joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4edcc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
xor eax, eax
push ebp
push 0x4edd8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004049e4
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404ca4
mov esi, eax
sar esi, 1
jns 0x4edd02
adc esi, 0
test esi, esi
jle 0x4edd6b
mov dword [ebp - 8], 1
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 8]
add edx, edx
dec edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00404f04
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4edda4
call fcn.00404cf0
mov eax, dword [ebp - 0x10]
call fcn.00409300
mov edx, eax
mov al, byte [ebx + 0x4f9e1c]
xor dl, al
lea eax, [ebp - 0xc]
call fcn.00404bcc
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404cac
lea eax, [ebx + 1]
mov ecx, 0xa
cdq
idiv ecx
mov ebx, edx
inc dword [ebp - 8]
dec esi
jne 0x4edd0d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edd95
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404a08
lea eax, [ebp - 4]
call fcn.004049e4
ret

Function at 0x4edda8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4eddfe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4edde7
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4edde7
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ede05
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x4edeac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4edf2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404bcc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4edf40
call fcn.00404cf0
mov eax, dword [ebp - 4]
call fcn.00404ea4
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
je 0x4edf0a
cmp eax, 1
je 0x4edf0a
cmp eax, 3
jne 0x4edf0a
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x5b
jne 0x4edeca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edf32
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a08
ret
Function at 0x4eed44
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
xor eax, eax
push ebp
push 0x4eef4c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4eef10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4fe540]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov eax, dword [ebp - 4]
call fcn.00402970
call fcn.00402934
lea eax, [ebp - 0x14c]
push eax
push 0x4eef60
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4eee3d
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00404c54
lea eax, [ebp - 0x150]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404cf0
mov eax, dword [ebp - 0x150]
call fcn.004096cc
test al, al
je 0x4eee26
lea eax, [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404cf0
mov edx, dword [ebp - 0x154]
mov eax, dword [0x4fe540]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4eedcc
push ebx
call sub.kernel32.dll_FindClose_1
mov eax, dword [0x4fe540]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov esi, eax
dec esi
test esi, esi
jl 0x4eef02
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x158]
mov eax, dword [0x4fe540]
mov eax, dword [eax + 0x218]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x158]
call fcn.004ed800
cmp edx, 0
jne 0x4eee8f
cmp eax, 0x25435650
jbe 0x4eeefa
jmp 0x4eee91
jle 0x4eeefa
lea ecx, [ebp - 0x15c]
mov eax, dword [0x4fe540]
mov eax, dword [eax + 0x218]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x15c]
call fcn.004ed800
cmp edx, 0
jne 0x4eeec2
cmp eax, 0x25437d60
jae 0x4eeefa
jmp 0x4eeec4
jge 0x4eeefa
mov byte [ebp - 5], 1
lea ecx, [ebp - 0x160]
mov eax, dword [0x4fe540]
mov eax, dword [eax + 0x218]
mov edx, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x160]
mov eax, 0x4fe508
call fcn.00404a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4eef1e
inc ebx
dec esi
jne 0x4eee5e
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4eef1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eef53
lea eax, [ebp - 0x160]
mov edx, 5
call fcn.00404a08
lea eax, [ebp - 0xc]
call fcn.004049e4
lea eax, [ebp - 4]
call fcn.004049e4
ret
Function at 0x4eefe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
xor eax, eax
push ebp
push 0x4ef062
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004049e4
mov eax, dword [ebp - 4]
call fcn.00404ca4
mov ebx, eax
test ebx, ebx
jle 0x4ef047
mov edi, 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, 5
call fcn.00404bcc
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00404cac
inc edi
dec ebx
jne 0x4ef027
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef069
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a08
ret

Function at 0x4ef070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ef1ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.004b50b0
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004b50d0
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4ef1b6
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404c54
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409a24
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408cdc
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408cdc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404df0
je 0x4ef190
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404c54
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408cdc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408cdc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404df0
jne 0x4ef1a7
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004b50f0
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4ef0f1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef1f1
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404a08
lea eax, [ebp - 4]
call fcn.004049e4
ret
Function at 0x4ef2b4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e94
xor eax, eax
push ebp
push 0x4ef311
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00404ea4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.004ef070
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp - 4]
call fcn.00409904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef318
lea eax, [ebp - 4]
call fcn.004049e4
ret

Function at 0x43a990
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2f000]
push edi
jmp 0x43a9aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43a9b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43a9a0
mov eax, 1
add ebx, ebx
jne 0x43a9c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43a9b8
jne 0x43a9d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a9b8
xor ecx, ecx
sub eax, 3
jb 0x43a9e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43aa5a
mov ebp, eax
add ebx, ebx
jne 0x43a9f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43aa00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43aa24
inc ecx
add ebx, ebx
jne 0x43aa10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43aa05
jne 0x43aa21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43aa05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43aa44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43aa35
jmp 0x43a9a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43aa44
add edi, ecx
jmp 0x43a9a6
pop esi
mov edi, esi
mov ecx, 0x6d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43aa62
cmp byte [edi], 0x11
jne 0x43aa62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43aa67
lea edi, [esi + 0x38000]
mov eax, dword [edi]
or eax, eax
je 0x43aadf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x51a50]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51b18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43aa94
mov ecx, edi
jns 0x43aac3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51b1c]
or eax, eax
je 0x43aad9
mov dword [ebx], eax
add ebx, 4
jmp 0x43aab1
call dword [esi + 0x51b2c]
mov ebp, dword [esi + 0x51b20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43ab13
sub esp, 0xffffff80
jmp 0x40a7b1
Function at 0x9943f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x999494]
cmp dword [eax + 0x28], 0
jne 0x994408
xor eax, eax
jmp 0x994537
mov ecx, dword [0x999414]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x999408], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x999404], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x999408]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x999404]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x99948c]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x998604
push 0x998620
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x999400], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00994330
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x9943c0
mov edx, dword [0x999494]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x99940c], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x994537
cmp dword [ebp - 0x38], 0x12
jne 0x99452b
mov dword [0x99941c], 0
call fcn.00994540
xor eax, eax
jmp 0x994537
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x9944fc
mov esp, ebp
pop ebp
ret 4

Function at 0x995840
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x99620c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x998118
sub eax, eax
test esi, esi
je 0x9962e4
sub eax, 1
test ecx, ecx
je 0x9962e2
test esi, 3
je 0x99624a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x99622f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x9962c9
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x996254
mov ecx, edx
test ecx, ecx
je 0x9962e2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x9962cf
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x9962ec
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0099636f
jae 0x9962fa
xor ecx, ecx
call fcn.0099636f
jae 0x996329
xor eax, eax
call fcn.0099636f
jae 0x996339
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0099636f
adc al, al
jae 0x99631b
jne 0x996365
stosb byte es:[edi], al
jmp 0x9962fd
call fcn.0099637b
sub ecx, ebx
jne 0x996342
call fcn.00996379
jmp 0x996361
lodsb al, byte [esi]
shr eax, 1
je 0x99638b
adc ecx, ecx
jmp 0x99635e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00996379
cmp eax, 0x7d00
jae 0x99635e
cmp ah, 5
jae 0x99635f
cmp eax, 0x7f
ja 0x996360
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9962fd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x996c7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x999000]
jne 0x996c86
repz ret
jmp fcn.00996f2d
Function at 0x409b60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, 1
push edi
mov dword [ecx], eax
mov dword [ecx + 0x9c0], esi
mov edi, 0x270
lea esp, [esp]
mov edx, dword [ecx + 0x9c0]
lea eax, [ecx + edx*4]
mov edx, dword [eax - 4]
imul edx, edx, 0x10dcd
mov dword [eax], edx
add dword [ecx + 0x9c0], esi
cmp dword [ecx + 0x9c0], edi
jl 0x409b80
mov eax, 0x5b3e9
mov dword [ecx + 0x9c0], esi
lea ecx, [ecx]
mov edx, dword [ecx + 0x9c0]
xor dword [ecx + edx*4], eax
imul eax, eax, 0x159b
add dword [ecx + 0x9c0], esi
lea edx, [ecx + edx*4]
add eax, 0x13e8b
mov edx, eax
mov ebx, eax
shl edx, 0x13
shr ebx, 9
xor edx, ebx
xor eax, edx
cmp dword [ecx + 0x9c0], edi
jl 0x409bb0
pop edi
pop esi
pop ebx
ret 4

Function at 0x409bf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [ecx + 0x9c0], 0x270
jl 0x409cac
xor eax, eax
push esi
mov edx, dword [ecx + eax*4 + 4]
xor edx, dword [ecx + eax*4]
inc eax
and edx, 0x7fffffff
xor edx, dword [ecx + eax*4 - 4]
mov esi, edx
shr edx, 1
and esi, 1
xor edx, dword [esi*4 + 0x43a020]
xor edx, dword [ecx + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [ecx + eax*4 - 4], edx
jl 0x409c04
cmp eax, 0x26f
jge 0x409c72
lea ecx, [ecx]
mov edx, dword [ecx + eax*4 + 4]
xor edx, dword [ecx + eax*4]
inc eax
and edx, 0x7fffffff
xor edx, dword [ecx + eax*4 - 4]
mov esi, edx
shr edx, 1
and esi, 1
xor edx, dword [esi*4 + 0x43a020]
xor edx, dword [ecx + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [ecx + eax*4 - 4], edx
jl 0x409c40
mov eax, dword [ecx + 0x9bc]
xor eax, dword [ecx]
pop esi
and eax, 0x7fffffff
xor eax, dword [ecx + 0x9bc]
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x43a020]
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov dword [ecx + 0x9c0], 0
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ecx + edx*4]
inc edx
mov dword [ecx + 0x9c0], edx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x409cf4
fadd dword [0x4334c0]
fmul qword [0x4334b8]
fstp dword [esp]
fld dword [esp]
pop ecx
ret

Function at 0x409fea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a074]
jne 0x409ff4
repz ret
jmp fcn.0040c86f
Function at 0x41eb26
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e03f
and dword [ebp - 4], 0
cmp dword [0x43c1c0], 0
mov ebx, eax
jne 0x41ebd7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41ec88
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41ec88
push eax
call fcn.0040dfcd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43c1c0], eax
call esi
push eax
call fcn.0040dfcd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43c1c4], eax
call esi
push eax
call fcn.0040dfcd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43c1c8], eax
call esi
push eax
call fcn.0040dfcd
pop ecx
mov dword [0x43c1d0], eax
test eax, eax
je 0x41ebd7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dfcd
pop ecx
mov dword [0x43c1cc], eax
mov eax, dword [0x43c1cc]
cmp eax, ebx
je 0x41ec2f
cmp dword [0x43c1d0], ebx
je 0x41ec2f
push eax
call fcn.0040e048
push dword [0x43c1d0]
mov esi, eax
call fcn.0040e048
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ec2f
test edi, edi
je 0x41ec2f
call esi
test eax, eax
je 0x41ec26
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41ec26
test byte [ebp - 0xc], 1
jne 0x41ec2f
or dword [ebp + 0x10], 0x200000
jmp 0x41ec68
mov eax, dword [0x43c1c4]
cmp eax, ebx
je 0x41ec68
push eax
call fcn.0040e048
pop ecx
test eax, eax
je 0x41ec68
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ec68
mov eax, dword [0x43c1c8]
cmp eax, ebx
je 0x41ec68
push eax
call fcn.0040e048
pop ecx
test eax, eax
je 0x41ec68
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43c1c0]
call fcn.0040e048
pop ecx
test eax, eax
je 0x41ec88
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41ec8a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402357
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4403e6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x467034]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov eax, dword [0x467034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.0040f644
pop ecx
and dword [esp + 0x30], 0
cmp dword [esp + 0x1c], 0x10
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
mov ecx, esi
call fcn.0040269a
lea ecx, [esp + 8]
call fcn.00402286
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0043ca20
mov esp, ebp
pop ebp
ret

Function at 0x406557
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441690
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x467034]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x467034]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [ebp + 8]
and dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0xb0]
and dword [esp + 0x38], 0
push eax
push edi
mov ecx, esi
call fcn.0042887a
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.0040253d
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0043ca20
mov esp, ebp
pop ebp
ret 4

Function at 0x406666
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b56e
Function at 0x407d80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x467034]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov esi, ecx
cmp byte [esi + 0x2d0], 0
je 0x407ded
push 0x110
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x407ddd
mov ecx, esi
call fcn.00407a86
jmp 0x407def
cmp dword [esp + 0xc], 6
jb 0x407ded
mov ecx, esi
call fcn.004072c9
jmp 0x407def
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
xor ecx, esp
call fcn.0043ca20
mov esp, ebp
pop ebp
ret