joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x3c]
cmp dword [edx], 0
push edi
mov edi, eax
mov dword [ebp - 4], 0
jne 0x1000e284
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push 0
and eax, 0x87f3f
push eax
mov eax, dword [ecx + 0x18]
push edx
push 0
push ecx
call eax
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000e3fa
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x1000e2bd
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.10069df0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 5
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], ecx
test edi, edi
je 0x1000e3f7
mov ebx, dword [edi + 0xc]
mov dword [ebp - 0xc], ebx
cmp ebx, dword [esi + 0x18]
ja 0x1000e3ea
test byte [edi + 0x14], 0x20
jne 0x1000e3ea
mov eax, dword [esi + 0x80]
cdq
push edx
push eax
lea ecx, [ebx - 1]
push 0
push ecx
call fcn.10069df0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp ebx, 1
jne 0x1000e35a
mov esi, dword [edi + 0x10]
movzx ecx, byte [esi + 0x64]
movzx edx, byte [esi + 0x65]
movzx eax, byte [esi + 0x66]
shl ecx, 8
or ecx, edx
movzx edx, byte [esi + 0x67]
mov esi, dword [edi]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, edx
inc ecx
mov byte [esi + 0x1b], cl
mov eax, ecx
mov edx, ecx
shr eax, 0x18
mov byte [esi + 0x18], al
shr edx, 0x10
mov byte [esi + 0x19], dl
mov ebx, ecx
shr ebx, 8
mov byte [esi + 0x1a], bl
mov esi, dword [edi]
mov byte [esi + 0x5e], bl
mov ebx, dword [ebp - 0xc]
mov byte [esi + 0x5c], al
mov byte [esi + 0x5d], dl
mov byte [esi + 0x5f], cl
mov ecx, dword [edi]
mov esi, dword [ebp + 8]
mov dword [ecx + 0x60], 0x1de22d00
push dword [ebp - 0x14]
mov eax, dword [edi]
push dword [ebp - 0x18]
mov ecx, dword [esi + 0x80]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x3c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
mov ecx, dword [ebp - 8]
push ecx
push eax
call edx
add esp, 0x14
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x1000e3a1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x68], edx
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x6c], ecx
mov edx, dword [eax + 0x24]
mov dword [esi + 0x70], edx
cmp ebx, dword [esi + 0x20]
jbe 0x1000e3a9
mov dword [esi + 0x20], ebx
mov ebx, dword [esi + 0x58]
mov eax, dword [edi]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x1000e3ea
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x1000e3c6
cmp eax, 5
je 0x1000e3c6
cmp eax, 6
jne 0x1000e3e3
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebx + 0x10]
jae 0x1000e3e3
mov ecx, dword [ebp - 8]
push ecx
push eax
push ebx
call fcn.1001d660
add esp, 0xc
test eax, eax
je 0x1000e3e3
mov dword [ebx + 0x1c], eax
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
jne 0x1000e3b5
cmp dword [ebp - 4], 0
mov edi, dword [edi + 8]
je 0x1000e2bd
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f200
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x1002f21a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x50
call fcn.10004360
mov edi, eax
test edi, edi
je 0x1002f211
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
push eax
push ecx
push esi
call fcn.1002ed40
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.1002eec0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.1002eac0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.1002ed40
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.1002eac0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.1002ed40
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.1002f200
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.1002eac0
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.1002eac0
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
add esp, 0x20
and cx, dx
mov dword [edi + 0x24], eax
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edi
test edi, edi
jne 0x1003763e
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x10037654
cmp byte [edi], al
je 0x10037647
inc ecx
cmp byte [ecx], al
jne 0x10037642
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x10037755
jmp 0x10037673
mov edi, dword [ebp + 0xc]
cmp esi, 2
jge 0x1003767b
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100376db
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ecx]
test dl, dl
je 0x100376bd
jmp 0x100376a0
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x10072618]
cmp dl, byte [eax + 0x10072618]
jne 0x100376bd
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x100376a0
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x10072618]
movzx ecx, byte [ecx + 0x10072618]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x10037745
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
add esi, esi
mov esi, dword [eax + esi*8 + 0xc]
cmp dword [esi + 0x10], 0
je 0x10037728
xor eax, eax
mov edx, ebx
mov ecx, edi
test ebx, ebx
jle 0x1003771e
jmp 0x10037700
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10037700
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
xor edx, edx
div dword [esi + 4]
jmp 0x1003772a
xor edx, edx
push ebx
push edi
lea eax, [esi + 4]
call fcn.10007320
add esp, 8
test eax, eax
je 0x1003775c
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10037755
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x10]
jl 0x10037670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10037745
Function at 0x10037800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov ecx, eax
test eax, eax
jne 0x1003781d
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x10037835
cmp byte [eax], 0
je 0x10037828
inc ecx
cmp byte [ecx], 0
jne 0x10037822
sub ecx, eax
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 4]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x10037917
mov ecx, dword [edx + 8]
mov dword [ebp - 0x10], ecx
push edi
nop
mov ecx, eax
cmp eax, 2
jge 0x1003785a
xor ecx, 1
mov edx, dword [ebp + 0xc]
shl ecx, 4
add ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 0xc]
test edx, edx
je 0x100378aa
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x10037892
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x10072618]
cmp cl, byte [eax + 0x10072618]
jne 0x1003788f
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x10037872
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x10072618]
movzx edx, byte [edx + 0x10072618]
sub edx, ecx
jne 0x10037906
cmp dword [edi + 0x20], 0
lea esi, [edi + 0x14]
je 0x100378e4
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x100378de
mov edi, edi
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x100378c0
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi]
jmp 0x100378e6
xor edx, edx
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, esi
call fcn.10007320
add esp, 8
test eax, eax
je 0x1003791d
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x10037916
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x14]
jl 0x10037850
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
jmp 0x10037903
Function at 0x10037930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add eax, eax
push edi
mov edi, dword [edx + eax*8 + 0xc]
add edi, 0x14
mov dword [ebp - 8], edi
mov eax, esi
test esi, esi
je 0x10037965
cmp byte [esi], 0
je 0x1003795e
inc eax
cmp byte [eax], 0
jne 0x10037958
sub eax, esi
and eax, 0x3fffffff
cmp dword [edi], 0
mov dword [ebp - 4], eax
je 0x100379a9
mov edx, eax
xor eax, eax
mov ecx, esi
cmp edx, eax
jle 0x1003799e
jmp 0x10037980
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10037980
mov edi, dword [ebp - 8]
xor edx, edx
div dword [edi]
mov eax, dword [ebp - 4]
mov ebx, edx
jmp 0x100379ab
xor ebx, ebx
push eax
push esi
mov edx, ebx
mov eax, edi
call fcn.10007320
add esp, 8
test eax, eax
je 0x10037a1d
mov esi, dword [eax + 8]
mov edx, ebx
mov ecx, edi
call fcn.100073c0
test esi, esi
je 0x10037a1d
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x10]
cmp eax, esi
jne 0x100379df
mov eax, dword [esi + 0x20]
mov dword [ecx + 0x10], eax
jmp 0x100379f8
test eax, eax
je 0x100379f8
mov ecx, dword [eax + 0x20]
cmp ecx, esi
je 0x100379f2
mov eax, ecx
test eax, eax
jne 0x100379e3
jmp 0x100379f8
mov ecx, dword [esi + 0x20]
mov dword [eax + 0x20], ecx
mov edx, dword [esi + 0x1c]
mov edi, dword [ebp + 8]
push edx
push edi
call fcn.10004120
push esi
push edi
call fcn.10004120
add esp, 0x10
or dword [edi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
or dword [eax + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x10037d9f
mov esi, dword [ebp + 8]
test esi, esi
je 0x10037c17
cmp dword [esi + 0x1f8], 0
jne 0x10037c26
mov eax, 0xffff
add word [ebx + 0x20], ax
jne 0x10037d9f
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x10], edi
test edi, edi
je 0x10037cfb
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x14], ecx
test esi, esi
je 0x10037c4d
cmp dword [esi + 0x1f8], 0
jne 0x10037cd7
mov ecx, dword [edi]
mov eax, ecx
test ecx, ecx
jne 0x10037c5b
mov dword [esp + 0xc], ecx
jmp 0x10037c71
cmp byte [ecx], 0
je 0x10037c66
inc eax
cmp byte [eax], 0
jne 0x10037c60
sub eax, ecx
and eax, 0x3fffffff
mov dword [esp + 0xc], eax
mov esi, dword [edi + 0x24]
cmp dword [esi + 0x14], 0
je 0x10037cac
mov edx, dword [esp + 0xc]
xor eax, eax
cmp edx, eax
jle 0x10037ca3
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10037c84
mov edi, dword [esp + 0x10]
xor edx, edx
div dword [esi + 0x14]
mov ebx, edx
jmp 0x10037cae
xor ebx, ebx
mov edx, dword [esp + 0xc]
mov eax, dword [edi]
push edx
push eax
mov edx, ebx
lea eax, [esi + 0x14]
call fcn.10007320
add esp, 8
test eax, eax
je 0x10037cd1
mov edx, ebx
lea ecx, [esi + 0x14]
call fcn.100073c0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [edi + 0x1c]
push eax
push esi
call fcn.10004120
push edi
push esi
call fcn.10004120
mov edi, dword [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x10], edi
test edi, edi
jne 0x10037c35
push ebx
mov eax, esi
call fcn.10042c00
add esp, 4
push ebx
mov edi, esi
call fcn.10037b80
mov ecx, dword [ebx]
add esp, 4
push ecx
push esi
call fcn.10004120
mov edx, dword [ebx + 0x28]
push edx
push esi
call fcn.10004120
mov edi, dword [ebx + 0x1c]
add esp, 0x10
test edi, edi
je 0x10037d3f
push edi
push esi
call fcn.1004b0b0
push edi
push esi
call fcn.10004120
add esp, 0x10
mov eax, dword [ebx + 0x2c]
push eax
push esi
call fcn.1002e930
add esp, 8
test esi, esi
je 0x10037d59
cmp dword [esi + 0x1f8], 0
jne 0x10037d65
push 0
mov edi, ebx
call fcn.100588a0
add esp, 4
cmp dword [ebx + 0x3c], 0
je 0x10037d95
xor edi, edi
cmp dword [ebx + 0x38], edi
jle 0x10037d88
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx + edi*4]
push edx
push esi
call fcn.10004120
inc edi
add esp, 8
cmp edi, dword [ebx + 0x38]
jl 0x10037d72
mov eax, dword [ebx + 0x3c]
push eax
push esi
call fcn.10004120
add esp, 8
push ebx
push esi
call fcn.10004120
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add eax, dword [ecx + 8]
mov ecx, edi
test edi, edi
je 0x10037dde
cmp byte [edi], 0
je 0x10037dd6
nop
inc ecx
cmp byte [ecx], 0
jne 0x10037dd0
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, dword [eax + 0xc]
add ebx, 4
cmp dword [ebx], 0
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
je 0x10037e29
xor eax, eax
mov esi, ecx
mov edx, edi
cmp ecx, eax
jle 0x10037e1e
lea esp, [esp]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x10072618]
lea ebx, [eax*8]
xor ecx, ebx
dec esi
xor eax, ecx
inc edx
test esi, esi
jg 0x10037e00
mov ebx, dword [ebp - 8]
xor edx, edx
div dword [ebx]
mov ecx, dword [ebp - 4]
mov esi, edx
jmp 0x10037e2b
xor esi, esi
push ecx
push edi
mov edx, esi
mov eax, ebx
call fcn.10007320
add esp, 8
test eax, eax
je 0x10037e4b
mov edi, dword [eax + 8]
mov edx, esi
mov ecx, ebx
call fcn.100073c0
jmp 0x10037e4d
xor edi, edi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10037bf0
add esp, 8
or dword [esi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10054bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add eax, eax
mov ebx, dword [edx + eax*8 + 0xc]
add ebx, 0x24
push edi
mov dword [ebp - 8], ebx
mov eax, esi
test esi, esi
je 0x10054bf5
cmp byte [esi], 0
je 0x10054bee
inc eax
cmp byte [eax], 0
jne 0x10054be8
sub eax, esi
and eax, 0x3fffffff
cmp dword [ebx], 0
mov dword [ebp - 4], eax
je 0x10054c3a
mov edx, eax
xor eax, eax
mov ecx, esi
cmp edx, eax
jle 0x10054c2e
jmp 0x10054c10
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10054c10
mov ebx, dword [ebp - 8]
xor edx, edx
div dword [ebx]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edx
jmp 0x10054c41
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
push eax
push esi
mov eax, ebx
call fcn.10007320
add esp, 8
test eax, eax
je 0x10054d0a
mov edi, dword [eax + 8]
mov edx, dword [ebp - 8]
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.100073c0
test edi, edi
je 0x10054d0a
mov edx, dword [edi + 0x18]
cmp dword [edi + 0x14], edx
jne 0x10054cc0
mov ecx, dword [edi + 4]
mov eax, ecx
test ecx, ecx
je 0x10054c93
cmp byte [ecx], 0
je 0x10054c8c
inc eax
cmp byte [eax], 0
jne 0x10054c86
sub eax, ecx
and eax, 0x3fffffff
push ecx
add edx, 4
push edx
mov esi, eax
call fcn.10007410
mov ecx, dword [eax + 0x40]
add eax, 0x40
add esp, 8
cmp ecx, edi
je 0x10054cb9
lea esp, [esp]
lea eax, [ecx + 0x20]
mov ecx, dword [eax]
cmp ecx, edi
jne 0x10054cb0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [eax], edx
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 8]
push eax
mov ebx, esi
call fcn.10053df0
mov ecx, dword [edi]
add esp, 4
push ecx
push esi
call fcn.10004120
mov edx, dword [edi + 4]
push edx
push esi
call fcn.10004120
mov eax, dword [edi + 0xc]
push eax
push esi
call fcn.1002e930
mov edi, dword [edi + 0x10]
call fcn.1003aeb0
mov ecx, dword [ebp - 4]
push ecx
push esi
call fcn.10004120
add esp, 0x20
or dword [esi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065fcc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10065fd6
repz ret
jmp fcn.10066a81

Function at 0x1006981b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10067ff2
and dword [ebp - 0x14], 0
cmp dword [0x1007e6b8], 0
mov dword [ebp - 0x18], eax
jne 0x100698ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10069976
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10069976
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1007e6b8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1007e6bc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1007e6c0], eax
call edi
push eax
call esi
mov dword [0x1007e6c8], eax
test eax, eax
je 0x100698ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1007e6c4], eax
mov eax, dword [0x1007e6c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10069927
cmp dword [0x1007e6c8], ecx
je 0x10069927
push eax
call esi
push dword [0x1007e6c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10069927
test ebx, ebx
je 0x10069927
call edi
test eax, eax
je 0x1006991e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1006991e
test byte [ebp - 8], 1
jne 0x10069927
or dword [ebp + 0x10], 0x200000
jmp 0x1006995a
mov eax, dword [0x1007e6bc]
cmp eax, dword [ebp - 0x18]
je 0x1006995a
push eax
call esi
test eax, eax
je 0x1006995a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1006995a
mov eax, dword [0x1007e6c0]
cmp eax, dword [ebp - 0x18]
je 0x1006995a
push eax
call esi
test eax, eax
je 0x1006995a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1007e6b8]
call esi
test eax, eax
je 0x10069976
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10069978
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10065fcc
leave
ret
Function at 0x40d588
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d3c
mov dword [ebp - 0x14], eax
cmp dword [0x4b2e58], esi
jne 0x40d67b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d608
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d75b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d75b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d75b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b2e58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b2e5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b2e60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b2e68], eax
test eax, eax
je 0x40d678
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b2e64], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6a0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d693
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push 4
pop eax
jmp 0x40d75d
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push dword [0x4b2e58]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d69a
mov eax, dword [0x4b2e64]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d713
cmp dword [0x4b2e68], edi
je 0x40d713
push eax
call ebx
push dword [0x4b2e68]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d713
test eax, eax
je 0x40d713
call ecx
test eax, eax
je 0x40d708
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d708
test byte [ebp - 8], 1
jne 0x40d713
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d743
mov eax, dword [0x4b2e5c]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
call eax
mov esi, eax
test esi, esi
je 0x40d740
mov eax, dword [0x4b2e60]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b2e58]
call ebx
test eax, eax
je 0x40d75b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d75d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040f0
mov esp, ebp
pop ebp
ret
Function at 0x10020004
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10020013
pop dword [ebp - 0xc]
mov eax, 0xb9f9524b
sub eax, 0xa9f75238
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd2f224e
add dword [ebp - 0x1c], 0x412322fd
mov dword [ebp - 0x18], 0xacb56342
sub dword [ebp - 0x18], 0x7a8216fd
mov dword [ebp - 0x14], 0x8b33d2c2
add dword [ebp - 0x14], 0xc118716c
mov dword [ebp - 0x10], 0xc6deec38
sub dword [ebp - 0x10], 0xc6deec38
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc86e0245
sub dword [ebp - 0x1c], 0x53fb98ef
mov dword [ebp - 0x18], 0xd80d3702
sub dword [ebp - 0x18], 0x96a0d58d
mov dword [ebp - 0x14], 0xb967f751
add dword [ebp - 0x14], 0xaa07751b
mov dword [ebp - 0x10], 0xd1b761fc
sub dword [ebp - 0x10], 0xd1b761fc
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xd5f3a169
add eax, 0x3a0f3eff
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x44a13
push 0
call eax
mov ecx, 0xd4127429
add ecx, 0x2bedd1da
xor ebx, ebx
add ebx, eax
mov edx, 0x9b52c91c
sub edx, 0x8b4e671c
add edx, dword [ebp - 0xc]
mov edi, 0x66c3f5d5
xor dword [ebp - 8], 0xaa1288b6
mov esi, dword [edx]
add dword [ebp - 4], 0x72532dc0
sub esi, edi
mov dword [ebx], esi
add ebx, 0x55672af8
sub ebx, 0x55672af4
add edx, 0x74cbfe1
add edx, 0xf8b34023
loop 0x1002012c
add eax, 0x3b624dd6
sub eax, 0x3b6142f7
mov ebx, eax
add eax, 0xe6c81955
add eax, 0x1937e6b0
mov ecx, 0xb9f4face
add ecx, 0x560b0532
add ecx, dword [ebp - 0xc]
call ebx
leave
ret