joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loop 0x40821e
loope 0x4081c4
add byte [edx - 0x39], bl
test dword [eax - 0x21], edx
call dword [edx - 0x7f]
repne insd dword es:[edi], dx
je 0x408226
add byte [ecx + 0x15ccbea], al
add byte [ecx + 0x1015ea], al
add byte [ecx + 0x1427ff2], al
add byte [edx + 0x57], bl
push esi
xor esi, 0x5410
sub esi, 0x156b
pop esi
push eax
push eax
add esp, 4
and eax, 0x8508
or eax, 0x23b4
pop eax
push edi
push ecx
add esp, 4
or edi, 0x15eed
add edi, 0x7985
pop edi
jmp 0x408495
mov dword [ebp - 0xc98], 7
mov edx, dword [ebp - 0x4fc]
mov dword [ebp - 0xae0], edx
push edi
and edi, 0x8692
xor edi, 0xf3aa
or edi, 0xeb58
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x32b2
add byte [eax], al
push esi
push eax
add esp, 4
jmp 0x4084a2
sub esi, 0x8c46
pop esi
push eax
push esi
add esp, 4
sub eax, 0x107a3
jmp 0x4084ba
or eax, 0xf9a2
add eax, 0x16a15
pop eax
mov dword [ebp - 0xad8], 0
push eax
sub eax, 0x56e
and eax, 0x52f0
pop eax
push edi
push eax
add esp, 4
xor edi, 0x7b9
xor edi, 0xc6f1
int1
mov byte [eax], 0
add edi, 0x3e
pop edi
push eax
push esi
add esp, 4
and eax, 0x2e3f
add byte [eax], al
pop eax
mov byte [ebp - 0x880], 0x45
mov byte [ebp - 0x87f], 0x78
js 0x4084d8
test dword [edx + 0x69fffff7], eax
mov byte [ebp - 0x87d], 0x74
mov byte [ebp - 0x87c], 0x50
mov byte [ebp - 0x87b], 0x72
mov byte [ebp - 0x87a], 0x6f
mov byte [ebp - 0x879], 0x63
mov byte [ebp - 0x878], 0x65
mov byte [ebp - 0x877], 0x73
mov byte [ebp - 0x876], 0x73

Function at 0x408510
Capabilities:
Get number of processors

Disassembly:
loop 0x40821e
loope 0x4081c4
add byte [edx - 0x39], bl
test dword [eax - 0x21], edx
call dword [edx - 0x7f]
repne insd dword es:[edi], dx
je 0x408226
add byte [ecx + 0x15ccbea], al
add byte [ecx + 0x1015ea], al
add byte [ecx + 0x1427ff2], al
add byte [edx + 0x57], bl
push esi
xor esi, 0x5410
sub esi, 0x156b
pop esi
push eax
push eax
add esp, 4
and eax, 0x8508
or eax, 0x23b4
pop eax
push edi
push ecx
add esp, 4
or edi, 0x15eed
add edi, 0x7985
pop edi
jmp 0x408495
mov dword [ebp - 0xc98], 7
mov edx, dword [ebp - 0x4fc]
mov dword [ebp - 0xae0], edx
push edi
and edi, 0x8692
xor edi, 0xf3aa
or edi, 0xeb58
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x32b2
add byte [eax], al
push esi
push eax
add esp, 4
jmp 0x4084a2
sub esi, 0x8c46
pop esi
push eax
push esi
add esp, 4
sub eax, 0x107a3
jmp 0x4084ba
or eax, 0xf9a2
add eax, 0x16a15
pop eax
mov dword [ebp - 0xad8], 0
push eax
sub eax, 0x56e
and eax, 0x52f0
pop eax
push edi
push eax
add esp, 4
xor edi, 0x7b9
xor edi, 0xc6f1
int1
mov byte [eax], 0
add edi, 0x3e
pop edi
push eax
push esi
add esp, 4
and eax, 0x2e3f
add byte [eax], al
pop eax
mov byte [ebp - 0x880], 0x45
mov byte [ebp - 0x87f], 0x78
js 0x4084d8
test dword [edx + 0x69fffff7], eax
mov byte [ebp - 0x87d], 0x74
mov byte [ebp - 0x87c], 0x50
mov byte [ebp - 0x87b], 0x72
mov byte [ebp - 0x87a], 0x6f
mov byte [ebp - 0x879], 0x63
mov byte [ebp - 0x878], 0x65
mov byte [ebp - 0x877], 0x73
mov byte [ebp - 0x876], 0x73
Function at 0x408550
Capabilities:
Get number of processors

