joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ee5a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp dword [0x4a1860], ebx
jne 0x43ee90
push 0x4a1844
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4a1860], 1
push 0x4a1844
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4a185c]
mov edi, eax
cmp eax, ebx
je 0x43eef4
cmp dword [ebp - 4], ebx
jne 0x43f034
xor eax, eax
inc eax
lea ecx, [edi + 0x114]
cmp esi, dword [ecx]
je 0x43eec7
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x43eeb8
jmp 0x43eee5
push dword [ebp + 0xc]
lea esi, [edi + eax*4 + 0x210]
push dword [ebp + 8]
call fcn.0043ecaf
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
mov dword [ebp - 4], 1
mov edi, dword [edi]
cmp edi, ebx
jne 0x43eea6
cmp dword [ebp - 4], ebx
jne 0x43f034
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push 0x100000
lea eax, [ebp - 8]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43f034
mov edi, dword [0x4a185c]
jmp 0x43ef34
cmp dword [edi + 0xc], 0x3f
jl 0x43efce
mov edi, dword [edi]
cmp edi, ebx
jne 0x43ef28
push 0x310
push 8
push dword [0x4a0dc8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x43f02b
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [edi + 8], eax
cmp eax, ebx
je 0x43f01d
push ebx
push ebx
push edi
push 0x43ed00
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x114], esi
push 0x1000
lea esi, [edi + 0x214]
push ebx
mov dword [edi + 0x14], eax
mov dword [esi], ebx
mov dword [edi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x43f014
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043ecaf
mov eax, dword [0x4a185c]
pop ecx
pop ecx
mov dword [edi + 4], ebx
mov dword [edi], eax
cmp eax, ebx
je 0x43efc6
mov dword [eax + 4], edi
mov dword [0x4a185c], edi
jmp 0x43f034
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
mov dword [edi + eax*4 + 0x10], ecx
mov eax, dword [edi + 0xc]
push dword [ebp + 8]
mov dword [edi + eax*4 + 0x110], esi
mov eax, dword [edi + 0xc]
mov dword [edi + eax*4 + 0x210], ebx
mov eax, dword [edi + 0xc]
lea esi, [edi + eax*4 + 0x210]
call fcn.0043ecaf
inc dword [edi + 0xc]
pop ecx
pop ecx
push ebx
push 1
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x43f034
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push dword [0x4a0dc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4a1844
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4403cc
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x158
push 8
push dword [0x4a0dc8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4a1c0c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x4a1c10], esi
and dword [esi + 0x88], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
push esi
mov dword [esi + 0x84], 0xffffff
mov dword [esi + 0x6c], 2
mov dword [esi + 0x70], 0x3f
call fcn.00446451
mov dword [esi + 0x58], 0x44034b
mov dword [esi + 0x5c], 0x44038a
mov dword [esi + 0x10], fcn.0043f4e9
mov dword [esi + 0x30], 0x43f66e
mov dword [esi + 0x64], 0x43f777
mov dword [esi + 0x60], 0x43f7c4
mov dword [esi + 0x34], 0x43feea
mov dword [esi + 0x24], 0x43fd89
mov dword [esi + 0x28], 0x43fdb2
mov dword [esi + 0x2c], 0x43fddd
mov dword [esi + 0x44], 0x4401db
mov eax, esi
pop esi
ret 4

Function at 0x4418b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x1c], 0
mov ecx, dword [esi + 0xb4]
mov dword [ebp - 4], ecx
je 0x441929
imul ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x14]
add eax, dword [ebp + 8]
push ebx
lea edx, [eax + edx*4]
push edi
mov eax, dword [esi + 0xac]
imul eax, dword [ebp + 0x10]
add eax, dword [esi + 0xa8]
mov edi, edx
add eax, ecx
cmp dword [ebp + 0x18], 0
jle 0x441918
mov ebx, dword [ebp + 0x18]
mov dword [ebp + 0x14], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add eax, dword [ebp - 4]
add edi, 4
dec dword [ebp + 0x14]
jne 0x4418fd
dec dword [ebp + 0x1c]
add edx, dword [ebp + 0xc]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x1c], 0
jne 0x4418dd
pop edi
pop ebx
leave
ret 0x18

Function at 0x4426ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0
mov edx, dword [esi + 0xb4]
je 0x44276e
push ebx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x14]
mov ecx, edx
imul ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x18]
add edi, dword [ebp + 8]
add eax, edi
mov edi, eax
mov dword [ebp + 0x18], eax
mov eax, dword [esi + 0xac]
imul eax, dword [ebp + 0x10]
add eax, dword [esi + 0xa8]
add eax, ecx
cmp dword [ebp + 0x1c], 0
jle 0x442757
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add edi, 3
add eax, edx
dec dword [ebp + 0x14]
jne 0x44273d
mov edi, dword [ebp + 0x18]
add edi, dword [ebp + 0xc]
dec dword [ebp + 0x20]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x18], edi
jne 0x44271f
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x404320
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 1
jmp 0x404330
Function at 0x4085c6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x40a3c0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, edi
push ebx
call fcn.0040b000
lea eax, [edi + 4]
mov dword [ebp - 0x38], eax
mov dword [edi + 4], ebx
mov byte [edi + 8], bl
lea eax, [edi + 0xc]
mov dword [ebp - 0x34], eax
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
lea eax, [edi + 0x14]
mov dword [ebp - 0x30], eax
mov dword [edi + 0x14], ebx
mov word [edi + 0x18], bx
lea eax, [edi + 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [edi + 0x1c], ebx
mov word [edi + 0x20], bx
mov dword [edi + 0x24], ebx
mov byte [edi + 0x28], bl
mov dword [edi + 0x2c], ebx
mov byte [edi + 0x30], bl
lea eax, [edi + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [edi + 0x2c]
mov dword [ebp - 0x24], eax
test esi, esi
mov dword [ebp - 0x20], edi
je 0x408679
mov dword [ebp - 0x10], 0
push esi
push edi
call fcn.0040b128
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], 0
push str.bad_locale_name
call fcn.0040b682
add esp, 4
nop
push ebp
sub esp, 8
add ebp, 0xc
mov ecx, dword [ebp - 0x24]
call fcn.0040a1e8
mov ecx, dword [ebp - 0x28]
call fcn.0040a1e8
mov ecx, dword [ebp - 0x2c]
call fcn.0040a1e8
mov ecx, dword [ebp - 0x30]
call fcn.0040a1e8
mov ecx, dword [ebp - 0x34]
call fcn.0040a1e8
mov ecx, dword [ebp - 0x38]
call fcn.0040a1e8
mov ecx, dword [ebp - 0x20]
call fcn.0040b031
add esp, 8
pop ebp
ret

Function at 0x408bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x43d054]
xor eax, esp
mov dword [esp + 0x24], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x408c48
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x408c48
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x408c3e
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x24]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
mov ebp, esp
lea edi, [esp + 4]
push ebp
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x408c42
cmp eax, 1
je 0x408c1b
test eax, eax
jne 0x408c3e
mov byte [esi + 0x3d], 0
mov ebx, dword [esp]
sub ebx, edi
je 0x408c35
push dword [esi + 0x4c]
push ebx
push 1
push edi
call fcn.0041602e
add esp, 0x10
cmp ebx, eax
jne 0x408c3e
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x408c48
xor ebx, ebx
jmp 0x408c48
mov byte [esi + 0x3d], 0
mov bl, 1
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0040bf48
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408d16
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebx, dword [esp + 0x48]
mov eax, dword [0x43d054]
xor eax, esp
mov dword [esp + 0x30], eax
cmp ebx, 0xffffffff
