax, esi
mov byte [edi + esi], 0
call fcn.00417e30
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [esi - 0xc]
mov edi, eax
cmp ecx, 0x424d78
je 0x417009
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x417009
push esi
call fcn.0040b07a
add esp, 4
jmp 0x417009
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [0x424d88]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov eax, 0x42073c
cmp edi, 0x18c00
jb 0x41702b
mov eax, 0x420738
shr edi, 0xa
push eax
push edi
push str._d__s
lea edx, [esp + 0x2c]
call fcn.00401990
add esp, 0xc
mov esi, ebp
call fcn.0041be80
mov edx, dword [0x424d88]
mov dword [esp + 0x10], edx
mov ecx, 0x42073c
cmp eax, 0x18c00
jb 0x417063
mov ecx, 0x420738
shr eax, 0xa
push ecx
push eax
push str._d__s
lea edx, [esp + 0x1c]
call fcn.00401990
add esp, 0xc
lea eax, [ebp + 0x107]
mov ecx, 7
lea edi, [esp + 0x14]
call fcn.004077a0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
push edi
push esi
push eax
lea edx, [esp + 0x24]
call fcn.00401990
mov eax, dword [esp + 0x20]
lea ecx, [eax - 0xc]
add esp, 0xc
cmp ecx, 0x424d78
je 0x4170cc
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4170cc
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.0040b07a
add esp, 4
lea eax, [esi - 0xc]
cmp eax, 0x424d78
je 0x4170e9
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x4170e9
push esi
call fcn.0040b07a
add esp, 4
lea ecx, [edi - 0xc]
cmp ecx, 0x424d78
je 0x417107
lea esi, [edi - 0xc]
push esi
call ebx
test eax, eax
jg 0x417107
push esi
call fcn.0040b07a
add esp, 4
mov esi, dword [esp + 0x18]
mov edx, dword [ebp + 0xeb]
push esi
push 0xdf
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea eax, [esi - 0xc]
cmp eax, 0x424d78
je 0x41713b
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x41713b
push esi
call fcn.0040b07a
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x417151
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xeb]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41716a
mov al, 1
pop esi
pop ecx
ret
mov ecx, dword [esi + 0xeb]
push ebx
push ebp
push edi
push 0xcf
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebp, eax
test ebp, ebp
je 0x417245
mov edx, dword [0x424d88]
lea eax, [ebp + 1]
push eax
lea edi, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.00401ec0
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ebx, [esp + 0x10]
mov edi, ebp
call fcn.00402190
mov ebx, dword [esp + 0x10]
cmp ebp, 0xffffffff
jne 0x4171ce
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov dword [ebx - 8], edi
mov byte [edi + ebx], 0
call fcn.0041be80
mov edi, eax
mov eax, ebx
call fcn.00417e30
cmp eax, edi
jae 0x4171f8
lea ecx, [esp + 0x10]
call fcn.00401fb0
pop edi
pop ebp
pop ebx
xor al, al
pop esi
pop ecx
ret
mov edx, dword [esi + 0xca]
xor eax, eax
test edx, edx
jle 0x417223
xor ecx, ecx
test ecx, ecx
jl 0x417276
cmp eax, edx
jge 0x417276
mov edi, dword [esi + 0xc6]
cmp byte [edi + ecx + 0x15], 0
jne 0x41724d
inc eax
add ecx, 0x1c
cmp eax, edx
jl 0x417206
lea ecx, [ebx - 0xc]
cmp ecx, 0x424d78
je 0x417245
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x417245
push esi
call fcn.0040b07a
add esp, 4
pop edi
pop ebp
pop ebx
xor al, al
pop esi
pop ecx
ret
lea eax, [ebx - 0xc]
cmp eax, 0x424d78
je 0x41726e
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41726e
push esi
call fcn.0040b07a
add esp, 4
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
pop ecx
ret
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x408937
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
cmp bh, 0x74
rcl dword [eax], 0x8d
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00408362
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x40892e
call fcn.004083f1
mov byte gs:[0x3c7e8b7a], al
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x408be0
add eax, esi
mov dword [ebp - 0x44], eax
Function at 0x408c1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00408401
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004083b6
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
invalid
invalid
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x1003596d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x14]
je 0x1003555a
dec si
btr dx, 0xd
not si
mov esi, dword [eax + 0x3c]
rol dh, cl
dec dh
test ax, 0xec21
add esi, eax
ror dx, cl
jmp 0x1004b8a6

