joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489a80
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5e3958]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x489c6a
sub esp, 0x48
mov eax, dword [0x5b88f4]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 0xa]
movzx ebx, word [ecx + 0xc]
movzx ebp, word [ecx + 2]
movzx esi, word [ecx + 8]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call sym.time.Date
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046059e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046059e
call sym.time.Time.abs
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call sym.runtime.uint64mod
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x489b57
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x489b71
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x489be8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x489bbe
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x489bba
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x489bb3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x489bc0
mov ebx, 0x1d
jmp 0x489bde
mov ebp, eax
jmp 0x489bc0
mov ebp, eax
cmp ebp, 0xd
jae 0x489c5d
lea eax, [ebp - 1]
lea edx, [0x5b1700]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x489c53
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x489be8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x489c1a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x489c22
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call sym.runtime.panicIndex
mov eax, ebp
mov ecx, 0xd
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.time.pseudoUnix
Function at 0x499f00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5e3958]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x499fa1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x499f97
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x499f97
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x499f97
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x499f97
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x499f97
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x499f97
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x499f97
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x499f97
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x499f97
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x499f97
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x499f99
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x4aa550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5e3958]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aa6ea
sub esp, 0x38
lea edi, [esp + 0x54]
xor eax, eax
call fcn.004600b8
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
cmp ecx, edx
jbe 0x4aa6e2
mov ebx, dword [esp + 0x40]
movzx ebp, byte [ebx + edx]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4aa66e
lea eax, [0x4e6560]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov dword [eax + 4], 0x25
lea ecx, [0x506565]
mov dword [eax], ecx
lea ecx, [0x5281f8]
cmp dword [0x5b8a20], ecx
jne 0x4aa5f2
mov edx, dword [0x5b8a24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sym.runtime.ifaceeq
movzx eax, byte [esp + 0xc]
test al, al
je 0x4aa5f2
lea ecx, [0x5281f8]
mov eax, dword [esp + 0x14]
jmp 0x4aa64d
lea eax, [0x4ea3a0]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [esp + 0x4c]
mov ebp, ebx
sar ebx, 0x1f
add edx, ebp
mov dword [eax], edx
adc ecx, ebx
mov dword [eax + 4], ecx
lea ecx, [0x5281f8]
mov dword [eax + 8], ecx
mov ecx, dword [0x5e3a60]
test ecx, ecx
jne 0x4aa639
mov ecx, dword [esp + 0x14]
jmp 0x4aa644
call sym.runtime.gcWriteBarrier1
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [eax + 0xc], ecx
lea ecx, [0x5284a0]
mov dword [esp + 0x10], ecx
lea edi, [esp + 0x54]
mov edx, eax
xor eax, eax
call fcn.004600b8
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x38
ret
xchg ebp, eax
movzx esi, al
xchg ebp, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
mov edi, edx
lea edx, [0x50962e]
movzx edx, byte [edx + ebp]
dec edx
nop
mov ebp, edi
lea edi, [esp + 0x18]
call fcn.004600b8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edx
lea edi, [esp + 0x54]
lea esi, [esp + 0x18]
call fcn.00460580
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x38
ret
mov eax, edx
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.internal_zstd._Reader_.makeReverseBitReader
Function at 0x4d11a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5e3958]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d121b
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4d1211
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4d1211
movzx ecx, word [eax + 6]
cmp word [edx + 6], cx
jne 0x4d1211
mov ecx, dword [eax + 8]
mov ebx, dword [edx + 0xc]
cmp dword [edx + 8], ecx
sete cl
cmp dword [eax + 0xc], ebx
sete bl
and ebx, ecx
test bl, bl
je 0x4d1211
mov ecx, dword [eax + 0x14]
cmp dword [edx + 0x14], ecx
jne 0x4d1211
mov edx, dword [edx + 0x10]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4d1213
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.cmd_internal_objfile.goobjReloc
Function at 0x408949
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
sub eax, 1
call fcn.00408985
add ebx, ebx
sub ebx, 0x99ecfeb6
xor dword [ecx], esi
add ecx, 1
sub ebx, 1
add ebx, 0x1247d5a9
cmp ecx, edx
jne fcn.00408949
sub esp, 4
mov dword [esp], 0xd229c052
pop ebx
ret

Function at 0x401d70
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
bswap eax
bswap ecx
xor edx, edx
mov dword [ebp - 4], 0x20
push edi
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0xc]
add eax, esi
sub edx, 0x61c88647
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
add ecx, esi
dec dword [ebp - 4]
jne 0x401d90
mov edx, dword [ebp + 8]
pop edi
bswap eax
bswap ecx
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401e00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add edx, 7
shr edx, 3
dec edx
mov dword [ebp - 0xc], edx
js 0x401ec5
push ebx
push esi
push edi
jmp 0x401e23
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*8 - 8]
test edx, edx
jne 0x401e2e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
bswap ecx
bswap eax
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
mov edi, dword [ebp + 0x10]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0x10]
sub eax, esi
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
sub ecx, esi
dec dword [ebp - 4]
jne 0x401e48
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
bswap ecx
mov dword [esi + edx*8], ecx
lea ecx, [esi + edx*8 + 4]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
xor dword [esi + edx*8], edi
mov eax, dword [eax + 4]
xor dword [ecx], eax
dec edx
mov dword [ebp - 0xc], edx
jns 0x401e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x408810
Capabilities:
Encode data using xor

Disassembly:
xor dh, byte [ebp + edx - 0x4585ed40]
nop
fstp qword [esi - 0x2bfc7048]
inc byte [esi + 0x6989ac02]
pop es
ficom word [edi]
and dword [ecx - 0x3c739d36], eax
out 0x54, al
xor byte [edx], bh
dec ebp
int3
div byte [ebx]
inc edx
sub esi, dword [ebx - 0x22]
cmp al, 0x53
dec edi
and byte [edx - 0x7a], bl
jp 0x40885c
loop 0x408848
adc eax, 0x85cdc587
pop eax
mov al, byte [0xcc839ba1]
mov bl, 0xd6
movsd dword es:[edi], dword [esi]
sti
mov cl, 0x2c
sub dword [eax + edx + 0x2c726fd], 0xffffffec
dec edx
pop eax
xlatb
inc esp
xor ebp, esi
pop edx
test bh, ch
shl cl, 0x8c
dec edi
dec edx
and esi, dword [ecx - 0x1b]
sbb bl, al
std
mov dl, 0xa4
jb 0x4087da
cmp bl, byte [eax + 0x52]
in al, dx
pop ecx
invalid
invalid
Function at 0x4409f7
Capabilities:
Encode data using xor

Disassembly:
sbb esi, esp
fidivr word [ecx]
push ds
push cs
pop edi
and ebx, dword [ebx + 0x7047af58]
scasd eax, dword es:[edi]
inc edi
jo 0x440a5f
outsb dx, byte [esi]
scasd eax, dword es:[edi]
inc edi
jo 0x440a5f
outsb dx, byte [esi]
xor cl, byte [eax - 0x5e]
mov esi, dword [edx + 0x52e1648c]
into
jno 0x440a2e
or eax, 0xa77db202
invalid
add bl, cl
push esp
dec edi
ja 0x440a50
xchg edi, eax
das
insb byte es:[edi], dx
push ecx
insd dword es:[edi], dx
mov ebp, 0x52dfe8
or dword [esi - 0x370e6af9], 0xf38b2150
sal dword [esp + ecx*4 - 0x7d70ca77], 1
jle 0x4409ed
pushfd
or eax, ebx
dec esp
stosd dword es:[edi], eax
invalid
imul eax, dword [edi], 0x2c
sub byte [edx - 0x6e066d10], 0xb6
sbb al, 0x83
mov eax, 0x6df869f0
pop ebx
sub byte [edi], ch
jle 0x440aed
xchg dword [esi], esp
scasb al, byte es:[edi]
leave
or eax, 0x5d779832
test dword [ecx - 0x2ee6b95d], ebp
invalid
int3

Function at 0x45698f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg edi, eax
leave
out 0x99, eax
in eax, 0x66
cli
clc
mov bh, 0x9f
rol ecx, 0x23
fdivr dword [edx + 0x17a9495d]
adc byte ss:[edi], ch
or dh, byte [edx + ecx]
inc ecx
xor edi, dword [ebx]
mov esi, 0x5e6a8e8f
mov ebp, 0xd8857c49
push esp
clc
sahf
sub dh, ah
inc edx
mov eax, dword [0x804cce48]
pop ebx
lds esp, [esi]
pushfd
cmpsd dword [esi], dword es:[edi]
add esi, dword [ebx - 0x16]
xor al, dh
mov ch, 0xdc
cmp edx, dword [ebp + 0x15]
loope 0x4569a9
popal
xchg dword [edi - 0x7d], ecx
inc edi
add eax, 0x74e770c0
xor byte [edi + 0x3e16577b], dh
or ebp, dword [edx]
and al, 0x65
ror dword [ebp - 0x44], 1
std
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
mov bh, 0xf5
sbb byte [ebp - 0x18e466bf], cl
adc byte [edi], dh
outsd dx, dword [esi]
mov eax, dword [0x36c0cd02]
sub ebp, dword [edx + 0x3d1c3f6b]
or byte [edx - 0x1a], dl
mov dh, 0x27
push eax
popfd
add byte [ecx], ch
xlatb
rol edi, cl
ljmp 0xf897
Function at 0x3201c0b8
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x32057b8c
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConverterCreate
push dword [edi + 4]
mov dword [edi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConverterClose
push dword [edi + 4]
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidAttachCallback
push dword [edi + 4]
mov dword [edi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidDetachCallback
push dword [edi + 4]
mov dword [edi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetConfiguration
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetOCRInterface
push dword [edi + 4]
mov dword [edi + 0x20], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConvert
push dword [edi + 4]
mov dword [edi + 0x24], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConvertSelection
push dword [edi + 4]
mov dword [edi + 0x28], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidExtractTables
push dword [edi + 4]
mov dword [edi + 0x2c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidExtractSelectedTables
push dword [edi + 4]
mov dword [edi + 0x30], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidExtractImages
push dword [edi + 4]
mov dword [edi + 0x34], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidResetOptions
push dword [edi + 4]
mov dword [edi + 0x38], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetOptionInt
push dword [edi + 4]
mov dword [edi + 0x3c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidGetOptionInt
push dword [edi + 4]
mov dword [edi + 0x40], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetOptionString
push dword [edi + 4]
mov dword [edi + 0x44], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidGetOptionString
push dword [edi + 4]
mov dword [edi + 0x48], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [edi + 0x4c], eax
cmp dword [edi + 0xc], esi
je 0x3201c237
cmp dword [edi + 0x10], esi
je 0x3201c237
cmp dword [edi + 0x14], esi
je 0x3201c237
cmp dword [edi + 0x18], esi
je 0x3201c237
cmp dword [edi + 0x1c], esi
je 0x3201c237
cmp dword [edi + 0x20], esi
je 0x3201c237
cmp dword [edi + 0x24], esi
je 0x3201c237
cmp dword [edi + 0x28], esi
je 0x3201c237
cmp dword [edi + 0x2c], esi
je 0x3201c237
cmp dword [edi + 0x30], esi
je 0x3201c237
cmp dword [edi + 0x34], esi
je 0x3201c237
cmp dword [edi + 0x38], esi
je 0x3201c237
cmp dword [edi + 0x3c], esi
je 0x3201c237
cmp dword [edi + 0x40], esi
je 0x3201c237
cmp dword [edi + 0x44], esi
je 0x3201c237
cmp dword [edi + 0x48], esi
je 0x3201c237
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
pop edi
mov ax, si
pop esi
ret
Function at 0x3203648c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x3203649b
pop dword [ebp - 0x30]
mov eax, 0xddafce4
add eax, 0x242867b7
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xdc7e76ce
add dword [ebp - 0x40], 0x71d3ce7d
mov dword [ebp - 0x3c], 0xd34c7e20
sub dword [ebp - 0x3c], 0xa11931db
mov dword [ebp - 0x38], 0x4cb74f2f
add dword [ebp - 0x38], 0xff94f4ff
mov dword [ebp - 0x34], 0x25f481fa
sub dword [ebp - 0x34], 0x25f481fa
lea eax, [ebp - 0x40]
push eax
mov eax, 0xcc7f71ce
sub eax, 0x9a7a214e
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xac2c9ced
add dword [ebp - 0x40], 0xc845cc69
mov dword [ebp - 0x3c], 0x2e8c5d99
add dword [ebp - 0x3c], 0x12e003dc
mov dword [ebp - 0x38], 0xecfd2f69
add dword [ebp - 0x38], 0x76723d03
mov dword [ebp - 0x34], 0x1a78c46b
sub dword [ebp - 0x34], 0x1a78c46b
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x8a8fbba0
add eax, 0xa77594d8
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x47da4
push 0
call eax
mov ecx, 0x3d211512
sub ecx, 0x3d20cb91
xor edx, edx
add edx, eax
mov esi, 0xc93f518e
sub esi, 0x97377b8e
add esi, dword [ebp - 0x30]
mov ebx, 0x3e9022ae
mov edi, dword [esi]
sub dword [ebp - 8], eax
sub edi, ebx
sub dword [ebp - 0x24], 0x7913a6ad
mov dword [edx], edi
xor dword [ebp - 0x2c], 0xe7ea3c8f
add edx, 4
add esi, 0x7a4ba166
add esi, 0x85b45e9e
loop 0x320365b9
add eax, 0x704d50d4
add eax, 0x8fb3c803
mov ebx, eax
add eax, 5
mov ecx, 0x4cbbfdcc
sub ecx, 0x1abbfdcc
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul esi
neg edi
inc esi
inc edi
imul edx
add ebx, 0xa1
ror edx, 0xbc
mov edi, 0xf9
not esi
imul eax
rcr edx, 0xd2
dec edi
bswap edi
mov esi, 0x3f
or edx, 0xf7
sub eax, 0x42
not esi
and ebx, 0xd3
add eax, 0x32
not esi
not ebx
neg edi
inc eax
bswap eax
bswap eax
ror eax, 0xf3
neg eax
bswap ebx
rol ebx, 0x7a
inc edi
mov eax, 0x8f
not ebx
mov edi, 0xde
imul edi
not edx
inc eax
and edi, 0x24
imul ebx
ror eax, 0xc8
rcr eax, 0x52
mov edi, 0x21
not edi
or eax, 0x6a
sbb ebx, 0x66
or esi, 0xce
rol edi, 0x39
or edi, 0x41
add eax, 0x63
imul edx
sbb edx, 0x71
xor ecx, ecx
xor edi, edi
sbb esi, 0xa1
rcr edx, 0xf1
not esi
rol esi, 0xfc
neg edx
add esi, 0x59
sbb esi, 0x53
inc edi
bswap eax
and edx, 0x3d
rol edi, 0x2d
sbb edi, 0x69
neg eax
not esi
imul esi
bswap edx
rcr esi, 0xc8
and eax, 0x91
bswap eax
sub eax, 0xcc
rol edx, 0x1f
imul eax
imul edx
ror edi, 0xdb
dec ebx
bswap eax
neg esi
dec edi
ror ebx, 0xc4
dec edi
sbb edi, 0xc0
ror edi, 0xbc
inc edx
ror ebx, 0xb2
not esi
dec edx
sub esi, 0x17
ror eax, 0xf5
mov esi, 0x54
sub esi, 3
rol edi, 0x88
rcl esi, 0xb0
add edi, 0xa7
inc edi
inc edx
sbb ebx, 0xce
dec esi
rol eax, 0x9a
inc ebx
neg edx
mov ecx, dword [ebp + 0xc]
bswap esi
and edi, 0x5b
rcr edx, 0x7b
bswap edx
not edx
add edx, 0x63
inc eax
imul edx
rol eax, 0x32
neg esi
imul edi
ror ebx, 0x1b
bswap esi
inc edi
dec edi
rcl esi, 0xfc
ror esi, 0xdc
not esi
rcl esi, 0xf3
rol ebx, 0xac
ror edx, 0x6c
dec edi
dec eax
rcl eax, 0x76
imul edx
imul edi
bswap edx
not eax
not ebx
sub eax, 0xae
not ebx
imul esi
and edi, 0xf
ror esi, 0x3e
rcl eax, 0xe6
and esi, 0xf2
sbb ebx, 0x27
dec eax
imul eax
ror edx, 0xd0
dec edx
and edx, 0x30
rol edi, 0xd7
dec edx
add esi, 0x25
not eax
bswap esi
and edi, 0x6d
and ebx, 0xfb
sub edi, 0xc0
mov edi, dword [ebp + 8]
xor ebx, esi
xor ebx, eax
mov ebx, eax
not byte [edi]
mov ebx, ebx
mov esi, esi
xor esi, ebx
xor ebx, esi
xor eax, esi
xor ebx, esi
xor eax, ebx
mov eax, eax
xor eax, ebx
add byte [edi], 0x26
xor eax, esi
xor esi, ebx
xor esi, ebx
xor eax, ebx
mov ebx, esi
mov eax, esi
mov eax, eax
xor ebx, ebx
xor eax, esi
sub byte [edi], 0x87
xor ebx, eax
mov esi, eax
xor eax, eax
xor ebx, esi
mov ebx, esi
mov ebx, ebx
xor ebx, ebx
xor ebx, ebx
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4013c7
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406224
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b25c]
jne 0x40622e
repz ret
jmp fcn.00407f25
Function at 0x409763
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004062a5
and dword [ebp - 4], 0
cmp dword [0x43c84c], 0
mov ebx, eax
jne 0x409814
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4098c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4098c5
push eax
call fcn.00406233
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43c84c], eax
call esi
push eax
call fcn.00406233
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43c850], eax
call esi
push eax
call fcn.00406233
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43c854], eax
call esi
push eax
call fcn.00406233
pop ecx
mov dword [0x43c85c], eax
test eax, eax
je 0x409814
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406233
pop ecx
mov dword [0x43c858], eax
mov eax, dword [0x43c858]
cmp eax, ebx
je 0x40986c
cmp dword [0x43c85c], ebx
je 0x40986c
push eax
call fcn.004062ae
push dword [0x43c85c]
mov esi, eax
call fcn.004062ae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40986c
test edi, edi
je 0x40986c
call esi
test eax, eax
je 0x409863
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409863
test byte [ebp - 0xc], 1
jne 0x40986c
or dword [ebp + 0x10], 0x200000
jmp 0x4098a5
mov eax, dword [0x43c850]
cmp eax, ebx
je 0x4098a5
push eax
call fcn.004062ae
pop ecx
test eax, eax
je 0x4098a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4098a5
mov eax, dword [0x43c854]
cmp eax, ebx
je 0x4098a5
push eax
call fcn.004062ae
pop ecx
test eax, eax
je 0x4098a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43c84c]
call fcn.004062ae
pop ecx
test eax, eax
je 0x4098c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4098c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415fdb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4203dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040dd8b
and dword [ebp - 0x14], 0
cmp dword [0x81d2d0], 0
mov dword [ebp - 0x18], eax
jne 0x41608e
push 0x403f10
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416136
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f04
push ebx
call edi
test eax, eax
je 0x416136
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403ef4
push ebx
mov dword [0x81d2d0], eax
call edi
push eax
call esi
push 0x403ee0
push ebx
mov dword [0x81d2d4], eax
call edi
push eax
call esi
push 0x403ec4
push ebx
mov dword [0x81d2d8], eax
call edi
push eax
call esi
mov dword [0x81d2e0], eax
test eax, eax
je 0x41608e
push 0x403eac
push ebx
call edi
push eax
call esi
mov dword [0x81d2dc], eax
mov eax, dword [0x81d2dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4160e7
cmp dword [0x81d2e0], ecx
je 0x4160e7
push eax
call esi
push dword [0x81d2e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4160e7
test ebx, ebx
je 0x4160e7
call edi
test eax, eax
je 0x4160de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4160de
test byte [ebp - 8], 1
jne 0x4160e7
or dword [ebp + 0x10], 0x200000
jmp 0x41611a
mov eax, dword [0x81d2d4]
cmp eax, dword [ebp - 0x18]
je 0x41611a
push eax
call esi
test eax, eax
je 0x41611a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41611a
mov eax, dword [0x81d2d8]
cmp eax, dword [ebp - 0x18]
je 0x41611a
push eax
call esi
test eax, eax
je 0x41611a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x81d2d0]
call esi
test eax, eax
je 0x416136
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416138
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b0ae
leave
ret