je 0x408ddc
mov esi, ecx
mov eax, dword [ecx + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x408d58
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
test edi, edi
jle 0x408d58
dec edi
mov dword [edx], edi
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x408e06
cmp dword [esi + 0x4c], 0
je 0x408e03
mov ecx, esi
call fcn.00408b9e
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x408de0
lea eax, [esp + 0x10]
mov byte [eax - 1], bl
lea edx, [esi + 0x40]
mov eax, dword [ecx]
mov dword [esp], eax
lea ebp, [esp + 4]
lea eax, [esp + 0x10]
lea edi, [esp + 0xf]
push ebp
mov ebp, edi
lea edi, [esp + 0x34]
push edi
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push ebp
push edx
mov eax, dword [esp + 0x1c]
call dword [eax + 0x1c]
cmp eax, 2
jae 0x408de5
mov edi, dword [esp + 4]
lea eax, [esp + 0x10]
sub edi, eax
je 0x408dcb
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041602e
add esp, 0x10
cmp edi, eax
jne 0x408e03
mov byte [esi + 0x3d], 1
xor eax, eax
dec eax
lea ecx, [esp + 0xf]
cmp dword [esp + 8], ecx
jmp 0x408dfe
xor ebx, ebx
jmp 0x408e06
movsx eax, bl
jmp 0x408def
cmp eax, 3
jne 0x408e03
movsx eax, byte [esp + 0xf]
push dword [esi + 0x4c]
push eax
call fcn.00415366
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
jmp 0x408e06
xor ebx, ebx
dec ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0040bf48
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x409284
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
cmp esi, 1
mov eax, ecx
sbb eax, 0
jl 0x4092b3
cmp dword [ebx + 0x38], 0
je 0x4092bc
mov ecx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_32
xor eax, eax
xor edx, edx
jmp 0x40934f
mov dword [esp], ecx
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 4], esi
je 0x4092f7
mov ecx, dword [ebx + 0x2c]
mov edi, dword [ecx]
test edi, edi
je 0x4092f7
cmp edi, esi
cmovae edi, esi
push edi
push eax
push ebp
call fcn.0040a510
add esp, 0xc
add ebp, edi
sub esi, edi
mov eax, dword [ebx + 0x2c]
sub dword [eax], edi
mov eax, dword [ebx + 0x1c]
add dword [eax], edi
cmp dword [ebx + 0x4c], 0
je 0x409343
mov ecx, ebx
call fcn.00408b9e
mov edi, 0xfff
cmp esi, 0x1000
jb 0x40932a
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call fcn.00415747
add esp, 0x10
add ebp, eax
sub esi, eax
cmp eax, edi
je 0x409309
jmp 0x409343
test esi, esi
je 0x409341
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call fcn.00415747
add esp, 0x10
sub esi, eax
jmp 0x409343
xor esi, esi
mov eax, dword [esp + 4]
sub eax, esi
mov edx, dword [esp]
sbb edx, 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
cmp ebp, 1
mov eax, esi
sbb eax, 0
jl 0x409793
mov ebx, ecx
mov edi, dword [esp + 0x18]
mov dword [esp], ecx
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x409771
mov ecx, dword [ebx + 0x2c]
mov ecx, dword [ecx]
test ecx, ecx
jle 0x409771
cmp ebp, ecx
mov ebx, esi
mov esi, edi
mov edi, ecx
cmovb edi, ebp
test ebx, ebx
cmovne edi, ecx
push edi
push eax
push esi
call fcn.0040a510
add esp, 0xc
add esi, edi
sub ebp, edi
sbb ebx, 0
mov eax, dword [esp]
mov eax, dword [eax + 0x2c]
sub dword [eax], edi
mov eax, dword [esp]
mov eax, dword [eax + 0x1c]
add dword [eax], edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp]
jmp 0x409786
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, 0xffffffff
je 0x409793
mov byte [edi], al
inc edi
add ebp, 0xffffffff
adc esi, 0xffffffff
mov eax, ebp
neg eax
mov eax, 0
sbb eax, esi
jl 0x409724
mov eax, dword [esp + 0x1c]
sub eax, ebp
mov edx, dword [esp + 0x20]
sbb edx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40935a
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, ecx
cmp dword [ecx + 0x38], 0
je 0x409377
mov ecx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_36
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov eax, dword [ebx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4093e1
cmp ebp, 1
mov ecx, edx
sbb ecx, 0
jl 0x4093e1
mov esi, ebp
mov ecx, dword [ebx + 0x30]
mov ebp, dword [ecx]
test ebp, ebp
jle 0x4093e8
mov dword [esp + 4], esi
cmp ebp, esi
mov ecx, esi
cmovb ecx, ebp
test edx, edx
cmove ebp, esi
cmove ebp, ecx
push ebp
push edi
push eax
mov esi, edx
call fcn.0040a510
mov edx, esi
add esp, 0xc
add edi, ebp
mov dword [esp], edi
mov ecx, dword [esp + 4]
mov edi, ecx
sub edi, ebp
sbb esi, 0
mov eax, dword [ebx + 0x30]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov ebp, ecx
jmp 0x4093f1
mov dword [esp], edi
mov edi, ebp
jmp 0x4093ef
mov dword [esp], edi
mov ebp, esi
mov edi, esi
mov esi, edx
cmp edi, 1
mov eax, esi
sbb eax, 0
jl 0x40941b
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40941b
push eax
push edi
push 1
push dword [esp + 0xc]
mov ebx, edx
call fcn.0041602e
mov edx, ebx
add esp, 0x10
sub edi, eax
sbb esi, 0
sub ebp, edi
sbb edx, esi
mov eax, ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
cmp ebp, 1
mov eax, esi
sbb eax, 0
jl 0x4096ed
mov ebx, ecx
mov edi, dword [esp + 0x18]
mov dword [esp], ecx
mov eax, dword [ebx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4096c9
mov ecx, dword [ebx + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4096c9
cmp ebp, ecx
mov ebx, esi
mov esi, edi
mov edi, ecx
cmovb edi, ebp
test ebx, ebx
cmovne edi, ecx
push edi
push esi
push eax
call fcn.0040a510
add esp, 0xc
add esi, edi
sub ebp, edi
sbb ebx, 0
mov eax, dword [esp]
mov eax, dword [eax + 0x30]
sub dword [eax], edi
mov eax, dword [esp]
mov eax, dword [eax + 0x20]
add dword [eax], edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp]
jmp 0x4096e0
movzx eax, byte [edi]
mov edx, dword [ebx]
mov ecx, ebx
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4096ed
inc edi
add ebp, 0xffffffff
adc esi, 0xffffffff
mov eax, ebp
neg eax
mov eax, 0
sbb eax, esi
jl 0x40967c
mov eax, dword [esp + 0x1c]
sub eax, ebp
mov edx, dword [esp + 0x20]
sbb edx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x421a40
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421a4b
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
not ebx
ror esi, 0x31
mov esi, 0x30
rol esi, 0x58
imul edx
ror eax, 0x74
inc esi
inc edx
inc eax
not edi
imul esi
not edx
imul edi
not edx
imul eax
mov edx, 0x56
inc ebx
dec edx
dec edx
inc edx
sub ebx, 0xfe
sbb esi, 0xd1
ror edi, 0x8a
not esi
imul edx
dec esi
ror edx, 1
imul edx
mov edi, pe_nt_image_headers32
and esi, 0x51
dec eax
rol ebx, 0x44
rol edx, 0x18
neg esi
rol edi, 0x4f
not edi
inc edi
bswap eax
rcl esi, 0x75
sub edi, 0xa7
neg edi
imul eax
inc eax
sbb edx, 0xf
rol ebx, 0x1f
not edi
inc ebx
imul edi
dec esi
sub edi, 0xfc
xor ecx, ecx
xor edi, edi
not edi
bswap eax
neg edx
inc edi
add edx, 0xe
neg esi
ror edi, 0xd1
or esi, 0xca
not esi
rol edx, 5
dec eax
mov esi, 0x7f
and eax, 0x4a
mov esi, 0x31
rcr ebx, 0xa5
sub eax, 0x3b
rcl esi, 0xe1
add edi, 0xab
bswap edx
inc edx
dec eax
rcl edx, 0xf4
neg eax
rcl edx, 1
and edi, 0xce
ror eax, 0x9d
sbb esi, 0x96
dec esi
add ebx, 0x4f
dec ebx
imul esi
inc edi
ror ebx, 0x90
rol esi, 0x9b
bswap esi
neg edx
mov edx, 0x14
rol esi, 0xc6
ror edi, 0xa0
inc esi
rol edx, 0x7f
ror ebx, 0xcb
bswap eax
bswap eax
add eax, 0xd1
and ebx, 0xbe
dec eax
sbb eax, 0xbc
inc esi
inc edi
mov ecx, dword [ebp + 0xc]
ror esi, 0x50
imul ebx
add edx, 0x94
add edi, 0xfb
sub ebx, 0xbe
or ebx, 0x78
inc edx
and eax, 0x49
and edi, 0x4d
not edx
imul esi
sub eax, 1
dec edx
rol esi, 0xfe
sbb edi, 0xc3
or edi, 0xef
sbb eax, 0x8a
inc edx
neg eax
rcl ebx, 3
add eax, 0x1e
rcl esi, 0xb8
sbb edx, 0xc1
sub eax, 0xc
sbb edx, 0xb0
sub edi, 0xf2
rcl edi, 5
add esi, 0x98
imul ebx
dec edi
inc ebx
or edx, 0x85
ror edi, 0xb7
sub esi, 0xd0
not edx
dec esi
neg eax
rcr edx, 0x2a
imul edi
rol eax, 0x77
sbb esi, 0xa5
dec ebx
bswap eax
neg ebx
not edx
rol eax, 0x55
add edi, 0x85
mov esi, 0x35
sbb eax, 0x46
neg eax
mov edi, dword [ebp + 8]
mov ebx, esi
xor eax, esi
mov eax, esi
not byte [edi]
mov esi, ebx
mov esi, esi
mov eax, ebx
xor ebx, esi
xor ebx, eax
xor ebx, eax
xor esi, esi
xor eax, ebx
xor ebx, eax
add byte [edi], 0x79
xor eax, eax
xor esi, eax
xor eax, esi
xor esi, eax
xor eax, ebx
xor ebx, esi
xor esi, esi
mov ebx, ebx
xor eax, ebx
sub byte [edi], 0x30
mov eax, eax
mov esi, ebx
mov esi, eax
xor eax, eax
xor eax, ebx
xor eax, esi
xor esi, esi
xor eax, esi
xor eax, esi
imul byte [edi]
inc edi
loop 0x4013e4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f85
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x493400]
jne 0x404f8f
repz ret
jmp fcn.00407320
Function at 0x4055f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043a5
and dword [ebp - 4], 0
cmp dword [0x494590], 0
mov ebx, eax
jne 0x4056a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405757
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405757
push eax
call fcn.00404333
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x494590], eax
call esi
push eax
call fcn.00404333
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x494594], eax
call esi
push eax
call fcn.00404333
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x494598], eax
call esi
push eax
call fcn.00404333
pop ecx
mov dword [0x4945a0], eax
test eax, eax
je 0x4056a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404333
pop ecx
mov dword [0x49459c], eax
mov eax, dword [0x49459c]
cmp eax, ebx
je 0x4056fe
cmp dword [0x4945a0], ebx
je 0x4056fe
push eax
call fcn.004043ae
push dword [0x4945a0]
mov esi, eax
call fcn.004043ae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056fe
test edi, edi
je 0x4056fe
call esi
test eax, eax
je 0x4056f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056f5
test byte [ebp - 0xc], 1
jne 0x4056fe
or dword [ebp + 0x10], 0x200000
jmp 0x405737
mov eax, dword [0x494594]
cmp eax, ebx
je 0x405737
push eax
call fcn.004043ae
pop ecx
test eax, eax
je 0x405737
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405737
mov eax, dword [0x494598]
cmp eax, ebx
je 0x405737
push eax
call fcn.004043ae
pop ecx
test eax, eax
je 0x405737
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x494590]
call fcn.004043ae
pop ecx
test eax, eax
je 0x405757
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405759
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x401150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x140]
test edi, edi
jne 0x401172
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
lea eax, [esp + 0x34]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__stat]
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
lea eax, [esp + 0x3c]
push 0x403510
push eax
call esi
mov ecx, dword [esp + 0x14c]
mov ebx, eax
push 0
push ecx
push ebx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [esp + 0x160]
push 0x40350c
push edx
call esi
push edi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x4011e5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
push ebx
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push ebp
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret

Function at 0x401220
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x60]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401272
push 5
push eax
push eax
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x54
ret