Function at 0x1004f86f
Capabilities:
Check for software breakpoints

Disassembly:
call 0x1004b8f8
cmp si, bp
sub ecx, ebx
bsr si, bp
push ebp
lea esi, [esp + 4]
push dword [esp]
stc
cmp al, dh
sub edi, 4
clc
cmp di, ax
bt cx, 3
clc
push dword [edi]
pop dword [esp + 4]
cmp bh, 0xcc
push 0x8d4b9035
cmp edi, ebx
jmp 0x1004bf72
push esp
lea esp, [esp + 0x20]
jne 0x1003555a
ror cx, cl
bt bx, di
mov ecx, edi
shr esi, 0x1c
jmp 0x1004dbd5
Function at 0x4017a0
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xc47667d7
sub ebp, 0x4e9b8f02
mov al, ah
mov ecx, 0xa9b165a6
imul ebp, esi
xor edx, ebx
add al, 0x10
sub ebp, 0x5fd59819
mov ah, ch
dec ebp
cmp ecx, ecx
movzx ebp, bp
dec ah
and al, 0xee
mov eax, esi
mov dh, 0xc1
imul ebx, edx
xchg ch, ch
call 0x4017dc
pop edi
js 0x4017e6
mov ecx, ebx
imul eax, esi
mov bh, dh
lea ebx, [0x31424e35]
imul esi, esi
mov eax, esi
lea ebp, [0xe02d8737]
add ebx, ebp
adc dl, 0x5b
inc dl
test al, cl
add eax, ecx
inc ecx
or esi, eax
test al, dh
lea edx, [0x12aff5e5]
mov esi, 0xba8d4b7f
mov ecx, ecx
lea ebx, [0x631c2fe8]
imul eax, ebp, 0x5bab2163
jno 0x40182c
imul ebp, ebx, 0xf8700de9
imul ebx, edi
test bl, 0x79
mov ch, dh
test ebp, 0x127f2873
test esi, ebp
test esi, ebp
test ch, cl
sub eax, eax
dec ebp
dec dl
imul edx, edx
add eax, 0x61a99
imul esi, edx, 0x895f06
test dl, ah
sub eax, 0xe5e
cmp dh, dh
xadd edi, eax
inc ebx
sub edi, 0xf3d
test edi, esi
jb 0x401873
cmp esi, esi
mov bh, 0xc1
mov ecx, 0xa1788625
imul ebx, edx
inc ebx
xchg cl, al
and dl, dl
imul eax, eax
movzx ebp, dl
jmp 0x40188f
sub ecx, edi
test ebp, edx
jbe 0x401897
or esi, ecx
sbb bh, ch
push 0x84e873
push 0x7a2a0b
mov cl, 0xf5
imul eax, eax, 0
xor ebx, 0x84f5c968
xchg ecx, esi
test edi, edi
imul ebx, ecx
add eax, 0xfffff175
mov ebx, 0x6499bb6b
add eax, 0xe8c
sub ebx, edi
imul ebp, ecx
mov ebp, 0x888bc9f8
dec bl
xor bh, 0x25
cmp eax, 0x23d
jl 0x4018a8
mov dl, dl
push edx
push ebp
imul esi, ebx, 0xf000aa4b
lea esi, [0x8504adba]
push edi
jmp 0x4018f9
xchg ecx, ebp
inc cl
lea ecx, [0x8fac9909]
push 0
pop edx
test dl, 0x64
or edx, 0xbcbd9
adc ebx, ebx
mov ah, 0xa
sub edx, 0xba56f
xor al, 0xe9
ret

