joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018005
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10023490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000f523
and dword [ebp - 0x14], 0
cmp dword [0x1018a8e4], 0
mov dword [ebp - 0x18], eax
jne 0x100180b8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10018160
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10018160
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1018a8e4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1018a8e8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1018a8ec], eax
call edi
push eax
call esi
mov dword [0x1018a8f4], eax
test eax, eax
je 0x100180b8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1018a8f0], eax
mov eax, dword [0x1018a8f0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10018111
cmp dword [0x1018a8f4], ecx
je 0x10018111
push eax
call esi
push dword [0x1018a8f4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10018111
test ebx, ebx
je 0x10018111
call edi
test eax, eax
je 0x10018108
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10018108
test byte [ebp - 8], 1
jne 0x10018111
or dword [ebp + 0x10], 0x200000
jmp 0x10018144
mov eax, dword [0x1018a8e8]
cmp eax, dword [ebp - 0x18]
je 0x10018144
push eax
call esi
test eax, eax
je 0x10018144
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10018144
mov eax, dword [0x1018a8ec]
cmp eax, dword [ebp - 0x18]
je 0x10018144
push eax
call esi
test eax, eax
je 0x10018144
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1018a8e4]
call esi
test eax, eax
je 0x10018160
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10018162
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100086e1
leave
ret
Function at 0x1019a357
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101acb98]
jne 0x1019a361
repz ret
jmp fcn.1019be4b

Function at 0x1019d13f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a45c
and dword [ebp - 4], 0
cmp dword [0x101ae6b8], 0
mov ebx, eax
jne 0x1019d1f0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d2a1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d2a1
push eax
call fcn.1019a3ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101ae6b8], eax
call esi
push eax
call fcn.1019a3ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101ae6bc], eax
call esi
push eax
call fcn.1019a3ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101ae6c0], eax
call esi
push eax
call fcn.1019a3ea
pop ecx
mov dword [0x101ae6c8], eax
test eax, eax
je 0x1019d1f0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a3ea
pop ecx
mov dword [0x101ae6c4], eax
mov eax, dword [0x101ae6c4]
cmp eax, ebx
je 0x1019d248
cmp dword [0x101ae6c8], ebx
je 0x1019d248
push eax
call fcn.1019a465
push dword [0x101ae6c8]
mov esi, eax
call fcn.1019a465
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d248
test edi, edi
je 0x1019d248
call esi
test eax, eax
je 0x1019d23f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d23f
test byte [ebp - 0xc], 1
jne 0x1019d248
or dword [ebp + 0x10], 0x200000
jmp 0x1019d281
mov eax, dword [0x101ae6bc]
cmp eax, ebx
je 0x1019d281
push eax
call fcn.1019a465
pop ecx
test eax, eax
je 0x1019d281
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d281
mov eax, dword [0x101ae6c0]
cmp eax, ebx
je 0x1019d281
push eax
call fcn.1019a465
pop ecx
test eax, eax
je 0x1019d281
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101ae6b8]
call fcn.1019a465
pop ecx
test eax, eax
je 0x1019d2a1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d2a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019ec71
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x101ac624], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019fba9
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019ecb7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101ac620], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019ed19
jmp 0x1019ed4a
mov al, byte [ebp - 0x31]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x38]
add edx, 1
mov ah, byte [ebp - 0x39]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x40], edx
jne 0x1019ed5e
jmp 0x1019ed8b
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [0x101ac624], 0x1dce
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x40], edx
jmp 0x1019ed5e
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
jmp 0x1019ed24
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x54]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x39], cl
jne 0x1019ecee
mov al, byte [ebp - 0x39]
test al, 1
jne 0x1019edc1
jmp 0x1019ed94
xor eax, eax
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov edx, dword [ebp - 0x4c]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
jb 0x1019ed24
jmp 0x1019ed19
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
mov dword [0x101ac620], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101ac624], 0x92b
mov dword [ebp - 0x30], edi
jmp 0x1019ed19
Function at 0x1019f111
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019f17a
mov dword [0x101ac620], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1019f169
xor eax, eax
mov ecx, 0x1088
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x1019f22e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019f1e5
jmp 0x1019f157
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x1019f1a7
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
jl 0x1019f17a
mov eax, dword [ebp - 0x28]
mov dword [0x101ac624], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1019f157
mov dword [0x101ac620], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1019f13e
jmp 0x1019f157
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1019f157
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1019f157
mov eax, 1
mov ecx, 0x18d0
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1019f157
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [0x101ac620], eax
mov eax, ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1019f3fb
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101ac62c], 0
mov byte [0x101ac630], 0
mov edi, dword [0x101ac620]
add edi, 0xfffff8e9
mov dword [0x101ac624], edi
mov dword [0x101ac628], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f45b
xor eax, eax
mov dword [0x101ac628], 0
mov dword [ebp - 0x20], eax
jmp 0x1019f497
mov eax, dword [ebp - 0x1c]
mov dword [0x101ac620], 0x7c1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101ac624], 0x17ea
mov eax, dword [0x101ac628]
add eax, 1
mov dword [0x101ac628], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f45b
jmp 0x1019f44a
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101ac634], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101ac62c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101ac634], esi
mov dword [0x101ac620], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101ac62c], edx
mov dword [0x101ac624], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101ac630], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101ac630]
mov esi, dword [0x101ac62c]
mov byte [ebx + esi], cl
mov esi, dword [0x101ac628]
add esi, 1
mov dword [0x101ac628], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f497
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f8dd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101ac624], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1019f947
lea eax, [ebp - 0x24]
mov dword [0x101ac624], 0x1a22
mov ecx, dword [0x101ac620]
add ecx, 0xffffefe3
mov dword [0x101ac620], ecx
mov dword [ebp - 0x34], eax
call fcn.1019edf3
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019e9f4
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1019fa1b
jmp 0x1019f973
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a14a8]
mov dh, byte [eax + 0x101a1479]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x1019f901
jmp 0x1019f947
mov dword [0x101ac620], 0x2091
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019f24c
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101ac620], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1019fd27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1e25
xor ebx, ebx
mov dword [0x101ac628], 0
mov dword [0x101ac62c], 0
mov dword [0x101ac638], 0
mov dword [0x101ac620], 0xfa3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1019feae
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
add eax, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101ac628], edx
mov dword [0x101ac620], 0x3264
mov ebx, dword [ebp - 0x24]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101ac62c], edx
mov ecx, dword [0x101ac624]
add ecx, 0xfffff82b
mov dword [0x101ac624], ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101ac630], cl
mov dword [0x101ac620], 0x26b4
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x101ac624], 0x112a
mov cl, byte [0x101ac630]
mov edx, dword [0x101ac62c]
mov byte [ebx + edx], cl
mov edx, dword [0x101ac628]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101ac62c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x101ac624], 0x55d
and ecx, 0xff
mov dword [0x101ac638], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x101ac620], 0x65f
mov dword [0x101ac624], 0xffffdf97
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1019fea1
mov eax, dword [0x101ac628]
mov ecx, dword [0x101ac62c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
jmp 0x1019fd92
mov eax, dword [0x101ac620]
add eax, 0xe82
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [0x101ac620], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019febe
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x101ac620]
mov esi, edx
add esi, 0xffffdde0
mov dword [0x101ac624], esi
add edx, 0xffffe928
mov dword [0x101ac620], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1019f60a
lea ecx, [0x1019f390]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x54], edx
mov dword [esp + 0x28], 0x15a600
mov edx, dword [0x101ac60c]
mov dword [esp + 0x64], edx
mov edx, dword [0x101ac610]
mov dword [esp + 0x2c], edx
mov edx, dword [0x101ac614]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101ac618]
mov dword [esp + 0x60], edx
mov dword [0x101ac620], 0x5bd
mov edx, dword [0x101ac61c]
mov dword [esp + 0x74], edx
mov dword [0x101ac624], 0xfffff4b2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1019ff9d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x20], edx
mov dword [0x101ac620], 0xe1c
call fcn.1019f111
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1019ffd4
jmp 0x101a0001
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1019ffc0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1019ff6b
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1019ff9d
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1019f8dd
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x41ecdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415fe2
and dword [ebp - 0x14], 0
cmp dword [0x46b270], 0
mov dword [ebp - 0x18], eax
jne 0x41ed8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ee37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ee37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46b270], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46b274], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46b278], eax
call edi
push eax
call esi
mov dword [0x46b280], eax
test eax, eax
je 0x41ed8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46b27c], eax
mov eax, dword [0x46b27c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ede8
cmp dword [0x46b280], ecx
je 0x41ede8
push eax
call esi
push dword [0x46b280]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ede8
test ebx, ebx
je 0x41ede8
call edi
test eax, eax
je 0x41eddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eddf
test byte [ebp - 8], 1
jne 0x41ede8
or dword [ebp + 0x10], 0x200000
jmp 0x41ee1b
mov eax, dword [0x46b274]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ee1b
mov eax, dword [0x46b278]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b270]
call esi
test eax, eax
je 0x41ee37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ee39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410717
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x440e06
Capabilities:
Encode data using xor

Disassembly:
mov dword [esi + 0xb1bc7e], edx
jnp 0x440e54
sub esp, dword [ebx + 0x71]
invalid
or ecx, dword [edi]
js 0x440e9c
retf 0xbed0
invalid
Function at 0x45bdd6
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
test eax, 0x3263136a
sti
cli
scasb al, byte es:[edi]
adc bl, byte [ebx + 0x70e38ee3]
into
pop ecx
adc al, 1
xchg esi, eax
xchg esi, eax
sti
push edi
pop esp
invalid
fadd dword [edx + esi + 0x77d9598]
repne lodsb al, byte [esi]
fisttp word [edi - 0x27516f89]
rcr byte [edi - 0x3107a7f8], 0xd5
jecxz 0x45be4e
sbb eax, 0x852e06d6
push edi
mov ecx, 0x4c213f4a
xor ebx, dword [edi + 0xb]
jp 0x45bd92
mov ch, 0xa0
invalid
mov ebp, 0xc03fc577
cmc
cwde
push esp
sahf
jb 0x45beca
and bh, al
out 0xd8, al
xlatb
retf 0xfdc5
sar ecx, cl
mov cs, word [0x4607632]
insd dword es:[edi], dx
xor dh, byte [esi + 0x60]
add al, 0x6d
cld
inc esi
loopne 0x45bece
iretd
Function at 0x4ae536
Capabilities:
Encode data using xor

Disassembly:
jns 0x4ae55e
in eax, dx
mov ch, 0x59
invalid
test byte [edi + 0x39d7c2c5], cl
test dword [edx + 0x2c12c15d], ebp
push ebp
sub al, 0x55
and edx, edx
imul ecx, dword [ecx - 0x59], 0x40
mov word [ecx + 0x22], fs
les eax, [edi + esi*8]
wait
sub eax, 0x21eaa330
mov ebx, 0x1f2cd6a4
neg dword [ebx - 0x155ccfd3]
and dword [ebx + 0x1f2cd6a4], edi
movsb byte es:[edi], byte [esi]
salc
sub al, 0x1f
rol byte [ebx - 0x301a5614], 1
div dword [0x8a44a8a5]
imul ebp, dword [ebp + 0x2ff58c41], 0xffffffcd
jns 0x4ae553
inc ebx
fidivr dword [edi + eax*8]
mov bl, 0x56
xchg byte [esi], al
adc esp, dword [edi + 0x20ec307d]
adc al, 0x19
sub eax, 0xeae79c98
pushfd
out 0xea, eax
xor eax, 0x742a8cd2
mov ds, word cs:[edx - 0x63]
salc
jbe 0x4ae5d8
fldcw word [esi]
mov word [ebx - 0x43aed492], gs
push edi
add dh, ch
test al, 0xcc
adc dword [edi - 0x14], 0xffffffd4
add byte [edi - 0x577821e3], al
sub byte [eax], ah
sbb byte [edx - 0x67], dl
lahf
sbb esi, dword [edx + edi]
inc eax
mov byte [edx - 0x1e], dl
js 0x4ae59e
out 0x4a, al
neg byte [esi]
jne 0x4ae573
lcall 0x6a99, 0x3b75b9ca
salc
wait
loopne 0x4ae56b
retf 0x75b9
xor byte [ebx + 0x46], ah
push esi
inc byte [esi + 0x22f4eed1]
lodsb al, byte [esi]
fist word [esi + ebp*8 - 0x14198c9c]
lds ecx, [edx - 0x4c314edc]
push edx
adc al, 0x72
shl byte [ebx + 0x65e483b5], cl
or ebx, dword [0x6d6bad66]
sal byte [eax + 0xa], 0x36
mov esp, dword [edi + 0x4d8a968a]
push es
imul eax, dword [ecx], 0x2a
js 0x4ae63b
fisub word [esp + edx + 0x5ba8469d]
retf 0xcc2e
mov edi, ecx
mov ch, 0x4b
test dword [ebp - 0x3103b0c9], esp
cmc
mov dword [edx], esp
shl dword [ebp - 0x60165126], cl
dec esi
or al, 0x4e
das
sbb al, 0x70
or dword [ecx], edi
mov bh, 0xdb
xor al, 0x4e
pop ss
out 0xd7, eax
mov ebp, dword [ebp + 0x37580fae]
dec esi
hlt
Function at 0x5f5f31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6003d0
cmp edx, dword [eax]
je 0x5f5f53
add eax, 8
inc ecx
cmp eax, 0x600460
jl 0x5f5f44
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6003d0]
jne 0x5f6081
mov eax, dword [0x604d5c]
cmp eax, 1
je 0x5f605b
test eax, eax
jne 0x5f5f84
cmp dword [0x6002fc], 1
je 0x5f605b
cmp edx, 0xfc
je 0x5f6081
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5f5fbb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.005f6910
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.005f6da0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5f5ffe
lea eax, [ebp - 0x1a4]
push eax
call fcn.005f6da0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5fbe44
push edi
call fcn.005f8c70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.005f6910
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005f6920
lea eax, [ebp - 0xa0]
push 0x5fbe24
push eax
call fcn.005f6920
push dword [esi + 0x6003d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.005f6920
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.005f8be4
add esp, 0x2c
pop edi
jmp 0x5f6081
lea eax, [ebp + 8]
lea esi, [esi + 0x6003d4]
push 0
push eax
push dword [esi]
call fcn.005f6da0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret