joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ee7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push edi
push dword [ebp + 0x10]
mov edi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
test eax, eax
jne 0x41eeb3
lea eax, [ebp + 0xc]
push eax
push str.Failed_to_find_resource._Resource_id:_.
mov ecx, dword [edi]
push 4
call fcn.0041083d
mov al, 1
jmp 0x41eee7
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [esi], eax
test eax, eax
jne 0x41eecd
lea eax, [ebp + 0xc]
push eax
push str.Failed_to_load_resource._Resource_id:_.
jmp 0x41eea6
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push dword [esi + 4]
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esi + 0xc], eax
xor al, al
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x41eeed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push ebx
push eax
push 2
pop edi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x41ef1d
mov al, 1
jmp 0x41ef61
cmp dword [ebp - 4], edi
jne 0x41ef19
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 1
push ecx
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
call esi
test eax, eax
je 0x41ef19
cmp dword [ebp - 4], edi
jne 0x41ef19
movzx eax, word [ebp + 0xc]
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x41ef19
cmp dword [ebp - 4], edi
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4361da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x465000
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00464cc0

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x40915c
nop
nop
mov ecx, 0xce73486
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x4a5c5b44
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40217c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40218b
pop dword [ebp - 0x2c]
mov eax, 0xe745ce4a
sub eax, 0xe705acbf
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xf77d2d01
add dword [ebp - 0x3c], 0x56d5184a
mov dword [ebp - 0x38], 0x4b978496
add dword [ebp - 0x38], 0xe69bc7af
mov dword [ebp - 0x34], 0x5187bd9f
add dword [ebp - 0x34], 0xfac4868f
mov dword [ebp - 0x30], 0xb94a3644
add dword [ebp - 0x30], 0x46b5c9bc
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x6e597500
add eax, 0x91e8bb74
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4663c773
add dword [ebp - 0x3c], 0x2e0ea1e3
mov dword [ebp - 0x38], 0x70fca6c6
add dword [ebp - 0x38], 0xd06fbaaf
mov dword [ebp - 0x34], 0x7e920711
add dword [ebp - 0x34], 0xe4dd655b
mov dword [ebp - 0x30], 0x9fc2b43b
sub dword [ebp - 0x30], 0x9fc2b43b
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x1c6b9586
sub eax, 0x1c296462
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad74
push 0
call eax
mov ecx, 0x3c94
xor edx, edx
add edx, eax
mov esi, 0x9da03c23
sub esi, 0x9d5cf823
add esi, dword [ebp - 0x2c]
mov ebx, 0xd6fa61cc
xor dword [ebp - 0x24], esi
mov edi, dword [esi]
sub dword [ebp - 8], 0xd46db042
xor edi, ebx
sub dword [ebp - 0x24], edi
mov dword [edx], edi
add edx, 4
add esi, 0x2bb57578
add esi, 0xd44a8a8c
loop 0x4022a3
add eax, 0xe523
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4011a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x404142], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.immortable
push str.Odios
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4011e8
xor eax, eax
jmp 0x401203
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402370
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x404240
push ecx
jmp fcn.0040237b
Function at 0xbf1a25
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
mov dword [ebp - 0xc], eax
jmp 0x97a928
je 0x844b9e
mov eax, dword [edx + ecx + 0x20]
add eax, ecx
cmp bx, bp
test bp, sp
xor ebx, ebx
jmp 0x7c3776
je 0xbe9899
xor eax, eax
pop esi
jmp 0x93f90a
test esi, esi
jmp 0x80713f
je 0x7d0204
mov eax, 0x5a4d
cmp word [ecx], ax
jmp 0x7d01fe
mov esp, ebp
pop ebp
ret
jmp 0x844b9e
js 0x844b9e
jmp 0x9130c7
jne 0x7d0204
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
cmp esp, edi
test si, 0x5f98
cmp ah, 0xe4
test edx, edx
je 0x7d0204
mov eax, dword [eax + ecx + 0x7c]
test ebp, esi
cmp esp, 0x730b3cb8
push ebx
stc
test esi, 0x66942c76
push edi
mov dword [ebp - 0x10], eax
test bx, 0x61e5
test bx, sp
cmp bh, 0x5d
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
ja 0x97d6c0
mov eax, esi
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x9522dc
mov edi, dword [edx + ecx + 0x18]
stc
cmp bl, 0x94
cmc
test edi, edi
jmp 0x7c6ebc
test ecx, ecx
je 0x7d0204
mov esi, dword [ebp + 0xc]
jmp 0x8060f0
mov eax, dword [ecx + 0x3c]
stc
clc
cmp dword [eax + ecx], 0x4550
jmp 0x97cf68
push ebp
mov ebp, esp
cmovno cx, bp
mov ecx, dword [ebp + 8]
cmc
clc
sub esp, 0x114
push esi
cmc
jmp 0xbdd165
Function at 0x40ef0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040aac3
and dword [ebp - 0x14], 0
cmp dword [0x417cac], 0
mov dword [ebp - 0x18], eax
jne 0x40efbe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f066
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40f066
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x417cac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x417cb0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x417cb4], eax
call edi
push eax
call esi
mov dword [0x417cbc], eax
test eax, eax
je 0x40efbe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x417cb8], eax
mov eax, dword [0x417cb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40f017
cmp dword [0x417cbc], ecx
je 0x40f017
push eax
call esi
push dword [0x417cbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40f017
test ebx, ebx
je 0x40f017
call edi
test eax, eax
je 0x40f00e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40f00e
test byte [ebp - 8], 1
jne 0x40f017
or dword [ebp + 0x10], 0x200000
jmp 0x40f04a
mov eax, dword [0x417cb0]
cmp eax, dword [ebp - 0x18]
je 0x40f04a
push eax
call esi
test eax, eax
je 0x40f04a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f04a
mov eax, dword [0x417cb4]
cmp eax, dword [ebp - 0x18]
je 0x40f04a
push eax
call esi
test eax, eax
je 0x40f04a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x417cac]
call esi
test eax, eax
je 0x40f066
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f068
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004055f8
leave
ret

