joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4134b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x64], 0x666a756a
mov dword [ebp - 0x60], 0x666a756a
mov dword [ebp - 0x5c], 0x666a756a
mov dword [ebp - 0x58], 0x666a756a
mov dword [ebp - 0xc], 3
push 4
lea ecx, [ebp - 0x54]
call fcn.0041981b
mov dword [ebp - 0x2c], 0x36be856d
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x38], 0xaa08
mov dword [ebp - 8], 0
jmp 0x413519
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x413532
push dword [ebp - 8]
lea ecx, [ebp - 0x54]
call fcn.00419909
mov dword [eax], 0x1bbb4f5a
jmp 0x413512
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp + eax - 0x64], ecx
cmp dword [ebp - 0x10], 0
je 0x4135f4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + eax - 0x64], ecx
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], eax
jge 0x413573
mov dword [ebp - 0x18], 1
jmp 0x413577
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 4]
sub esi, dword [ebp - 0xc]
push 0
lea ecx, [ebp - 0x54]
call fcn.00419909
cmp esi, dword [eax]
jl 0x41359a
mov dword [ebp - 0x1c], 1
jmp 0x41359e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jle 0x4135af
mov dword [ebp - 0x20], 1
jmp 0x4135b3
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 4], 0x461e3ff1
jl 0x4135cb
mov dword [ebp - 0x24], 1
jmp 0x4135cf
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov esi, dword [ebp - 0xc]
push 0
lea ecx, [ebp - 0x54]
call fcn.00419909
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x64]
push 0
lea ecx, [ebp - 0x54]
call fcn.00419909
cmp esi, dword [eax]
je 0x413615
mov dword [ebp - 0x30], 1
jmp 0x413619
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x54]
call fcn.004198ed
mov eax, dword [ebp + 0xc]
dec eax
and eax, dword [ebp + 8]
je 0x413649
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041337f
pop ecx
pop ecx
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
jmp 0x41364f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6cb224e2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x14ce628c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4da0c8]
jne 0x40243a
repz ret
jmp fcn.004049fe

Function at 0x40462b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004024b1
and dword [ebp - 4], 0
cmp dword [0x4dbab0], 0
mov ebx, eax
jne 0x4046dc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40478d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40478d
push eax
call fcn.0040243f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4dbab0], eax
call esi
push eax
call fcn.0040243f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4dbab4], eax
call esi
push eax
call fcn.0040243f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4dbab8], eax
call esi
push eax
call fcn.0040243f
pop ecx
mov dword [0x4dbac0], eax
test eax, eax
je 0x4046dc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040243f
pop ecx
mov dword [0x4dbabc], eax
mov eax, dword [0x4dbabc]
cmp eax, ebx
je 0x404734
cmp dword [0x4dbac0], ebx
je 0x404734
push eax
call fcn.004024ba
push dword [0x4dbac0]
mov esi, eax
call fcn.004024ba
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404734
test edi, edi
je 0x404734
call esi
test eax, eax
je 0x40472b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40472b
test byte [ebp - 0xc], 1
jne 0x404734
or dword [ebp + 0x10], 0x200000
jmp 0x40476d
mov eax, dword [0x4dbab4]
cmp eax, ebx
je 0x40476d
push eax
call fcn.004024ba
pop ecx
test eax, eax
je 0x40476d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40476d
mov eax, dword [0x4dbab8]
cmp eax, ebx
je 0x40476d
push eax
call fcn.004024ba
pop ecx
test eax, eax
je 0x40476d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4dbab0]
call fcn.004024ba
pop ecx
test eax, eax
je 0x40478d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40478f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5c644e4f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1d441d5b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
call fcn.00401040
mov edi, dword [esp + 0x18]
test ebp, ebp
jg 0x40147c
mov eax, dword [esp + 0x14]
push edi
push eax
call fcn.00401930
push ebp
push str.nbeseefgpetigpoemfqgocaio
call fcn.00401c70
add esp, 8
mov ecx, dword [0x40db34]
mov eax, dword [0x40db38]
push ebx
lea ebx, [ebp + 0xb]
and ebx, 0xfffffffc
push esi
add ecx, ebx
cmp ecx, eax
jle 0x4014bb
mov edx, dword [esp + 0x1c]
push edi
push edx
call fcn.00401930
mov eax, dword [0x40db38]
mov ecx, dword [0x40db34]
push eax
push ebx
push ecx
push str.mddtthsejtetmdmdgdqfrlkchqhsflmtsttedc
call fcn.00401c70
add esp, 0x10
cmp dword [0x40db28], 1
jne 0x401555
lea edx, [ebx + 0x1c]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4014f5
mov eax, dword [esp + 0x1c]
push edi
push eax
call fcn.00401930
push ebx
push ebp
push str.pfqocljsqefsckkdgpjechrkbjlbhe
call fcn.00401c70
add esp, 0xc
lea edx, [esi + ebx]
mov ecx, 7
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [edx], ecx
mov ecx, dword [esp + 0x18]
mov dword [edx + 4], eax
mov dword [edx + 8], ebp
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], esi
mov eax, dword [0x40db2c]
xor ecx, ecx
cmp eax, ecx
je 0x401547
mov eax, dword [eax + 0x18]
mov dword [edx + 0x18], eax
mov ecx, dword [0x40db2c]
mov dword [edx + 0x14], ecx
mov eax, dword [0x40db2c]
mov dword [eax + 0x18], edx
mov dword [0x40db2c], edx
jmp 0x40157f
mov dword [edx + 0x18], ecx
mov dword [edx + 0x14], ecx
mov dword [0x40db2c], edx
jmp 0x40157f
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x40157f
mov ecx, dword [esp + 0x1c]
push edi
push ecx
call fcn.00401930
push ebx
push ebp
push str.pfqocljsqefsckkdgpjechrkbjlbhe
call fcn.00401c70
add esp, 0xc
xor edi, edi
mov edx, esi
mov ecx, edi
sar edx, cl
xor dl, 0xcc
mov byte [edi + esi], dl
inc edi
cmp edi, 4
jl 0x401581
lea ecx, [ebx - 8]
lea ebp, [esi + 4]
mov edx, ecx
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [ebx + ebp - 8]
xor ecx, ecx
mov eax, esi
sar eax, cl
xor al, 0xcc
mov byte [ecx + edi], al
inc ecx
cmp ecx, 4
jl 0x4015b1
mov eax, dword [0x40db30]
mov ecx, dword [0x40db34]
mov edx, dword [0x40db3c]
inc eax
add ecx, ebx
pop esi
cmp edx, eax
mov dword [0x40db30], eax
mov dword [0x40db34], ecx
pop ebx
jge 0x4015ea
mov dword [0x40db3c], eax
cmp dword [0x40db40], ecx
jge 0x4015f8
mov dword [0x40db40], ecx
call fcn.00401070
mov eax, ebp
pop edi
pop ebp
ret 0x10
Function at 0x407860
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
push 0x40b9b8
push ebx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40791c
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00401f20
lea ecx, [esp + 0xc]
push ecx
call fcn.00401ec0
lea ecx, [esp + eax + 0xc]
lea edx, [esp + 0xc]
cmp ecx, edx
jbe 0x4078c2
mov al, byte [ecx]
cmp al, 0x5c
je 0x4078c1
cmp al, 0x2f
je 0x4078c1
dec ecx
lea eax, [esp + 0xc]
cmp ecx, eax
ja 0x4078ac
jmp 0x4078c2
inc ecx
mov byte [ecx], 0
lea ecx, [esp + 0xc]
push ecx
call fcn.004077d0
test eax, eax
jne 0x4078ef
push ebx
push str.jrspoeokomssscljbetgqnfmhcgotqtr
call fcn.00401bb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc
push 0x40b9b8
push ebx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40791c
push ebx
push str.ihdpnrhrgrfmkabdemjlsdnalnk
call fcn.00401bb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc
mov edi, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push esi
push edi
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
je 0x40795f
push ebx
push str.omrhjdnblhgbfratchqpipfrnnlbh
call fcn.00401bb0
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x104
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5dae765a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2fd12667
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
mov eax, 1
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
mov ebp, eax
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
mov edi, esi
mov ecx, 0x5ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 0
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1924c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19250]
or eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x19254]
popal
jmp 0x40e274

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x53966569
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x464f5890
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x421faa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041b9d7
and dword [ebp - 4], 0
cmp dword [0x437fc8], 0
mov ebx, eax
jne 0x42205b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42210c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42210c
push eax
call fcn.0041b965
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437fc8], eax
call esi
push eax
call fcn.0041b965
mov dword [esp], 0x42b6b4
push edi
mov dword [0x437fcc], eax
call esi
push eax
call fcn.0041b965
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x437fd0], eax
call esi
push eax
call fcn.0041b965
pop ecx
mov dword [0x437fd8], eax
test eax, eax
je 0x42205b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041b965
pop ecx
mov dword [0x437fd4], eax
mov eax, dword [0x437fd4]
cmp eax, ebx
je 0x4220b3
cmp dword [0x437fd8], ebx
je 0x4220b3
push eax
call fcn.0041b9e0
push dword [0x437fd8]
mov esi, eax
call fcn.0041b9e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4220b3
test edi, edi
je 0x4220b3
call esi
test eax, eax
je 0x4220aa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4220aa
test byte [ebp - 0xc], 1
jne 0x4220b3
or dword [ebp + 0x10], 0x200000
jmp 0x4220ec
mov eax, dword [0x437fcc]
cmp eax, ebx
je 0x4220ec
push eax
call fcn.0041b9e0
pop ecx
test eax, eax
je 0x4220ec
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4220ec
mov eax, dword [0x437fd0]
cmp eax, ebx
je 0x4220ec
push eax
call fcn.0041b9e0
pop ecx
test eax, eax
je 0x4220ec
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437fc8]
call fcn.0041b9e0
pop ecx
test eax, eax
je 0x42210c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42210e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408924
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
call fcn.00408953
sub ecx, 0xb445183
or ecx, ecx
xor dword [ebx], esi
inc edi
add ecx, 0xcbfa2bb6
inc ebx
add edi, ecx
cmp ebx, edx
jne fcn.00408924
mov edi, 0x2277b0fe
ret
Function at 0x4027e0
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.00408dd0
mov eax, dword [0x2a8eff8]
mov ecx, dword [0x2a8df48]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4028b5
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2a8eff8], 0x959
jne 0x4028a3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xc00]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.0040262e
add edi, 8
dec ebx
jne 0x40280c
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4037a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a0c8]
jne 0x4037aa
repz ret
jmp fcn.00405cfe

Function at 0x405924
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404439
and dword [ebp - 4], 0
cmp dword [0x41b884], 0
mov ebx, eax
jne 0x4059d5
push 0x401930
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405a86
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401924
push edi
call esi
test eax, eax
je 0x405a86
push eax
call fcn.004043c7
mov dword [esp], 0x401914
push edi
mov dword [0x41b884], eax
call esi
push eax
call fcn.004043c7
mov dword [esp], 0x401900
push edi
mov dword [0x41b888], eax
call esi
push eax
call fcn.004043c7
mov dword [esp], 0x4018e4
push edi
mov dword [0x41b88c], eax
call esi
push eax
call fcn.004043c7
pop ecx
mov dword [0x41b894], eax
test eax, eax
je 0x4059d5
push 0x4018cc
push edi
call esi
push eax
call fcn.004043c7
pop ecx
mov dword [0x41b890], eax
mov eax, dword [0x41b890]
cmp eax, ebx
je 0x405a2d
cmp dword [0x41b894], ebx
je 0x405a2d
push eax
call fcn.00404442
push dword [0x41b894]
mov esi, eax
call fcn.00404442
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405a2d
test edi, edi
je 0x405a2d
call esi
test eax, eax
je 0x405a24
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405a24
test byte [ebp - 0xc], 1
jne 0x405a2d
or dword [ebp + 0x10], 0x200000
jmp 0x405a66
mov eax, dword [0x41b888]
cmp eax, ebx
je 0x405a66
push eax
call fcn.00404442
pop ecx
test eax, eax
je 0x405a66
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405a66
mov eax, dword [0x41b88c]
cmp eax, ebx
je 0x405a66
push eax
call fcn.00404442
pop ecx
test eax, eax
je 0x405a66
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41b884]
call fcn.00404442
pop ecx
test eax, eax
je 0x405a86
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405a88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret