joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf2c
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x437d66
call fcn.00425651
mov edi, dword [ebp + 8]
push edi
call fcn.004087c3
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.00404bf2
pop ecx
mov byte [ebp - 4], 1
call fcn.00417923
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0041d9e5
push dword [edi]
mov byte [ebp - 0xd], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41bf77
mov byte [ebp - 0xd], 1
mov eax, dword [edi]
push ebx
push ebx
push 4
push ebx
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x41bf98
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], bl
je 0x41bfcb
push dword [edi]
call fcn.0040ac6a
push ebx
call fcn.00423949
pop ecx
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, 0x442d88
call fcn.00412e3d
mov byte [ebp - 4], 2
push edi
mov byte [ebp - 4], bl
call fcn.0040c2b0
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00425729
ret 4

Function at 0x41c7d8
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x4378a1
call fcn.00425651
lea eax, [ebp - 0x10]
push eax
call fcn.00412e3d
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea esi, [ebp - 0x10]
call fcn.0041c108
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push 1
push str.InstallDir
mov ebx, str.SoftwareAdvancedSystemRepairPro
push ebx
push SysReAllocString
call edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
call fcn.0041c108
push eax
push 1
push str.InstallDir
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041d9e5
call fcn.00425729
ret

Function at 0x41d56d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x44dd60]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x437871
call fcn.00425651
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x1c], esi
call fcn.00423ac0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
xor eax, eax
cmp byte [ebp + 0x214], bl
push str.InstallDir
setne al
push str.SoftwareAdvancedSystemRepairPro
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x104
add eax, 0x80000001
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
shr eax, 1
mov word [ebp + eax*2], cx
push esi
lea ecx, [ebp]
call fcn.00412e3d
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040ea6c
add ebp, 0x20c
leave
ret
Function at 0x420a1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x420aaa
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00423b40
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x420a6a
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x420a8c
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x420b68
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x420ad2
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x420add
xor eax, eax
jmp 0x420b29
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x420afa
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.0042136b
jmp 0x420b0a
cmp ecx, 2
jne 0x420b13
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00422c9d
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.00423b40
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x420b54
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x420b68
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x420a28
pop edi
pop ebx
leave
ret
Function at 0x423079
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x44dd60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x423111
push 0x43ed64
push 4
push eax
call fcn.00424714
push eax
call fcn.00409567
add esp, 0x10
push ebx
push edi
call fcn.004257dc
mov edi, dword [eax]
call fcn.004257dc
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00425779
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004257dc
cmp dword [eax], ebx
je 0x423128
call fcn.004257dc
push dword [eax]
call fcn.00416770
pop ecx
jmp 0x42312f
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4230bc
jmp 0x4231b6
call fcn.004257dc
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x4231b2
cmp dword [ebp - 0x234], esi
jae 0x4231b2
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00423ac0
add esp, 0xc
push 0x43e974
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4231a1
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4231a1
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4231a1
push ebx
push ebx
push esi
jmp 0x4231aa
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4231b4
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ea6c
leave
ret
Function at 0x410d63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae06
and dword [ebp - 0x14], 0
cmp dword [0x430110], 0
mov dword [ebp - 0x18], eax
jne 0x410e16
push 0x4038dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410ebe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038d0
push ebx
call edi
test eax, eax
je 0x410ebe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038c0
push ebx
mov dword [0x430110], eax
call edi
push eax
call esi
push 0x4038ac
push ebx
mov dword [0x430114], eax
call edi
push eax
call esi
push 0x403890
push ebx
mov dword [0x430118], eax
call edi
push eax
call esi
mov dword [0x430120], eax
test eax, eax
je 0x410e16
push 0x403878
push ebx
call edi
push eax
call esi
mov dword [0x43011c], eax
mov eax, dword [0x43011c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410e6f
cmp dword [0x430120], ecx
je 0x410e6f
push eax
call esi
push dword [0x430120]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410e6f
test ebx, ebx
je 0x410e6f
call edi
test eax, eax
je 0x410e66
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410e66
test byte [ebp - 8], 1
jne 0x410e6f
or dword [ebp + 0x10], 0x200000
jmp 0x410ea2
mov eax, dword [0x430114]
cmp eax, dword [ebp - 0x18]
je 0x410ea2
push eax
call esi
test eax, eax
je 0x410ea2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410ea2
mov eax, dword [0x430118]
cmp eax, dword [ebp - 0x18]
je 0x410ea2
push eax
call esi
test eax, eax
je 0x410ea2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x430110]
call esi
test eax, eax
je 0x410ebe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410ec0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a41
leave
ret
Function at 0x4134e0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004118d0
cmp dword [0x7b3eac], 0x37
jne 0x41357a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x7b4ea0]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x434efc]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x413800
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7b3eac]
sub esp, 0x974
push ebx
push ebp
push esi
mov esi, dword [0x434efc]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x4139ff
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x413836
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7b3eac], 0x1c
jne 0x41384d
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x42bd78]
mov ebx, dword [0x42bd80]
mov ebp, dword [0x42bd84]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x42bd7c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x413896
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x7b3e1c], edi
mov eax, dword [esp + 0x1c]
add dword [0x7b3e1c], eax
mov eax, dword [0x7b3e1c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0x7b3eac], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x41392d
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x7b3eac], 0x979
mov dword [0x7b3e20], 0xff6b3619
mov dword [0x7b3e24], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x413977
push 0
lea ecx, [esp + 0x184]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0x7b3eac]
cmp eax, 0x93
je 0x41399d
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x413890
cmp eax, 0x8d4
jne 0x4139b4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x7b3eac], 0x17
jne 0x4139ee
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404080
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x413830
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret
Function at 0x960058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9601a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x96007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x96006a
add dl, dl
jne 0x960089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9600dc
xor eax, eax
add dl, dl
jne 0x960096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x96017d
add dl, dl
jne 0x9600a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9600b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9600bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9600c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9600d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x960075
mov eax, 1
add dl, dl
jne 0x9600ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9600f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9600e1
sub eax, ebx
mov ebx, 1
jne 0x960128
mov ecx, 1
add dl, dl
jne 0x96010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x960119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x960105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x960075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x96013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x96014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x960136
cmp eax, 0x7d00
jae 0x96016d
cmp eax, 0x500
jb 0x960168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x960075
cmp eax, 0x7f
ja 0x960170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x960075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x96019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x960075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4010fd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
xchg esi, edi
push esi
push edi
push ebx
push ebp
call fcn.00401000
mov edi, eax
sub edi, 0x80090305
mov dword [ebp - 0x18], edi
and dword [ebp - 4], edi
clc
xor eax, eax
mov ebx, eax
or ebx, 0x5a4ec6
not ebx
inc ebx
sub edi, ebx
add edi, dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
mov ecx, ebp
mov edx, 0x1a8
neg edx
add ecx, edx
mov dword [ebp - 0x10], ecx
xor edx, edx
sub edx, section..data
neg edx
mov dword [ebp - 0x28], 0
xor dword [ebp - 0x28], edx
mov esi, dword [ebp - 0x10]
mov ebx, 0xfffffff0
sub esi, ebx
mov dword [ebp - 0x1c], esi
sub dword [ebp - 4], 0x30
xor esi, esi
dec esi
not dword [ebp - 4]
sub dword [ebp - 4], esi
push dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp - 0xc]
lea edi, [ebp - 0x1a8]
push edi
call fcn.00401238
xor esi, esi
or esi, dword [ebp - 0x10]
add esi, 4
mov esi, dword [esi]
mov edi, dword [ebp - 0x10]
add esi, dword [edi]
mov dword [ebp - 0x24], esi
mov esi, 0x40
push esi
and dword [ebp - 0x18], 0
mov edx, 0x3000
push edx
lea edx, [ebp - 0x24]
push edx
push 0
xor edx, edx
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x20]
push edx
push 0xffffffffffffffff
call dword [sym.imp.NTDLL.dll_NtAllocateVirtualMemory]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 8], edx
mov dword [ebp - 0x20], 0x400000
and dword [ebp - 0x1ac], 0
jmp 0x4011f4
mov esi, dword [ebp - 0x1ac]
inc esi
mov dword [ebp - 0x1ac], esi
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebx + 8]
cmp ecx, eax
jae 0x401246
push dword [ebp - 0x28]
mov ebx, dword [ebp - 0x1c]
push dword [ebx + 4]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
add edi, dword [esi]
push edi
mov ebx, dword [ebp - 8]
add ebx, dword [ebp - 0x18]
push ebx
call fcn.00401230
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
add ecx, dword [edx + 4]
mov dword [ebp - 0x18], ecx
jmp 0x4011de
mov edx, dword [ebp - 0x20]
push edx
mov edi, dword [ebp - 8]
mov ecx, 0x1530
add edi, ecx
mov dword [ebp - 0x14], edi
push dword [ebp - 0x19c]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
add ecx, dword [edi + 4]
push ecx
xor ecx, ecx
or ecx, dword [ebp - 0x14]
push ecx
add ecx, 0x280
push ecx
mov edx, dword [ebp - 0x14]
push edx
ret 4
Function at 0x401240
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb esi, 0xee
imul edi
not eax
bswap edi
bswap esi
bswap esi
imul ebx
bswap eax
neg edx
rcl edx, 0x8f
add edi, 0x5c
sub esi, 0x90
sub eax, 0xbe
inc edx
add ebx, 0xf3
inc ebx
ror ebx, 0xfd
mov edx, 0x7e
rol edx, 0xc2
inc ebx
bswap ebx
or edi, 0x76
rcl edx, 0x25
rcr edx, 0xd
ror edx, 0x17
not edx
rcl edi, 0x50
rcl eax, 0x6b
and esi, 0x43
rol ebx, 0x33
rol eax, 0x8e
rcr edi, 0xad
dec eax
rol ebx, 0xf4
ror edi, 0xa7
dec ebx
sub edi, 0xce
inc eax
inc ebx
imul ebx
sbb edi, 6
or eax, 6
imul esi
rol edi, 0xbb
not eax
or ebx, 0x48
rcr ebx, 0xef
bswap ebx
bswap esi
neg edi
xor ecx, ecx
xor edi, edi
imul edx
sub eax, 0xef
dec edx
dec ebx
or esi, 0x76
ror ebx, 0xfa
rcr ebx, 0xb1
not edx
sbb ebx, 0xcc
rcr edx, 0x7d
imul esi
not edi
add esi, 0xa4
dec ebx
rol ebx, 0x93
bswap ebx
imul edi
not esi
mov ebx, 0x75
or eax, 0xa1
and edi, 0x78
rol ebx, 0xff
ror esi, 0x9e
and ebx, 0xd0
add edi, 0x88
neg edi
sbb edi, 0xbe
inc edx
imul edi
rcr ebx, 0x7c
not eax
add edi, 0x56
neg edi
neg edi
or esi, 0x45
inc eax
and ebx, 0x5f
and edi, 0x49
inc edi
and esi, 0x34
not edi
neg esi
dec edx
add eax, 0x2b
or ebx, 0x43
and esi, 0xfc
rcl edx, 0xef
ror ebx, 0xad
imul eax
imul edx
mov ecx, dword [ebp + 0xc]
not eax
sbb esi, 0xe4
sub ebx, 0xef
add ebx, 0x63
imul ebx
dec eax
or ebx, 0x5b
bswap edx
imul esi
bswap edx
rcl eax, 0x2e
sbb eax, 0xe8
and ebx, 0x4c
dec edx
dec edi
mov edi, 0xde
bswap esi
rol eax, 0x98
imul ebx
rol edx, 0x12
bswap edx
sub edi, 0x56
and edx, 0x2e
not edx
not esi
dec ebx
rol edi, 0x49
bswap edx
mov eax, 0xf4
bswap esi
rcl edi, 0xa0
inc edi
rol eax, 0x28
inc edx
sbb edi, 0x10
bswap esi
not ebx
not esi
sbb edi, 0x2a
add edx, 0xd6
dec ebx
sub eax, 6
mov eax, 0xcd
not ebx
neg edx
rcl edx, 0xb8
bswap esi
sbb esi, 0xf7
dec edi
imul edx
mov edi, dword [ebp + 8]
xor esi, eax
xor ebx, eax
xor ebx, ebx
not byte [edi]
xor ebx, eax
mov esi, esi
xor eax, esi
mov eax, ebx
xor ebx, esi
mov eax, eax
mov eax, esi
mov ebx, eax
xor ebx, eax
add byte [edi], 0x79
xor esi, esi
mov esi, esi
xor esi, ebx
mov esi, eax
xor esi, esi
xor esi, esi
mov ebx, eax
xor eax, eax
xor eax, ebx
sub byte [edi], 0x30
mov esi, esi
xor ebx, ebx
mov ebx, eax
mov esi, eax
mov esi, eax
xor ebx, ebx
mov ebx, ebx
xor ebx, eax
xor ebx, esi
imul byte [edi]
inc edi
loop 0x4013f5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4042f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f5d0]
jne 0x4042ff
repz ret
jmp fcn.00406075
Function at 0x404986
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403721
and dword [ebp - 4], 0
cmp dword [0x430468], 0
mov ebx, eax
jne 0x404a37
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404ae8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404ae8
push eax
call fcn.004036af
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x430468], eax
call esi
push eax
call fcn.004036af
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43046c], eax
call esi
push eax
call fcn.004036af
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430470], eax
call esi
push eax
call fcn.004036af
pop ecx
mov dword [0x430478], eax
test eax, eax
je 0x404a37
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004036af
pop ecx
mov dword [0x430474], eax
mov eax, dword [0x430474]
cmp eax, ebx
je 0x404a8f
cmp dword [0x430478], ebx
je 0x404a8f
push eax
call fcn.0040372a
push dword [0x430478]
mov esi, eax
call fcn.0040372a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404a8f
test edi, edi
je 0x404a8f
call esi
test eax, eax
je 0x404a86
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404a86
test byte [ebp - 0xc], 1
jne 0x404a8f
or dword [ebp + 0x10], 0x200000
jmp 0x404ac8
mov eax, dword [0x43046c]
cmp eax, ebx
je 0x404ac8
push eax
call fcn.0040372a
pop ecx
test eax, eax
je 0x404ac8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404ac8
mov eax, dword [0x430470]
cmp eax, ebx
je 0x404ac8
push eax
call fcn.0040372a
pop ecx
test eax, eax
je 0x404ac8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430468]
call fcn.0040372a
pop ecx
test eax, eax
je 0x404ae8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404aea
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4063f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x43bc7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4046c4
call fcn.00407051
push 4
mov dword [esp + 0x18], 0
call fcn.00407ef6
mov edi, eax
add esp, 4
test edi, edi
je 0x406464
push ebx
call fcn.00406f29
mov dword [edi], eax
call fcn.00406ce8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00407012
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406458
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040703a
pop ebx
jmp 0x406466
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408961
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f520]
jne 0x40896b
repz ret
jmp fcn.0040d0bc