Function at 0x40cef0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x44c540], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x44c53c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x44c540], edx
cmp eax, 0x26f
jl 0x40cef8
mov dword [0x43dd70], 0x270
ret

Function at 0x40cf30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x44c544]
mov ebx, dword [eax*4 + 0x44c540]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x44cb74]
mov dword [eax*4 + 0x44c540], edx
cmp eax, 0xe2
jl 0x40cf38
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x44c544]
mov ebx, dword [eax*4 + 0x44c540]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x44c1b4]
mov dword [eax*4 + 0x44c540], edx
cmp eax, 0x26e
jl 0x40cf88
mov edx, dword [0x44c540]
mov ecx, dword [0x44cefc]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x44cb70]
mov dword [0x44cefc], eax
mov dword [0x43dd70], 0
pop ebx
ret
Function at 0x40d010
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x43dd70]
add dword [0x43dd70], 1
mov eax, dword [0x44b0f0]
cmp eax, dword [0x43d4c0]
jne 0x40d033
cmp ebx, 0x271
jb 0x40d054
mov eax, dword [0x44b0f0]
call fcn.0040cef0
not dword [0x44b0f0]
mov eax, dword [0x44b0f0]
mov dword [0x43d4c0], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40d070
call fcn.0040cf30
xor ebx, ebx
mov dword [0x43dd70], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x44c540]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret

Function at 0x40eb20
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x43d220]
cmp ax, 0xcb
je 0x40ec2c
cmp ax, 0xcc
je 0x40ec2c
lea esi, [esi]
mov edx, dword [0x44d140]
test edx, edx
je 0x40eb55
mov eax, dword [0x44cff0]
call edx
mov ebx, eax
jmp 0x40eb5a
mov ebx, 0x44cff4
cmp word [0x44cfe0], 0
jle 0x40eb80
mov eax, 0x44cfc0
call fcn.0040ed90
mov eax, ebx
call fcn.0040e6e0
mov eax, ebx
call fcn.0040e750
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40eba2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40eb9d
mov edx, edi
mov eax, ebx
call fcn.0040db50
jmp 0x40eba0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40eb88
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x44cfe0], 0
jle 0x40ec2c
mov edx, 0x44cf00
mov eax, ebx
call fcn.0040dc90
mov edi, eax
test edi, edi
je 0x40ebfc
mov eax, dword [0x44cf94]
mov dword [edi + 0xc], eax
cmp dword [0x44cf94], 0
je 0x40ebf0
mov eax, dword [0x44cf94]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x44cf94], eax
nop
sub word [0x44cfe0], 1
cmp word [0x44cfe0], 0
sete bl
mov eax, 0x44cfc0
call fcn.0040edb0
test bl, bl
je 0x40ec2c
mov eax, 0x44cfc0
call fcn.0040ed80
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x407550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.00407503
add esp, 0x1c
leave
ret

Function at 0x40950a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.004090c3
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040910e
push eax
push esi
push dword [ebp + 8]
call fcn.004090c3
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004090fe
and eax, esp
xchg ecx, eax
mov bh, 0x88
Function at 0x4097de
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4097d5
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4097f3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add al, 1
add byte [eax], al
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x409851
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x409838
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x409841
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40984b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40982d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4097b7
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40989e
dec eax
je 0x409895
sub eax, 3
je 0x40988c
mov dword [ebp - 4], 0x40
jmp 0x4098bb
mov dword [ebp - 4], 4
jmp 0x4098a1
mov dword [ebp - 4], 0x20
jmp 0x4098a1
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4098ed
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40986d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004090fe
mov eax, dword [0xff46a4de]
jne 0x4098f8
push 1
push esi
call edi
mov eax, esi
jmp 0x4098f9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b2a0
Capabilities:
Access peb ldr_data

Disassembly:
add ebp, 0x24
push esp
call fcn.004090fe
pop esp
jp 0x40b2db
push ss
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40b2c2
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004090fe
div byte [edi - 0x59]
imul ecx, dword [ebx + 0x3c478bf8], 0x7807548b
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
dec edx
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.004090fe
mov dl, 0x58
mov eax, dword [0x348b4927]
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40b2eb
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40b2eb
call fcn.004090fe
invalid
Function at 0x4122aa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4122d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4122d0
xor al, al
jmp 0x4122f0
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00419380
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x100015dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, esp
mov dword [eax + 4], 0x2eb
mov dword [eax], 0x2542a4
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
sub esp, 8
xor ecx, ecx
lea edx, [esp + 0x60]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
jmp 0x10001666
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, 0xfa
mov dword [esp + 0x54], eax
je 0x1000178e
jmp 0x10001666
mov eax, dword [esp + 0x4c]
add eax, 1
mov ecx, esp
mov dword [ecx], 0x9af
mov ecx, dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x48], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x48]
cmp ecx, 0xa
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], ecx
je 0x10001616
jmp 0x10001630
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, esp
mov dword [edx], 0x63f80a
mov edx, dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0x50], eax
mov dword [esp + 0x40], ecx
call edx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xdb1045
mov ecx, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov dword [esp + 0x3c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x634
mov dword [ecx + 4], 0xb67f0d
mov dword [ecx], 0x896e5a
mov ecx, dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov dword [esp + 0x38], eax
call ecx
sub esp, 0xc
xor ecx, ecx
mov edx, dword [esp + 0x50]
sub edx, 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
je 0x10001736
jmp 0x100016dc
mov eax, dword [esp + 0x50]
sub eax, 0x2e
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x4c], ecx
jne 0x10001630
jmp 0x100016f7
mov eax, esp
mov dword [eax], 0x178594
mov eax, dword [sym.imp.GDI32.dll_BeginPath]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x52df89
mov ecx, dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov dword [esp + 0x24], eax
call ecx
sub esp, 4
mov eax, esp
mov dword [eax], 0x4cf98d
mov eax, dword [sym.imp.GDI32.dll_GetBkColor]
call eax
sub esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call eax
xor ecx, ecx
mov edx, 0x18
mov esi, dword [esp + 0x58]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x18
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
call fcn.1000b420
mov eax, esp
lea ecx, [esp + 0x60]
mov dword [eax], ecx
mov dword [eax + 4], 0xfe6
mov eax, dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
call eax
sub esp, 8
mov dword [esp + 0x10], eax
jmp 0x10001616
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x1000b82c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102346f0]
jne 0x1000b836
repz ret
jmp fcn.1000badd
Function at 0x1000c28e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0x20f3
xor edi, edi
mov dword [0x102346c4], 0x20f3
mov dword [0x102346d0], 0
mov byte [0x102346d4], 0
mov dword [0x102346c8], 0x1f84
mov dword [0x102346cc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffffed74
mov edx, eax
mov bl, dl
mov dword [0x102346c8], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x102346c8]
mov edx, eax
add edx, 0x22fb
mov dword [0x102346c4], edx
mov esi, dword [0x102346cc]
add esi, 1
mov dword [0x102346cc], esi
cmp esi, 0x100
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
jl 0x1000c2e5
xor eax, eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x1856
mov dword [0x102346cc], 0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, 0x23e
mov esi, 0x100
mov dword [ebp - 0x30], eax
xor edi, edi
mov dword [ebp - 0x34], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov dword [0x102346d8], 0
mov dword [0x102346c8], ecx
mov ecx, dword [0x102346d0]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x30]
movzx edi, byte [ebx + edi]
add edi, ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add edi, edx
mov dword [0x102346d8], edi
mov eax, edi
cdq
idiv esi
mov dword [0x102346d0], edx
mov dword [0x102346c4], 0x133c
mov esi, dword [ebp - 0x30]
mov cl, byte [ebx + esi]
mov byte [0x102346d4], cl
mov dword [0x102346c8], 0x2285
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x102346d4]
mov edx, dword [0x102346d0]
mov byte [ebx + edx], cl
mov dword [0x102346c4], 0xce3
mov edx, dword [0x102346cc]
add edx, 1
mov dword [0x102346cc], edx
cmp edx, 0x100
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edx
jl 0x1000c352
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret