joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d0413c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x57
pop edi
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.COMCTL32.dll_DSA_GetItemPtr]
test eax, eax
je 0x7d04141a
lea ecx, [ebp + 0xc]
push ecx
push 1
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x7d04141a
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x7d0418ca
Capabilities:
Check os version

Disassembly:
cmp dword [0x7d04eefc], 0
push esi
push 1
pop esi
jne 0x7d0418f2
push 0x7d04ee68
mov dword [0x7d04eefc], esi
mov dword [0x7d04ee68], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
sub eax, 0
je 0x7d04199a
dec eax
je 0x7d04198f
dec eax
je 0x7d041976
dec eax
je 0x7d04196d
dec eax
je 0x7d04195b
dec eax
je 0x7d04193c
dec eax
jne 0x7d04198b
cmp dword [0x7d04ee78], esi
jne 0x7d04198b
cmp dword [0x7d04ee6c], 4
jne 0x7d04198b
cmp dword [0x7d04ee70], 0xa
jne 0x7d04198b
cmp word [0x7d04ee74], 0x7ce
jne 0x7d04198b
jmp 0x7d041987
cmp dword [0x7d04ee78], esi
jne 0x7d04198b
mov eax, dword [0x7d04ee6c]
cmp eax, 4
ja 0x7d041987
jne 0x7d04198b
cmp dword [0x7d04ee70], 0xa
jb 0x7d04198b
jmp 0x7d041987
cmp dword [0x7d04ee78], 2
jne 0x7d04198b
cmp dword [0x7d04ee6c], 5
jmp 0x7d041985
cmp dword [0x7d04ee78], 2
jmp 0x7d04197c
cmp dword [0x7d04ee78], esi
jne 0x7d04198b
cmp dword [0x7d04ee6c], 4
jb 0x7d04198b
mov eax, esi
jmp 0x7d0419a5
xor eax, eax
jmp 0x7d0419a5
xor eax, eax
cmp dword [0x7d04ee78], 2
jmp 0x7d0419a2
xor eax, eax
cmp dword [0x7d04ee78], esi
sete al
pop esi
ret 4

Function at 0x7d0421d6
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x7d04f380
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
pop edi
cmp dword [0x7d04ef4c], edi
jne 0x7d0421ff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0x10], 0
mov dword [0x7d04ef48], edi
jne 0x7d04225a
mov eax, dword [0x7d04ef50]
test eax, eax
jle 0x7d042249
mov ecx, dword [0x7d04ef54]
test eax, eax
lea esi, [ecx + eax*4 - 4]
jle 0x7d042236
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x7d04222d
call eax
sub esi, 4
dec edi
jne 0x7d042225
push 1
pop edi
push dword [0x7d04ef54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [0x7d04ef50], 0
push 0x7d04b01c
push 0x7d04b018
call fcn.7d042292
pop ecx
pop ecx
push 0x7d04b024
push 0x7d04b020
call fcn.7d042292
cmp dword [esp + 0x1c], 0
pop ecx
pop ecx
je 0x7d04227f
push 0x7d04f380
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x7d04228f
push dword [esp + 0xc]
mov dword [0x7d04ef4c], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
ret
Function at 0x7d042573
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x7d04c5fc]
push ebx
xor ebx, ebx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], ebx
je 0x7d042597
cmp eax, ebx
jmp 0x7d04269e
push 4
mov dword [0x7d04c5fc], ebx
call fcn.7d0418ca
test eax, eax
je 0x7d042607
call fcn.7d042777
cmp ax, bx
mov word [0x7d04ef58], ax
je 0x7d042698
movzx eax, ax
nop
lea ecx, [ebp - 0x3c]
push 0x10
push ecx
push 0x58
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x7d042698
test byte [ebp - 0x2d], 8
je 0x7d042698
mov ax, word [0x7d04ef58]
push eax
call fcn.7d0427b4
test eax, eax
je 0x7d042698
mov dword [0x7d04c5fc], 1
jmp 0x7d042698
push 5
call fcn.7d0418ca
test eax, eax
je 0x7d042698
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x7d042698
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push 0x7cf4d1b0
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7d042698
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x7cf35148
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov byte [ebp - 0x11], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.7d0424ba
test eax, eax
je 0x7d042698
mov eax, dword [ebp - 4]
push 1
and eax, 0x3ff
pop ecx
cmp eax, ecx
je 0x7d04268c
cmp eax, 0xd
jne 0x7d042698
mov dword [0x7d04c5fc], ecx
mov word [0x7d04ef58], ax
cmp dword [0x7d04c5fc], ebx
je 0x7d0426b1
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x7d0426b1
mov cx, word [0x7d04ef58]
mov word [eax], cx
mov eax, dword [0x7d04c5fc]
pop ebx
leave
ret 4

Function at 0x7d0426c3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push 2
xor esi, esi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ebx
call fcn.7d0418ca
test eax, eax
je 0x7d04276f
push 5
call fcn.7d0418ca
test eax, eax
jne 0x7d04276f
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x7d04276f
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x7cf4d1b0
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7d04276f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x7cf35148
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov byte [ebp - 0x11], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.7d0424ba
test eax, eax
je 0x7d04276f
mov eax, dword [ebp - 8]
and eax, 0x3ff
cmp eax, 1
je 0x7d04276c
cmp eax, 0xd
jne 0x7d04276f
cmp dword [ebp + 8], ebx
jne 0x7d04276f
push 1
pop esi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x7d0428e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret 4

Function at 0x7d0437d7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x7d043803
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
mov edi, eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
push edi
setne bl
call esi
pop esi
pop edi
mov eax, ebx
pop ebx
ret 4

Function at 0x7d043aac
Capabilities:
Read file via mapping

Disassembly:
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push ParseURLA
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
je 0x7d043aeb
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jne 0x7d043aef
xor eax, eax
jmp 0x7d043afb
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
pop esi
ret 0xc

Function at 0x7d043b4c
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
cmp word [edx], 0x5a4d
je 0x7d043b5b
xor eax, eax
jmp 0x7d043b78
mov ecx, dword [edx + 0x3c]
push 1
add ecx, edx
pop eax
cmp dword [ecx], 0x4550
jne 0x7d043b6e
push 3
pop eax
cmp word [ecx], 0x454e
jne 0x7d043b78
push 2
pop eax
ret 4

Function at 0x7d043b7b
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x7d043b9c
cmp ecx, 0xffffffff
je 0x7d043b9c
cmp word [ecx], 0x5a4d
jne 0x7d043b9c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x7d043b9e
xor eax, eax
ret 4

Function at 0x7d04abc8
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push 0x20
push 2
push 0x7d04abc0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7d04ac0f
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x7d04ac17
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
mov dword [ebp - 4], esi
jmp 0x7d04ac06

Function at 0x7d04ac66
Capabilities:
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.USER32.dll_GetShellWindow]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
call fcn.7cf83942
leave
ret 0x10
Function at 0x7d04ad48
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jne 0x7d04ad5d
mov eax, reloc.SHLWAPI.dll_ParseURLA
lea ecx, [ebp + 8]
push ecx
push 8
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUnreadMail
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x7d04adb3
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, edi
je 0x7d04ada1
mov word [ebx], di
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
pop ebx
jne 0x7d04adb3
xor eax, eax
jmp 0x7d04adc3
jle 0x7d04adc1
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop edi
pop esi
leave
ret 0x10

Function at 0x7d04adcc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
nop
nop
nop
mov eax, dword [ebp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUnreadMail
push 0x7cf350f8
mov edi, 0x200
lea eax, [ebp - 0x404]
push edi
push eax
mov dword [ebp - 0x40c], ecx
call fcn.7d050e7b
mov ebx, eax
xor esi, esi
add esp, 0x14
cmp ebx, esi
jl 0x7d04af22
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x404]
push eax
push reloc.SHLWAPI.dll_ParseURLA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x7d04af14
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.MessageCount
push dword [ebp - 0x408]
call esi
test eax, eax
jne 0x7d04aef8
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea eax, [ebp - 0x418]
push eax
push 3
push 0
push str.TimeStamp
push dword [ebp - 0x408]
call esi
test eax, eax
jne 0x7d04aef8
push edi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.SHLWAPI.dll_PathUnExpandEnvStringsW]
test eax, eax
jne 0x7d04aec2
push dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.7cf8d56d
mov ebx, eax
test ebx, ebx
jl 0x7d04af06
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x404]
push eax
push 1
push 0
push 0x7cf44284
push dword [ebp - 0x408]
call esi
test eax, eax
jne 0x7d04aef8
xor ebx, ebx
jmp 0x7d04af06
jle 0x7d04af04
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7d04af22
jle 0x7d04af20
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
nop
nop
nop
pop edi
pop esi
mov eax, ebx
pop ebx
nop
nop
nop
nop
nop
leave
ret 0xc

Function at 0x7d051548
Capabilities:
Find taskbar

Disassembly:
mov eax, dword [esp + 8]
mov edx, 0x3a8
cmp dword [eax], edx
jb 0x7d051557
mov dword [eax], edx
jmp fcn.7cfa815d
Function at 0x401090
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, eax
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4010b4
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.00401330
lea eax, [esp + 4]
push 0
push eax
call fcn.00425930
mov esi, 0x10
add esp, 8
cmp dword [esp + 0x1c], esi
jb 0x4010ef
mov ecx, dword [esp + 8]
push ecx
call fcn.0040e643
add esp, 4
cmp dword [0x42e4a8], 0
je 0x401117
mov ecx, dword [0x42e498]
cmp dword [0x42e4ac], esi
jae 0x40110b
mov ecx, 0x42e498
call fcn.0040b2da
pop esi
add esp, 0x1c
ret 0x10
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
Function at 0x4042b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426308
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x42d040]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x90], ecx
mov eax, dword [ebp - 0x90]
cmp dword [eax + 0x3c], 0
je 0x4042fc
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x404308
mov al, 1
jmp 0x4044cc
mov dword [ebp - 0x10], 8
call fcn.0040a7d0
push eax
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x90]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0040a7d0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040a6c0
add esp, 8
movzx eax, al
test eax, eax
je 0x404351
xor al, al
jmp 0x4044cc
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00403290
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.004033f0
mov ecx, eax
call fcn.00404070
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00401190
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.004033f0
mov ecx, eax
call fcn.00404070
push eax
mov ecx, dword [ebp - 0x90]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x90]
mov ecx, dword [edx + 0x3c]
call fcn.00405fe0
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x4043de
cmp dword [ebp - 0x94], 1
je 0x4043e8
cmp dword [ebp - 0x94], 3
je 0x404488
jmp 0x4044a0
mov eax, dword [ebp - 0x90]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004033f0
mov ecx, eax
call fcn.00404070
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x40444e
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.004033f0
mov ecx, eax
call fcn.00404070
push eax
call fcn.0040fff7
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x40444e
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401160
mov al, byte [ebp - 0x61]
jmp 0x4044cc
mov ecx, dword [ebp - 0x90]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x404474
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401160
mov al, byte [ebp - 0x62]
jmp 0x4044cc
cmp dword [ebp - 0x38], 0
jne 0x404486
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004032d0
jmp 0x4044b8
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401160
mov al, byte [ebp - 0x63]
jmp 0x4044cc
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401160
mov al, byte [ebp - 0x64]
jmp 0x4044cc
jmp 0x404364
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040e30a
mov esp, ebp
pop ebp
ret
Function at 0x40b997
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov dl, byte [eax + 0x209]
mov esi, ecx
mov ecx, dword [eax + 0x204]
mov byte [ebp - 1], dl
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
sub edi, ecx
mov ebx, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], edx
cmp ecx, edx
jae 0x40ba19
mov dword [ebp + 8], edi
sub dword [ebp + 8], esi
movzx ecx, bl
lea esi, [ecx + eax + 0x100]
mov dl, byte [esi]
add byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
lea ecx, [ecx + eax + 0x100]
mov bl, byte [ecx]
mov byte [esi], bl
mov ebx, dword [ebp - 8]
mov byte [ecx], dl
mov ecx, dword [ebp - 0xc]
lea edi, [ebx + ecx]
mov cl, byte [esi]
add cl, dl
mov edx, dword [ebp + 8]
movzx ecx, cl
mov cl, byte [ecx + eax + 0x100]
xor cl, byte [edx + edi]
inc ebx
mov byte [edi], cl
mov dword [ebp - 8], ebx
cmp ebx, dword [ebp - 0x10]
jb 0x40b9d1
mov cl, byte [ebp - 1]
pop edi
pop esi
mov dword [eax + 0x204], ebx
mov byte [eax + 0x209], cl
pop ebx
leave
ret

Function at 0x40bcae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.0041fa20
mov eax, dword [0x42d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov ecx, ebx
call fcn.00401ab0
push 0x40
push 0x42a0d4
push esi
call fcn.00411ebc
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x40bcea
xor al, al
jmp 0x40bd24
mov esi, 0x10000
jmp 0x40bd04
test ebx, ebx
je 0x40bd04
push eax
lea eax, [ebp - 0x10004]
push eax
mov eax, ebx
call fcn.0040bd32
push edi
push esi
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.00412222
add esp, 0x10
test eax, eax
ja 0x40bcf1
push edi
call fcn.00411cc4
pop ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040e30a
leave
ret
Function at 0x40e30a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d040]
jne 0x40e314
repz ret
jmp fcn.00412269

Function at 0x41b345
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041283a
and dword [ebp - 4], 0
cmp dword [0x42f2dc], 0
mov ebx, eax
jne 0x41b3f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41b4a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41b4a7
push eax
call fcn.004127c8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42f2dc], eax
call esi
push eax
call fcn.004127c8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42f2e0], eax
call esi
push eax
call fcn.004127c8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42f2e4], eax
call esi
push eax
call fcn.004127c8
pop ecx
mov dword [0x42f2ec], eax
test eax, eax
je 0x41b3f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004127c8
pop ecx
mov dword [0x42f2e8], eax
mov eax, dword [0x42f2e8]
cmp eax, ebx
je 0x41b44e
cmp dword [0x42f2ec], ebx
je 0x41b44e
push eax
call fcn.00412843
push dword [0x42f2ec]
mov esi, eax
call fcn.00412843
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41b44e
test edi, edi
je 0x41b44e
call esi
test eax, eax
je 0x41b445
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41b445
test byte [ebp - 0xc], 1
jne 0x41b44e
or dword [ebp + 0x10], 0x200000
jmp 0x41b487
mov eax, dword [0x42f2e0]
cmp eax, ebx
je 0x41b487
push eax
call fcn.00412843
pop ecx
test eax, eax
je 0x41b487
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41b487
mov eax, dword [0x42f2e4]
cmp eax, ebx
je 0x41b487
push eax
call fcn.00412843
pop ecx
test eax, eax
je 0x41b487
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f2dc]
call fcn.00412843
pop ecx
test eax, eax
je 0x41b4a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41b4a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4242b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x4242ef
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x4243f3
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x424370
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x42436b
push 4
push 0x1000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x424344
xor eax, eax
jmp 0x4243f8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040fc20
add esp, 0xc
jmp 0x4242dd
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00424110
add esp, 8
test eax, eax
jne 0x424391
xor eax, eax
jmp 0x4243f8
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4243bc
xor eax, eax
jmp 0x4243f8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004130e0
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
jmp 0x4242dd
mov eax, 1
mov esp, ebp
pop ebp
ret