Disassembly:
mov byte [ebp - 0x875], 0
push esi
jmp 0x40855d
pop esi
push ebx
push edi
add esp, 4
jmp 0x40856a
or ebx, 0x45d4
sub ebx, 0xf43b
pop ebx
push edx
push edi
add esp, 4
and edx, 0x102ae
add edx, 0xe95d
pop edx
mov edx, 0x6b
mov word [ebp - 0x173c], dx
mov eax, 0x65
mov word [ebp - 0x173a], ax
mov ecx, 0x72
invalid
invalid

Function at 0x4089a9
Capabilities:
Get number of processors

Disassembly:
push edi
add esp, 4
sub ecx, 0xaf06
xor ecx, 0xbe04
add ecx, 0xcdf5
pop ecx
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0x2f0], ecx
jmp 0x408981
push eax
add eax, 0xff88
call 0x408998
add byte [0x3a3e3533], bh
cmp al, 0x3f
inc esi
dec edi
push eax
add esp, 4
call 0x4089a9
add byte [ecx + 0x3f], al
xor al, byte [eax + edi + 0x36]
inc eax
cmp dword [ebx - 0x177efb3c], eax
fsub dword [edx]
add byte [eax - 0x7d], bl
mov ebp, 0xfffffd10
add byte [edi], cl
test esi, eax
or byte [eax], al
add byte [eax + 0x6b], bh
mov word [ebp - 0x1758], ax
mov ecx, 0x65
mov word [ebp - 0x1756], cx
mov edx, 0x72
mov word [ebp - 0x1754], dx
mov eax, 0x6e
mov word [ebp - 0x1752], ax
mov ecx, 0x65
mov word [ebp - 0x1750], cx
mov edx, 0x6c
mov word [ebp - 0x174e], dx
mov eax, 0x33
mov word [ebp - 0x174c], ax
mov ecx, 0x32
mov word [ebp - 0x174a], cx
mov edx, 0x2e
mov word [ebp - 0x1748], dx
mov eax, 0x64
mov word [ebp - 0x1746], ax
mov ecx, 0x6c
mov word [ebp - 0x1744], cx
mov edx, 0x6c
mov word [ebp - 0x1742], dx
xor eax, eax
mov word [ebp - 0x1740], ax
push esi
add esi, 0x127a7
pop esi
push ecx
push ecx
add esp, 4
and ecx, 0xc9df
call 0x408a7b
add byte [eax + 0x50], cl
dec esp
xor edi, dword [ecx]
dec ebp
aas
cmp dword ds:[ebx - 0x167efb3c], eax
movsd dword es:[edi], dword [esi]
xor eax, dword [ecx]
add byte [ecx + 0x16874e1], al
add byte [ecx - 0x3a], bl
test dword [edi + esi*8 - 1], esp
dec dword [esi + eax*8 - 0x7b]
idiv edi
jmp [edi - 0x3a]
Function at 0x408a7b
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push edi
add esp, 4
sub ecx, 0xaf06
xor ecx, 0xbe04
add ecx, 0xcdf5
pop ecx
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0x2f0], ecx
jmp 0x408981
push eax
add eax, 0xff88
call 0x408998
add byte [0x3a3e3533], bh
cmp al, 0x3f
inc esi
dec edi
push eax
add esp, 4
call 0x4089a9
add byte [ecx + 0x3f], al
xor al, byte [eax + edi + 0x36]
inc eax
cmp dword [ebx - 0x177efb3c], eax
fsub dword [edx]
add byte [eax - 0x7d], bl
mov ebp, 0xfffffd10
add byte [edi], cl
test esi, eax
or byte [eax], al
add byte [eax + 0x6b], bh
mov word [ebp - 0x1758], ax
mov ecx, 0x65
mov word [ebp - 0x1756], cx
mov edx, 0x72
mov word [ebp - 0x1754], dx
mov eax, 0x6e
mov word [ebp - 0x1752], ax
mov ecx, 0x65
mov word [ebp - 0x1750], cx
mov edx, 0x6c
mov word [ebp - 0x174e], dx
mov eax, 0x33
mov word [ebp - 0x174c], ax
mov ecx, 0x32
mov word [ebp - 0x174a], cx
mov edx, 0x2e
mov word [ebp - 0x1748], dx
mov eax, 0x64
mov word [ebp - 0x1746], ax
mov ecx, 0x6c
mov word [ebp - 0x1744], cx
mov edx, 0x6c
mov word [ebp - 0x1742], dx
xor eax, eax
mov word [ebp - 0x1740], ax
push esi
add esi, 0x127a7
pop esi
push ecx
push ecx
add esp, 4
and ecx, 0xc9df
call 0x408a7b
add byte [eax + 0x50], cl
dec esp
xor edi, dword [ecx]
dec ebp
aas
cmp dword ds:[ebx - 0x167efb3c], eax
movsd dword es:[edi], dword [esi]
xor eax, dword [ecx]
add byte [ecx + 0x16874e1], al
add byte [ecx - 0x3a], bl
test dword [edi + esi*8 - 1], esp
dec dword [esi + eax*8 - 0x7b]
idiv edi
jmp [edi - 0x3a]

Function at 0x408b36
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x2710
pop edi
cmp dword [ebp - 0x15e0], 0
jne 0x408b58
mov dword [ebp - 0x758], 0
jmp 0x408dff
mov edx, dword [ebp - 0x15e0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcb4], ecx
push edi
push edx
add esp, 4
call 0x408b7e
add byte [ecx + 0x40], cl
inc ecx
dec ecx
inc esi
dec esp
cmp al, byte [esi + 0x49]
add esp, 4
xor edi, 0x16125
pop edi
push eax
and eax, 0x10b10
or eax, dword [ecx]
add byte [ecx + 0xeec9f0], al
add byte [ecx + 0xd82ae8], al
add byte [eax - 0x7d], bl
invalid
dec esp
invalid

Function at 0x408b7e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x2710
pop edi
cmp dword [ebp - 0x15e0], 0
jne 0x408b58
mov dword [ebp - 0x758], 0
jmp 0x408dff
mov edx, dword [ebp - 0x15e0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcb4], ecx
push edi
push edx
add esp, 4
call 0x408b7e
add byte [ecx + 0x40], cl
inc ecx
dec ecx
inc esi
dec esp
cmp al, byte [esi + 0x49]
add esp, 4
xor edi, 0x16125
pop edi
push eax
and eax, 0x10b10
or eax, dword [ecx]
add byte [ecx + 0xeec9f0], al
add byte [ecx + 0xd82ae8], al
add byte [eax - 0x7d], bl
invalid
dec esp
invalid
Function at 0x408b8c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x2710
pop edi
cmp dword [ebp - 0x15e0], 0
jne 0x408b58
mov dword [ebp - 0x758], 0
jmp 0x408dff
mov edx, dword [ebp - 0x15e0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcb4], ecx
push edi
push edx
add esp, 4
call 0x408b7e
add byte [ecx + 0x40], cl
inc ecx
dec ecx
inc esi
dec esp
cmp al, byte [esi + 0x49]
add esp, 4
xor edi, 0x16125
pop edi
push eax
and eax, 0x10b10
or eax, dword [ecx]
add byte [ecx + 0xeec9f0], al
add byte [ecx + 0xd82ae8], al
add byte [eax - 0x7d], bl
invalid
dec esp
invalid
Function at 0x409640
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x8a4d
pop esi
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x2f0], edx
jmp 0x4095d1
invalid
push eax
push esi
add esp, 4
sub eax, 0xcd8e
add eax, 0x1824
pop eax
push edi
add edi, 0x2f2a
xor edi, 0x5d43
pop edi
push ebx
push ebx
add esp, 4
xor ebx, 0x16fce
and ebx, 0x1818c
pop ebx
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edx
add edx, 0xee3c
or edx, 0x1546b
xor edx, 0x13cea
pop edx
push eax
xor eax, 0x6ea
or eax, 0x184ef
call 0x409640
add byte [eax + 0x43], cl
xor cl, byte [esp + ecx*2 + 0x36]
cmp eax, dword [ebx - 0x38a7fb3c]
test dword [eax + 0xfffff8], ecx
add byte [eax], al
add byte [ebx - 0x3377b], cl
dec dword [ecx - 0x16037b]
inc dword [ebx - 0x160343]
inc dword [eax]
jne 0x409674
mov ecx, dword [ebp - 0x778]
mov dword [ebp - 0x50c], ecx
jmp 0x409965
mov edx, dword [ebp - 0x1604]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1608], eax
jne 0x40969c
mov ecx, dword [ebp - 0x778]
mov dword [ebp - 0x50c], ecx
jmp 0x409965
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1608]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x160c], edx
cmp dword [ebp - 0x160c], 0
jne 0x4096ce
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x50c], eax
jmp 0x409965
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x160c]
mov dword [ebp - 0x76c], ecx
jne 0x4096f3
mov edx, dword [ebp - 0x778]
mov dword [ebp - 0x50c], edx
jmp 0x409965
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19f4], ecx
mov edx, dword [ebp - 0x76c]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x76c]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19fc], edx
mov dword [ebp - 0x770], 0
jmp 0x40974d
Function at 0x409c0c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0xcd4]
mov dword [ebp - 0x510], edx

Function at 0x409c34
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
jmp 0x409c23
pop ecx
push ebx
call fcn.00409c34
add byte [esi], dh
dec edx
cmp edi, dword [edi]
inc ebx
add esp, 4
xor ebx, 0x132de

Function at 0x409c96
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x32
inc ebx
cmp eax, 0x8104c483
add esp, 4
xor ebx, 0x132de
add ebx, 0x2528
add ebx, 0xf11d
pop ebx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push esi
push edi
add esp, 4
sub esi, 0x13eb0
pop esi
push edi
and edi, 0x15635
call 0x409c96
add byte [edx + eax*2], dh
dec edi
xor eax, 0x3c384c4c
push eax
add esp, 4
pop edi
push edi
push ebx
add esp, 4
xor edi, 0xa6b1
pop edi
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x104e]
mov word [ebp - 0x238], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1050], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1050]
mov word [ebp - 0x4c], ax
push edx
push edi
add esp, 4
call 0x409d11
add byte [ebx + 0x39], cl
cmp byte [edi], bh
cmp eax, 0x834e4937
les eax, [edx + ebx*2]
push ecx
sub ecx, 0xa8b8
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x121cd
int 0x21
add dword [eax], eax
xor ecx, 0x55d7
pop ecx
movzx ecx, word [ebp - 0x4c]
test ecx, ecx
jne 0x409d4c
movzx edx, word [ebp - 0x238]
movzx eax, word [ebp - 0x4c]
sub edx, eax
mov dword [ebp - 0x1618], edx
jmp 0x409da6
movzx ecx, word [ebp - 0x238]
movzx edx, word [ebp - 0x4c]
cmp ecx, edx
je 0x409c74
movzx eax, word [ebp - 0x238]
invalid
invalid
Function at 0x409d11
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, 0x32
inc ebx
cmp eax, 0x8104c483
add esp, 4
xor ebx, 0x132de
add ebx, 0x2528
add ebx, 0xf11d
pop ebx
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push esi
push edi
add esp, 4
sub esi, 0x13eb0
pop esi
push edi
and edi, 0x15635
call 0x409c96
add byte [edx + eax*2], dh
dec edi
xor eax, 0x3c384c4c
push eax
add esp, 4
pop edi
push edi
push ebx
add esp, 4
xor edi, 0xa6b1
pop edi
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x104e]
mov word [ebp - 0x238], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1050], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1050]
mov word [ebp - 0x4c], ax
push edx
push edi
add esp, 4
call 0x409d11
add byte [ebx + 0x39], cl
cmp byte [edi], bh
cmp eax, 0x834e4937
les eax, [edx + ebx*2]
push ecx
sub ecx, 0xa8b8
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x121cd
int 0x21
add dword [eax], eax
xor ecx, 0x55d7
pop ecx
movzx ecx, word [ebp - 0x4c]
test ecx, ecx
jne 0x409d4c
movzx edx, word [ebp - 0x238]
movzx eax, word [ebp - 0x4c]
sub edx, eax
mov dword [ebp - 0x1618], edx
jmp 0x409da6
movzx ecx, word [ebp - 0x238]
movzx edx, word [ebp - 0x4c]
cmp ecx, edx
je 0x409c74
movzx eax, word [ebp - 0x238]
invalid
invalid

Function at 0x409d68
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and byte [edi], cl
mov bh, 0x4d
mov ah, 0x3b
ror dword [edi], 0x84
invalid
Function at 0x409ffb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ebx
push ebx
add esp, 4
and ebx, 0x6cae
jmp 0x40a00f
xor ebx, 0xc98c
pop ebx
cmp dword [ebp - 0x161c], 0
jne 0x40a02e
mov dword [ebp - 0x77c], 0
jmp 0x40a2d5
mov eax, dword [ebp - 0x161c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce0], edx
push edi
push edx
add esp, 4
and edi, 0x6bf4
xor edi, 0x9466
pop edi
push edx
push ecx
add esp, 4
jmp 0x40a05f
pop edx
push edx
push ecx
add esp, 4
add edx, 0x3174
sub edx, 0x3589
pop edx
cmp dword [ebp - 0xce0], 0
jne 0x40a08a
mov dword [ebp - 0x77c], 0
jmp 0x40a2d5
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x514], eax
push edi
push ebx
add esp, 4
add edi, 0x962b
pop edi
push edx
push edi
add esp, 4
xor edx, 0x3a2f
jmp 0x40a0b5
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x657c
add ebx, 0x1682a
pop ebx
lea ecx, [ebp - 0x1774]
mov dword [ebp - 0xcdc], ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcd8], eax
xor ecx, ecx
mov word [ebp - 0x23c], cx
xor edx, edx
mov word [ebp - 0x50], dx
push ebx
push edx
add esp, 4
jmp 0x40a0fe
jmp 0x40a107
pop ebx
push eax
add eax, 0x8a2f
and eax, 0xa2f7
pop eax
push ebx
and ebx, 0x11002
or ebx, 0x5cb2
pop ebx
mov eax, dword [ebp - 0xcd8]
mov cx, word [eax]
mov word [ebp - 0x1052], cx
mov edx, dword [ebp - 0xcd8]
add edx, 2
mov dword [ebp - 0xcd8], edx
mov ax, word [ebp - 0x1052]
mov word [ebp - 0x23c], ax
mov ecx, dword [ebp - 0xcdc]
mov dx, word [ecx]
mov word [ebp - 0x1054], dx
mov eax, dword [ebp - 0xcdc]
add eax, 2
mov dword [ebp - 0xcdc], eax
mov cx, word [ebp - 0x1054]
mov word [ebp - 0x50], cx
push edx
add edx, 0xd38e
pop edx
push ecx
jmp 0x40a18c
add ecx, 0x1a4c
or ecx, 0x15b9
add ecx, 0xc3b6
pop ecx
push ecx
sub ecx, 0x49f4
or ecx, 0xb051
pop ecx
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x40a1ca
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
sub eax, ecx
mov dword [ebp - 0x1624], eax
jmp 0x40a224
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x40a0f2
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x40a0f2
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
cmp eax, ecx
jge 0x40a20e
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x40a218
mov dword [ebp - 0x1620], 1
mov edx, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], edx
cmp dword [ebp - 0x1624], 0
jne 0x40a26d
push ecx
push ebx
add esp, 4
and ecx, 0x5382
jmp 0x40a23d
and ecx, 0x12ccc
and ecx, 0x5f47
pop ecx
push ebx
call 0x40a25b
push esi
or esi, 0xdb03
pop esi
push ebx
and ebx, 0x8aba
add ebx, 0x17300
sub ebx, 0xeba3
jmp 0x40a290
pop ebx
push ebx
xor ebx, 0xd4f1
and ebx, 0x114d5
pop ebx
mov ecx, dword [ebp - 0x514]
mov edx, dword [ecx]
mov dword [ebp - 0x514], edx
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xce0]
je 0x40a2cb
mov ecx, dword [ebp - 0x514]
cmp dword [ecx + 0x30], 0
jne 0x40a096
mov dword [ebp - 0x77c], 0
Function at 0x40a25b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx], bh
xor bh, byte [ecx]
inc ebx
cmp eax, 0x4f494640
aaa
add esp, 4
pop ebx
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x77c], eax
jmp 0x40a2d5
cmp dword [ebp - 0x77c], 0
jne 0x40a31f
push esi
add esi, 0x1351f
and esi, 0x181b
xor esi, 0xc84b
or esi, 0x14df6
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xec51
add ebx, 0xbe60
sub ebx, 0x99b9
pop ebx
mov dword [ebp - 0xad4], 0
jmp 0x40ae47
push edx
call 0x40a32c
add byte [ebp + 0x3b], cl
cmp dh, byte [0xc4833f44]
add al, 0x81
retf 0x6f57

Function at 0x40a32c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx], bh
xor bh, byte [ecx]
inc ebx
cmp eax, 0x4f494640
aaa
add esp, 4
pop ebx
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x77c], eax
jmp 0x40a2d5
cmp dword [ebp - 0x77c], 0
jne 0x40a31f
push esi
add esi, 0x1351f
and esi, 0x181b
xor esi, 0xc84b
or esi, 0x14df6
pop esi
push ebx
push esi
add esp, 4
or ebx, 0xec51
add ebx, 0xbe60
sub ebx, 0x99b9
pop ebx
mov dword [ebp - 0xad4], 0
jmp 0x40ae47
push edx
call 0x40a32c
add byte [ebp + 0x3b], cl
cmp dh, byte [0xc4833f44]
add al, 0x81
retf 0x6f57
Function at 0x40106a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x8103f8]
mov dword [ebp - 0x30], eax
mov eax, dword [0x8103fc]
push edi
xor edi, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], edi
call fcn.00401063
mov eax, dword [0x810400]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [str.S_rd]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
shl eax, 4
cmp dword [0x1e00fac], 0xc
mov dword [ebp - 4], eax
jne 0x4010ef
push edi
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x434]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x1e00fac]
cmp eax, 0xfa9
jne 0x40110b
mov dword [0x1e00fa8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40111f
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x1e00efc], edi
mov eax, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1e00fa4], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 8], eax
sub esi, dword [ebp - 8]
cmp dword [0x1e00fac], 0xc
mov dword [ebp - 4], eax
jne 0x401175
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add ebx, 0x61c88647
dec dword [ebp - 0x20]
jne 0x4010be
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], ecx
pop ebx
leave
ret 4
Function at 0x40448c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80f250]
jne 0x404496
repz ret
jmp fcn.00409bc4

Function at 0x40b1aa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406f5c
and dword [ebp - 4], 0
cmp dword [0x8197a4], 0
mov ebx, eax
jne 0x40b25b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b30c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b30c
push eax
call fcn.00406eea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x8197a4], eax
call esi
push eax
call fcn.00406eea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x8197a8], eax
call esi
push eax
call fcn.00406eea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x8197ac], eax
call esi
push eax
call fcn.00406eea
pop ecx
mov dword [0x8197b4], eax
test eax, eax
je 0x40b25b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406eea
pop ecx
mov dword [0x8197b0], eax
mov eax, dword [0x8197b0]
cmp eax, ebx
je 0x40b2b3
cmp dword [0x8197b4], ebx
je 0x40b2b3
push eax
call fcn.00406f65
push dword [0x8197b4]
mov esi, eax
call fcn.00406f65
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2b3
test edi, edi
je 0x40b2b3
call esi
test eax, eax
je 0x40b2aa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2aa
test byte [ebp - 0xc], 1
jne 0x40b2b3
or dword [ebp + 0x10], 0x200000
jmp 0x40b2ec
mov eax, dword [0x8197a8]
cmp eax, ebx
je 0x40b2ec
push eax
call fcn.00406f65
pop ecx
test eax, eax
je 0x40b2ec
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2ec
mov eax, dword [0x8197ac]
cmp eax, ebx
je 0x40b2ec
push eax
call fcn.00406f65
pop ecx
test eax, eax
je 0x40b2ec
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x8197a4]
call fcn.00406f65
pop ecx
test eax, eax
je 0x40b30c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b30e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret