joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414390
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push 0x1000
push 0
push dword [0x421e00]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 8], edx
test edx, edx
je 0x41454f
mov ax, word [esp + 0x1c]
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x18], 0x7ff
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x4143e9
test ecx, ecx
je 0x4144ac
dec ecx
mov dword [esp + 0x30], ecx
cmp dword [ebx + 4], 0
lea ebp, [ebx + 4]
je 0x414405
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.004140c0
mov dword [esp + 0x10], eax
jmp 0x41441f
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, 2
mov ax, word [esp + 0x28]
jne 0x4144af
test ax, ax
je 0x41443d
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, edi
mov ecx, dword [esp + 0x18]
sub esi, edx
sar esi, 1
cmp esi, ecx
jle 0x414484
mov eax, dword [esp + 0x1c]
add ecx, 0x800
add eax, 0x1000
mov dword [esp + 0x18], ecx
push eax
push edx
push 8
push dword [0x421e00]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
mov ax, word [esp + 0x28]
mov dword [esp + 0x14], edx
lea edi, [edx + esi*2]
test ax, ax
je 0x4144af
cmp dword [esp + 0x2c], 0
jne 0x4143d3
cmp ax, 0xd
je 0x4144b6
cmp ax, 0xa
jne 0x4143d3
sub edi, 2
jmp 0x41452e
lea ebp, [ebx + 4]
cmp dword [esp + 0x2c], 0
jne 0x41452e
cmp ax, 0xa
jne 0x4144c1
sub edi, 2
jmp 0x41452e
cmp ax, 0xd
jne 0x41452e
sub edi, 2
cmp dword [ebp], 0
je 0x4144e3
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.004140c0
mov dword [esp + 0x10], eax
jmp 0x4144f9
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x28], 0xa
je 0x41452e
cmp dword [ebp], 0
je 0x41450d
add dword [ebx + 0xc], 2
jmp 0x41452e
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, dword [esp + 0x14]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x414560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x421e00]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4146b0
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x4145ac
test edi, edi
je 0x41461d
dec edi
push esi
push ebp
call fcn.004147d0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4145bf
xor cl, cl
jmp 0x4145c1
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x414604
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x421e00]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x41461d
test eax, eax
jne 0x4145a2
cmp cl, 0xd
je 0x414621
cmp cl, 0xa
jne 0x4145a2
dec esi
jmp 0x414693
test eax, eax
jne 0x414693
cmp cl, 0xa
jne 0x414629
dec esi
jmp 0x414693
cmp cl, 0xd
jne 0x414693
dec esi
cmp dword [ebp + 4], 0
je 0x414648
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004140c0
mov dword [esp + 0x20], eax
jmp 0x41465f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x414693
cmp dword [ebp + 4], 0
je 0x414671
inc dword [ebp + 0xc]
jmp 0x414693
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4146c0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4147bf
cmp word [edx], 0
je 0x4147bf
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4146ee
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x414744
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414700
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x414726
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.004148d0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.004149f0
mov edi, eax
test edi, edi
je 0x41473a
cmp dword [esi + 4], 0
je 0x414792
push dword [esp + 0x14]
push edi
push esi
call fcn.004148d0
push edi
push 0
push dword [0x421e00]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x421e00]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x4147d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 4], 0
je 0x4147f7
push 1
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004140c0
mov dword [esp + 4], eax
jmp 0x414811
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x4148c8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x414836
mov eax, dword [esp + 0x10]
pop esi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push edi
cmp al, 0xc0
jne 0x414846
mov edi, 2
jmp 0x414862
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x414855
mov edi, 3
jmp 0x414862
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x4148b4
mov edi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [edi - 1]
mov byte [eax], cl
inc eax
cmp dword [esi + 4], 0
je 0x41488e
push ebx
push eax
push esi
call fcn.004140c0
mov ecx, eax
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, ebx
pop ebx
setne al
dec eax
and eax, edi
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x4148d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x4149e7
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x41491d
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x4149a6
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x41498f
sub eax, 1
je 0x414976
sub eax, 2
je 0x41495f
push esi
push dword [esp + 0x24]
push ecx
call fcn.00411aa0
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.00413cf0
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x4149d5
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x414947
xor eax, eax
pop edi
add esp, 8
ret 0xc
Function at 0x415411
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x41546f
add ebx, 2
lea eax, [ebx*2 + 2]
push eax
push edi
push dword [0x421e00]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x41546f
cmp dword [ebp + 0xc], 0
je 0x41545e
push dword [ebp + 0xc]
push edi
call fcn.004168c9
push 0x41e310
push edi
call fcn.00416898
add esp, 0x10
jmp 0x41546b
push 0x41e310
push edi
call fcn.004168c9
pop ecx
pop ecx
mov esi, edi
jmp 0x415472
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x4154db
mov eax, dword [0x421d7c]
dec eax
sub eax, 1
je 0x4154b5
sub eax, 0x16
je 0x4154ad
push 0
lea eax, [ebp + 0x10]
push eax
lea eax, [ebx + ebx]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4154db
push esi
call fcn.004163c0
jmp 0x4154bb
push esi
call fcn.00416450
mov esi, eax
lea eax, [ebp + 0x10]
push 0
push eax
push esi
call fcn.004168f0
pop ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.004163b0
test edi, edi
je 0x4154ee
push edi
push 0
push dword [0x421e00]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x416730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41675d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41675d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403f5c
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403f74
push dword [esp + 4]
push 0x403ef5
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403fb1
push esi
mov esi, dword [0x412954]
test esi, esi
je 0x403fb0
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403fa8
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x412954
call fcn.00408f21
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403f81
pop edi
pop ebx
pop esi
ret 4
Function at 0x405a46
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x412dc8]
call fcn.00408da9
mov edi, eax
test edi, edi
je 0x405aa8
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x405a6f
push dword [esp + 0xc]
push edi
call eax
jmp 0x405aa8
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00409230
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.004092b0
pop esi
pop ebx
pop edi
ret 8
Function at 0x40735d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetPropA]
mov dword [ebp - 4], eax
je 0x4073e8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x4073da
push 0x11
call esi
test al, al
js 0x4073da
push 0x10
call esi
test al, al
js 0x4073da
push 0x12
call esi
test al, al
js 0x4073da
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4073da
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x407408
push str.PB_Hotkey
push dword [ebp - 4]
call edi
test eax, eax
jne 0x407408
push str.PB_WindowID
push dword [ebp + 8]
call edi
test eax, eax
je 0x407408
dec eax
push eax
push dword [0x412dd4]
call fcn.00408da9
mov eax, dword [eax + 8]
jmp 0x40740a
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x408183
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x412d64], eax
je 0x4081b6
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x412d68], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x412d60], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4081f4
cmp dword [ebp - 0xc], 1
je 0x408205
cmp dword [ebp - 0xc], 2
jne 0x4081f4
cmp dword [ebp - 0x18], 5
jb 0x408205
jne 0x4081f4
cmp dword [ebp - 0x14], edi
jne 0x4081f4
mov dword [0x412d60], edi
cmp dword [0x412d60], edi
je 0x40820b
call fcn.004080ca
test eax, eax
jne 0x40820b
mov dword [0x412d60], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x40a7de
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x14c
push 8
push dword [0x412858]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x412de4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x412de8], esi
and dword [esi + 0x84], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
push esi
mov dword [esi + 0x6c], 2
mov dword [esi + 0x70], 0x3f
call fcn.0040f12d
mov dword [esi + 0x58], 0x40a75d
mov dword [esi + 0x5c], 0x40a79c
mov dword [esi + 0x10], fcn.004099d6
mov dword [esi + 0x30], 0x409b3b
mov dword [esi + 0x64], 0x409bfc
mov dword [esi + 0x60], 0x409c3f
mov dword [esi + 0x34], 0x40a317
mov dword [esi + 0x24], 0x40a1b6
mov dword [esi + 0x28], 0x40a1df
mov dword [esi + 0x2c], 0x40a20a
mov dword [esi + 0x44], 0x40a5fe
mov eax, esi
pop esi
ret 4
Function at 0x40b235
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x20], 0
push esi
mov esi, dword [ecx + 0xb4]
mov dword [ebp - 4], esi
je 0x40b2a8
mov eax, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 8]
push ebx
lea edx, [eax + edx*4]
push edi
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
mov edi, edx
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x40b297
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add eax, dword [ebp - 4]
add edi, 4
dec dword [ebp + 0x10]
jne 0x40b27c
dec dword [ebp + 0x20]
inc dword [ebp + 0x14]
add edx, dword [ebp + 0xc]
cmp dword [ebp + 0x20], 0
jne 0x40b25c
pop edi
pop ebx
pop esi
leave
ret 0x1c

Function at 0x40bf22
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0
mov edx, dword [ecx + 0xb4]
je 0x40bf9e
push ebx
imul eax, eax, 3
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x18]
add edi, dword [ebp + 8]
mov esi, edx
imul esi, dword [ebp + 0x10]
add eax, edi
mov edi, eax
mov dword [ebp + 0x18], eax
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x40bf86
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add edi, 3
add eax, edx
dec dword [ebp + 0x10]
jne 0x40bf6c
mov edi, dword [ebp + 0x18]
dec dword [ebp + 0x20]
add edi, dword [ebp + 0xc]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x18], edi
jne 0x40bf4e
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0x40bffa
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, eax, 3
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], eax
je 0x40c08a
mov eax, dword [ebp + 0x10]
imul ecx, ecx, 3
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
imul esi, esi, 3
add ecx, eax
push edi
mov edi, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
imul ecx, dword [ebp + 0x14]
add ecx, dword [eax + 0xa8]
mov edx, dword [ebp - 4]
add ecx, esi
test edx, edx
jle 0x40c072
mov eax, 0xff
sub eax, dword [ebp + 0x20]
mov dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
movzx eax, byte [ecx]
movzx edx, byte [edi]
imul eax, dword [ebp - 8]
imul edx, dword [ebp + 0x20]
add eax, edx
cdq
mov ebx, 0xff
idiv ebx
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x18]
jne 0x40c051
mov edi, dword [ebp + 0xc]
dec dword [ebp + 0x1c]
add edi, dword [ebp + 0x10]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], edi
jne 0x40c027
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x401017
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, fcn.00401017
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0
jmp 0x401052
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x14], ecx
jae 0x4010e4
mov dword [ebp - 0x1c], 0x2000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x28
add ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0xf8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
je 0x4010df
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0xc]
jbe 0x4010ac
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 8]
cmp dword [ebp - 4], edx
jb 0x4010df
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x2000
jbe 0x4010c5
mov dword [ebp - 0x20], 0x2000
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
call fcn.004010f7
add esp, 0xc
jmp 0x401049
mov esp, ebp
pop ebp
ret

Function at 0x401231
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6719110]
jne 0x40123b
repz ret
jmp fcn.004014bd
Function at 0x405021
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6719110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004015c3
and dword [ebp - 0x14], 0
cmp dword [0x671c3e4], 0
mov dword [ebp - 0x18], eax
jne 0x4050d4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40517c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40517c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x671c3e4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x671c3e8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x671c3ec], eax
call edi
push eax
call esi
mov dword [0x671c3f4], eax
test eax, eax
je 0x4050d4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x671c3f0], eax
mov eax, dword [0x671c3f0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x40512d
cmp dword [0x671c3f4], ecx
je 0x40512d
push eax
call esi
push dword [0x671c3f4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40512d
test ebx, ebx
je 0x40512d
call edi
test eax, eax
je 0x405124
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405124
test byte [ebp - 8], 1
jne 0x40512d
or dword [ebp + 0x10], 0x200000
jmp 0x405160
mov eax, dword [0x671c3e8]
cmp eax, dword [ebp - 0x18]
je 0x405160
push eax
call esi
test eax, eax
je 0x405160
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405160
mov eax, dword [0x671c3ec]
cmp eax, dword [ebp - 0x18]
je 0x405160
push eax
call esi
test eax, eax
je 0x405160
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x671c3e4]
call esi
test eax, eax
je 0x40517c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40517e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401231
leave
ret
Function at 0xad0291
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0xad02cc
lea esp, [esp + 0x44]
neg ax
jbe 0xad02b6
ja 0xad02b6
inc edx
jecxz 0xad034d
push ss
in eax, 0x5d
cmpsb byte [esi], byte es:[edi]
shl dword [eax + 0x66], 1
pushal
dec ax
jmp 0xad10f3
add cl, dl
lea edx, [esi + esi]
neg dh
jp 0xad0d11
bswap eax
jmp 0xad05c4
jmp 0xad03cd
lea edx, [ebx + ebp]
mov edx, ebx
dec bl
dec eax
jno 0xad0324
pushfd
inc edx
lea esp, [esp]
rdtsc
push dword [esp + 1]
and al, 1
jmp 0xad037c
lea esp, [esp + 4]
neg bl
cmc
jmp 0xad039c
mov dx, bp
mov dx, di
mov al, byte [esp]
call fcn.00ad03ea
mov dh, 0x34
stosb byte es:[edi], al
int 0x3c
jmp dword [ecx + 0xf5a23e0]
rdtsc
push dword [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0xad0351
mov al, byte [esp]
jmp 0xad03a6
jbe 0xad035e
mov dx, bp
mov dx, di
jmp 0xad0386
not bl
xchg edx, eax
lea eax, [ebp*4]
inc eax
jb 0xad0429
sub esp, 6
mov dl, byte [esp + 4]
add esp, 2
sub esp, 0xd
lea esp, [esp + 1]
jmp 0xad048c
pushfd
inc edx
lea esp, [esp]
jmp 0xad0376
mov edx, dword [esp]
mov ah, bh
xchg dl, al
jmp 0xad0538
jmp 0xad045b
sub esp, 0xd
lea esp, [esp + 1]
jmp 0xad048c
sub esp, 6
mov dl, byte [esp + 4]
add esp, 2
jmp 0xad0445
push si
lea esp, [esp + 4]
sub bl, 0x40
call fcn.00ad0476
ret
lea esp, [esp + 0x10]
dec bl
mov dl, byte [esp]
push di
mov eax, dword [esp]
jmp 0xad0467
jo 0xad052a
add esp, 0
lea esp, [esp + 1]
jmp 0xad041d
add esp, 0
lea esp, [esp + 1]
mov edx, dword [esp]
mov ah, bh
xchg dl, al
mov dx, word [esp]
jmp 0xad033a
bswap eax
inc ebp
mov ax, word [esp]
sub esp, 1
jmp 0xad04cb
jmp 0xad05c2
jb 0xad02e8
jae 0xad02e8
stc
jmp 0xad1176
lea eax, [ebp - 9]
mov edx, dword [edx - reloc.KERNEL32.dll_FlushFileBuffers]
call 0xad1154