Function at 0x408936
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call main
sub edx, ecx
push edx
pop ecx
xor dword [esi], edi
add edx, 1
push ecx
pop edx
add esi, 1
inc edx
dec edx
cmp esi, ebx
jne fcn.00408936
sub edx, 0x37f1cda3
ret
Function at 0x40cfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40cfcf
pop dword [ebp - 0x28]
mov eax, 0xc2b11f4d
add eax, 0x3d8fb082
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xf75d41e5
add dword [ebp - 0x38], 0x56f50366
mov dword [ebp - 0x34], 0xe9bc3ab2
sub dword [ebp - 0x34], 0xb788ee6d
mov dword [ebp - 0x30], 0xab9a1ea4
sub dword [ebp - 0x30], 0x5f4dda76
mov dword [ebp - 0x2c], 0x815d3be
sub dword [ebp - 0x2c], 0x815d3be
lea eax, [ebp - 0x38]
push eax
mov eax, 0x9ce79eb6
sub eax, 0x9ca66e16
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd512169a
add dword [ebp - 0x38], 0x9f6052bc
mov dword [ebp - 0x34], 0x3c95bc1e
sub dword [ebp - 0x34], 0xfb295aa9
mov dword [ebp - 0x30], 0xe15cd8e6
sub dword [ebp - 0x30], 0x7ded6c7a
mov dword [ebp - 0x2c], 0x832be430
sub dword [ebp - 0x2c], 0x832be430
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3d141
push 0
call eax
mov ecx, 0x47f95741
sub ecx, 0x47f9058b
mov edx, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x28]
mov esi, 0xcf65ce70
add esi, 0x4b7da776
xor dword [ebp - 0x18], 0x37fd5917
mov edi, dword [ebx]
mov dword [ebp - 0x18], 0xac1140b3
sub edi, esi
add dword [ebp - 0x18], esi
mov dword [edx], edi
mov dword [ebp - 0x24], 0xe80050dd
add edx, 0x872e0bba
add edx, 0x78d1f44a
add ebx, 0x79fb1e9d
add ebx, 0x8604e167
loop 0x40d0e6
add eax, 0x139ab
mov ebx, eax
add eax, 0xe7062b00
add eax, 0x18f9d505
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30d23c5c
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x21f138f4
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10
Function at 0x403d39
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x403e81
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
push edi
mov edi, dword [esp + 0x10]
call ebx
sub byte [esi + edi], 0x1d
call ebx
add byte [esi + edi], 0x10
call ebx
xor byte [esi + edi], 0x79
call ebx
add byte [esi + edi], 0x8e
call ebx
add byte [esi + edi], 0xbb
call ebx
add byte [esi + edi], 0xd0
call ebx
add byte [esi + edi], 0x3a
call ebx
xor byte [esi + edi], 0xdc
call ebx
add byte [esi + edi], 0x47
call ebx
add byte [esi + edi], 0x24
call ebx
xor byte [esi + edi], 0x62
call ebx
add byte [esi + edi], 0xc0
call ebx
add byte [esi + edi], 0x36
call ebx
add byte [esi + edi], 0x49
call ebx
add byte [esi + edi], 0x81
call ebx
add byte [esi + edi], 0x1c
call ebx
xor byte [esi + edi], 0xf3
call ebx
sub byte [esi + edi], 0x80
call ebx
add byte [esi + edi], 0xf4
call ebx
add byte [esi + edi], 0x13
call ebx
add byte [esi + edi], 0x1c
call ebx
add byte [esi + edi], 2
call ebx
add byte [esi + edi], 7
call ebx
add byte [esi + edi], 0xac
call ebx
add byte [esi + edi], 0xfc
call ebx
xor byte [esi + edi], 0x25
call ebx
add byte [esi + edi], 0xb
call ebx
add byte [esi + edi], 0x87
call ebx
add byte [esi + edi], 0x8d
call ebx
add byte [esi + edi], 0xd7
call ebx
add byte [esi + edi], 0xa0
call ebx
xor byte [esi + edi], 0x22
call ebx
xor byte [esi + edi], 0xa7
call ebx
xor byte [esi + edi], 0x7b
call ebx
add byte [esi + edi], 0x63
call ebx
add byte [esi + edi], 0x37
call ebx
xor byte [esi + edi], 0xf3
call ebx
add byte [esi + edi], 0xf7
call ebx
add byte [esi + edi], 0xb4
call ebx
xor byte [esi + edi], 0x2b
call ebx
add byte [esi + edi], 0x96
call ebx
xor byte [esi + edi], 0xa2
call ebx
add byte [esi + edi], 0x1c
call ebx
xor byte [esi + edi], 0xde
call ebx
add byte [esi + edi], 0x8c
call ebx
xor byte [esi + edi], 0x92
call ebx
add byte [esi + edi], 0x10
call ebx
add byte [esi + edi], 0xd2
call ebx
inc esi
cmp esi, dword [esp + 0x14]
jb 0x403d52
pop edi
pop ebx
pop esi
ret

Function at 0x403f0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x45a8ec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x403f74
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401b44
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004040e2
pop ecx
pop ecx
cmp eax, dword [esp + 0x38]
je 0x403f8c
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00403ab2
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x403f3c
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405f48
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00403ab2
jmp 0x403f76
Function at 0x4040e2
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, dword [esp + 0x1c]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x404107
mov esi, dword [esi]
mov dword [esp + 0x18], esi
push esi
shr edi, 2
push edi
push str._x_and__p
call fcn.004043b6
add esp, 0xc
test edi, edi
je 0x404162
mov ebp, esi
mov esi, edi
push 4
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.00406aa0
imul ecx, dword [esp + 0x28], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x1c], eax
sub esi, 1
jne 0x404121
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x40418b
sub eax, 1
je 0x404181
sub eax, 1
jne 0x404199
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ecx
ret

Function at 0x4041bf
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipCursor]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x45bea0], eax
pop edi
pop esi
ret

Function at 0x4066ce
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40670d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40670d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40670d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40670d
cmp dword [ecx + 0x74], 0xe
jbe 0x40670d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d08a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bd28
push 0x41bd20
push str.FlsAlloc
push 0x1e
call fcn.0040cf4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d0be
push dword [ebp + 8]
mov ecx, esi
call dword [0x419184]
call esi
jmp 0x40d0c4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d108
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bd38
push 0x41bd30
push str.FlsGetValue
push 0x20
call fcn.0040cf4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d13f
push dword [ebp + 8]
mov ecx, esi
call dword [0x419184]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40611c
pop dword [ebp - 0x44]
mov eax, 0x40611c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x437f9077
add dword [ebp - 0x54], 0xad2b4d4
mov dword [ebp - 0x50], 0x3be5285b
add dword [ebp - 0x50], 0xf64e23ea
mov dword [ebp - 0x4c], 0x87aefc2e
add dword [ebp - 0x4c], 0xc49d4800
mov dword [ebp - 0x48], 0x7d302519
sub dword [ebp - 0x48], 0x7d302519
lea eax, [ebp - 0x54]
push eax
mov eax, 0x407db996
sub eax, 0x403d4936
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x46e387d6
add dword [ebp - 0x54], 0x2d8ee180
mov dword [ebp - 0x50], 0x245858fc
add dword [ebp - 0x50], 0x1d140879
mov dword [ebp - 0x4c], 0xaa218974
add dword [ebp - 0x4c], 0xb94de2f8
mov dword [ebp - 0x48], 0xcffcf414
sub dword [ebp - 0x48], 0xcffcf414
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x352a5e9e
add eax, 0xcb161262
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab33
push 0
call eax
mov ecx, 0x80bef76b
sub ecx, 0x80be9f0d
mov edx, eax
mov ebx, 0x8c6f4600
add ebx, 0x73d1ba00
add ebx, dword [ebp - 0x44]
mov esi, 0x6c674a4
add esi, 0x8a11a6dc
add dword [ebp - 8], eax
mov edi, dword [ebx]
mov dword [ebp - 0x40], 0x2f16cd52
xor edi, esi
mov dword [ebp - 0x14], 0xad78bdfd
mov dword [edx], edi
mov dword [ebp - 8], 0xeee8fa06
add edx, 4
add ebx, 0x5bff92d5
add ebx, 0xa4006d2f
loop 0x406239
add eax, 0xac942599
sub eax, 0xac92d14e
mov ebx, eax
add eax, 0x4c551fec
add eax, 0xb3aae019
mov ecx, 0xf2bb7370
sub ecx, 0xf27b7370
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941