joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100275b8
Capabilities:
Hash data using sha256

Disassembly:
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, ecx
push ebx
push edi
lea edi, [esi + 0x50]
mov dword [esi + 4], edx
jae 0x100275cf
inc dword [esi + 8]
mov ebx, 0x80
mov byte [eax + edi], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x70
jbe 0x10027609
mov ecx, ebx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov eax, ebx
mov edx, edi
mov dword [esi], ebx
call fcn.1002539a
pop ecx
push esi
call fcn.1002547e
and dword [esi], 0
pop ecx
mov eax, dword [esi]
push 0x70
pop ecx
sub ecx, eax
push ecx
xor ebx, ebx
add eax, edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0xc
mov ecx, eax
shl eax, 3
push edi
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
mov dword [esi + 4], eax
push 0x70
pop eax
mov edx, edi
mov dword [esi + 8], ecx
call fcn.1002539a
mov eax, dword [esi + 8]
pop ecx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ebx
call fcn.1002547e
pop ecx
lea edi, [esi + 0x10]
push edi
push 0x40
pop eax
mov edx, edi
call fcn.1002539a
pop ecx
push 0x40
push edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop ebx
jmp fcn.10025403

Function at 0x1002768e
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x100276b3
push 0xffffffffffffff99
pop edi
jmp 0x100276f5
lea eax, [ebp - 0x20]
push eax
push 0x20
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x100276c9
push 0xffffffffffffff98
jmp 0x100276b0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x20]
push 0x20
push eax
lea eax, [esi + 4]
call fcn.10022722
push pe_nt_image_headers32
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.100276fa
add esp, 0x14
mov eax, edi
pop edi
leave
ret
Function at 0x10027723
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea edx, [eax + 0x20]
mov esi, edx
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x40]
mov esi, 0x4d34d34d
add ecx, esi
add dword [edx], ecx
mov edx, dword [edx]
cmp edx, dword [ebp - 0x2c]
mov ecx, 0x2cb2cb2d
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x24], edx
mov edx, dword [eax + 0x24]
cmp edx, dword [ebp - 0x28]
mov edx, 0x34d34d34
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x28], edi
mov edi, dword [eax + 0x28]
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, esi
add dword [eax + 0x2c], edi
mov edi, dword [eax + 0x2c]
cmp edi, dword [ebp - 0x20]
sbb edi, edi
neg edi
sub edi, ecx
add dword [eax + 0x30], edi
mov edi, dword [eax + 0x30]
cmp edi, dword [ebp - 0x1c]
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x34], edi
mov edx, dword [eax + 0x34]
cmp edx, dword [ebp - 0x18]
sbb edx, edx
neg edx
add edx, esi
add dword [eax + 0x38], edx
mov edx, dword [eax + 0x38]
cmp edx, dword [ebp - 0x14]
mov esi, eax
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x3c], edx
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
sbb ecx, ecx
neg ecx
mov dword [eax + 0x40], ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
mov edx, dword [esi + 0x20]
add edx, dword [esi]
movzx edi, dx
mov esi, edx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, edx
imul esi, edx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [ecx + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x100277d3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, ecx
rol esi, 0x10
add esi, edx
rol edi, 0x10
add edi, esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [eax], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
rol edi, 0x10
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x24]
add edi, esi
rol edx, 0x10
add edx, edi
mov edi, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, esi
rol edx, 8
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x1c]
add edi, edx
add esi, edi
mov dword [eax + 0x10], esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x18]
pop edi
add esi, dword [ebp - 0x20]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, ecx
rol edx, 0x10
add edx, esi
rol ecx, 8
add ecx, dword [ebp - 0x18]
pop esi
add ecx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x10027923
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
shl eax, 0x10
mov ebx, edi
shr ebx, 0x10
or eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
mov ebx, ecx
shl ebx, 0x10
or eax, ebx
mov dword [esi + 0xc], eax
mov eax, edx
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
or eax, ebx
mov dword [esi + 0x14], eax
mov ebx, edx
shr ebx, 0x10
mov eax, edi
shl eax, 0x10
or eax, ebx
mov dword [esi + 0x1c], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov ebx, edx
mov dword [esi + 0x30], eax
mov eax, edx
xor ebx, ecx
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, 0xffff
and ebx, eax
xor ebx, ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], edx
mov ebx, edi
xor ebx, edx
and ebx, eax
xor ebx, edx
mov edx, dword [ebp - 4]
xor edx, edi
and edx, eax
xor edx, edi
mov dword [esi + 0x34], edx
mov edx, dword [ebp - 4]
xor edx, ecx
and edx, eax
xor edx, dword [ebp - 4]
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x10], edi
mov dword [esi], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], edx
pop edi
mov eax, esi
call fcn.10027723
dec edi
jne 0x100279d9
pop edi
xor ecx, ecx
lea eax, [esi + 0x20]
pop ebx
lea edx, [ecx - 4]
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jb 0x100279ea
push 8
lea eax, [esi + 0x20]
pop ecx
mov edx, dword [eax - 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [eax]
mov dword [eax + 0x44], edx
add eax, 4
dec ecx
jne 0x10027a04
mov eax, dword [esi + 0x40]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10027a2c
mov edx, esi
call fcn.1002789b
leave
ret
Function at 0x10027a2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x10
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
jb 0x10027ab8
mov ecx, dword [ebp + 0xc]
shr ecx, 4
lea eax, [esi + 0x44]
mov dword [ebp - 4], ecx
call fcn.10027723
movzx edx, word [esi + 0x5a]
mov ecx, dword [esi + 0x50]
shl ecx, 0x10
xor edx, ecx
xor edx, dword [eax]
mov ecx, dword [ebp + 8]
xor edx, dword [ebx]
sub dword [ebp + 0xc], 0x10
mov dword [ecx], edx
movzx edx, word [esi + 0x62]
mov edi, dword [esi + 0x58]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx + 4]
add ecx, 0x10
xor edx, dword [esi + 0x4c]
add ebx, 0x10
mov dword [ecx - 0xc], edx
movzx edx, word [esi + 0x4a]
mov edi, dword [esi + 0x60]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 8]
mov dword [ebp + 8], ecx
xor edx, dword [esi + 0x54]
mov dword [ecx - 8], edx
movzx edx, word [esi + 0x52]
mov edi, dword [esi + 0x48]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 4]
xor edx, dword [esi + 0x5c]
dec dword [ebp - 4]
mov dword [ecx - 4], edx
jne 0x10027a4d
cmp dword [ebp + 0xc], 0
je 0x10027b37
lea eax, [esi + 0x44]
call fcn.10027723
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, ecx
mov eax, edx
shl eax, 0x10
shr edi, 0x10
xor eax, edi
xor eax, dword [esi + 0x44]
mov edi, dword [esi + 0x60]
mov dword [ebp - 0x14], eax
shl ecx, 0x10
mov eax, edi
shr eax, 0x10
xor eax, ecx
xor eax, dword [esi + 0x4c]
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov ecx, eax
shr ecx, 0x10
xor ecx, edi
xor ecx, dword [esi + 0x54]
shl eax, 0x10
shr edx, 0x10
xor eax, edx
xor eax, dword [esi + 0x5c]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jbe 0x10027b37
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ebx
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
jb 0x10027b25
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002aff6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003ba30]
jne 0x1002b000
repz ret
jmp fcn.1002b23e
Function at 0x405a40
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40f79c], eax
mov dword [0x40e224], edx
call fcn.00406360
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [0x40e2aa], eax
xor eax, eax
mov dword [0x40fec4], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x40e2b0], al
shr eax, 0x10
push 0x104
mov word [0x40e2b2], ax
xor eax, eax
mov ebx, 0x208
mov ax, word [0x40e2b2]
and edx, 0xffff
mov dword [0x40e2b4], eax
xor eax, eax
sar edx, 8
mov al, byte [0x40e2b0]
and edx, 0xff
mov dword [0x40e2b8], eax
xor eax, eax
mov byte [0x40e2b1], dl
mov al, dl
mov edx, dword [0x40e2b8]
push 0x40f7a0
shl edx, 8
push 0
or edx, eax
mov dword [0x40e2bc], eax
mov dword [0x40e2c0], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40f8a4
xor eax, eax
mov dword [0x40e278], 0x40f7a0
call fcn.00406490
mov dword [0x40e284], 0x40f8a4
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00406530
mov edx, eax
mov bl, byte [eax]
mov dword [0x40f798], eax
cmp bl, 0x22
je 0x405b34
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4049d1], 2
je 0x405b4c
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4049d1], 2
je 0x405b53
inc eax
jmp 0x405b24
inc eax
cmp bl, byte [eax]
je 0x405b44
cmp byte [eax], 0
je 0x405b44
inc eax
cmp byte [eax], 0x22
jne 0x405b39
cmp byte [eax], 0
je 0x405b24
inc eax
jmp 0x405b24
test dl, dl
je 0x405b24
inc eax
jmp 0x405b17
mov dword [0x40e274], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x405bc7
call fcn.00406570
mov edx, eax
mov bx, word [eax]
mov dword [0x40f794], eax
cmp bx, 0x22
je 0x405b9a
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4049d1], 2
je 0x405bbc
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4049d1], 2
je 0x405bcc
add eax, 2
jmp 0x405b88
add eax, 2
cmp bx, word [eax]
je 0x405bb1
cmp word [eax], 0
je 0x405bb1
add eax, 2
cmp word [eax], 0x22
jne 0x405ba2
cmp word [eax], 0
je 0x405b88
add eax, 2
jmp 0x405b88
cmp word [eax], 0
je 0x405b88
add eax, 2
jmp 0x405b7b
mov eax, 0x405a00
mov dword [0x40e280], eax
test edi, edi
jne 0x405bde
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40faac
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40fbb0
mov eax, esi
mov dword [0x40e27c], 0x40faac
call fcn.00406490
mov dword [0x40e288], 0x40fbb0
mov eax, 1
pop edi
pop esi
pop ecx
ret

Function at 0x407420
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x407437
inc edx
jmp 0x40742c
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x405ce0
Function at 0x408290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x40e400]
test eax, eax
je 0x4082ac
cmp dword [0x40e270], 0xfffffffe
jne 0x4082b2
xor eax, eax
add esp, 4
pop edx
pop ecx
ret
mov eax, esp
call fcn.00408240
test eax, eax
je 0x4082ac
push 0x40
push 0x1000
mov ecx, dword [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, eax
test eax, eax
je 0x4082ac
mov eax, dword [esp]
sub eax, 4
cmp eax, dword [esp]
ja 0x4082aa
mov dword [esp], eax
cmp eax, 0x38
jb 0x4082aa
mov dword [edx], eax
mov eax, edx
call fcn.004081c0
mov ecx, eax
mov eax, dword [eax]
mov dword [esp], eax
or al, 1
mov dword [ecx], eax
mov dword [edx + 0x14], 0
lea eax, [ecx + 4]
inc dword [edx + 0x18]
call fcn.004065a0
mov eax, 1
add esp, 4
pop edx
pop ecx
ret

Function at 0x408bd0
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x14
mov ebp, eax
mov dword [esp], 2
mov edx, 0x3d
mov dword [esp + 4], 1
call fcn.004090c0
mov ebx, eax
test eax, eax
je 0x408bfe
cmp eax, ebp
jne 0x408c0d
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
sub eax, ebp
mov dword [esp + 0xc], eax
inc eax
call fcn.004075d0
mov edx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x408bfe
mov ecx, dword [esp + 0xc]
mov esi, ebp
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0xc]
lea esi, [ebx + 1]
mov byte [edx + eax], 0
mov eax, esi
call fcn.00409120
mov ebx, eax
test eax, eax
je 0x408cd3
inc eax
call fcn.004075d0
mov dword [esp + 0x10], eax
test eax, eax
je 0x408cbd
mov ecx, ebx
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, edi
mov byte [ebx], 0
mov edx, dword [esp + 0x10]
push edx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, dword [esp + 8]
call fcn.004065a0
mov eax, dword [esp + 0x10]
call fcn.004065a0
test edx, edx
jne 0x408cd9
cmp dword [esp + 0x10], 0
jne 0x408bfe
xor eax, eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, edx
call fcn.004065a0
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov dword [esp + 0x10], eax
jmp 0x408c7e
mov eax, ebp
call fcn.00408e60
test eax, eax
jne 0x408bfe
cmp dword [0x40fec8], 0
je 0x408c03
mov eax, ebp
call fcn.00409120
lea ebx, [eax + 1]
mov eax, dword [esp]
imul eax, ebx
call fcn.004075d0
mov ecx, eax
test eax, eax
je 0x408d41
imul ebx, dword [esp + 4]
mov edx, ebp
call fcn.00409150
cmp eax, 0xffffffff
jne 0x408d5a
mov eax, ecx
call fcn.004065a0
mov eax, 0xe
call fcn.004076ca
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, 5
call fcn.004076ca
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.004093f0
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10005f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x10056280]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov ecx, 1
mov byte [esp + 8], 0x3a
mov byte [esp + 9], 0x5c
mov byte [esp + 0xa], 0x2f
mov byte [esp + 0xb], 0x2a
mov byte [esp + 0xc], 0x3f
mov byte [esp + 0xd], 0x22
mov byte [esp + 0xe], 0x3c
mov byte [esp + 0xf], 0x3e
mov byte [esp + 0x10], 0x7c
mov byte [esp + 0x11], 0
cmp byte [eax], 0
push ebp
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov ebp, eax
je 0x10006052
push ebx
push esi
push edi
cmp byte [esp + 0x18], 0
mov edi, 1
lea ebx, [esp + 0x18]
je 0x1000600f
cmp edi, 1
jne 0x10006018
movsx esi, byte [ebp]
push esi
call fcn.10033dff
add esp, 4
test eax, eax
jne 0x10005fea
push esi
call fcn.1003437c
add esp, 4
test eax, eax
je 0x10005fea
mov al, byte [ebp]
cmp al, byte [ebx]
jne 0x10005ffa
mov cl, byte [esp + 0x30]
mov edx, dword [esp + 0x10]
xor edi, edi
mov byte [edx], cl
mov dword [esp + 0x14], edi
push ebx
call fcn.100332de
mov ebx, eax
add esp, 4
cmp byte [ebx], 0
jne 0x10005fc0
cmp edi, 1
jne 0x10006018
mov al, byte [ebp]
mov ecx, dword [esp + 0x10]
mov byte [ecx], al
push ebp
call fcn.100332de
mov edx, dword [esp + 0x14]
push edx
mov ebp, eax
call fcn.100332de
add esp, 8
cmp byte [ebp], 0
mov dword [esp + 0x10], eax
jne 0x10005fb0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1003158d
add esp, 0x18
ret
mov eax, ecx
mov ecx, dword [esp + 0x18]
pop ebp
xor ecx, esp
call fcn.1003158d
add esp, 0x18
ret
Function at 0x10012e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
push 0x1004f0b4
push 3
call fcn.10006a40
add esp, 0xc
push ebp
lea ecx, [esp + 0x24]
lea ebx, [esp + 0x8c]
call fcn.100034e0
mov esi, eax
mov eax, dword [esp + 0xc0]
mov ecx, 9
lea edi, [esp + 0x48]
add esp, 4
test eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x20]
je 0x10012eb3
mov dword [eax], ecx
cmp ecx, 1
je 0x10012ec8
push ebp
push 0x1004f0cc
push 2
call fcn.10006a40
add esp, 0xc
lea eax, [esp + 0x44]
push eax
call fcn.10012d10
mov edi, dword [0x100430e0]
add esp, 4
lea ecx, [esp + 0x68]
push ecx
call edi
lea edx, [esp + 0x68]
push edx
mov esi, 0x1004f0fc
call fcn.10012c90
movzx ecx, word [esp + 0x4c]
movzx edx, word [esp + 0x50]
mov ax, word [esp + 0x48]
mov word [esp + 0x16], cx
movzx ecx, word [esp + 0x54]
mov word [esp + 0x1a], cx
movzx ecx, word [esp + 0x5c]
mov word [esp + 0x18], dx
movzx edx, word [esp + 0x58]
mov word [esp + 0x1e], cx
movzx ecx, word [esp + 0x64]
mov word [esp + 0x1c], dx
movzx edx, word [esp + 0x60]
mov word [esp + 0x22], cx
mov ecx, dword [esp + 0x18]
mov word [esp + 0x20], dx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x20]
mov word [esp + 0x14], ax
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], ecx
mov cx, word [esp + 0x6c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1c]
add esp, 4
cmp ax, cx
mov dword [esp + 0x2c], edx
je 0x10012f90
movzx edx, cx
movzx eax, ax
lea esi, [edx + 1]
cmp eax, esi
je 0x10012f90
push edx
push 0x1004f100
push 4
mov word [esp + 0x30], cx
call fcn.10006a40
add esp, 0xc
mov esi, dword [0x100430b4]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x28]
push edx
call esi
lea eax, [esp + 0x78]
push eax
call edi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x7c]
push edx
call esi
mov eax, dword [esp + 0x64]
push 0
cdq
push 0x989680
push edx
push eax
call fcn.10040c70
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, eax
add edi, dword [esp + 0x3c]
mov esi, edx
adc esi, dword [esp + 0x40]
push 0
mov eax, edi
sub eax, ebp
mov ecx, esi
push 0x989680
sbb ecx, ebx
push ecx
push eax
call fcn.1003d470
cmp esi, ebx
mov edx, dword [esp + 0xb8]
mov dword [edx], eax
jg 0x1001302c
jl 0x10013005
cmp edi, ebp
ja 0x1001302c
mov eax, dword [esp + 0xb4]
push eax
push 0x1004f128
push 4
call fcn.10006a40
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
mov ecx, dword [esp + 0xb4]
push ecx
push 0x1004f144
push 4
call fcn.10006a40
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0
ret
Function at 0x41ec7c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415f82
and dword [ebp - 0x14], 0
cmp dword [0x46b150], 0
mov dword [ebp - 0x18], eax
jne 0x41ed2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41edd7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41edd7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46b150], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46b154], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46b158], eax
call edi
push eax
call esi
mov dword [0x46b160], eax
test eax, eax
je 0x41ed2f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46b15c], eax
mov eax, dword [0x46b15c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ed88
cmp dword [0x46b160], ecx
je 0x41ed88
push eax
call esi
push dword [0x46b160]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ed88
test ebx, ebx
je 0x41ed88
call edi
test eax, eax
je 0x41ed7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41ed7f
test byte [ebp - 8], 1
jne 0x41ed88
or dword [ebp + 0x10], 0x200000
jmp 0x41edbb
mov eax, dword [0x46b154]
cmp eax, dword [ebp - 0x18]
je 0x41edbb
push eax
call esi
test eax, eax
je 0x41edbb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41edbb
mov eax, dword [0x46b158]
cmp eax, dword [ebp - 0x18]
je 0x41edbb
push eax
call esi
test eax, eax
je 0x41edbb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b150]
call esi
test eax, eax
je 0x41edd7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41edd9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004106c7
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
invalid
invalid
Function at 0x91b45c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x91b462
pop ebp
sub ebp, 6
sub ebp, 0x51b45c
jmp 0x91b4c0
jmp 0x91b4c9
mov eax, 0x51b45c
add eax, ebp
add eax, 0x93
mov ecx, 0x61f
mov edx, 0xfb9a7c1c
xor byte [eax], dl
inc eax
dec ecx
jne 0x91b4e0
jmp 0x91b4f3
jbe 0x91b551
je 0x91b513
or al, 0x1c
sbb al, 0x74
sbb al, 0xd0
xor byte [edi + ebp], bl
fmul qword [ebx - 0x77]
and ch, bh
pop ebx
sbb al, 0x4c
xchg edi, eax
rcl dword [edi + 0x1c1c2095]
sbb al, 0x9d
fucom st(4)
sbb al, 0x1c
sbb al, 0x1f
in al, 0x1c
sbb al, 0x1c
pop ds
shl dword [edx + ebx - 0x59e3e3e4], 1
xor al, 0x1c
sbb al, 0x1c
jmp 0x91b523
adc al, 0x1c
sbb al, 0x1c
xchg edi, eax
mov dword [eax], edx
sbb al, 0x1c
sbb al, 0x97
xchg ecx, eax
or al, 0x1c
sbb al, 0x1c
invalid