joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401040
Capabilities:
Terminate process

Disassembly:
sub esp, 0x58
mov eax, dword [0x45e490]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
mov ebx, dword [esp + 0x60]
push ebp
push esi
push edi
mov edi, dword [esp + 0x70]
xor ebp, ebp
mov dword [0x469f00], 0x40d250
mov dword [0x46df28], 1
mov dword [0x46df3c], 0x45d808
mov eax, dword [edi]
mov dword [0x469f18], eax
cmp ebx, 1
jle 0x4010a9
mov eax, dword [edi + ebx*4 - 4]
cmp byte [eax], 0x3c
jne 0x4010a9
inc eax
push 0x43c234
push eax
call fcn.0041fd10
add esp, 8
mov dword [edi + ebx*4 - 4], 0
mov ebp, eax
dec ebx
push 0x1b6
push 0x302
push str.dbout.___
call fcn.00431493
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4010dc
push 1
call fcn.00429ba8
push esi
call fcn.0043ad5a
push esi
call fcn.00429ba8
add esp, 0xc
push 0x1b6
push 0x302
push str.dberr.___
call fcn.00431493
mov esi, eax
add esp, 0xc
test esi, esi
js 0x40110f
push 2
call fcn.00429ba8
push esi
call fcn.0043ad5a
push esi
call fcn.00429ba8
add esp, 0xc
dec ebx
add edi, 4
mov dword [esp + 0x10], edi
mov esi, ebx
test ebx, ebx
jle 0x40112f
lea ecx, [ecx]
mov eax, dword [edi]
cmp byte [eax], 0x2d
jne 0x40112f
dec esi
add edi, 4
test esi, esi
jg 0x401120
lea eax, [esp + 0x14]
sub ebx, esi
push eax
push 0x459058
push 0x4701e0
push dword [esp + 0x1c]
push ebx
call fcn.0040d260
add esp, 0x14
test eax, eax
je 0x401164
push dword [0x469f18]
push str.Usage_:__s___b__df__dt__ff__fd__h__heap__p__t__u__T__D__E__F__I__U__V___...__n
call fcn.0040d8a0
add esp, 8
test ebp, ebp
jne 0x40117d
mov ebp, dword [0x4701e4]
test ebp, ebp
jne 0x40117d
test esi, esi
jg 0x40117d
call fcn.0041fb70
mov ebp, eax
push 0x4011b0
push 0xb
call fcn.004204ad
push ebp
push edi
push esi
call fcn.004011e0
add esp, 0x14
mov esi, eax
call fcn.0040da10
mov ecx, dword [0x469f10]
test ecx, ecx
cmovne esi, ecx
push esi
call fcn.004201d6
pop edi
pop esi
pop ebp
pop ebx
push dword [esp + 4]
push 0x43c1f4
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.0041fd25
add esp, 0xc
push 0xde
call fcn.004201d6
int3
Function at 0x403c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x7c
call fcn.0040bba0
mov edi, dword [esp + 0x1c]
mov esi, eax
mov dword [esi + 0x10], 0
lea ebx, [esi + 0x10]
xor eax, eax
push edi
mov dword [esi + 0x14], 0
and dword [esi + 0x74], 0xffff921f
mov dword [esi], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 4], 0
mov word [esi + 0x20], ax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x78], eax
call fcn.00409d10
mov ecx, eax
add esp, 8
xor eax, eax
mov dword [esp + 0x10], ecx
xor ebp, ebp
cmp ax, word [ecx + 6]
jae 0x403d54
add edi, 0xc
push dword [edi]
call fcn.00403c90
mov dword [ebx], eax
add esp, 4
mov dword [eax + 0x78], esi
mov ecx, dword [ebx]
cmp dword [ecx], 0
je 0x403d2d
mov eax, dword [edi]
mov edx, 0x107
cmp word [eax], dx
jne 0x403d2d
mov eax, 1
jmp 0x403d2f
xor eax, eax
shl eax, 0x12
inc ebp
xor eax, dword [ecx + 0x74]
add edi, 4
and eax, 0x40000
add ebx, 4
xor dword [ecx + 0x74], eax
mov ecx, dword [esp + 0x10]
movzx eax, word [ecx + 6]
cmp ebp, eax
jl 0x403d04
mov edi, dword [esp + 0x18]
mov eax, dword [ecx + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0xc]
push edi
push esi
call eax
mov esi, eax
add esp, 8
test esi, esi
jne 0x403d94
cmp word [edi + 2], ax
je 0x403d8f
push edi
call fcn.004046b0
add esp, 4
push str.Initialisation_error_n
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.0041fd25
add esp, 8
call fcn.004047b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40a1c0
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ecx, dword [edx + 4]
imul eax, ecx, 0xd
push edi
mov edi, dword [esi + 4]
add eax, edi
mov ebx, dword [eax*4 + 0x45cb00]
test ebx, ebx
je 0x40a22d
test byte [esi + 0x80], 1
je 0x40a1f8
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
movzx esi, word [eax + ecx]
add esi, ecx
jmp 0x40a1fe
mov esi, dword [esi]
add esi, dword [esp + 0x1c]
test byte [edx + 0x80], 1
mov eax, dword [edx]
je 0x40a21e
mov ecx, dword [esp + 0x14]
push esi
movzx eax, word [eax + ecx]
add eax, ecx
push eax
call ebx
add esp, 8
pop edi
pop esi
pop ebx
ret
add eax, dword [esp + 0x14]
push esi
push eax
call ebx
add esp, 8
pop edi
pop esi
pop ebx
ret
imul eax, edi, 0xd
add eax, ecx
mov edi, dword [eax*4 + 0x45cb00]
test edi, edi
je 0x40a28d
test byte [edx + 0x80], 1
je 0x40a254
mov eax, dword [edx]
mov ecx, dword [esp + 0x14]
movzx edx, word [eax + ecx]
add edx, ecx
jmp 0x40a25a
mov edx, dword [edx]
add edx, dword [esp + 0x14]
test byte [esi + 0x80], 1
mov eax, dword [esi]
je 0x40a27c
mov ecx, dword [esp + 0x1c]
push edx
movzx eax, word [eax + ecx]
add eax, ecx
push eax
call edi
add esp, 8
neg eax
pop edi
pop esi
pop ebx
ret
add eax, dword [esp + 0x1c]
push edx
push eax
call edi
add esp, 8
neg eax
pop edi
pop esi
pop ebx
ret
lea eax, [esi + 0x68]
push eax
lea eax, [edx + 0x68]
push eax
push str.Cant_compare_fields__s_and__s_n
call fcn.0040d7e0
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.00420b2e
add esp, 0x10
push 1
call fcn.004201d6
int3
Function at 0x40a2c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov edx, dword [eax + 0x60]
mov ecx, dword [eax + 0x64]
movzx eax, word [eax + 0x58]
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea esp, [esp]
mov edx, dword [edx]
mov ecx, dword [ecx]
mov esi, dword [edx + 4]
mov edi, dword [ecx + 4]
imul eax, esi, 0xd
add eax, edi
mov eax, dword [eax*4 + 0x45cb00]
mov dword [esp + 0x18], eax
test eax, eax
je 0x40a33f
test byte [ecx + 0x80], 1
je 0x40a31f
mov eax, dword [ecx]
movzx ecx, word [eax + ebx]
jmp 0x40a321
mov ecx, dword [ecx]
mov eax, dword [edx]
add ecx, ebx
test byte [edx + 0x80], 1
je 0x40a332
movzx eax, word [eax + ebp]
add eax, ebp
push ecx
push eax
call dword [esp + 0x20]
add esp, 8
jmp 0x40a37e
imul eax, edi, 0xd
add eax, esi
mov esi, dword [eax*4 + 0x45cb00]
test esi, esi
je 0x40a3aa
test byte [edx + 0x80], 1
je 0x40a360
mov eax, dword [edx]
movzx edx, word [eax + ebp]
jmp 0x40a362
mov edx, dword [edx]
mov eax, dword [ecx]
add edx, ebp
test byte [ecx + 0x80], 1
je 0x40a373
movzx eax, word [eax + ebx]
add eax, ebx
push edx
push eax
call esi
add esp, 8
neg eax
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
add edx, 4
add ecx, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], ecx
test eax, eax
jne 0x40a3a2
dec dword [esp + 0x14]
jne 0x40a2f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea eax, [ecx + 0x68]
push eax
lea eax, [edx + 0x68]
push eax
push str.Cant_compare_fields__s_and__s_n
call fcn.0040d7e0
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.00420b2e
add esp, 0x10
push 1
call fcn.004201d6
int3
Function at 0x40a600
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x4c
mov eax, dword [0x45e490]
xor eax, esp
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x60]
push ebx
mov ebx, dword [esp + 0x58]
push ebp
mov ebp, dword [esp + 0x58]
push esi
mov dword [esp + 0xc], ecx
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x10], ebp
cmp cx, word [eax + 6]
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edi
jae 0x40a696
add ebx, 4
lea edi, [esp + 0x4c]
add ebp, 0xc
lea eax, [esp + 0x1c]
push eax
push edi
push edx
push ecx
push dword [ebp]
call fcn.0040a4c0
mov ecx, dword [esp + 0x24]
lea ebp, [ebp + 4]
mov edx, dword [esp + 0x34]
lea ebx, [ebx + 4]
mov dword [ebx - 4], eax
inc esi
mov eax, dword [esp + 0x7c]
add esp, 0x14
add edi, 4
movzx eax, word [eax + 6]
cmp esi, eax
jl 0x40a656
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x4c]
push eax
push ebx
push ebp
call fcn.0040ab50
mov dword [edi], eax
add esp, 0xc
mov eax, dword [esp + 0x68]
xor ecx, ecx
movzx esi, word [eax + 6]
test esi, esi
jle 0x40a6c9
lea edx, [ebx + 4]
mov eax, dword [edx]
mov eax, dword [eax]
cmp dword [eax], 1
jne 0x40a703
inc ecx
add edx, 4
cmp ecx, esi
jl 0x40a6b8
push 0x14
call fcn.0040bba0
push 0
push 0
mov esi, eax
push ebx
push esi
call fcn.00406280
mov cx, word [ebp + 2]
add esp, 0x14
mov word [esp + 0x2a], cx
mov dword [esp + 0x30], esi
mov eax, dword [esi + 0x10]
cmp eax, 0xc
ja case.default.0x40a6fc
movzx eax, byte [eax + 0x40a768]
jmp dword [eax*4 + 0x40a75c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00420704
add esp, 0x4c
ret
mov eax, 0x109
jmp 0x40a72b
mov eax, 0x10a
jmp 0x40a72b
mov eax, 0x10b
mov word [esp + 0x28], ax
lea eax, [esp + 0x1c]
push eax
push edi
push 0
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0040a4c0
mov ecx, dword [esp + 0x6c]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420704
add esp, 0x4c
ret
Function at 0x40d260
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 0xc]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [edx], eax
mov dword [edx + 4], eax
mov eax, dword [edx + 0x10]
and eax, 0xffffc004
mov dword [edx + 8], ecx
or eax, 4
mov word [edx + 0xc], 0xa20
mov dword [edx + 0x10], eax
test ecx, ecx
je 0x40d290
mov dword [ecx], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x40d353
mov eax, dword [esp + 0x18]
dec ebp
mov ebx, dword [eax]
add eax, 4
mov dword [esp + 0x18], eax
mov al, byte [ebx]
inc ebx
cmp al, 0x2d
jne 0x40d34b
mov ecx, 0x43d0ec
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40d2e0
test dl, dl
je 0x40d2dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40d2e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40d2c0
xor eax, eax
jmp 0x40d2e5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d35a
mov eax, dword [esp + 0x20]
mov edi, eax
mov esi, dword [eax]
test esi, esi
je 0x40d31e
mov eax, esi
lea edi, [edi + 4]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d300
sub eax, edx
push eax
push esi
push ebx
call fcn.004253a0
add esp, 0xc
test eax, eax
je 0x40d336
mov esi, dword [edi]
test esi, esi
jne 0x40d2f5
push ebx
push str.Invalid_flag___s_n
call fcn.0040d7e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push ebx
push dword [esp + 0x20]
call fcn.0040d390
add esp, 8
test eax, eax
jne 0x40d31e
test esi, esi
je 0x40d31e
test ebp, ebp
jne 0x40d2a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push str.Version_V8.07.00_MSDOS
push dword [0x469f18]
push str._s____s_comp._n
call fcn.00421913
call fcn.0041fb70
add eax, 0x20
push eax
call fcn.00420b2e
add esp, 0x10
push 0
call fcn.004201d6
int3

Function at 0x40d8a0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x204
mov eax, dword [0x45e490]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [0x469f18]
test eax, eax
je 0x40d8d4
push eax
push str._s__
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.0041fd25
add esp, 0xc
lea eax, [esp + 0x20c]
push eax
push dword [esp + 0x20c]
lea eax, [esp + 8]
push eax
call fcn.0042549c
add esp, 0xc
lea eax, [esp]
push eax
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.0041fd25
call fcn.0041fb70
add eax, 0x40
push eax
call fcn.00420b2e
add esp, 0xc
call fcn.0040d790
push 0x17
call fcn.004201d6
int3
Function at 0x40dca0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x469f04], 0
mov dword [0x469f10], 0
je 0x40dcb9
mov eax, dword [0x469f14]
ret
mov eax, dword [esp + 8]
xor ecx, ecx
cmp dword [0x46df2c], ecx
push ecx
push ecx
cmovne eax, ecx
push ecx
mov dword [0x46df24], eax
call fcn.0040df60
add esp, 0xc
test eax, eax
jne 0x40dea0
cmp word [0x46df48], ax
ja 0x40dcf4
mov eax, 0x7fb
mov word [0x46df48], ax
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x40dd04
movzx ecx, word [0x45d870]
dec ecx
cmp ecx, 0xa
movzx eax, cx
mov edx, 9
cmovge eax, edx
mov word [0x45d7fc], ax
test ax, ax
jne 0x40dd28
mov eax, 1
mov word [0x45d7fc], ax
mov ecx, dword [str.english]
mov dword [0x470208], 0
push esi
mov esi, 0x45d830
push edi
test ecx, ecx
je 0x40dd8f
mov edi, dword [str.ENGLISH]
lea esp, [esp]
mov eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40dd72
test dl, dl
je 0x40dd6e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40dd72
add ecx, 2
add eax, 2
test dl, dl
jne 0x40dd52
xor eax, eax
jmp 0x40dd77
sbb eax, eax
or eax, 1
test eax, eax
je 0x40dd87
mov ecx, dword [esi + 8]
add esi, 8
test ecx, ecx
jne 0x40dd50
jmp 0x40dd8f
mov eax, dword [esi + 4]
mov dword [0x470208], eax
mov eax, dword [0x45d878]
mov esi, dword [esp + 0xc]
mov dword [0x470260], eax
mov eax, dword [0x46df5c]
mov dword [0x46df2c], eax
test esi, esi
jne 0x40ddb2
movzx esi, word [0x45d868]
mov eax, 0x64
cmp esi, eax
cmovb esi, eax
imul edi, esi, 0x1034
push edi
call fcn.0040db80
mov edx, eax
add esp, 4
test edx, edx
jne 0x40ddde
pop edi
mov dword [0x469f10], 0x15
pop esi
ret
mov dword [0x469f14], esi
lea ecx, [edx + 0x1034]
mov dword [0x470264], edx
mov dword [0x469f04], edx
mov dword [0x469f08], 0
mov dword [0x469f0c], edx
jmp 0x40de10
mov dword [ecx - 0x1030], 0
mov eax, dword [0x469f08]
mov dword [ecx - 0x1028], eax
mov dword [0x469f08], edx
mov dword [ecx - 0x1024], edx
mov dword [ecx - 0x1020], edx
add edx, 0x1034
mov dword [ecx - 0x102c], ecx
mov dword [ecx - 0x1014], ecx
mov dword [ecx - 0x101c], 0
mov dword [ecx - 0x1018], 0
add ecx, 0x1034
mov eax, dword [0x469f04]
add eax, edi
cmp edx, eax
jb 0x40de10
mov dword [edx - 0x1014], 0
mov dword [edx - 0x102c], 0
call fcn.00416e70
pop edi
mov eax, esi
mov dword [0x470204], 0
mov dword [0x470200], 0
pop esi
ret
push str.Cannot_get_environment_n
call fcn.0040d7e0
add esp, 4
push 0x1c
call fcn.004201d6
int3
Function at 0x415900
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
lea ebx, [esi + esi*2]
shl ebx, 2
mov eax, dword [edi]
movzx edx, word [edi + 8]
lea ecx, [eax + 0x80]
add eax, 0xc
add eax, ebx
and dword [eax], 0xfffffffe
lea eax, [eax + 0x88]
mov dword [eax - 0x8c], 0
lea ecx, [ecx + 0x88]
or dword [ecx - 0x88], 4
dec edx
jne 0x415926
mov eax, dword [edi]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
add eax, 8
add eax, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], eax
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
mov eax, dword [esp + 0x1c]
sub ecx, dword [eax]
mov eax, 0x78787879
imul ecx
mov ecx, dword [esp + 0x20]
sar edx, 6
mov eax, edx
add dword [esp + 0x20], 0x88
shr eax, 0x1f
add eax, edx
imul esi, eax, 0x88
mov eax, dword [edi]
add eax, esi
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
lea edx, [esi + ebx]
add edx, dword [esp + 0x10]
or dword [edx + 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
shr eax, 3
xor eax, dword [edx + 0xc]
and eax, 2
xor dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
and dword [eax + 0x80], 0xffffffef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
shr eax, 1
xor eax, dword [esi + ecx + 0x80]
and eax, 4
xor dword [esi + ecx + 0x80], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
inc eax
mov dword [esp + 0x14], eax
cmp eax, ecx
jb 0x415960
mov eax, dword [esp + 0x24]
lea eax, [eax + eax*4]
mov word [edi + eax*4 + 0x2c], cx
lea eax, [eax + 8]
lea eax, [edi + eax*4]
push eax
push edi
call fcn.00414c70
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x417450
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x41745c
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push dword [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 8]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
ret

Function at 0x417490
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x41749c
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push dword [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 8]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
ret
Function at 0x431d74
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45e490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004282ac
mov dword [ebp - 0x14], eax
cmp dword [0x46f284], esi
jne 0x431e67
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x431df4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x431f47
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x431f47
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431f47
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x46f284], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46f288], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x46f28c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46f294], eax
test eax, eax
je 0x431e64
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46f290], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x431e8c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x431e7f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x431ea1
push 4
pop eax
jmp 0x431f49
cmp dword [ebp - 0x14], esi
je 0x431ea1
push dword [0x46f284]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x431e86
mov eax, dword [0x46f290]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x431eff
cmp dword [0x46f294], edi
je 0x431eff
push eax
call ebx
push dword [0x46f294]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x431eff
test eax, eax
je 0x431eff
call ecx
test eax, eax
je 0x431ef4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x431ef4
test byte [ebp - 8], 1
jne 0x431eff
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x431f2f
mov eax, dword [0x46f288]
cmp eax, edi
je 0x431f2c
push eax
call ebx
test eax, eax
je 0x431f2c
call eax
mov esi, eax
test esi, esi
je 0x431f2c
mov eax, dword [0x46f28c]
cmp eax, edi
je 0x431f2c
push eax
call ebx
test eax, eax
je 0x431f2c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46f284]
call ebx
test eax, eax
je 0x431f47
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x431f49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420704
mov esp, ebp
pop ebp
ret
Function at 0x4071bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4071ca
pop dword [ebp - 0x40]
mov eax, 0x3117fa55
add eax, 0xcf287775
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xcc350bfd
sub dword [ebp - 0x50], 0x7de2c6b2
mov dword [ebp - 0x4c], 0x13d7051d
add dword [ebp - 0x4c], 0x1e5c4728
mov dword [ebp - 0x48], 0xfff44ae6
add dword [ebp - 0x48], 0x4c57f948
mov dword [ebp - 0x44], 0xd27703bb
add dword [ebp - 0x44], 0x2d88fc45
lea eax, [ebp - 0x50]
push eax
mov eax, 0xd5391ed8
add eax, 0x2b09119c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x97126d48
add dword [ebp - 0x50], 0xdd5ffc0e
mov dword [ebp - 0x4c], 0x4c6d6664
sub dword [ebp - 0x4c], 0xb0104ef
mov dword [ebp - 0x48], 0x9e3e6d68
sub dword [ebp - 0x48], 0x3acf00fc
mov dword [ebp - 0x44], 0xda57bd0e
sub dword [ebp - 0x44], 0xda57bd0e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x87783bee
sub eax, 0x87360aca
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3ea98
push 0
call eax
mov ecx, 0xd00961ae
add ecx, 0x2ff6e99a
mov edx, eax
mov edi, 0xa0e39ac8
add edi, 0x5f5fa938
add edi, dword [ebp - 0x40]
mov esi, 0x3a1b3ac4
add esi, 0x4da5a54a
sub dword [ebp - 8], 0xfc50f2c8
mov ebx, dword [edi]
xor dword [ebp - 0x10], edi
add ebx, esi
sub dword [ebp - 0x1c], esi
mov dword [edx], ebx
add edx, 0x898d3f10
sub edx, 0x898d3f0c
add edi, 4
loop 0x4072ec
add eax, 0x84bf39ac
sub eax, 0x84be19b9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4d923b44
sub ecx, 0x4d523b44
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4010ea
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x401234
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x40c150]
xor eax, ebp
mov dword [ebp + 0x7b4], eax
push ebx
push esi
xor esi, esi
push edi
mov edi, 0x20019
push edi
push 0x408314
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x50], esi
call fcn.00407701
mov ebx, eax
cmp ebx, esi
je 0x4012c0
lea ecx, [ebp - 0x68]
call fcn.00401080
lea ecx, [ebp - 0x5c]
call fcn.00401080
lea ecx, [ebp - 0x80]
call fcn.00401080
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, ebx
jmp 0x4013e2
push edi
push 0x408320
push dword [ebp - 0x74]
lea ecx, [ebp - 0x80]
call fcn.00407701
mov ebx, eax
cmp ebx, esi
jne 0x401299
push edi
push 0x40832c
push dword [ebp - 0x80]
lea ecx, [ebp - 0x5c]
call fcn.00407701
mov edi, eax
cmp edi, esi
jne 0x4013c0
mov ebx, 0x800
push ebx
lea eax, [ebp - 0x4c]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
cmp edi, esi
jne 0x4013c0
inc dword [ebp - 0x50]
push 7
xor eax, eax
mov edi, 0x40833c
lea esi, [ebp - 0x4c]
pop ecx
repe cmpsb byte [esi], byte es:[edi]
lea eax, [ebp - 0x4c]
je 0x40135a
push ebx
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
test edi, edi
je 0x40131e
jmp 0x4013c0
push 0x2001f
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x68]
call fcn.00407701
mov esi, eax
test esi, esi
je 0x401395
lea ecx, [ebp - 0x68]
call fcn.00401080
lea ecx, [ebp - 0x5c]
call fcn.00401080
lea ecx, [ebp - 0x80]
call fcn.00401080
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, esi
jmp 0x4013e2
mov eax, dword [ebp + 0x7c0]
push 4
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
push 4
push 0
push 0x408344
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x68]
mov edi, eax
call fcn.00401080
lea ecx, [ebp - 0x68]
call fcn.00401080
lea ecx, [ebp - 0x5c]
call fcn.00401080
lea ecx, [ebp - 0x80]
call fcn.00401080
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, edi
mov ecx, dword [ebp + 0x7b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ab9
add ebp, 0x7b8
leave
ret