joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x453004]
jne 0x401010
repz ret
jmp fcn.00401460

Function at 0x4082b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058a1
and dword [ebp - 4], 0
cmp dword [0x455798], 0
mov ebx, eax
jne 0x408366
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408417
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408417
push eax
call fcn.0040582f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x455798], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45579c], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4557a0], eax
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4557a8], eax
test eax, eax
je 0x408366
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4557a4], eax
mov eax, dword [0x4557a4]
cmp eax, ebx
je 0x4083be
cmp dword [0x4557a8], ebx
je 0x4083be
push eax
call fcn.004058aa
push dword [0x4557a8]
mov esi, eax
call fcn.004058aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083be
test edi, edi
je 0x4083be
call esi
test eax, eax
je 0x4083b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083b5
test byte [ebp - 0xc], 1
jne 0x4083be
or dword [ebp + 0x10], 0x200000
jmp 0x4083f7
mov eax, dword [0x45579c]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083f7
mov eax, dword [0x4557a0]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x455798]
call fcn.004058aa
pop ecx
test eax, eax
je 0x408417
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408419
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b7b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
push esi
cmp ebx, 0x19f
jne 0x40b7c6
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor esi, esi
cmp ebx, ebp
jle 0x40b801
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
call fcn.0040b7a0
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0x64
mov dword [esp + 8], eax
sub dword [esp + 8], 0x64
mov cl, byte [esp + 8]
xor byte [esi + edi], cl
inc esi
cmp esi, ebx
jl 0x40b7d0
pop esi
pop ebp
cmp ebx, 0x2d
jne 0x40b81c
mov dword [0x2b0e1e0], 0xa62e7790
mov dword [0x2b0e1e4], 0xffffffff
add esp, 8
ret
Function at 0x100028b0
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
lea edi, [ebp - 0x10]
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10171126
call fcn.10009c40
mov esi, esp
push 0x105
push 0x1016db20
push 0x1016dd34
push 0x1016dd30
push 0x1016dd2c
push 0x105
push 0x1016d910
push 0x1000d7e8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp esi, esp
call fcn.10009c10
test eax, eax
je 0x10002972
mov dword [ebp - 8], 0xee3d8
mov eax, dword [0x1016dd2c]
cmp eax, dword [ebp - 8]
jne 0x10002972
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
je 0x10002935
jmp 0x1000296b
mov esi, esp
push str.Ultra.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.10009c10
test eax, eax
je 0x1000296b
mov esi, esp
push 0
push 0
push 0
push 0x10002560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10009c10
mov eax, 1
jmp 0x10002978
jmp 0x10002976
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.10009c10
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004f40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1017121e
call fcn.10009c40
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], 0
jmp 0x10004fa3
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x28
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x14], edx
jge 0x100050b9
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x10], 0
jne 0x1000502d
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
jle 0x10005028
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
add edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.10009c10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10005001
xor eax, eax
jmp 0x100050be
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x20]
push eax
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
jmp 0x10004f91
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 0x44]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
call fcn.10004ed0
test eax, eax
jne 0x1000504e
xor eax, eax
jmp 0x100050be
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.10009c10
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10005082
xor eax, eax
jmp 0x100050be
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 8], ecx
jmp 0x10004f91
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.10009c10
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10006a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x60]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x1016d640]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov ecx, 0x1017121a
call fcn.10009c40
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x10006aa8
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10006aaf
mov al, 1
jmp 0x10006bb0
call fcn.10007ce0
mov esi, esp
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
call eax
cmp esi, esp
call fcn.10009c10
push eax
call fcn.10007ce0
push eax
call fcn.10007d20
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10006ae8
xor al, al
jmp 0x10006bb0
mov dword [ebp - 0x18], 0x20
mov esi, esp
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x38]
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
cmp esi, esp
call fcn.10009c10
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10006b3a
cmp dword [ebp - 0x120], 1
je 0x10006b41
cmp dword [ebp - 0x120], 3
je 0x10006ba3
jmp 0x10006bae
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x40]
sub eax, ecx
mov dword [ebp - 0x58], eax
je 0x10006b7a
mov esi, esp
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x58]
push edx
push 1
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.10009c10
cmp dword [ebp - 0x58], eax
je 0x10006b7a
xor al, al
jmp 0x10006bb0
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10006b91
mov dword [ebp - 0x120], 1
jmp 0x10006b9b
mov dword [ebp - 0x120], 0
mov al, byte [ebp - 0x120]
jmp 0x10006bb0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x10006bb0
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x10006be0]
call fcn.10009bb0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009c80
add esp, 0x120
cmp ebp, esp
call fcn.10009c10
mov esp, ebp
pop ebp
ret
Function at 0x10009500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x1017121a
call fcn.10009c40
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10009556
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
cmp esi, esp
call fcn.10009c10
jmp 0x10009668
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov esi, esp
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
cmp esi, esp
call fcn.10009c10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp + 0x10], 0
jl 0x10009610
jg 0x10009590
cmp dword [ebp + 0xc], 0
jbe 0x10009610
cmp dword [ebp - 0x24], 0
jl 0x10009610
jg 0x1000959e
cmp dword [ebp - 0x28], 0
jbe 0x10009610
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x24]
jg 0x100095bc
jl 0x100095b0
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x28]
jae 0x100095bc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov esi, esp
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp esi, esp
call fcn.10009c10
push eax
call fcn.10007b30
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x24]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x28]
mov esi, esp
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp esi, esp
call fcn.10009c10
cmp dword [ebp + 0x10], 0
jl 0x1000965c
jg 0x1000961e
cmp dword [ebp + 0xc], 0
jbe 0x1000965c
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1000965c
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.10009c10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
sbb edx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0xec
cmp ebp, esp
call fcn.10009c10
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f1c7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a19b
mov dword [ebp - 0x14], eax
cmp dword [0x47bfdc], esi
jne 0x40f2ba
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f247
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f39a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f39a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f39a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x47bfdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x47bfe0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x47bfe4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47bfec], eax
test eax, eax
je 0x40f2b7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47bfe8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2df
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2d2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2f4
push 4
pop eax
jmp 0x40f39c
cmp dword [ebp - 0x14], esi
je 0x40f2f4
push dword [0x47bfdc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2d9
mov eax, dword [0x47bfe8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f352
cmp dword [0x47bfec], edi
je 0x40f352
push eax
call ebx
push dword [0x47bfec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f352
test eax, eax
je 0x40f352
call ecx
test eax, eax
je 0x40f347
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f347
test byte [ebp - 8], 1
jne 0x40f352
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f382
mov eax, dword [0x47bfe0]
cmp eax, edi
je 0x40f37f
push eax
call ebx
test eax, eax
je 0x40f37f
call eax
mov esi, eax
test esi, esi
je 0x40f37f
mov eax, dword [0x47bfe4]
cmp eax, edi
je 0x40f37f
push eax
call ebx
test eax, eax
je 0x40f37f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x47bfdc]
call ebx
test eax, eax
je 0x40f39a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f39c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040485b
mov esp, ebp
pop ebp
ret
Function at 0x40f1c7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a19b
mov dword [ebp - 0x14], eax
cmp dword [0x813edc], esi
jne 0x40f2ba
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40f247
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40f39a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40f39a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f39a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813edc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813ee0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813ee4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813eec], eax
test eax, eax
je 0x40f2b7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813ee8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40f2df
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40f2d2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40f2f4
push 4
pop eax
jmp 0x40f39c
cmp dword [ebp - 0x14], esi
je 0x40f2f4
push dword [0x813edc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40f2d9
mov eax, dword [0x813ee8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40f352
cmp dword [0x813eec], edi
je 0x40f352
push eax
call ebx
push dword [0x813eec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40f352
test eax, eax
je 0x40f352
call ecx
test eax, eax
je 0x40f347
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40f347
test byte [ebp - 8], 1
jne 0x40f352
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40f382
mov eax, dword [0x813ee0]
cmp eax, edi
je 0x40f37f
push eax
call ebx
test eax, eax
je 0x40f37f
call eax
mov esi, eax
test esi, esi
je 0x40f37f
mov eax, dword [0x813ee4]
cmp eax, edi
je 0x40f37f
push eax
call ebx
test eax, eax
je 0x40f37f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813edc]
call ebx
test eax, eax
je 0x40f39a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40f39c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040485b
mov esp, ebp
pop ebp
ret
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x412290
pop dword [ebp - 0x34]
mov eax, 0x21691ae0
add eax, 0xded807b0
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x38a82
push 0
mov eax, 0xb5ff47ba
add eax, 0x4a434872
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x6019bc57
sub ecx, 0x601975e6
xor ebx, ebx
add ebx, eax
mov esi, 0x879c9bd4
sub esi, 0x87592dd4
add esi, dword [ebp - 0x34]
mov edi, 0xde0091ec
sub edi, 0x76fa649e
add dword [ebp - 0x24], 0x210d45
mov edx, dword [esi]
xor dword [ebp - 0x2c], ecx
xor edx, edi
add dword [ebp - 0x18], ebx
mov dword [ebx], edx
xor dword [ebp - 0x1c], 0x8de57d8c
add ebx, 0x95c65d0b
sub ebx, 0x95c65d07
add esi, 0x90ae0fe
sub esi, 0x90ae0fa
loop 0x4122f1
add eax, 0xfd40ec7d
add eax, 0x2c0201a
xor ebx, ebx
add ebx, eax
add eax, 0x35cd4492
sub eax, 0x35cd448d
mov ecx, 0x74a535b4
sub ecx, 0x746535b4
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40596d
pop dword [ebp - 0x24]
mov eax, 0x40596d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x475f405a
sub dword [ebp - 0x34], 0xf90cfb0f
mov dword [ebp - 0x30], 0x93f9114e
sub dword [ebp - 0x30], 0x61c5c509
mov dword [ebp - 0x2c], 0x82611e82
sub dword [ebp - 0x2c], 0x3614da54
mov dword [ebp - 0x28], 0x18b8a09b
sub dword [ebp - 0x28], 0x18b8a09b
lea eax, [ebp - 0x34]
push eax
mov eax, 0x90407c15
sub eax, 0x90000bb5
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x8a1c0c9
sub dword [ebp - 0x34], 0x942f5773
mov dword [ebp - 0x30], 0x69e60ea3
add dword [ebp - 0x30], 0xd78652d2
mov dword [ebp - 0x2c], 0x797e9a64
sub dword [ebp - 0x2c], 0x160f2df8
mov dword [ebp - 0x28], 0xcd2253a6
sub dword [ebp - 0x28], 0xcd2253a6
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x349cf
push 0
call eax
mov ecx, 0x3f96
xor edx, edx
add edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x24]
mov esi, 0x332de3b8
add esi, 0x77147b99
add dword [ebp - 0x20], eax
mov ebx, dword [edi]
xor dword [ebp - 0x20], 0x41468333
sub ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x18], edi
add edx, 4
add edi, 0x3c5126c1
add edi, 0xc3aed943
loop 0x405a7b
add eax, 0xa60372da
sub eax, 0xa60281af
mov ebx, eax
add eax, 0x164e87f8
sub eax, 0x164e87f3
mov ecx, 0x3242d70f
add ecx, 0xcdfd28f1
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x405fc4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp byte [0x4e7268], 0
jne 0x406109
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + str.0123456789ABCDEF]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
inc eax
cmp eax, 8
jne 0x405fe0
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x4e7264], eax
cmp dword [0x4e7264], 0
jne 0x4060ae
mov eax, dword [sym.imp.rtl250.bpl__System_IsLibrary]
cmp byte [eax], 0
jne 0x406069
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x4e7264], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x4e7264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x4e724c
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x4e724c], fcn.004049d0
mov dword [0x4e7250], 0x404cb4
mov dword [0x4e7254], 0x404e34
mov dword [0x4e7258], 0x4050c4
mov dword [0x4e725c], 0x405298
mov dword [0x4e7260], 0x4052e4
mov byte [0x4e7269], 1
jmp 0x4060ee
push 0
push 0
push 0
push 4
mov eax, dword [0x4e7264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, dword [eax]
mov edi, 0x4e724c
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [0x4e7264]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x4e7264], eax
mov byte [0x4e7269], 0
mov eax, 0x4e7234
call sub.rtl250.bpl__System_GetMemoryManager_qqrr23System_TMemoryManagerEx
mov eax, 0x4e724c
call sub.rtl250.bpl__System_SetMemoryManager_qqrrx23System_TMemoryManagerEx
mov byte [0x4e7268], 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4091d0
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x4e0a70], 0
jne 0x409208
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4091ff
movzx eax, word [esp]
mov word [0x4e0a70], ax
jmp 0x409208
mov word [0x4e0a70], 0x2c
movzx eax, word [0x4e0a70]
pop edx
ret