joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e656
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x43506c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00415e52
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00415e52
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41e6cd
cmp word [ecx], dx
je 0x41e6cd
mov eax, dword [0x42b124]
push edi
dec eax
push eax
push 0x42b010
call fcn.0041e5f5
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x41e740
cmp word [eax], dx
je 0x41e740
mov eax, dword [edi]
test eax, eax
je 0x41e6f1
cmp word [eax], dx
je 0x41e6f1
lea eax, [ebp - 0x10]
push eax
call fcn.0041dfd8
jmp 0x41e6fa
lea eax, [ebp - 0x10]
push eax
call fcn.0041e073
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x41e76a
mov eax, dword [0x42b00c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42ad00
call fcn.0041e5f5
add esp, 0xc
test al, al
je 0x41e76a
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41e735
cmp word [eax], di
je 0x41e735
lea eax, [ebp - 0x10]
push eax
call fcn.0041dfd8
pop ecx
jmp 0x41e76c
lea eax, [ebp - 0x10]
push eax
call fcn.0041e073
jmp 0x41e732
mov eax, dword [edi]
test eax, eax
je 0x41e757
cmp word [eax], dx
je 0x41e757
lea eax, [ebp - 0x10]
push eax
call fcn.0041df8d
pop ecx
jmp 0x41e76a
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41e835
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0041e47a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41e835
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41e835
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41e835
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41e7c2
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00417704
test ebx, ebx
je 0x41e830
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00417704
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41e835
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41e835
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00422267
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41e837
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a314
leave
ret
Function at 0x401d10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub edi, 0x2c
and eax, 0x65
bswap esi
mov edi, 0x2d
sub esi, 0xdd
inc edx
not edx
sub edx, 0x40
neg edi
imul edx
bswap edi
and edx, 0x99
imul edx
not eax
rcl esi, 0x91
and ebx, 0xf4
neg edx
bswap ebx
dec esi
imul eax
ror edx, 0x23
sbb edi, 0xac
neg ebx
neg ebx
inc edx
rcr ebx, 0xff
add edx, 0xb
and edi, 0x95
not ebx
neg eax
rcr edx, 0x18
neg ebx
neg esi
not esi
inc edi
or edi, 0xd7
or esi, 2
and esi, 0x48
dec edx
rol esi, 0x7d
neg esi
and ebx, 0x9f
bswap eax
and edi, 0xdd
sub edi, 0xf6
not eax
neg esi
bswap ebx
rol eax, 0xc0
rol esi, 0x94
xor ecx, ecx
xor edi, edi
not ebx
not edi
not eax
neg edi
rcr edi, 0xd6
dec esi
neg esi
dec ebx
dec edi
sub esi, 0x84
dec edx
dec esi
sub esi, 0x89
inc edi
not esi
imul edi
ror edx, 0xaa
dec edi
not edx
sbb edi, 0x40
dec eax
or ebx, 0x55
inc ebx
imul ebx
imul edx
inc eax
sub esi, 0x85
dec ebx
sub edi, 0x5d
bswap eax
inc ebx
imul ebx
rol esi, 0xc0
add edi, 0xd2
sub ebx, 0xae
ror edx, 0x52
add eax, 0x56
bswap edx
sub esi, 0xb1
imul edi
bswap esi
add edi, 0x1a
inc edi
not eax
add edx, 0x9c
ror eax, 0x9a
neg esi
sbb eax, 5
imul esi
not edi
mov ecx, dword [ebp + 0xc]
inc eax
and edx, 0x59
bswap esi
mov edi, 0xa5
inc ebx
neg esi
not edx
rcl ebx, 0x7c
imul edi
inc eax
rol ebx, 0xcf
bswap edi
bswap esi
and esi, 0x11
add esi, 0x90
neg edi
not esi
sub esi, 0xc4
imul ebx
rol edx, 0x42
rcl edi, 0x24
neg esi
rcr edx, 0x7d
neg eax
neg ebx
sub edi, 0x3b
sub eax, 0xf9
inc ebx
neg esi
bswap eax
sbb edi, 0xc
not edi
dec eax
imul edi
imul ebx
dec ebx
ror edi, 0xf2
and eax, 0x5e
not eax
not esi
rcl edx, 0xef
mov edi, 0x45
imul ebx
sub ebx, 0x9b
not esi
dec edi
inc ebx
dec edi
rol edi, 0xc7
mov edx, 0xf1
mov edi, dword [ebp + 8]
xor eax, ebx
xor ebx, eax
mov ebx, ebx
not byte [edi]
xor ebx, esi
mov eax, esi
xor eax, ebx
mov eax, eax
mov ebx, eax
mov esi, ebx
xor esi, eax
mov eax, ebx
mov esi, eax
add byte [edi], 0x79
xor eax, esi
mov ebx, ebx
mov ebx, ebx
mov ebx, ebx
xor ebx, eax
mov ebx, ebx
mov ebx, ebx
mov ebx, eax
xor esi, ebx
sub byte [edi], 0x30
mov ebx, ebx
xor ebx, ebx
xor ebx, eax
xor esi, ebx
xor eax, eax
mov ebx, esi
mov eax, ebx
xor esi, esi
mov ebx, eax
imul byte [edi]
inc edi
loop 0x401eb7
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4073c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e294]
jne 0x4073ce
repz ret
jmp fcn.0040bda6
Function at 0x40d5ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a36f
and dword [ebp - 4], 0
cmp dword [0x42f814], 0
mov ebx, eax
jne 0x40d65e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d70f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40d70f
push eax
call fcn.0040a2fd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42f814], eax
call esi
push eax
call fcn.0040a2fd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42f818], eax
call esi
push eax
call fcn.0040a2fd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42f81c], eax
call esi
push eax
call fcn.0040a2fd
pop ecx
mov dword [0x42f824], eax
test eax, eax
je 0x40d65e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a2fd
pop ecx
mov dword [0x42f820], eax
mov eax, dword [0x42f820]
cmp eax, ebx
je 0x40d6b6
cmp dword [0x42f824], ebx
je 0x40d6b6
push eax
call fcn.0040a378
push dword [0x42f824]
mov esi, eax
call fcn.0040a378
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d6b6
test edi, edi
je 0x40d6b6
call esi
test eax, eax
je 0x40d6ad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d6ad
test byte [ebp - 0xc], 1
jne 0x40d6b6
or dword [ebp + 0x10], 0x200000
jmp 0x40d6ef
mov eax, dword [0x42f818]
cmp eax, ebx
je 0x40d6ef
push eax
call fcn.0040a378
pop ecx
test eax, eax
je 0x40d6ef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d6ef
mov eax, dword [0x42f81c]
cmp eax, ebx
je 0x40d6ef
push eax
call fcn.0040a378
pop ecx
test eax, eax
je 0x40d6ef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f814]
call fcn.0040a378
pop ecx
test eax, eax
je 0x40d70f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d711
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d2015a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [0x6d203048], 1
jne 0x6d2015b8
mov eax, 0x57
ret 0xc
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], str.__p__0x_x___ld_:_stub_n
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], str.DetachVirtualDisk
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x6d203048
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov eax, 0x57
leave
ret 0xc

Function at 0x6d201740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
test byte [0x6d203048], 1
jne 0x6d2017b0
test esi, esi
je 0x6d201798
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x6d201798
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
and edx, 0xffc0ffff
and eax, 0xfffffffc
or edx, eax
jne 0x6d201798
test ebx, ebx
je 0x6d201798
cmp dword [ebx], 1
mov eax, 0x57
mov edx, 0x78
cmove eax, edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x18
lea esp, [ebp - 8]
mov eax, 0x57
pop ebx
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0xc]
call sym._wine_dbgstr_wn.constprop.0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.__p___s___d__0x_x___p___p_:_stub_n
mov dword [esp + 8], str.OpenVirtualDisk
mov dword [esp + 4], 0x6d203048
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6d20175a
Function at 0x6d2021f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6d20224b
cmp byte [esi + ebx - 1], 0xa
je 0x6d20221f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6d203118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401cca
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov esi, ebx
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x1d
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xd5
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x7a
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x99
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xb2
push ebx
push ebx
push ebx
call edi
sub byte [esi + section..BSS], 0x80
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x64
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xd4
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x43
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xd8
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x77
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x6f
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xa9
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x78
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xc
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x58
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xa4
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x49
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xaa
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xf9
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x8c
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x36
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x31
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 7
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x50
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x5b
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x56
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xf5
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 9
inc esi
cmp esi, 0x2d200
jb 0x401cd7
pop edi
pop esi
pop ebx
ret
Function at 0x4067c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4067e8
xor eax, eax
test eax, eax
je 0x4067fb
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4067fb
xor ecx, ecx
jmp 0x4067fe
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406927
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x40695e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406938
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406933
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40698f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406971
pop edi
not eax
pop esi
ret 0xc

Function at 0x888db8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x888dc2
pushal
call 0x888dc8
pop ebp
sub ebp, 0x10
sub ebp, 0x488db8
jmp 0x888dde
mov eax, 0x488db8
add eax, ebp
add eax, 0x4c
mov ecx, 0x605
mov edx, 0x2b4167d0
xor byte [eax], dl
inc eax
dec ecx
jne 0x888df5
jmp 0x888e08
pop ebx
sbb eax, 0xd0ec595b
rcl al, 1
push ecx
adc dword [eax], ebp
rcl al, 1
rcl bl, 1
sbb eax, 0xd0d0da68
shr byte [edx - 8], 1
rcl al, 1
shl byte [edi], 1
xor dl, bl
sbb byte [ebx + 0x51], bl
invalid
Function at 0x474997
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4746cc
add edx, 0xbd5f7887
call fcn.004749d8
or edx, edx
xor dword [edi], ebx
add edx, 0xabf5ae10
inc edx
mov edx, 0x19fb5056
add edi, 2
sub ecx, 0x2a2dfba
or edx, ecx
dec edx
cmp edi, esi
jl fcn.00474997
inc ecx
add edx, 0x5b3e67b7
ret

Function at 0x43cf73
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x43ccda
sub eax, eax
add edi, 0x78da4757
call fcn.0043cf95
xor dword [esi], edx
inc esi
cmp esi, ebx
jne fcn.0043cf73
inc edi
and eax, eax
ret
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb esi, 0x6c
rcr ebx, 0xb1
rcr esi, 0x25
rcl edx, 0x3a
rcr esi, 0x28
or eax, 0x3f
imul eax
not eax
not eax
rcr ebx, 0xad
bswap eax
and esi, 0x4d
sbb ebx, 0xdf
dec esi
mov ebx, 0x45
add ebx, 0x54
not esi
rol edi, 0x99
inc ebx
dec edi
rcl eax, 0x89
mov ebx, 0x2b
neg eax
neg esi
neg edx
sub edi, 0x5b
imul edi
bswap esi
bswap edx
rcr eax, 0x66
add eax, 0x9a
dec esi
bswap esi
dec edi
rcl ebx, 0x2a
inc ebx
imul esi
dec esi
bswap ebx
and ebx, 0x53
rol edx, 0xbd
and ebx, 0x30
mov esi, 0x10
or edi, 0x9e
bswap eax
inc edi
mov ebx, 0x45
bswap edx
mov edx, 0xfe
add eax, 0x79
xor ecx, ecx
xor edi, edi
bswap ebx
add edi, 0x2e
inc eax
dec eax
and edx, 0x8a
sub ebx, 0x17
not edi
rol edi, 0xc5
inc eax
sub edi, 0x31
rcr edi, 0x7e
bswap ebx
rcl edx, 0x91
rcr eax, 0xb0
dec eax
imul esi
and edi, 0x3a
rcr edx, 0x84
rol edi, 4
inc edx
and ebx, 0x5a
neg esi
inc esi
rcl eax, 0xf4
imul esi
inc edi
or edx, 0x2c
mov ebx, 0x2c
neg edx
not edi
not edx
not esi
and esi, 0xcd
ror edx, 0x62
sbb eax, 0xe7
and edx, 0xc3
bswap ebx
rcr esi, 0x89
inc eax
imul edi
and eax, 0x77
dec edi
imul edx
ror edx, 0xe0
not eax
bswap eax
add ebx, 0x61
not edi
rcr edi, 0x3b
and ebx, 0xb4
mov ecx, dword [ebp + 0xc]
imul edi
rcl eax, 0x6e
bswap edi
rcr edx, 3
or esi, 0xe0
inc ebx
imul edx
not esi
ror edi, 0x21
not edi
and esi, 0x30
bswap edi
neg edx
imul eax
not esi
mov edx, 0xd2
rcr ebx, 0xe1
sub esi, 0x3e
neg edi
imul ebx
ror edi, 0xf6
rcl esi, 0x54
neg edx
rcl edx, 0xff
rol esi, 0x7b
sub edi, 0xf3
inc eax
inc esi
not esi
rcl edi, 0x10
or edx, 0x3d
and eax, 0x38
imul esi
neg eax
or ebx, 0xc5
neg edi
and eax, 0x4e
dec edi
inc eax
neg esi
rol eax, 0xd4
sub edx, 0xc1
mov edi, 0x42
dec edi
dec edi
rol edi, 0xd8
mov edx, 0xb6
and eax, 0x48
neg ebx
not edx
mov edi, dword [ebp + 8]
mov eax, esi
xor eax, ebx
xor eax, eax
not byte [edi]
xor esi, ebx
mov eax, esi
xor esi, esi
mov ebx, ebx
mov esi, eax
xor ebx, eax
mov ebx, esi
mov eax, ebx
xor ebx, esi
add byte [edi], 0x79
xor esi, ebx
xor esi, eax
mov esi, ebx
xor ebx, eax
mov eax, ebx
mov eax, eax
xor ebx, esi
xor eax, ebx
mov eax, ebx
sub byte [edi], 0x30
xor ebx, esi
xor ebx, ebx
xor esi, ebx
mov eax, esi
mov eax, ebx
xor ebx, esi
xor eax, ebx
mov esi, eax
xor eax, esi
imul byte [edi]
inc edi
loop 0x4013b9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f65
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417800]
jne 0x404f6f
repz ret
jmp fcn.00407300
Function at 0x4055d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404385
and dword [ebp - 4], 0
cmp dword [0x418990], 0
mov ebx, eax
jne 0x405686
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405737
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405737
push eax
call fcn.00404313
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418990], eax
call esi
push eax
call fcn.00404313
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x418994], eax
call esi
push eax
call fcn.00404313
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x418998], eax
call esi
push eax
call fcn.00404313
pop ecx
mov dword [0x4189a0], eax
test eax, eax
je 0x405686
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404313
pop ecx
mov dword [0x41899c], eax
mov eax, dword [0x41899c]
cmp eax, ebx
je 0x4056de
cmp dword [0x4189a0], ebx
je 0x4056de
push eax
call fcn.0040438e
push dword [0x4189a0]
mov esi, eax
call fcn.0040438e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056de
test edi, edi
je 0x4056de
call esi
test eax, eax
je 0x4056d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056d5
test byte [ebp - 0xc], 1
jne 0x4056de
or dword [ebp + 0x10], 0x200000
jmp 0x405717
mov eax, dword [0x418994]
cmp eax, ebx
je 0x405717
push eax
call fcn.0040438e
pop ecx
test eax, eax
je 0x405717
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405717
mov eax, dword [0x418998]
cmp eax, ebx
je 0x405717
push eax
call fcn.0040438e
pop ecx
test eax, eax
je 0x405717
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418990]
call fcn.0040438e
pop ecx
test eax, eax
je 0x405737
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405739
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438c9c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
and eax, edx
call fcn.00438cbe
dec edx
xor dword [edi], ecx
or edx, edx
add eax, eax
inc edi
add eax, edx
cmp edi, ebx
jne fcn.00438c9c
mov edx, eax
inc edx
ret