joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403fbb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40abb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402f14
and dword [ebp - 0x14], 0
cmp dword [0x40bdc4], 0
mov dword [ebp - 0x18], eax
jne 0x40406e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404116
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404116
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40bdc4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40bdc8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40bdcc], eax
call edi
push eax
call esi
mov dword [0x40bdd4], eax
test eax, eax
je 0x40406e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40bdd0], eax
mov eax, dword [0x40bdd0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x4040c7
cmp dword [0x40bdd4], ecx
je 0x4040c7
push eax
call esi
push dword [0x40bdd4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4040c7
test ebx, ebx
je 0x4040c7
call edi
test eax, eax
je 0x4040be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4040be
test byte [ebp - 8], 1
jne 0x4040c7
or dword [ebp + 0x10], 0x200000
jmp 0x4040fa
mov eax, dword [0x40bdc8]
cmp eax, dword [ebp - 0x18]
je 0x4040fa
push eax
call esi
test eax, eax
je 0x4040fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4040fa
mov eax, dword [0x40bdcc]
cmp eax, dword [ebp - 0x18]
je 0x4040fa
push eax
call esi
test eax, eax
je 0x4040fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40bdc4]
call esi
test eax, eax
je 0x404116
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404118
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404326
leave
ret

Function at 0x404326
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40abb0]
jne 0x404330
repz ret
jmp fcn.004054c6
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x28ea3237
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x52e6228c
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4011f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol ebx, 0x17
neg edx
neg esi
bswap ebx
and esi, 0xbd
or edi, 0xd4
rcr edx, 0xb5
rol ebx, 0xf0
imul eax
imul eax
mov eax, 0xd8
dec eax
bswap eax
and edx, 0xfd
inc esi
and eax, 0xb
and edx, 0x8f
rol edx, 0xd6
neg ebx
add edx, 0x55
bswap esi
imul ebx
neg eax
inc ebx
rcr edx, 0x5f
bswap edi
imul edi
imul edi
inc ebx
inc edi
not edi
not ebx
not eax
rcr ebx, 0xad
imul edi
dec esi
dec esi
ror edi, 0x84
or eax, 9
sbb esi, 0x5d
sbb edx, 0x8f
not ebx
and eax, 0x64
not edi
neg eax
not eax
or esi, 0x43
imul edi
bswap esi
or eax, 0xc9
xor ecx, ecx
xor edi, edi
dec eax
ror edx, 0x13
rol edx, 0x36
ror ebx, 0x85
sub eax, 0xc5
rcl esi, 0xc9
rcl edi, 0x67
bswap esi
imul esi
rol eax, 0x75
sub esi, 0xcb
rol edi, 0x25
rol esi, 0xe
dec edi
inc edi
rcl edi, 0x90
neg edx
rol edx, 0x93
sbb esi, 0xc6
dec edx
inc edx
inc edx
imul edx
rcr ebx, 0xc8
add ebx, 0xbb
imul esi
mov esi, 0xb5
mov edx, 0xb2
mov edx, 0x42
imul esi
or eax, 0x19
or edx, 0xc1
imul edx
rcl esi, 0x97
not eax
rcl eax, 0x56
ror esi, 0xac
mov esi, 0x42
and ebx, 0x73
bswap esi
sub esi, 0xaf
and eax, 0x63
dec eax
mov edi, 0x1a
sbb edx, 0x44
sbb eax, 0x8a
sbb eax, 0xe0
ror eax, 0x19
imul edx
bswap edx
mov ecx, dword [ebp + 0xc]
bswap eax
sbb eax, 0xb7
inc edi
rol eax, 0x3e
dec esi
neg esi
dec edx
add ebx, 0xc5
or eax, 0xc3
inc ebx
rol esi, 0x9c
or edi, 0xd1
bswap edx
not esi
dec esi
bswap edi
bswap esi
mov eax, 0x88
sbb edi, 0xe6
dec ebx
sub edi, 0xd
bswap esi
ror edx, 0x93
bswap edi
bswap esi
rcr edx, 0xe
bswap esi
inc eax
rol ebx, 0x68
rcr edx, 0xf1
inc esi
or ebx, 0x6b
neg edx
sub edx, 0x87
or eax, 0xc7
not eax
inc edi
inc esi
inc edi
sub esi, 0x89
not eax
bswap ebx
rcl edi, 0x75
ror edx, 5
mov edx, 0x54
or edx, 0xff
rcr ebx, 0x4c
dec esi
mov eax, 0x14
rcl esi, 0xec
mov edi, dword [ebp + 8]
xor eax, esi
mov esi, ebx
xor ebx, esi
not byte [edi]
mov esi, ebx
mov esi, eax
xor ebx, ebx
add byte [edi], 0x56
xor esi, esi
mov ebx, eax
mov esi, eax
sub byte [edi], 0x34
mov eax, esi
mov eax, eax
xor esi, ebx
imul byte [edi]
inc edi
loop 0x4013b4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405ce3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bd2
and dword [ebp - 4], 0
cmp dword [0x40e268], 0
mov ebx, eax
jne 0x405d94
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405e45
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405e45
push eax
call fcn.00404b60
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e268], eax
call esi
push eax
call fcn.00404b60
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e26c], eax
call esi
push eax
call fcn.00404b60
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e270], eax
call esi
push eax
call fcn.00404b60
pop ecx
mov dword [0x40e278], eax
test eax, eax
je 0x405d94
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b60
pop ecx
mov dword [0x40e274], eax
mov eax, dword [0x40e274]
cmp eax, ebx
je 0x405dec
cmp dword [0x40e278], ebx
je 0x405dec
push eax
call fcn.00404bdb
push dword [0x40e278]
mov esi, eax
call fcn.00404bdb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405dec
test edi, edi
je 0x405dec
call esi
test eax, eax
je 0x405de3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405de3
test byte [ebp - 0xc], 1
jne 0x405dec
or dword [ebp + 0x10], 0x200000
jmp 0x405e25
mov eax, dword [0x40e26c]
cmp eax, ebx
je 0x405e25
push eax
call fcn.00404bdb
pop ecx
test eax, eax
je 0x405e25
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405e25
mov eax, dword [0x40e270]
cmp eax, ebx
je 0x405e25
push eax
call fcn.00404bdb
pop ecx
test eax, eax
je 0x405e25
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e268]
call fcn.00404bdb
pop ecx
test eax, eax
je 0x405e45
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405e47
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4077e9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40da08]
jne 0x4077f3
repz ret
jmp fcn.00408ce5
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x407610
pop dword [ebp - 0xc]
mov eax, 0xdcc40714
sub eax, 0xdc839104
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3d980
push 0
mov eax, 0x6be72101
add eax, 0x9459bfd7
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x5939
xor esi, esi
add esi, eax
mov edx, 0xd8a2ea15
add edx, 0x279e51af
add edx, dword [ebp - 0xc]
mov edi, 0xb1512791
add edi, 0x3a29a585
sub dword [ebp - 8], 0xc6dd9435
mov ebx, dword [edx]
sub dword [ebp - 8], 0x304b7065
add ebx, edi
add dword [ebp - 8], edx
mov dword [esi], ebx
xor dword [ebp - 8], 0x305b10dc
add esi, 4
add edx, 0x1220f587
sub edx, 0x1220f583
loop 0x40766b
add eax, 0x157b7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4011e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
inc ebx
neg eax
not ebx
add ebx, 0x17
neg esi
bswap ebx
or esi, 0x54
mov esi, 0xa
inc ebx
not edx
not ebx
rcl edi, 0xe1
imul edi
imul eax
inc edi
dec ebx
sub edx, 0x51
not eax
sbb esi, 0xb5
neg ebx
rol esi, 0x33
inc ebx
add ebx, 0xe8
neg edx
dec ebx
add ebx, 0x8f
mov edx, 0x5a
imul eax
not edx
rol edi, 0xc6
or ebx, 0xa4
imul ebx
mov eax, 0x27
not ebx
bswap ebx
bswap ebx
rcr edx, 0xd6
sbb edx, 0x92
rcl eax, 0x1d
bswap eax
imul edi
rcr eax, 0x64
imul edx
rcl edx, 0xa1
ror edx, 0x69
rol edx, 0x9d
or esi, 0x45
or edx, 0x34
sub edx, 0x7a
not edi
xor ecx, ecx
xor edi, edi
sub ebx, 0xd5
mov edi, 0xf1
neg edx
inc edi
bswap eax
dec edx
sbb edx, 0xc5
neg edi
or edx, 0x4f
rcl esi, 0xda
bswap esi
rcr edx, 0xbf
sbb eax, 0xbb
not edx
imul eax
imul esi
rol edi, 0xdf
inc edi
rcr edi, 0x62
bswap ebx
ror esi, 0x71
dec edx
inc edi
imul edx
or edx, 0xb1
imul ebx
dec edx
imul eax
imul ebx
dec ebx
bswap edx
ror edx, 0xda
rol ebx, 0xdb
dec edi
mov edx, 0x33
and eax, 0xf5
imul ebx
rcl ebx, 0x5e
inc ebx
not ebx
add esi, 0xcf
imul eax
rcl edi, 0x9e
dec ebx
or ebx, 0x85
or edi, 0x83
dec ebx
dec ebx
and edx, 0x41
inc eax
mov ecx, dword [ebp + 0xc]
imul edi
neg esi
rcr esi, 0x3c
neg eax
bswap esi
not edi
ror esi, 0x9c
neg esi
imul esi
not edx
rcr ebx, 0xef
sbb edx, 0x28
bswap ebx
rol ebx, 0x65
not ebx
neg edi
imul ebx
neg ebx
bswap edi
ror edx, 0xdf
imul ebx
imul ebx
dec edi
dec edi
not esi
dec eax
not ebx
dec edi
ror edx, 0xb6
rcl ebx, 0xb1
and ebx, 0x20
rol edi, 0xe7
not edi
dec edx
not edx
not edx
dec eax
and ebx, 6
not ebx
inc ebx
inc edx
sbb esi, 0xa9
imul eax
dec edx
add esi, 0x8a
rcr edx, 8
rcr esi, 0x5f
sbb esi, 0xac
bswap edx
imul edx
mov edi, dword [ebp + 8]
xor esi, ebx
mov esi, eax
xor eax, esi
not byte [edi]
mov ebx, ebx
xor esi, esi
mov ebx, esi
add byte [edi], 0x56
mov eax, eax
xor ebx, esi
xor eax, ebx
sub byte [edi], 0x34
mov ebx, eax
xor esi, ebx
mov esi, eax
imul byte [edi]
inc edi
loop 0x40137a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405c63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b52
and dword [ebp - 4], 0
cmp dword [0x40e268], 0
mov ebx, eax
jne 0x405d14
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405dc5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405dc5
push eax
call fcn.00404ae0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e268], eax
call esi
push eax
call fcn.00404ae0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e26c], eax
call esi
push eax
call fcn.00404ae0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e270], eax
call esi
push eax
call fcn.00404ae0
pop ecx
mov dword [0x40e278], eax
test eax, eax
je 0x405d14
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ae0
pop ecx
mov dword [0x40e274], eax
mov eax, dword [0x40e274]
cmp eax, ebx
je 0x405d6c
cmp dword [0x40e278], ebx
je 0x405d6c
push eax
call fcn.00404b5b
push dword [0x40e278]
mov esi, eax
call fcn.00404b5b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405d6c
test edi, edi
je 0x405d6c
call esi
test eax, eax
je 0x405d63
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405d63
test byte [ebp - 0xc], 1
jne 0x405d6c
or dword [ebp + 0x10], 0x200000
jmp 0x405da5
mov eax, dword [0x40e26c]
cmp eax, ebx
je 0x405da5
push eax
call fcn.00404b5b
pop ecx
test eax, eax
je 0x405da5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405da5
mov eax, dword [0x40e270]
cmp eax, ebx
je 0x405da5
push eax
call fcn.00404b5b
pop ecx
test eax, eax
je 0x405da5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e268]
call fcn.00404b5b
pop ecx
test eax, eax
je 0x405dc5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405dc7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407769
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40da08]
jne 0x407773
repz ret
jmp fcn.00408c65
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4014aa
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 4, 0
push eax
mov cl, byte [ebp - 8]
mov edx, dword [0x40f050]
mov ebx, eax
mov eax, 0x40f054
shl edx, cl
call fcn.004013e6
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
or dl, 0x40
mov esi, 0x401ec4
push edx
sub esi, fcn.0040168f
push esi
xor eax, eax
push fcn.0040168f
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401518
mov ebx, dword [ebp - 8]
mov eax, fcn.0040168f
mov edx, esi
call fcn.004013e6
mov ebx, dword [ebp - 8]
mov edx, 0x1b600
mov eax, 0x40f054
call fcn.004012f1
leave
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4015d7
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebx
push ecx
push edx
enter 0x13c, 0
xor eax, eax
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x7f00
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], 6
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
push 0x7f00
push 0
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x13c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x10]
lea ebx, [eax - 0x47]
call dword [sym.imp.OLE32.DLL_CoUninitialize]
mov eax, dword [ebp - 4]
add eax, ebx
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x403c80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x4000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x40e650
push 0x69
push esi
call edi
push 0x64
push 0x40e5e8
push 0x67
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x6b
push esi
mov dword [ebp - 0x54], 0x30
mov dword [ebp - 0x4c], 0x4012c0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x50], 3
call edi
push 0x7f00
push 0
mov dword [ebp - 0x3c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x6c
push eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], 0x69
mov dword [ebp - 0x2c], str.Charge_Window_App
call edi
push str.riched32.dll
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Magnetick
push str.Charge_Window_App
push 0
mov dword [0x40b619], esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x403dce
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call esi
test eax, eax
je 0x403dc3
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call edi
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
call esi
test eax, eax
jne 0x403da3
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403e76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b760
cmp edx, dword [eax]
je 0x403e98
add eax, 8
inc ecx
cmp eax, 0x40b7f0
jl 0x403e89
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b760]
jne 0x403fc6
mov eax, dword [0x40e6d8]
cmp eax, 1
je 0x403fa0
test eax, eax
jne 0x403ec9
cmp dword [0x40b694], 1
je 0x403fa0
cmp edx, 0xfc
je 0x403fc6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403f00
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406370
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x403f43
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4098b8
push edi
call fcn.00407c30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406370
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406380
lea eax, [ebp - 0xa0]
push 0x409898
push eax
call fcn.00406380
push dword [esi + 0x40b764]
lea eax, [ebp + 8]
lea esi, [esi + 0x40b764]
push 0
push eax
push dword [esi]
call fcn.00406460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x4df72ab5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x287b322f
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4034ea
Capabilities:
Terminate process

Disassembly:
jmp 0x4508a9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4508ba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004056d2
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40360c
Capabilities:
Query environment variable

Disassembly:
jmp 0x4987d1
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4987e2
pop esi
ret
push ebx
push edi
push esi
call fcn.004986b8
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403e4f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49880a
push ebx
push esi
push edi
call fcn.004054c5
add esp, 0xc
push 0
call fcn.00406005
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40558d
Capabilities:
Parse pe header

Disassembly:
jmp 0x43f750
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43f78f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43f78f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43f78f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43f78f
cmp dword [ecx + 0x74], 0xe
jbe 0x43f78f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret