joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016366c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102c9be0]
jne 0x10163676
repz ret
jmp fcn.10165aa8

Function at 0x10166ea0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10162286
and dword [ebp - 4], 0
cmp dword [0x102cac78], 0
mov ebx, eax
jne 0x10166f51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10167002
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10167002
push eax
call fcn.10162214
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102cac78], eax
call esi
push eax
call fcn.10162214
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102cac7c], eax
call esi
push eax
call fcn.10162214
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102cac80], eax
call esi
push eax
call fcn.10162214
pop ecx
mov dword [0x102cac88], eax
test eax, eax
je 0x10166f51
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10162214
pop ecx
mov dword [0x102cac84], eax
mov eax, dword [0x102cac84]
cmp eax, ebx
je 0x10166fa9
cmp dword [0x102cac88], ebx
je 0x10166fa9
push eax
call fcn.1016228f
push dword [0x102cac88]
mov esi, eax
call fcn.1016228f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10166fa9
test edi, edi
je 0x10166fa9
call esi
test eax, eax
je 0x10166fa0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10166fa0
test byte [ebp - 0xc], 1
jne 0x10166fa9
or dword [ebp + 0x10], 0x200000
jmp 0x10166fe2
mov eax, dword [0x102cac7c]
cmp eax, ebx
je 0x10166fe2
push eax
call fcn.1016228f
pop ecx
test eax, eax
je 0x10166fe2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10166fe2
mov eax, dword [0x102cac80]
cmp eax, ebx
je 0x10166fe2
push eax
call fcn.1016228f
pop ecx
test eax, eax
je 0x10166fe2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102cac78]
call fcn.1016228f
pop ecx
test eax, eax
je 0x10167002
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10167004
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10168770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10168770]
mov ecx, 0x1c5a
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10168799
mov eax, dword [ebp - 0xc]
mov dword [0x102c9370], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [ecx], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x101687bb
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x10168789
mov eax, dword [ebp - 0xc]
add eax, 0xffffddc4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x10168799
Function at 0x101687e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102c937c], 0
mov byte [0x102c9380], 0
mov dword [0x102c9370], 0x25ab
mov dword [0x102c9378], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10168845
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x102c9370], 0x213c
mov dword [0x102c9378], 0
jmp 0x10168877
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x102c9370], 0x1b02
mov eax, dword [0x102c9378]
add eax, 1
mov dword [0x102c9378], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10168845
jmp 0x1016882f
mov eax, 0x100
mov dword [0x102c9384], 0
mov ecx, dword [0x102c937c]
mov edx, dword [0x102c9378]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x102c9384], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x102c937c], edx
mov ecx, dword [0x102c9378]
mov bl, byte [esi + ecx]
mov byte [0x102c9380], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x102c9380]
mov ecx, dword [0x102c937c]
mov byte [esi + ecx], bl
mov ecx, dword [0x102c9378]
add ecx, 1
mov dword [0x102c9378], ecx
cmp ecx, 0x100
jl 0x10168877
jmp 0x10168827
Function at 0x10168d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [0x102c9370]
add edx, 0xfffff83c
mov dword [0x102c9374], edx
mov dword [0x102c9370], 0x1acf
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
jmp 0x10168e30
mov dword [0x102c9370], 0x811
mov eax, dword [ebp - 0x3c]
add eax, 0xa7ffe
mov ecx, dword [ebp - 0x3c]
add ecx, 0x146987
mov edx, dword [ebp - 0x3c]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x40]
mov dword [esp + 8], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
call fcn.101686d0
xor eax, eax
mov ecx, dword [0x102c9370]
add ecx, 0x1234
mov dword [0x102c9374], ecx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
mov dword [ecx + 4], 0x149c00
mov dword [0x102c9370], 0x4ed
mov edx, dword [ebp - 0x44]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x2080
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x24
mov edi, edx
add edi, esi
add edi, 4
imul esi, eax, 0x24
add edx, esi
add edx, 8
add eax, 1
mov edx, dword [edx]
movzx esi, word [edi]
xor esi, edx
add esi, ecx
cmp eax, 0x1df
mov ecx, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], eax
jne 0x10168e30
lea eax, [0x1016a1bf]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
call fcn.101690a0
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call fcn.101695b0
mov ecx, eax
mov dword [0x102c938c], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
lea edx, section..data
imul esi, ecx, 0x24
mov edi, edx
add edi, esi
mov esi, dword [ebp - 0x3c]
add esi, eax
imul ebx, ecx, 0x24
mov dword [ebp - 0x5c], eax
mov eax, edx
add eax, ebx
add eax, 4
mov ebx, ecx
add ebx, 1
imul ecx, ecx, 0x24
add edx, ecx
add edx, 8
mov ecx, dword [edx]
mov edx, dword [edi]
movzx eax, word [eax]
xor eax, ecx
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ebx
call fcn.101694b0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x64]
cmp edx, 0x1df
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], eax
je 0x10168db7
jmp 0x10168ee2
Function at 0x101692a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x102c9374]
add eax, 0xfffff55c
mov dword [0x102c9370], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102c9374], 0x1ffe
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10169323
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x10169323
jmp 0x10169339
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x101693e3
mov dword [0x102c9370], 0xca
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10169398
jmp 0x101692fe
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x101692e5
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x102c9374]
add ecx, 0x10f2
mov dword [0x102c9374], ecx
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x101692fe
mov dword [0x102c9374], 0xe77
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101692fe
mov dword [0x102c9370], 0xa83
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10169308
jmp 0x101692fe
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x101692fe
mov dword [0x102c9370], 0xf8e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101692fe
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x101692fe
mov eax, dword [ebp - 0x1c]
add esp, 0x20
pop ebp
ret
Function at 0x101695e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102c9378], 0
mov dword [0x102c937c], 0
mov dword [0x102c9388], 0
mov ebx, dword [0x102c9370]
add ebx, 0xfffff25f
mov dword [0x102c9374], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x10169718
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, eax
add edx, 1
mov esi, dword [0x102c9378]
add esi, 1
mov dword [ebp - 0x24], eax
mov eax, esi
mov dword [ebp - 0x28], edx
cdq
idiv ecx
mov dword [0x102c9378], edx
mov dword [0x102c9370], 0xffffe88b
mov esi, dword [0x102c937c]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x102c937c], edx
mov ecx, dword [0x102c9378]
mov bl, byte [edi + ecx]
mov byte [0x102c9380], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x102c9380]
mov ecx, dword [0x102c937c]
mov byte [edi + ecx], bl
mov ecx, dword [0x102c9378]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x102c937c]
movzx edx, byte [edi + edx]
add edx, ecx
mov dword [0x102c9370], 0x1ae9
and edx, 0xff
mov dword [0x102c9388], edx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x10]
cmp esi, edi
mov dword [ebp - 0x20], esi
jne 0x10169641
mov dword [0x102c9370], 0x18d5
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x405540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c8d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x467014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x468070
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041bfc0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x467a88
push eax
call fcn.0041bfc0
mov esi, dword [str.FreeLibrary]
xor ebx, ebx
mov edi, dword [0x468084]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x46b280], bl
mov eax, ebx
mov ecx, 0x468070
cmovae ecx, dword [0x468070]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x46b390], al
inc ebx
cmp ebx, 0x100
jl 0x4055c0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x46b280]
movzx eax, byte [esi + 0x46b390]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x405614
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x46b280]
mov byte [esi + 0x46b280], al
inc esi
mov byte [edi + 0x46b280], dl
cmp esi, 0x100
jl 0x4055f0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00405190
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405669
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40565f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.00421568
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x4056ab
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4056a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4056bf
push edx
push ecx
call fcn.00421568
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043ab6a
int3
Function at 0x4056d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov ecx, dword [eax]
mov eax, 0xaaaaaaab
add ecx, 2
mov dword [ebp - 0xc], ebx
mul ecx
push esi
push edi
shr edx, 1
mov ecx, ebx
shl edx, 2
push 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebx], 0
call fcn.0041be80
cmp dword [ebx + 0x14], 0x10
mov edi, ebx
jb 0x405723
mov edi, dword [ebx]
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], 3
xor esi, esi
mov ecx, dword [ecx]
mov eax, ecx
div dword [ebp - 4]
sub ecx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
je 0x4057ce
mov eax, dword [ebp - 8]
dec ecx
add eax, 2
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 1
inc eax
mov ebx, eax
movsx ecx, byte [edx - 2]
lea edx, [edx + 3]
movsx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movsx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
sar eax, 0x12
movzx eax, byte [eax + 0x45ccd0]
mov byte [edi + esi], al
mov eax, ecx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x45ccd0]
mov byte [edi + esi + 1], al
mov eax, ecx
sar eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + 0x45ccd0]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + 0x45ccd0]
mov byte [edi + esi + 3], al
add esi, 4
sub ebx, 1
jne 0x405761
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x405845
mov eax, dword [ebp - 8]
movsx eax, byte [ecx + eax]
sub edx, 1
je 0x4057f8
mov ebx, dword [ebp - 8]
shl eax, 8
movsx ecx, byte [ecx + ebx + 1]
mov ebx, dword [ebp - 0x10]
or ecx, eax
mov eax, ecx
sar eax, 0xa
and eax, 0x3f
jmp 0x4057fd
mov ecx, eax
sar eax, 2
mov al, byte [eax + 0x45ccd0]
mov byte [edi + esi], al
mov eax, ecx
test edx, edx
je 0x405814
sar eax, 4
and eax, 0x3f
jmp 0x40581a
and eax, 3
shl eax, 4
mov al, byte [eax + 0x45ccd0]
mov byte [edi + esi + 1], al
test edx, edx
je 0x40583f
and ecx, 0xf
mov al, byte [ecx*4 + 0x45ccd0]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ac0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x467014]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0x67452301
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.0041baf0
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push 0x10
push eax
push esi
call fcn.00438150
lea eax, [esp + 0x1c]
add esp, 0xc
lea ebx, [esi + 0x10]
cmp edi, eax
je 0x405b8b
mov eax, dword [edi]
test eax, eax
je 0x405b6d
mov ecx, dword [edi + 8]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x405b63
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405bce
mov eax, edx
push ecx
push eax
call fcn.00421568
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00420ef1
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x405bbc
mov ecx, dword [esp + 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x405bb2
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405bce
push ecx
push esi
call fcn.00421568
add esp, 8
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420ef1
mov esp, ebp
pop ebp
ret
call fcn.0043ab6a
int3
Function at 0x4080f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x467014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call dword [0x4540c0]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4082d9
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x4082d9
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00437ff0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call dword [0x454068]
test eax, eax
je 0x4082d9
push 4
push 0x1000
push 4
push 0
call dword [0x4540b0]
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call dword [0x454054]
test eax, eax
je 0x4082d9
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x45cd9c
push dword [esp + 0x30]
call dword [0x4540c4]
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x4081fc
push str.cosh
push str.atan2
call dword [0x454098]
push eax
call dword [0x454058]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call dword [0x45405c]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4082d9
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call dword [0x4540bc]
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x408293
mov dword [esp + 0xc], eax
call fcn.00407f40
push eax
call dword [0x454094]
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [0x4540bc]
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x408242
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call dword [0x4540bc]
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call dword [0x454070]
push dword [esp + 0x24]
call dword [0x4540a0]
push 0x8000
push 0
push esi
call dword [0x4540b8]
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00420ef1
mov esp, ebp
pop ebp
ret
Function at 0x59ac9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ad148]
jne 0x59aca7
repz ret
jmp fcn.0059d5ee

Function at 0x59df7f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00599a06
and dword [ebp - 4], 0
cmp dword [0x5ae53c], 0
mov ebx, eax
jne 0x59e030
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x59e0e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x59e0e1
push eax
call fcn.00599994
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5ae53c], eax
call esi
push eax
call fcn.00599994
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5ae540], eax
call esi
push eax
call fcn.00599994
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5ae544], eax
call esi
push eax
call fcn.00599994
pop ecx
mov dword [0x5ae54c], eax
test eax, eax
je 0x59e030
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00599994
pop ecx
mov dword [0x5ae548], eax
mov eax, dword [0x5ae548]
cmp eax, ebx
je 0x59e088
cmp dword [0x5ae54c], ebx
je 0x59e088
push eax
call fcn.00599a0f
push dword [0x5ae54c]
mov esi, eax
call fcn.00599a0f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x59e088
test edi, edi
je 0x59e088
call esi
test eax, eax
je 0x59e07f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x59e07f
test byte [ebp - 0xc], 1
jne 0x59e088
or dword [ebp + 0x10], 0x200000
jmp 0x59e0c1
mov eax, dword [0x5ae540]
cmp eax, ebx
je 0x59e0c1
push eax
call fcn.00599a0f
pop ecx
test eax, eax
je 0x59e0c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x59e0c1
mov eax, dword [0x5ae544]
cmp eax, ebx
je 0x59e0c1
push eax
call fcn.00599a0f
pop ecx
test eax, eax
je 0x59e0c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5ae53c]
call fcn.00599a0f
pop ecx
test eax, eax
je 0x59e0e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x59e0e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret