joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022f07
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10022f60
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10022f07
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10022f16
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10428bb9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10022f67
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10009ddd
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10023006
add edi, 4
add eax, 2
dec ecx
jne 0x10022f4c
call 0x10022fb3
loope 0x10022fa9
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10023003
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10023014
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10022fc7
cmp eax, ecx
ja 0x10022fc7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10023051
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10023047
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000a2bc
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10022f16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10022f60
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10022f07
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10022f16
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10428bb9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10022f67
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10009ddd
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10023006
add edi, 4
add eax, 2
dec ecx
jne 0x10022f4c
call 0x10022fb3
loope 0x10022fa9
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10023003
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10023014
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10022fc7
cmp eax, ecx
ja 0x10022fc7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10023051
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10023047
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000a2bc
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401054
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push esi
test edx, edx
mov esi, ecx
jle 0x4010e0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
sub eax, ecx
push edi
mov dword [ebp + 0x10], ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
mov edi, 0x100
mov eax, dword [esi + 0x104]
mov ecx, edi
inc eax
mov ebx, edi
cdq
idiv ecx
mov ecx, edx
mov dword [esi + 0x104], ecx
movzx eax, byte [ecx + esi]
add eax, dword [esi + 0x108]
cdq
idiv ebx
push edx
push ecx
push esi
mov ecx, esi
mov dword [esi + 0x108], edx
call fcn.004010fc
mov eax, dword [esi + 0x108]
mov ecx, dword [esi + 0x104]
movzx eax, byte [eax + esi]
movzx ecx, byte [ecx + esi]
add eax, ecx
mov ecx, edi
cdq
idiv ecx
mov eax, dword [ebp + 0x10]
mov cl, byte [edx + esi]
mov edx, dword [ebp + 8]
xor cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
jne 0x401079
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x40111c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
xor esi, esi
mov eax, esi
cdq
idiv dword [edi + 0x100]
mov eax, dword [esp + 0x10]
movzx ecx, byte [edx + eax]
movzx eax, byte [esi + edi]
add ebx, ecx
mov ecx, 0x100
add eax, ebx
cdq
idiv ecx
mov ecx, edi
mov ebx, edx
push ebx
push esi
push edi
call fcn.004010fc
inc esi
cmp esi, 0x100
jl 0x401125
pop edi
pop esi
pop ebx
ret 4

Function at 0x401205
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push str._temp1.ini
push eax
call fcn.00403e00
pop ecx
xor esi, esi
pop ecx
lea eax, [ebp - 0x104]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
mov edi, eax
push 0x100
push 0x43dcbe
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x40128b
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
lea eax, [ebp - 0x108]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00401205
lea eax, [ebp - 0x108]
push str._temp.dll
push eax
call fcn.00403e00
pop ecx
pop ecx
lea ecx, [ebp - 0x214]
call fcn.004010f9
push 4
push 0x43dcb0
lea ecx, [ebp - 0x214]
call fcn.00401161
xor ebx, ebx
lea eax, [ebp - 0x108]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, 0x30c00
mov dword [ebp - 4], eax
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push esi
push 0x40d0b0
push edi
call fcn.00403ee0
add esp, 0xc
lea ecx, [ebp - 0x214]
push esi
push edi
push edi
call fcn.004010e5
cmp dword [ebp - 4], 0xffffffff
je 0x401346
push ebx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call fcn.00401273
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x405024
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442f3c]
jne 0x40502e
repz ret
jmp fcn.00408e12

Function at 0x40b8ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004069f0
and dword [ebp - 4], 0
cmp dword [0x444870], 0
mov ebx, eax
jne 0x40b95d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ba0e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ba0e
push eax
call fcn.0040697e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444870], eax
call esi
push eax
call fcn.0040697e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444874], eax
call esi
push eax
call fcn.0040697e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444878], eax
call esi
push eax
call fcn.0040697e
pop ecx
mov dword [0x444880], eax
test eax, eax
je 0x40b95d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040697e
pop ecx
mov dword [0x44487c], eax
mov eax, dword [0x44487c]
cmp eax, ebx
je 0x40b9b5
cmp dword [0x444880], ebx
je 0x40b9b5
push eax
call fcn.004069f9
push dword [0x444880]
mov esi, eax
call fcn.004069f9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b9b5
test edi, edi
je 0x40b9b5
call esi
test eax, eax
je 0x40b9ac
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b9ac
test byte [ebp - 0xc], 1
jne 0x40b9b5
or dword [ebp + 0x10], 0x200000
jmp 0x40b9ee
mov eax, dword [0x444874]
cmp eax, ebx
je 0x40b9ee
push eax
call fcn.004069f9
pop ecx
test eax, eax
je 0x40b9ee
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b9ee
mov eax, dword [0x444878]
cmp eax, ebx
je 0x40b9ee
push eax
call fcn.004069f9
pop ecx
test eax, eax
je 0x40b9ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444870]
call fcn.004069f9
pop ecx
test eax, eax
je 0x40ba0e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ba10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
bswap edx
inc edi
sub ebx, 0xea
imul edx
ror esi, 0xac
rcr ebx, 0xab
dec edi
add edx, 0x60
add edi, 0x35
inc esi
neg eax
neg edi
sbb ebx, 0x3a
ror esi, 0x66
not edi
bswap edx
not edx
ror eax, 0xc5
and eax, 0xb
rcr ebx, 0xd8
sub edi, 0xf8
dec edi
mov edx, 0x67
neg esi
or edx, 0x9b
inc eax
ror ebx, 0x44
dec edx
and edx, 0x86
not edi
rcr edx, 0xb1
sbb ebx, 0x31
inc eax
bswap eax
not edx
inc ebx
or edi, 0x53
ror edx, 0x4c
dec ebx
neg eax
mov edx, 0xc6
dec ebx
ror ebx, 0xd3
or eax, 0x37
rcr eax, 0x94
not esi
rol esi, 0xf2
and edi, 0x11
rcr eax, 0xcf
mov edx, 0x19
xor ecx, ecx
xor edi, edi
rcl edi, 0x36
imul eax
not edx
inc eax
neg esi
imul edi
or eax, 0x89
and eax, 0x3b
inc eax
add esi, 0xbc
add eax, 0x68
bswap ebx
neg esi
not edx
bswap eax
neg ebx
rcl ebx, 0xf1
add eax, 0x8e
not ebx
sub eax, 0x12
mov edx, 0x9b
sub edi, 0x3f
bswap esi
sub edx, 0xe2
bswap ebx
ror edx, 0xc4
or esi, 0x22
not edx
imul edx
sub esi, 0xc2
sub esi, 0x90
bswap esi
bswap ebx
dec esi
or eax, 0x87
rol edi, 0xa9
or esi, 0xde
ror esi, 0x81
dec edi
dec edx
not edi
add edi, 0x10
dec esi
not eax
rcr edi, 0x2a
imul ebx
neg esi
dec eax
and edi, 0xfc
mov edi, 0xa8
mov ecx, dword [ebp + 0xc]
rcr esi, 9
neg esi
bswap ebx
imul edx
sub eax, 0xb6
not eax
or esi, 0x75
dec ebx
dec edx
dec edx
sbb eax, 0xb1
ror edx, 0xeb
rcl esi, 0x63
imul eax
sbb ebx, 0x83
and edx, 0x70
not edx
not ebx
or eax, 0xa1
not esi
add esi, 0x3d
not eax
add edx, 0x80
inc eax
dec edi
imul ebx
and esi, 0xae
add edx, 3
not edi
mov edi, 0xcd
and eax, 0x9a
imul esi
rcr esi, 0x14
neg esi
bswap edx
sub edi, 0x68
sub eax, 0x46
dec edi
bswap eax
neg ebx
not esi
dec edi
or eax, 0x35
rol edx, 0xc4
not edx
rcr eax, 0xfb
imul ebx
add ebx, 0xd3
add edx, 0x3c
mov ebx, 0xca
mov edi, dword [ebp + 8]
mov esi, esi
mov ebx, eax
xor ebx, esi
not byte [edi]
xor eax, ebx
xor ebx, eax
xor eax, eax
xor esi, eax
mov ebx, eax
mov ebx, ebx
xor esi, eax
xor eax, eax
mov ebx, esi
add byte [edi], 0x26
mov ebx, esi
mov esi, ebx
xor esi, eax
mov esi, esi
xor eax, eax
mov esi, eax
xor ebx, ebx
mov ebx, ebx
xor ebx, esi
sub byte [edi], 0x86
mov esi, ebx
mov eax, eax
mov esi, ebx
xor ebx, ebx
mov eax, eax
xor eax, ebx
xor eax, ebx
mov esi, ebx
xor eax, ebx
imul byte [edi]
inc edi
loop 0x4103ca
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x579b0a9b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5fb944c4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40152e
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x40158a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040152e
mov dword [esp], 0x401664
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x4020c6
sub eax, 0x401664
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40162d
mov dword [esp], ebx
lea esi, [ebp - 0x88]
call fcn.0040144c
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004014ad
lea eax, [ebx + 0x1b600]
mov cl, bl
mov edx, 0x40300c
shl eax, cl
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, edx
or eax, 1
imul ebx, eax
sub edx, ebx
mov dword [esp], edx
call fcn.00401dc9
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xc3f3515c
int3
in al, dx
jnp 0x414b15
sbb dword [edx - 0xc46611a], edi
fisttp word [edi]
jnp 0x414a7e
mov bh, 0xb5
dec edi
sbb cl, ch
sbb al, byte [edi + 0xd]
out 0x37, eax
sbb eax, 0x204934
push edi
popfd
mov ecx, 0xfb3fb348
invalid
mov bh, 0xdf
inc esi
or eax, 0xf2b92048
mov bh, 0xdf
mov ecx, 0xb9dfb7f2
mov bh, 0xdf
mov ecx, 0xbd3334f2
xor eax, 0x5a55fbb3
cmc
fbstp tbyte [eax - 0x464807f7]
xor dh, 0xdf
div dword [ebp - 0x37c4f8f1]
xor dword [esi + esi*2 - 0x5d], esp
xlatb
lcall 0xe2b9, 0x66f10d90
neg edi
cmp byte [0xf2b9dfb6], dh
xor dword ss:[eax - 0x7c], edx
xor dword [eax - 0x7c], edx
mov edi, 0xb61c383d
fistp qword [ecx - 0xd00f20e]
mov bl, CoUninitialize
pop esi
push esi
push eax
jnp 0x414b57
popfd
dec eax
aaa
xchg edx, eax
mov bh, 0xdf
add bl, al
fiadd dword [esp + edi*2]
stosd dword es:[edi], eax
jl 0x414b25
sahf
sub dword [edx], esi
out 0x93, al
pop esp
jge 0x414b78
sbb byte ss:[ecx], bh
ret 0x9f80
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x7a
bswap edx
imul eax
inc edx
dec esi
and edi, 0xe6
imul edx
sub esi, 0xbd
add esi, 0xc
dec ebx
add edx, 0xdd
inc ebx
inc edi
dec edi
rol ebx, 0xe8
bswap eax
inc ebx
mov edx, 0xca
inc eax
imul eax
rcr ebx, 0x79
or eax, 0x17
not edi
inc edi
rcr esi, 0x51
imul eax
sbb edx, 0x49
dec edx
inc edx
imul eax
inc ebx
add ebx, 0x63
rol esi, 6
rcr edx, 0x44
bswap esi
dec esi
neg edi
not eax
not esi
inc esi
or edi, 0x76
rcr edx, 0x53
ror edx, 0xf8
imul eax
and edi, 0x73
inc eax
rol edi, 0xbb
inc edx
imul eax
mov edx, 0x30
xor ecx, ecx
xor edi, edi
not esi
inc edx
and ebx, 8
sbb edi, 0x2c
imul eax
sub edx, 0xd7
bswap esi
neg edi
dec edi
sub esi, 0xff
add edx, 7
bswap edi
and esi, 0xce
inc edx
add esi, 0x1a
rcr esi, 0x3d
add edi, 0x4d
not esi
mov edi, 0x61
bswap eax
dec eax
rcl edi, 0x2a
sub edx, 0xfd
imul eax
or esi, 0xb4
inc ebx
bswap edx
rol ebx, 0x73
sbb edi, 0xfd
bswap eax
inc esi
bswap esi
add eax, 0x3b
rol esi, 0x31
inc edi
rcr edi, 0xba
sbb esi, 0xb6
neg esi
rol eax, 0x9d
rcr eax, 0xec
dec eax
add edx, 0xd3
bswap eax
bswap eax
rcl ebx, 0x4d
imul ebx
dec edx
neg edx
not eax
sbb edi, 0x31
mov ecx, dword [ebp + 0xc]
sub esi, 0xcf
inc edi
add ebx, 0xb3
bswap edx
mov ebx, 0x1b
bswap edx
inc eax
ror esi, 0x96
not edx
dec edi
rcr edx, 0x37
sub edi, 0xe1
sub ebx, 0x34
and esi, 0x3e
ror edx, 0x88
and ebx, 0x94
or edi, 0x63
ror eax, 0x9d
and edx, 0x51
rol edx, 0x51
rcr edx, 0x9e
add ebx, 0xa9
add edx, 0x99
neg edi
not eax
rol edx, 0x50
inc esi
bswap esi
dec edx
mov edx, 0xbb
add edx, 0xa7
inc edi
imul ebx
inc esi
add ebx, 0x73
dec esi
or edx, 0x4c
inc ebx
inc ebx
or edi, 0xb9
mov edx, 0x6d
sub edi, 0xf6
inc edx
sub edx, 0x87
inc edx
rol ebx, 0xed
ror esi, 0xca
ror edx, 0xfc
sbb esi, 0x9c
rol edi, 0x18
mov edi, dword [ebp + 8]
xor eax, esi
xor eax, esi
mov eax, ebx
not byte [edi]
mov eax, ebx
mov eax, esi
mov eax, ebx
xor eax, ebx
xor esi, ebx
xor esi, ebx
xor ebx, eax
xor esi, esi
xor esi, eax
add byte [edi], 0x26
mov esi, eax
mov ebx, ebx
mov ebx, ebx
mov ebx, ebx
xor ebx, esi
xor eax, esi
xor eax, ebx
mov ebx, ebx
xor eax, esi
sub byte [edi], 0x87
xor esi, esi
mov ebx, ebx
mov esi, ebx
mov esi, esi
mov eax, esi
mov esi, esi
xor esi, esi
xor eax, ebx
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4013d8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406224
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48ae5c]
jne 0x40622e
repz ret
jmp fcn.00407f25
Function at 0x409763
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004062a5
and dword [ebp - 4], 0
cmp dword [0x48c44c], 0
mov ebx, eax
jne 0x409814
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4098c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4098c5
push eax
call fcn.00406233
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48c44c], eax
call esi
push eax
call fcn.00406233
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48c450], eax
call esi
push eax
call fcn.00406233
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48c454], eax
call esi
push eax
call fcn.00406233
pop ecx
mov dword [0x48c45c], eax
test eax, eax
je 0x409814
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406233
pop ecx
mov dword [0x48c458], eax
mov eax, dword [0x48c458]
cmp eax, ebx
je 0x40986c
cmp dword [0x48c45c], ebx
je 0x40986c
push eax
call fcn.004062ae
push dword [0x48c45c]
mov esi, eax
call fcn.004062ae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40986c
test edi, edi
je 0x40986c
call esi
test eax, eax
je 0x409863
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409863
test byte [ebp - 0xc], 1
jne 0x40986c
or dword [ebp + 0x10], 0x200000
jmp 0x4098a5
mov eax, dword [0x48c450]
cmp eax, ebx
je 0x4098a5
push eax
call fcn.004062ae
pop ecx
test eax, eax
je 0x4098a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4098a5
mov eax, dword [0x48c454]
cmp eax, ebx
je 0x4098a5
push eax
call fcn.004062ae
pop ecx
test eax, eax
je 0x4098a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48c44c]
call fcn.004062ae
pop ecx
test eax, eax
je 0x4098c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4098c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret