joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd838
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x14039e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404868
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4cd873
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4cd88c
lea eax, [ebp - 0x10]
mov edx, dword [0x144df78]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.004048c8
jmp 0x4cd89f
lea eax, [ebp - 0x10]
mov edx, dword [0x144df78]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004048c8
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4cd8ab
adc edx, 0
mov edx, dword [edx*4 + 0x144c580]
call fcn.00404ac8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404aac
push eax
call fcn.00406a50
mov esi, eax
cmp esi, 0xffffffff
je 0x4cd9b9
mov eax, 0x40
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406e80
test eax, eax
je 0x4cd9ac
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4cd9ac
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ef8
mov eax, edi
call fcn.00402744
mov eax, 0x18
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406e80
test eax, eax
je 0x4cd9ac
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4cd9ac
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4cd9ac
cmp dx, 0x150
ja 0x4cd9ac
mov eax, edi
call fcn.00402744
mov eax, 0xe0
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406e80
test eax, eax
je 0x4cd9ac
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4cd9ac
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004048a4
mov eax, edi
call fcn.00402744
push esi
call fcn.00406a08
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404bd4
jne 0x4cd9d1
inc ebx
cmp ebx, 0x19
jne 0x4cd865
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14039ee
lea eax, [ebp - 0x10]
call fcn.00404868
ret
Function at 0x1001d862
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071d3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001d8bd
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x7125
push dword [ebp - 0x24]
push 1
push 0x265e
push 0x584
push 0x7dab
push 0x44a9
call fcn.1001da22
add esp, 0x1c
jmp 0x1001da11
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001d910
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001d90b
push 0x137
push 0
push 0x21d5
push 0x6ce
push 0x974
call dword [sym.imp.GDI32.dll_TextOutA]
jmp 0x1001da11
mov dword [ebp - 0x20], 0x3eb9
mov dword [ebp - 0x3c], 0x1000bb24
cmp dword [ebp - 0x20], 0x3fef
jle 0x1001d9ab
and dword [ebp - 0x1c], 0
jmp 0x1001d938
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2ba6
jge 0x1001d993
and dword [ebp - 0x14], 0
jmp 0x1001d94e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x288b
jge 0x1001d991
and dword [ebp - 0x18], 0
jmp 0x1001d964
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5e1f
jge 0x1001d98f
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1061a898
call fcn.10019034
jmp 0x1001d95d
jmp 0x1001d947
jmp 0x1001d931
push 0x2284
push 0
push 0
push 0
push 0
push 0xfc4
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3adc
jge 0x1001d9cb
mov edx, dword [ebp - 0x3c]
mov ecx, 0x1061a898
call fcn.1001bd42
jmp 0x1001d9e7
or dword [ebp - 4], 0xffffffff
jmp 0x1001d9f1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1001da11
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100220c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10022121
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.10022165
add esp, 0x20
jmp 0x10022161
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10022143
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10022161
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10022161
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov esp, ebp
pop ebp
ret
Function at 0x1003831e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003836e
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10038356
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and dword [eax], 0
jmp 0x1003836c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003836c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10038382
push 0x12c8
push 0
push 0x47ab
call fcn.100379a6
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10041e71
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10041eaa
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10041e97
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x10041ea8
push 0x1f79
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10041ec3
push 0x6517
push 0x49d1
push 0
push 0x6b3
call fcn.10044547
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10045010
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100450c7
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100450bb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004506d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x100450b9
push 1
push 0
push 0xb20
push 0x6389
push 0xf85
push 0x4c0b
push 1
call fcn.1004753d
add esp, 0x1c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.100193bb
mov esi, eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.100193bb
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10045062
jmp 0x100450c5
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1004510a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0x3ad8
push 0x5f2c
push dword [ebp - 0x20]
push 0
push 0x4d76
push 0x77b7
push 0x7f46
push 0x803
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.1003c992
add esp, 0x28
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004753d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10047689
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10047588
push 0x1557
push 0x1eaa
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x10047687
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, 0xdd688769
test eax, eax
je 0x10047670
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x10047656
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
cmp eax, 0x188047d2
jle 0x100475e4
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x100475e4
and dword [ebp - 0x10], 0
jmp 0x100475eb
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [eax]
cmp ecx, 0x89fe57f6
jne 0x10047604
mov dword [ebp - 0x14], 1
jmp 0x10047608
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jne 0x1004761b
mov dword [ebp - 0x40], 1
jmp 0x1004761f
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
imul eax, dword [ecx]
cmp eax, 0xf635
jle 0x10047642
mov dword [ebp - 0x18], 1
jmp 0x10047646
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x10047656
and dword [ebp - 0x1c], 0
jmp 0x1004765d
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [eax]
je 0x10047670
mov dword [ebp - 0x20], 1
jmp 0x10047674
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
imul eax, dword [ecx]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
jmp 0x100476d9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x100476b9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100476b7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x100476d9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x100476d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esp, ebp
pop ebp
ret
Function at 0x1006d975
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10077750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005ea18
mov dword [ebp - 0x14], eax
cmp dword [0x1061b9b4], esi
jne 0x1006da68
push 0x800
push esi
push 0x1000b060
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006d9f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006db48
push esi
push esi
push 0x1000b060
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006db48
push 0x1000b078
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006db48
push eax
call ebx
push 0x1000b084
push edi
mov dword [0x1061b9b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000b094
push edi
mov dword [0x1061b9b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000b0a8
push edi
mov dword [0x1061b9bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061b9c4], eax
test eax, eax
je 0x1006da65
push 0x1000b0c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061b9c0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006da8d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006da80
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006daa2
push 4
pop eax
jmp 0x1006db4a
cmp dword [ebp - 0x14], esi
je 0x1006daa2
push dword [0x1061b9b4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006da87
mov eax, dword [0x1061b9c0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006db00
cmp dword [0x1061b9c4], edi
je 0x1006db00
push eax
call ebx
push dword [0x1061b9c4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006db00
test eax, eax
je 0x1006db00
call ecx
test eax, eax
je 0x1006daf5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006daf5
test byte [ebp - 8], 1
jne 0x1006db00
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006db30
mov eax, dword [0x1061b9b8]
cmp eax, edi
je 0x1006db2d
push eax
call ebx
test eax, eax
je 0x1006db2d
call eax
mov esi, eax
test esi, esi
je 0x1006db2d
mov eax, dword [0x1061b9bc]
cmp eax, edi
je 0x1006db2d
push eax
call ebx
test eax, eax
je 0x1006db2d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1061b9b4]
call ebx
test eax, eax
je 0x1006db48
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006db4a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005ba81
mov esp, ebp
pop ebp
ret
Function at 0x401240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x426b98
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x432ea8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40128d
mov eax, dword [eax]
jmp 0x40128f
xor eax, eax
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x6c]
push esi
call eax
test eax, eax
jge 0x4012ad
push 0x42cbac
push esi
push eax
call fcn.00424d90
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebx
call fcn.0040f98c
mov esi, dword [esp + 0x44]
xor edx, edx
add esp, 0x10
mov word [esp + 0xc], dx
test esi, esi
je 0x401306
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x401306
test esi, esi
je 0x401306
mov eax, dword [esi]
test eax, eax
je 0x4012ed
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x4012fd
push eax
call fcn.0040340d
add esp, 4
push esi
call fcn.0040340d
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4

Function at 0x401320
Capabilities:
Encode data using xor

Disassembly:
mov eax, str.abc123
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401328
push esi
sub eax, edx
push str.001001ABCABC_n
mov esi, eax
call fcn.0040fb47
push str.001001ABCABC_n
call fcn.0040fb47
push str.00142135dsafBCABC_n
call fcn.0040fb47
push 0x42c804
call fcn.0040fb47
push 0x42c804
call fcn.0040fb47
add esp, 0x14
xor ecx, ecx
test edi, edi
jbe 0x401385
nop
mov eax, ecx
xor edx, edx
div esi
inc ecx
mov al, byte [edx + str.abc123]
xor byte [ecx + ebx - 1], al
cmp ecx, edi
jb 0x401370
pop esi
ret
Function at 0x40f97d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432ea8]
jne 0x40f987
repz ret
jmp fcn.004132ef

Function at 0x41e1f0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004137d7
and dword [ebp - 4], 0
cmp dword [0x436e60], 0
mov ebx, eax
jne 0x41e2a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e352
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41e352
push eax
call fcn.00413765
mov dword [esp], 0x42c5b8
push edi
mov dword [0x436e60], eax
call esi
push eax
call fcn.00413765
mov dword [esp], 0x42c5a4
push edi
mov dword [0x436e64], eax
call esi
push eax
call fcn.00413765
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x436e68], eax
call esi
push eax
call fcn.00413765
pop ecx
mov dword [0x436e70], eax
test eax, eax
je 0x41e2a1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413765
pop ecx
mov dword [0x436e6c], eax
mov eax, dword [0x436e6c]
cmp eax, ebx
je 0x41e2f9
cmp dword [0x436e70], ebx
je 0x41e2f9
push eax
call fcn.004137e0
push dword [0x436e70]
mov esi, eax
call fcn.004137e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41e2f9
test edi, edi
je 0x41e2f9
call esi
test eax, eax
je 0x41e2f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41e2f0
test byte [ebp - 0xc], 1
jne 0x41e2f9
or dword [ebp + 0x10], 0x200000
jmp 0x41e332
mov eax, dword [0x436e64]
cmp eax, ebx
je 0x41e332
push eax
call fcn.004137e0
pop ecx
test eax, eax
je 0x41e332
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41e332
mov eax, dword [0x436e68]
cmp eax, ebx
je 0x41e332
push eax
call fcn.004137e0
pop ecx
test eax, eax
je 0x41e332
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436e60]
call fcn.004137e0
pop ecx
test eax, eax
je 0x41e352
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e354
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6a6f55b8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x35333de3
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x405673
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c9b0]
jne 0x40567d
repz ret
jmp fcn.004091cb

Function at 0x40b51f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405796
and dword [ebp - 4], 0
cmp dword [0x43eb98], 0
mov ebx, eax
jne 0x40b5d0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b681
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b681
push eax
call fcn.00405724
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43eb98], eax
call esi
push eax
call fcn.00405724
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43eb9c], eax
call esi
push eax
call fcn.00405724
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43eba0], eax
call esi
push eax
call fcn.00405724
pop ecx
mov dword [0x43eba8], eax
test eax, eax
je 0x40b5d0
push 0x41944c
push edi
call esi
push eax
call fcn.00405724
pop ecx
mov dword [0x43eba4], eax
mov eax, dword [0x43eba4]
cmp eax, ebx
je 0x40b628
cmp dword [0x43eba8], ebx
je 0x40b628
push eax
call fcn.0040579f
push dword [0x43eba8]
mov esi, eax
call fcn.0040579f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b628
test edi, edi
je 0x40b628
call esi
test eax, eax
je 0x40b61f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b61f
test byte [ebp - 0xc], 1
jne 0x40b628
or dword [ebp + 0x10], 0x200000
jmp 0x40b661
mov eax, dword [0x43eb9c]
cmp eax, ebx
je 0x40b661
push eax
call fcn.0040579f
pop ecx
test eax, eax
je 0x40b661
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b661
mov eax, dword [0x43eba0]
cmp eax, ebx
je 0x40b661
push eax
call fcn.0040579f
pop ecx
test eax, eax
je 0x40b661
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43eb98]
call fcn.0040579f
pop ecx
test eax, eax
je 0x40b681
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b683
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret