joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420cd6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x420ce5
pop dword [ebp - 0x50]
mov eax, 0x420ce5
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xc0628c2b
sub dword [ebp - 0x60], 0x721046e0
mov dword [ebp - 0x5c], 0xae59c7d2
add dword [ebp - 0x5c], 0x83d98473
mov dword [ebp - 0x58], 0xec3997e6
sub dword [ebp - 0x58], 0x9fed53b8
mov dword [ebp - 0x54], 0xb0467654
add dword [ebp - 0x54], 0x4fb989ac
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x5195dfe7
sub dword [ebp - 0x60], 0xdd237691
mov dword [ebp - 0x5c], 0x8dd5e73d
add dword [ebp - 0x5c], 0xb3967a38
mov dword [ebp - 0x58], 0x10eb6b4
sub dword [ebp - 0x58], 0x9d9f4a48
mov dword [ebp - 0x54], 0x950df629
sub dword [ebp - 0x54], 0x950df629
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4785f
push 0
call eax
mov ecx, 0x56cde5e2
sub ecx, 0x56cd9775
xor edi, edi
add edi, eax
mov ebx, 0x475600
add ebx, dword [ebp - 0x50]
mov esi, 0xf0e0ef98
sub esi, 0xe468eaf7
sub dword [ebp - 0x1c], ecx
mov edx, dword [ebx]
xor dword [ebp - 8], edx
xor edx, esi
add dword [ebp - 4], ebx
mov dword [edi], edx
sub dword [ebp - 0x28], ecx
add edi, 4
add ebx, 0x924e921e
sub ebx, 0x924e921a
loop 0x420df4
add eax, 0x12c87
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8
Function at 0x574d20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x107000]
lea eax, [edi + 0x113974]
push dword [eax]
mov dword [eax], 0x78295fc3
push eax
push edi
jmp 0x574d4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x574d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x574d40
mov eax, 1
add ebx, ebx
jne 0x574d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x574d74
jne 0x574d93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x574d93
dec eax
add ebx, ebx
jne 0x574d80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x574d58
add ebx, ebx
jne 0x574d8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x574de5
xor ecx, ecx
sub eax, 3
jb 0x574dab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x574e1a
sar eax, 1
mov ebp, eax
jmp 0x574db6
add ebx, ebx
jne 0x574db6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x574d84
inc ecx
add ebx, ebx
jne 0x574dc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x574d84
add ebx, ebx
jne 0x574dd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x574dc6
jne 0x574de2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x574dc6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x574e04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x574df6
jmp 0x574d46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x574e04
add edi, ecx
jmp 0x574d46
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x5087
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x574e26
cmp byte [edi], 0x11
jne 0x574e26
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x574e2b
lea edi, [esi + 0x16c000]
mov eax, dword [edi]
or eax, eax
je 0x574ea3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1bb540]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1bb698]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x574e58
mov ecx, edi
jns 0x574e87
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1bb6a0]
or eax, eax
je 0x574e9d
mov dword [ebx], eax
add ebx, 4
jmp 0x574e75
call dword [esi + 0x1bb69c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x574ed4
cmp al, 0xef
ja 0x574ec7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x574ea9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x574eb6
mov ebp, dword [esi + 0x1bb6a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x574f08
sub esp, 0xffffff80
jmp 0x4a577e
Function at 0x401000
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x401080
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x401080
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x14], eax
mov esi, eax
test eax, eax
je 0x401080
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._GetUserNameExW_12
mov edx, dword [ebp - 0x14]
sub esp, 0xc
test al, al
jne 0x401082
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4011e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x34
cmp edx, 0xffffffff
je 0x401320
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x14], eax
call eax
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401240
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x20], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x401236
mov edx, dword [ebp - 0x20]
call edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
mov ebx, dword [ebp - 0x1c]
call ebx
lea ebx, [ebp - 0x10]
sub esp, 0x20
mov dword [esp], 0xfffffff5
mov esi, dword [ebp - 0x14]
call esi
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
mov ecx, dword [ebp - 0x18]
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edi, eax
mov esi, eax
jmp 0x4011fb
Function at 0x4019c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401a18
cmp byte [esi + ebx - 1], 0xa
je 0x4019ec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x406084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x406094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x402180
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x406094]
movzx eax, al
bt eax, esi
jae 0x4021e0
mov ecx, dword [0x406084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x402085
test byte [0x403018], 8
jne 0x402120
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x4020d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402054
cmp esi, 3
jbe 0x402090
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4041ec]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x402054
mov ecx, dword [0x406094]
test ecx, ecx
je 0x4021c0
mov dword [esp], 0x403028
call dword [0x406094]
test al, 8
je 0x40202b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x40202b
mov ebx, dword [0x406094]
test ebx, ebx
je 0x4021a0
mov dword [esp], 0x403018
call dword [0x406094]
test al, 8
je 0x402016
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x40201e
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x406094
call sym._load_func.part.0
