joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa98f80
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0xb08578]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0xa98fc0
cmp byte [ebx], 0xa
jne 0xa98fc0
or byte [eax + edi + 0x28], 4
jmp 0xa98fc5
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0xa990c3
mov al, byte [edx]
cmp al, 0x1a
je 0xa990a5
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0xa98ff4
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0xa99019
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0xa99023
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0xa98fd6
jmp 0xa990c3
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xa990a0
cmp dword [ebp - 0xc], 0
je 0xa990a0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0xb08578]
test byte [eax + edi + 0x28], 0x48
je 0xa9907a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0xa99065
mov byte [esi], dl
jmp 0xa99076
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0xb08578]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0xa990c3
cmp byte [ebp - 1], 0xa
jne 0xa99089
cmp esi, ebx
jne 0xa99089
mov byte [esi], 0xa
jmp 0xa990c2
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00a8f5b7
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0xa990c3
mov byte [esi], 0xd
jmp 0xa990c2
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0xb08578]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0xa990bf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0xa990c3
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xa990cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0xb08578]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0xa9910f
cmp word [esi], dx
jne 0xa9910f
or byte [edi + eax + 0x28], 4
jmp 0xa99114
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0xa9924d
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0xa9922d
add eax, 2
cmp cx, word [ebp - 0xc]
je 0xa99156
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0xa9918c
cmp eax, edx
jae 0xa99198
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0xa9912e
jmp 0xa9924d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xa99229
cmp dword [ebp - 0x14], 0
je 0xa99229
mov eax, dword [ebx*4 + 0xb08578]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0xa99201
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0xa99247
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0xb08578]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0xb08578]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0xb08578]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0xa9924a
pop ebx
cmp word [ebp - 4], bx
jne 0xa99212
cmp esi, dword [ebp + 0xc]
jne 0xa99212
mov word [esi], bx
jmp 0xa9924a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00a8f5b7
add esp, 0x10
cmp word [ebp - 4], bx
je 0xa9924d
push 0xd
jmp 0xa99246
mov ecx, dword [ebx*4 + 0xb08578]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0xa99244
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0xa9924d
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0xa99a6e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a998df
Function at 0xa9aaea
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00a9aa66
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0xa9ac62
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0xa9ac62
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0xa9ac11
jg 0xa9ab43
test eax, eax
je 0xa9ac07
push 1
push 0x1000
call fcn.00a847df
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0xa9ab69
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0xa9abfe
push 0x8000
push ebx
call fcn.00a82e9e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0xa9ab95
jg 0xa9ab90
cmp ecx, 0x1000
jb 0xa9ab95
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00a9a366
add esp, 0x10
cmp eax, 0xffffffff
je 0xa9abda
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0xa9ab90
jl 0xa9abc1
test ecx, ecx
jne 0xa9ab82
push dword [ebp - 0xc]
push ebx
call fcn.00a82e9e
push esi
call fcn.00a85506
add esp, 0xc
xor edi, edi
jmp 0xa9ac73
cmp byte [edi + 0x24], 0
je 0xa9abf1
cmp dword [edi + 0x20], 5
jne 0xa9abf1
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0xa9abfc
mov edi, dword [edi + 0x18]
jmp 0xa9abfe
xor edi, edi
push esi
call fcn.00a85506
pop ecx
jmp 0xa9ac73
test ecx, ecx
jg 0xa9abd3
jl 0xa9ac11
test eax, eax
jae 0xa9abd3
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00a8f5b7
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0xa9ac34
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0xa9abd3
jmp 0xa9ac6b
push ebx
call fcn.00a93e12
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xa9abd3
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0xa9ac73
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0xa9ac70
mov edi, dword [edi + 0x18]
jmp 0xa9ac73
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00a8f5b7
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0xaa09f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10023fab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100037dc]
jne 0x100243f1
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100289d8], eax
mov dword [0x100289d4], ecx
mov dword [0x100289d0], edx
mov dword [0x100289cc], ebx
mov dword [0x100289c8], esi
mov dword [0x100289c4], edi
mov word [0x100289f0], ss
mov word [0x100289e4], cs
mov word [0x100289c0], ds
mov word [0x100289bc], es
mov word [0x100289b8], fs
mov word [0x100289b4], gs
pushfd
pop dword [0x100289e8]
mov eax, dword [ebp]
mov dword [0x100289dc], eax
mov eax, dword [ebp + 4]
mov dword [0x100289e0], eax
lea eax, [ebp + 8]
mov dword [0x100289ec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10028928], 0x10001
mov eax, dword [0x100289e0]
mov dword [0x100288dc], eax
mov dword [0x100288d0], 0xc0000409
mov dword [0x100288d4], 1
mov eax, dword [0x100037dc]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10028734]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028920], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100037e4
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028920], 0
jne 0x100244dd
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002b9d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
push ecx
push 0x40
mov eax, dword [esi + 4]
sub eax, dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100011fe
mov ecx, dword [esi]
mov eax, dword [esi + 4]
push 0
sub eax, ecx
push eax
push ecx
push edi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100011e5
push 0x10
push str.Patch_Application_Error
push ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
mov eax, dword [esi + 4]
sub eax, dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012b2
push str.Failed_to_change_memory_protection_:
lea ecx, [ebp - 0x2c]
call fcn.10001b60
mov edi, ebx
mov dword [ebp - 4], 0
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10001217
mov edx, dword [ebp - 0x18]
sub edi, ecx
mov ecx, dword [ebp - 0x1c]
mov eax, edx
sub eax, ecx
push edi
push ebx
cmp edi, eax
ja 0x10001251
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + edi]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x10001261
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x30]
push edi
call fcn.10001c70
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
push 0x10
cmova eax, dword [ebp - 0x2c]
push str.Memory_Protection_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x100012b2
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100012a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100012a8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10001e1a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001ddc
mov esp, ebp
pop ebp
ret
Function at 0x481800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00481870
movzx eax, al
test eax, eax
je 0x481831
push 0xab962c
push 0x31199b8
call fcn.0046d6a0
add esp, 8
push 0
call fcn.004adf6c
mov ecx, dword [ebp - 4]
call fcn.00481b30
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.00481960
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4a2400
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x4a241e
mov ecx, dword [ebp - 8]
call fcn.004a3930
jmp 0x4a2431
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x4a2431
mov ecx, dword [ebp - 8]
call fcn.004a37b0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 0xb
mov ecx, dword [ebp - 8]
and eax, dword [ecx + 0x1384]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a37b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x4a37cb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x4a3837
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4a380f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4a3816
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4a37c2
jmp 0x4a3842
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x4a38ae
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x4a3886
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x4a388d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4a3839
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x4a38ec
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x4a38f3
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x4a3930
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x4a394b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x4a39b7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4a398f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4a3996
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4a3942
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403e59
pop dword [ebp - 0x10]
mov eax, 0x403e59
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x955eb18e
sub dword [ebp - 0x20], 0x470c6c43
mov dword [ebp - 0x1c], 0x88454d07
add dword [ebp - 0x1c], 0xa9edff3e
mov dword [ebp - 0x18], 0xcac7b1a2
add dword [ebp - 0x18], 0x8184928c
mov dword [ebp - 0x14], 0x890256e3
add dword [ebp - 0x14], 0x76fda91d
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x6696186a
add dword [ebp - 0x20], 0xddc50ec
mov dword [ebp - 0x1c], 0x3ce8a685
add dword [ebp - 0x1c], 0x483baf0
mov dword [ebp - 0x18], 0xfeb8991e
add dword [ebp - 0x18], 0x64b6d34e
mov dword [ebp - 0x14], 0xe1143e2f
add dword [ebp - 0x14], 0x1eebc1d1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35a89
push 0
call eax
mov ecx, 0x43a5
mov edi, eax
mov ebx, 0xf5455fe8
add ebx, 0xafbb018
add ebx, dword [ebp - 0x10]
mov esi, 0x228cdc7
add esi, 0xc829fc6e
mov dword [ebp - 0xc], 0x8145bf29
mov edx, dword [ebx]
xor dword [ebp - 8], 0xc8d50484
sub edx, esi
sub dword [ebp - 0xc], ebx
mov dword [edi], edx
sub dword [ebp - 8], edx
add edi, 0xf7f8a5ee
sub edi, 0xf7f8a5ea
add ebx, 0xf2e3e4cd
sub ebx, 0xf2e3e4c9
loop 0x403f66
add eax, 0x301a2300
add eax, 0xcfe6de67
xor ebx, ebx
add ebx, eax
add eax, 0x483e7c7c
add eax, 0xb7c18389
mov ecx, 0x22df3859
sub ecx, 0x229f3859
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x29a10f52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x29a10f61
pop dword [ebp - 0x30]
mov eax, 0xeec5e542
add eax, 0x3adb2a1f
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x88374
add dword [ebp - 0x40], 0x4e49c1d7
mov dword [ebp - 0x3c], 0xe3a65780
sub dword [ebp - 0x3c], 0xb1730b3b
mov dword [ebp - 0x38], 0xd9b6e986
add dword [ebp - 0x38], 0x72955aa8
mov dword [ebp - 0x34], 0xf43b9cf0
add dword [ebp - 0x34], 0xbc46310
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x30a035f2
sub dword [ebp - 0x40], 0xbc2dcc9c
mov dword [ebp - 0x3c], 0x1ceea4c
add dword [ebp - 0x3c], 0x3f9d7729
mov dword [ebp - 0x38], 0x8a2b3dac
add dword [ebp - 0x38], 0xd9442ec0
mov dword [ebp - 0x34], 0x5b251969
add dword [ebp - 0x34], 0xa4dae697
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xaf7cb99b
add eax, 0x7a2486a9
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x38341
push 0
call eax
mov ecx, 0xb3689d07
sub ecx, 0xb3685d99
mov edi, eax
mov ebx, 0xdeb4cdc3
add ebx, 0x4aed523d
add ebx, dword [ebp - 0x30]
mov esi, 0xf14b953c
mov edx, dword [ebx]
sub edx, esi
sub dword [ebp - 0x18], ecx
mov dword [edi], edx
xor dword [ebp - 0x20], esi
add edi, 0x3d07ee41
add edi, 0xc2f811c3
add ebx, 0xfbe36374
sub ebx, 0xfbe36370
loop 0x29a11078
add eax, 0xead908f7
add eax, 0x1527e794
mov ebx, eax
add eax, 0xeae3776c
add eax, 0x151c8899
mov ecx, 0x74537e4d
sub ecx, 0x4ab37e4d
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4136a1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040aa39
and dword [ebp - 4], 0
cmp dword [0x420f30], 0
mov ebx, eax
jne 0x413752
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413803
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413803
push eax
call fcn.0040a9c7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x420f30], eax
call esi
push eax
call fcn.0040a9c7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x420f34], eax
call esi
push eax
call fcn.0040a9c7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x420f38], eax
call esi
push eax
call fcn.0040a9c7
pop ecx
mov dword [0x420f40], eax
test eax, eax
je 0x413752
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a9c7
pop ecx
mov dword [0x420f3c], eax
mov eax, dword [0x420f3c]
cmp eax, ebx
je 0x4137aa
cmp dword [0x420f40], ebx
je 0x4137aa
push eax
call fcn.0040aa42
push dword [0x420f40]
mov esi, eax
call fcn.0040aa42
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4137aa
test edi, edi
je 0x4137aa
call esi
test eax, eax
je 0x4137a1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4137a1
test byte [ebp - 0xc], 1
jne 0x4137aa
or dword [ebp + 0x10], 0x200000
jmp 0x4137e3
mov eax, dword [0x420f34]
cmp eax, ebx
je 0x4137e3
push eax
call fcn.0040aa42
pop ecx
test eax, eax
je 0x4137e3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4137e3
mov eax, dword [0x420f38]
cmp eax, ebx
je 0x4137e3
push eax
call fcn.0040aa42
pop ecx
test eax, eax
je 0x4137e3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x420f30]
call fcn.0040aa42
pop ecx
test eax, eax
je 0x413803
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413805
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx