joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40966b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00409594
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebp - 1], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub edi, dword [ebp - 0x24]
sub esi, eax
sub esi, dword [ebp - 0x20]
inc edi
inc esi
cmp byte [ebp - 1], 0
je 0x4096f8
cmp byte [ebp + 0x10], 0
jne 0x409738
imul eax, dword [ebp - 8]
push 0x206
cdq
push 0x64
pop ecx
idiv ecx
add eax, esi
push eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
add eax, edi
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [ebp + 0x10], 0
jne 0x409738
push 0x400
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x444]
push eax
push eax
call fcn.004094b0
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
push dword [ebp + 8]
sub esi, eax
call dword [sym.imp.USER32.dll_GetWindow]
and dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x40982e
cmp dword [ebp + 8], 0x200
jge 0x409836
push 0x400
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [ebp - 0x444], 0
je 0x4097ac
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x444]
push eax
push eax
call fcn.004094b0
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp byte [ebp - 1], 0
je 0x409818
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call ebx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 0x204
inc eax
imul eax, dword [ebp - 8]
cdq
push 0x64
pop ecx
idiv ecx
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
inc eax
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
push eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
sub eax, esi
imul eax, dword [ebp - 8]
cdq
idiv ecx
push eax
mov eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x34]
sar ecx, 1
sub eax, ecx
sub eax, dword [ebp - 0x24]
push 0x64
imul eax, dword [ebp - 0xc]
pop ecx
cdq
idiv ecx
push eax
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x14]
je 0x409836
inc dword [ebp + 8]
test eax, eax
jne 0x40975c
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4098ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040a213
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x409a0d
cmp ebx, edx
jge 0x409954
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x409956
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x409939
cmp ecx, edx
jne 0x40995e
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x409925
cmp eax, 0xa
jg 0x409a0d
mov dword [ebp - 4], 0x418ca8
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x418dc8]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x4099b9
add eax, edx
dec edi
jne 0x4099b7
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x409a0d
cmp ebx, edx
jge 0x4099f6
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x4099f8
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x4099da
cmp ecx, edx
jne 0x4099ff
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x4099cc
cmp dword [ebp + 8], 0xa
jle 0x409972
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x409a14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x415ca8]
xor dl, byte [eax + ebx*4 + 0x4164a8]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4168a8]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4160a8]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x409a3c
inc eax
cmp eax, edi
jl 0x409a2f
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040a213
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x409a2d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ab36
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x67
push dword [0x419f80]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x41a814], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40ab98
mov ecx, dword [0x418ecc]
call fcn.004064ad
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x41257a
push 0
push 0xc2
push edi
call esi
mov byte [0x41a814], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x40]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x40], 0x3c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x3c], eax
je 0x40abe8
mov ecx, dword [ebp - 0x38]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], 0xa0
mov dword [ebp - 0x3c], 0x40000001
lea ecx, [ebp - 0x40]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40ac32
mov eax, dword [ebp - 0x38]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x4125b0
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40b50a
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
lea eax, [ebp - 0x420]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [0x41a815], 0
jne 0x40b599
push 6
push dword [0x41409c]
lea eax, [ebp - 0x420]
push eax
call fcn.00407338
push eax
call fcn.0040a51a
test eax, eax
jne 0x40b599
push 0x41231c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x420]
push eax
call fcn.0040a2e1
push 0x1e
mov byte [ebp + eax - 0x41f], 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0040a1e6
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
leave
ret

Function at 0x40b653
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
mov dword [0x419f70], esi
cmp dword [0x419f80], ebx
je 0x40b67d
push 0x7d
call fcn.00409854
push eax
push esi
push dword [0x419f80]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x419f80]
mov dword [0x419f6c], ebx
mov dword [0x419f68], esi
cmp eax, ebx
je 0x40b6cd
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x41a824], ebx
jne 0x40b6c4
cmp byte [0x41a814], bl
jne 0x40b6c4
push ebx
push esi
push 0x111
push dword [0x419f80]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40b6c4
call fcn.0040a78a
cmp dword [0x419f78], 2
jne 0x40b6bf
cmp byte [0x419f88], bl
pop esi
pop ebx
je 0x40b6dc
jmp fcn.0040b50a
ret
Function at 0x40b70b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp byte [0x419f90], bl
je 0x40b787
cmp byte [0x418ed0], bl
je 0x40b787
push esi
push 0x418ed0
lea esi, [ebp - 0x408]
call fcn.0040b6dd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
test eax, eax
jne 0x40b787
push dword [ebp + 8]
call fcn.0040a2e1
inc eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40b78c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
cmp byte [0x419f90], 0
je 0x40b80e
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x40c]
call fcn.0040b6dd
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x40b80e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b805
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call fcn.0040a3d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x40b873
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp byte [0x419ede], 0
mov eax, dword [ebp + 0x10]
mov dword [0x419ee0], eax
mov eax, dword [ebp + 0x14]
mov dword [0x419ee4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x419ed8], eax
je 0x40b8a3
xor eax, eax
inc eax
jmp 0x40b8cc
cmp byte [0x419edf], 0
je 0x40b8b1
push 2
pop eax
jmp 0x40b8cc
push dword [ebp + 0xc]
push 0x40ac87
push dword [0x419f80]
push str.REPLACEFILEDLG
push dword [0x414c74]
call esi
dec eax
je 0x40b92d
dec eax
je 0x40b90c
dec eax
je 0x40b926
dec eax
jne 0x40b8ff
push dword [ebp + 0xc]
push 0x40af83
push dword [0x419f80]
push str.RENAMEDLG
push dword [0x414c74]
call esi
test eax, eax
je 0x40b87d
mov eax, dword [ebp + 8]
mov byte [eax], 0x52
jmp 0x40b93e
dec eax
je 0x40b914
dec eax
jne 0x40b93e
mov byte [0x419edf], 1
mov eax, dword [ebp + 8]
mov byte [eax], 0x4e
jmp 0x40b93e
mov eax, dword [ebp + 8]
mov dword [0x419f78], 1
mov byte [eax], 0x43
jmp 0x40b93e
mov byte [0x419ede], 1
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
mov byte [eax], 0x59
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
pop ebp
ret 0x18
Function at 0x40ba69
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push esi
mov esi, eax
push esi
call fcn.0040a2e1
cmp eax, 0x3f6
jae 0x40bc7d
push ebx
push edi
push 0x3c
pop edi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x44]
push eax
call fcn.0040a1e6
mov cl, byte [esi]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x5c0
cmp cl, 0x22
jne 0x40bab1
lea eax, [esi + 1]
mov dword [ebp - 0x34], eax
jmp 0x40bab4
mov dword [ebp - 0x34], esi
xor eax, eax
cmp cl, bl
je 0x40baf9
mov ecx, esi
cmp byte [ecx], 0x22
jne 0x40bad5
jmp 0x40bac9
cmp byte [eax + esi], 0x22
je 0x40bad1
inc eax
cmp byte [eax + esi], bl
jne 0x40bac3
jmp 0x40bad5
mov byte [eax + esi], 0x20
cmp byte [eax + esi], 0x20
je 0x40baec
cmp byte [eax + esi + 1], 0x2f
je 0x40baec
inc eax
lea ecx, [eax + esi]
cmp byte [ecx], bl
jne 0x40babc
jmp 0x40baf9
add eax, esi
cmp byte [eax], 0x20
jne 0x40baf5
mov byte [eax], bl
inc eax
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], bl
jne 0x40bb0d
cmp byte [0x41a392], bl
je 0x40bb0d
mov dword [ebp - 0x30], 0x41a392
push dword [ebp - 0x34]
mov dword [ebp - 0x28], 1
call fcn.004075ed
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40bb39
push str..inf
push eax
call fcn.0040a4f7
test eax, eax
jne 0x40bb39
mov dword [ebp - 0x38], 0x412620
push ebx
push dword [ebp - 0x34]
call fcn.0040577a
mov byte [ebp - 1], al
cmp al, bl
je 0x40bb61
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x34]
call fcn.00405830
lea eax, [ebp - 0x844]
mov dword [ebp - 0x34], eax
cmp byte [ebp + 8], bl
je 0x40bba0
cmp byte [ebp - 1], bl
jne 0x40bba0
push dword [ebp - 0x34]
lea eax, [ebp - 0x444]
push eax
call fcn.0040a3d4
push str..exe
lea eax, [ebp - 0x444]
push eax
call fcn.0040a53f
push ebx
lea eax, [ebp - 0x444]
push eax
call fcn.0040577a
test al, al
je 0x40bc7b
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
setne al
cmp al, bl
jne 0x40bbd2
and dword [ebp - 0x40], 0xfffffbff
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x34], esi
call edi
test eax, eax
setne al
cmp al, bl
je 0x40bc7b
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
cmp byte [0x419f88], bl
jne 0x40bbe8
cmp byte [ebp + 8], bl
je 0x40bc1f
mov eax, dword [0x419f80]
cmp eax, ebx
je 0x40bc09
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40bc09
push ebx
push dword [0x419f80]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
call fcn.0040b4cb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40bc3e
push str..exe
push dword [ebp - 8]
call fcn.0040a4f7
test eax, eax
je 0x40bc6c
cmp byte [0x419f88], bl
je 0x40bc52
cmp byte [ebp + 8], bl
jne 0x40bc52
push 0x1b58
jmp 0x40bc66
xor eax, eax
cmp byte [ebp + 8], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 1], bl
je 0x40bc7b
push 1
push dword [0x419f80]
call esi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x40d020
Capabilities:
Accept command line arguments
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x41fdb8
call fcn.0040e0ab
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
je 0x40d05c
push esi
call fcn.0040b275
push esi
push str.sfxcmd
call edi
push 0x400
mov esi, 0x419ad8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push str.sfxname
call edi
call fcn.00406e02
test eax, eax
je 0x40d092
push 0x400
push 0x4192d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x40d09a
xor eax, eax
mov word [0x4192d8], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x64
push edi
mov dword [0x414c78], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x65
push dword [0x414c78]
mov dword [0x4192d4], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
lea ecx, [ebp - 8]
mov dword [0x4192d0], eax
call fcn.004111fa
push esi
mov ecx, 0x414c88
call fcn.0040983d
lea ecx, [ebp - 0x38]
call fcn.00406487
lea ecx, [ebp - 0x20]
call fcn.00406487
push ebx
push 0x40c90e
push ebx
lea eax, [ebp - 0x38]
mov dword [0x418ecc], eax
push str.STARTDLG
lea eax, [ebp - 0x20]
push edi
mov dword [0x418ec8], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea ecx, [ebp - 0x20]
mov dword [0x419f80], ebx
mov dword [0x418ec8], ebx
mov dword [0x418ecc], ebx
call fcn.004064a0
lea ecx, [ebp - 0x38]
call fcn.004064a0
lea ecx, [ebp - 8]
call fcn.00411272
cmp byte [0x419f88], bl
je 0x40d147
call fcn.0040b50a
push 0x80
push ebx
push 0x419ee8
call fcn.0040a1e6
cmp dword [0x41a824], ebx
jbe 0x40d16a
push dword [0x41a818]
call fcn.0040a162
push dword [0x4192d4]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x4192d0]
cmp eax, ebx
je 0x40d184
push eax
call esi
cmp dword [0x414c7c], ebx
jne 0x40d1a3
cmp dword [0x419f78], ebx
je 0x40d1a3
push 0xff
mov ecx, 0x414c7c
call fcn.004032d8
mov eax, dword [0x41a828]
mov dword [0x419f78], 2
cmp eax, ebx
je 0x40d1bc
push eax
call fcn.0040b4cb
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x414c7c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40d52e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x40e5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, esi
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040e20a
push eax
push esi
push dword [ebp + 8]
call fcn.0040e1bf
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040e20a
push eax
push esi
push dword [ebp + 8]
call fcn.0040e1bf
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040e1fa
inc ebp
push ss
leave
cmp al, 0x88
popfd
jl 0x40e67f
invalid
invalid

Function at 0x40f67c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040e1fa
movsd dword es:[edi], dword [esi]
adc al, 0xe3
jo 0x40f675
test esp, edx
clc
invalid
Function at 0x424744
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429c48
push 0x424860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4337cc], 0xffffffff
or dword [0x4337dc], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x43363c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x433638]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4337c0], eax
call fcn.004248ab
cmp dword [0x4332e8], 0
jne 0x4247c7
push 0x4248a8
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00424890
push 0x42e46c
push 0x42e368
call sub.MSVCRT.dll__initterm
mov eax, dword [0x433634]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x433630]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x42e264
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00401d9d
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401b90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401bdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401bd4
test esi, esi
je 0x401bd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401bb0
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401dc0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401ee8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401e4e
cmp eax, 4
jne 0x401e70
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401e5e
cmp edx, 4
je 0x401e5e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401dc0