jmp 0x401fdd
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x406094
call sym._load_func.part.0
jmp 0x40212a
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x406094
call sym._load_func.part.0
jmp 0x4020de
mov eax, 0xffffffff
jmp 0x402085
Function at 0x402340
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402c00
pop dword [ebp - 0x44]
mov eax, 0x6a6e514f
add eax, 0x95d1dab1
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x51f230b6
sub dword [ebp - 0x54], 0x39feb6b
mov dword [ebp - 0x50], 0xfb19b90f
add dword [ebp - 0x50], 0x37199336
mov dword [ebp - 0x4c], 0x2e53a7a5
add dword [ebp - 0x4c], 0x1df89c89
mov dword [ebp - 0x48], 0x2eff3ce3
add dword [ebp - 0x48], 0xd100c31d
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x5b946071
add dword [ebp - 0x54], 0x18de08e5
mov dword [ebp - 0x50], 0xbe8490b3
sub dword [ebp - 0x50], 0x7d182f3e
mov dword [ebp - 0x4c], 0x90ac69f
sub dword [ebp - 0x4c], 0xa59b5a33
mov dword [ebp - 0x48], 0x9f50ab48
sub dword [ebp - 0x48], 0x9f50ab48
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x5cc3bbe2
add eax, 0xa37cc4f2
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1da
push 0
call eax
mov ecx, 0x912fdf29
add ecx, 0x6ed0768c
mov esi, eax
mov edi, 0x411000
add edi, dword [ebp - 0x44]
mov ebx, 0xb22c2308
add ebx, 0x2c620287
sub dword [ebp - 0x3c], 0xbc3980e0
mov edx, dword [edi]
sub dword [ebp - 0x34], ecx
sub edx, ebx
xor dword [ebp - 0x10], edi
mov dword [esi], edx
sub dword [ebp - 0x20], 0xac75eee1
add esi, 4
add edi, 0x4ac9f479
sub edi, 0x4ac9f475
loop 0x402d17
add eax, 0x149a7
xor ebx, ebx
add ebx, eax
add eax, 0x936b82f2
sub eax, 0x936b82ed
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x44cd36e9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x417d09d9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000ff4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000bac0]
jne 0x10051674
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10054c28], eax
mov dword [0x10054c24], ecx
mov dword [0x10054c20], edx
mov dword [0x10054c1c], ebx
mov dword [0x10054c18], esi
mov dword [0x10054c14], edi
mov word [0x10054c40], ss
mov word [0x10054c34], cs
mov word [0x10054c10], ds
mov word [0x10054c0c], es
mov word [0x10054c08], fs
mov word [0x10054c04], gs
pushfd
pop dword [0x10054c38]
mov eax, dword [ebp]
mov dword [0x10054c2c], eax
mov eax, dword [ebp + 4]
mov dword [0x10054c30], eax
lea eax, [ebp + 8]
mov dword [0x10054c3c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10054b78], 0x10001
mov eax, dword [0x10054c30]
mov dword [0x10054b2c], eax
mov dword [0x10054b20], 0xc0000409
mov dword [0x10054b24], 1
mov eax, dword [0x1000bac0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10054a58]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10054b70], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000bac8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10054b70], 0
jne 0x10051760
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x1002a73f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1002a74e
pop dword [ebp - 0x14]
mov eax, 0x1002a74e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x43241939
sub dword [ebp - 0x24], 0xf4d1d3ee
mov dword [ebp - 0x20], 0x3e4575ab
add dword [ebp - 0x20], 0xf3edd69a
mov dword [ebp - 0x1c], 0xe4feb715
sub dword [ebp - 0x1c], 0x98b272e7
mov dword [ebp - 0x18], 0xbe6c96c4
add dword [ebp - 0x18], 0x4193693c
lea eax, [ebp - 0x24]
push eax
mov eax, 0x207c8e13
add eax, 0xef838361
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x53aef345
sub dword [ebp - 0x24], 0xdf3c89ef
mov dword [ebp - 0x20], 0x146712f
add dword [ebp - 0x20], 0x4025f046
mov dword [ebp - 0x1c], 0x68e59043
sub dword [ebp - 0x1c], 0x57623d7
mov dword [ebp - 0x18], 0x8efe29bc
add dword [ebp - 0x18], 0x7101d644
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xa4d61773
add eax, 0x6b29f981
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x5187f
push 0
call eax
mov ecx, 0x5275
mov edx, eax
mov edi, 0xa306e829
add edi, 0x6cffc9d7
add edi, dword [ebp - 0x14]
mov esi, 0xd27ffe96
sub esi, 0x366cb000
xor dword [ebp - 4], 0x880a5150
mov ebx, dword [edi]
xor dword [ebp - 8], ecx
sub ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0xc], 0x19d4872f
add edx, 0x385a02d3
sub edx, 0x385a02cf
add edi, 4
loop 0x1002a865
add eax, 0x16f5de60
sub eax, 0x16f4a1b9
xor ebx, ebx
add ebx, eax
add eax, 0x225741e4
add eax, 0xdda8be21
mov ecx, 0xe765f63
sub ecx, 0xfe765f63
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456004]
jne 0x40100a
repz ret
jmp fcn.004016b5

Function at 0x405d4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004031ad
and dword [ebp - 0x14], 0
cmp dword [0x458c74], 0
mov dword [ebp - 0x18], eax
jne 0x405dfd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405ea5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405ea5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x458c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x458c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x458c7c], eax
call edi
push eax
call esi
mov dword [0x458c84], eax
test eax, eax
je 0x405dfd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x458c80], eax
mov eax, dword [0x458c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405e56
cmp dword [0x458c84], ecx
je 0x405e56
push eax
call esi
push dword [0x458c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405e56
test ebx, ebx
je 0x405e56
call edi
test eax, eax
je 0x405e4d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405e4d
test byte [ebp - 8], 1
jne 0x405e56
or dword [ebp + 0x10], 0x200000
jmp 0x405e89
mov eax, dword [0x458c78]
cmp eax, dword [ebp - 0x18]
je 0x405e89
push eax
call esi
test eax, eax
je 0x405e89
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405e89
mov eax, dword [0x458c7c]
cmp eax, dword [ebp - 0x18]
je 0x405e89
push eax
call esi
test eax, eax
je 0x405e89
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x458c74]
call esi
test eax, eax
je 0x405ea5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405ea7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret