joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3cf8160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.03cf82b0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x3cf8186
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3cf8172
add dl, dl
jne 0x3cf8191
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3cf81e4
xor eax, eax
add dl, dl
jne 0x3cf819e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3cf8285
add dl, dl
jne 0x3cf81ad
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3cf81b8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3cf81c3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3cf81ce
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x3cf81da
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x3cf817d
mov eax, 1
add dl, dl
jne 0x3cf81f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3cf81fd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3cf81e9
sub eax, ebx
mov ebx, 1
jne 0x3cf8230
mov ecx, 1
add dl, dl
jne 0x3cf8216
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3cf8221
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3cf820d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3cf817d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x3cf8247
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3cf8252
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3cf823e
cmp eax, 0x7d00
jae 0x3cf8275
cmp eax, 0x500
jb 0x3cf8270
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3cf817d
cmp eax, 0x7f
ja 0x3cf8278
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3cf817d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x3cf82a6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x3cf817d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x402255
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov eax, 0x412140
call fcn.00411c00
sub esp, 0x25c
push ebx
push esi
push edi
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.00402b62
and dword [ebp - 4], 0
push 0x418080
lea ecx, [ebp - 0x18]
call fcn.00402bc3
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40233c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401544
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.004015e1
lea eax, [ebp - 0x23c]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402bc3
test byte [ebp - 0x268], 0x10
je 0x402307
lea eax, [ebp - 0x23c]
push 0x41807c
push eax
call ebx
test eax, eax
je 0x40231f
lea eax, [ebp - 0x23c]
push 0x418074
push eax
call ebx
test eax, eax
je 0x40231f
push dword [ebp - 0x18]
call fcn.00402255
pop ecx
jmp 0x40231b
push 0
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x402359
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402359
lea eax, [ebp - 0x268]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4022ab
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push dword [ebp + 8]
call esi
test eax, eax
je 0x402359
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x402359
push 1
pop esi
jmp 0x40235b
xor esi, esi
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x402379
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [0x419228], 0
push esi
jne 0x402393
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402398
push 1
pop eax
pop esi
ret
test al, 0x10
jne 0x4023b6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4023b2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
xor eax, eax
pop esi
ret
push esi
call fcn.00402255
pop ecx
pop esi
ret

Function at 0x402cea
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x402d25
Function at 0x402fa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00402caa
outsb dx, byte [esi]
mov dh, 0x35
add al, 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x40330c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40335e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
push eax
add al, 0x8d
dec eax
or byte [ebx], al
ror byte [ecx - 0x35c4f7b3], 1
jae 0x403359
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x403343
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40334b
cmp edx, ebx
jne 0x403499
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40331a
add eax, dword [eax + 4]
jmp 0x403307
mov dword [ebp + 0xc], ebx
jmp 0x403369
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x403381
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40339f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4033fd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4033e4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4033ed
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4033f7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4033d9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x403363
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x40652b
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
mov edi, 0x4b6
push eax
mov esi, ecx
push edi
call fcn.00405f05
mov eax, dword [ebp - 4]
push 1
sub eax, dword [ebp - 0xc]
push edi
mov ecx, esi
inc eax
inc eax
mov dword [esi + 0x40], eax
call fcn.00405f6e
inc edi
push 1
push edi
mov ecx, esi
call fcn.00405f6e
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
lea eax, [ebp - 0x4d0]
push 0x2b4
push eax
lea eax, [ebp - 0x21c]
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
push edi
push dword [esi + 4]
mov dword [esi + 0x38], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x4066cd
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x3c], eax
call fcn.00405d28
pop edi
pop esi
leave
ret

Function at 0x407763
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 4]
test edx, edx
jbe 0x407790
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x419360]
xor eax, esi
inc ecx
dec edx
jne 0x407771
pop edi
pop esi
ret 4

Function at 0x40d7b4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x412e5b
call fcn.00411c00
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4145a0
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4145c8
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040f4e2
push dword [esi + 8]
mov ecx, ebx
call fcn.0040f4e2
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f4e2
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f4e2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x44a380
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.GetFirmwareEnvironmentVariableA
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a3c9
mov ecx, dword [0x4cf9f4]
push 0x4cf6fc
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test ebx, ebx
je 0x44a3ef
push 0
push 0
push str.4E1E14B9_502C_14f9_B714_0DA320D30E8E
push 0x4d03d4
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
pop edi
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
pop ecx
ret
pop edi
mov al, bl
pop esi
pop ebx
pop ecx
ret

Function at 0x4c51d2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cc5a8
cmp edx, dword [eax]
je 0x4c51f4
add eax, 8
inc ecx
cmp eax, 0x4cc638
jl 0x4c51e5
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cc5a8]
jne 0x4c5322
mov eax, dword [0x4d0c80]
cmp eax, 1
je 0x4c52fc
test eax, eax
jne 0x4c5225
cmp dword [0x4cc4ec], 1
je 0x4c52fc
cmp edx, 0xfc
je 0x4c5322
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c525c
lea eax, [ebp - 0x1a4]
push 0x4c97e4
push eax
call fcn.004c58f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c5b20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c529f
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c5b20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c97e0
push edi
call fcn.004c72f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c97c4
push eax
call fcn.004c58f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c5900
lea eax, [ebp - 0xa0]
push 0x4c97c0
push eax
call fcn.004c5900
push dword [esi + 0x4cc5ac]
dec esp
add byte [ebp - 0x9f7b], cl
call dword [eax - 0x18]
and byte [esi], al
add byte [eax], al
lea eax, [ebp + 8]
lea esi, [esi + 0x4cc5ac]
push 0
push eax
push dword [esi]
call fcn.004c5b20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg eax
add esi, 0xd5
add edx, 0xac
rcl eax, 0x47
inc esi
add ebx, 0xe2
neg edi
inc esi
ror edi, 0xe6
bswap esi
imul esi
rol esi, 0x46
bswap esi
inc edx
add esi, 0x9b
bswap ebx
mov ebx, 0xe1
rcl eax, 0xe0
mov edi, 0x98
bswap edx
sbb edx, 0x8b
ror esi, 0xd6
ror ebx, 8
sbb eax, 0xc6
mov esi, 0xc0
dec edx
not esi
neg esi
mov edx, 0x10
not edi
rol ebx, 0xee
sbb edx, 0x14
mov ebx, 0xb2
dec esi
neg eax
dec edi
imul edx
ror edi, 0xdf
inc ebx
ror edx, 0x85
rol edx, 0xd1
not ebx
or esi, 0x12
or esi, 0x83
or eax, 0xa5
not esi
not ebx
dec eax
mov eax, 0x10
rol edi, 0x90
xor ecx, ecx
xor edi, edi
bswap edx
sbb esi, 0x8d
and eax, 0xc7
add esi, 0x1c
mov edi, 0xab
rcr edx, 0x73
bswap eax
ror ebx, 0xd8
rcl edx, 0xcd
sbb edx, 0xf1
imul ebx
not esi
inc ebx
inc esi
sbb edi, 0x92
sub eax, 0xc0
sbb ebx, 0x48
inc ebx
add eax, 1
neg edi
rcl ebx, 0x57
or eax, 0xa0
ror esi, 0x8f
mov edi, 0x25
neg edi
inc edi
sub edx, 0xed
bswap edx
dec eax
and esi, 5
imul edx
neg eax
not ebx
rcr eax, 0xef
bswap ebx
imul edx
ror ebx, 0x51
sbb ebx, 0x6d
rcr esi, 0x95
bswap ebx
rcr edx, 0x9f
not edi
not ebx
dec edx
neg edx
bswap esi
or esi, 0x79
and ebx, 0xec
sub edi, 0x41
rcl eax, 0xdf
mov ecx, dword [ebp + 0xc]
neg edx
ror esi, 0xc
neg edi
not edi
add esi, 0x13
dec edi
dec ebx
add edx, 0x34
mov edi, 0x9a
imul edi
sbb edi, 0xcd
sub edx, 0x87
rcr eax, 0x8c
not eax
inc eax
sbb ebx, 0xcc
not esi
imul eax
or ebx, 0xe7
dec eax
rol edi, 1
mov edx, 0x53
sbb edx, 0xb0
dec edx
ror edx, 0x17
ror esi, 0xd6
bswap edx
inc edi
dec ebx
add eax, 0x9e
inc edi
dec ebx
rcr esi, 0xb1
and edx, 0xb2
bswap ebx
rol esi, 5
not esi
rcr edi, 0x68
sbb edx, 0x69
sub ebx, 7
inc ebx
dec edx
inc esi
rcl ebx, 0x59
or eax, 0x57
neg eax
imul edx
mov eax, 0x25
rcr ebx, 0x37
or edx, 0x63
mov edi, dword [ebp + 8]
xor eax, esi
mov eax, ebx
mov eax, ebx
not byte [edi]
xor eax, ebx
mov esi, eax
mov eax, eax
xor ebx, esi
mov eax, eax
xor esi, esi
mov eax, esi
xor eax, ebx
xor eax, ebx
add byte [edi], 0x79
mov eax, ebx
xor esi, esi
xor eax, eax
xor eax, ebx
xor ebx, ebx
mov ebx, ebx
xor ebx, ebx
mov eax, ebx
xor esi, ebx
sub byte [edi], 0x30
mov eax, eax
mov esi, eax
mov ebx, esi
xor eax, eax
xor esi, esi
mov esi, esi
mov ebx, eax
mov ebx, esi
mov ebx, ebx
imul byte [edi]
inc edi
loop 0x4013ec
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f95
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434a00]
jne 0x404f9f
repz ret
jmp fcn.00407330
Function at 0x405605
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043b5
and dword [ebp - 4], 0
cmp dword [0x435b90], 0
mov ebx, eax
jne 0x4056b6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405767
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405767
push eax
call fcn.00404343
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435b90], eax
call esi
push eax
call fcn.00404343
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435b94], eax
call esi
push eax
call fcn.00404343
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435b98], eax
call esi
push eax
call fcn.00404343
pop ecx
mov dword [0x435ba0], eax
test eax, eax
je 0x4056b6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404343
pop ecx
mov dword [0x435b9c], eax
mov eax, dword [0x435b9c]
cmp eax, ebx
je 0x40570e
cmp dword [0x435ba0], ebx
je 0x40570e
push eax
call fcn.004043be
push dword [0x435ba0]
mov esi, eax
call fcn.004043be
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40570e
test edi, edi
je 0x40570e
call esi
test eax, eax
je 0x405705
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405705
test byte [ebp - 0xc], 1
jne 0x40570e
or dword [ebp + 0x10], 0x200000
jmp 0x405747
mov eax, dword [0x435b94]
cmp eax, ebx
je 0x405747
push eax
call fcn.004043be
pop ecx
test eax, eax
je 0x405747
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405747
mov eax, dword [0x435b98]
cmp eax, ebx
je 0x405747
push eax
call fcn.004043be
pop ecx
test eax, eax
je 0x405747
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435b90]
call fcn.004043be
pop ecx
test eax, eax
je 0x405767
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405769
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dh, 0x8b
jne 0x406755
push edi
invalid
add byte [edi + 0x52], dl
mov dword [esi + 3], eax
mov dword [esi + 0xc], ecx
call 0x120e453
mov eax, dword [esi + 0x14]
push 0
push edi
push eax
call 0x4157d0
sbb ecx, 0x18
pop edi
pop esi
pop ebp
xor al, 0x90
nop
dec eax
nop
out 0x6b, al
nop
nop
nop
nop
and ecx, dword [ebx + 0x5d8b53ec]
or al, 0x56
push edi
push 0x50
push ebx
call int.00404a60
mov ebx, dword [eax + ecx - 0x75]
clc
loope 0x406758
mov edx, edi
dec eax
adc al, 0
scasb al, byte es:[edi]
add byte [edx + 0x38], ch
sub ebp, dword [ebx + 0x56891689]
inc byte [esi]
mov ecx, dword [eax]
push ecx
call int.00404a60
mov ecx, dword [ebx + 0x33]
ror byte [ebx + 0xe3dd7], 0x62
add bl, dh
aas
mov ebx, esi
push 0x38
mov byte [0xc18b1050], al
mov edx, dword [ecx + 0x10]
aaa
sbb cl, byte [ebx + 0x51088b06]
call 0xff514a60
mov edi, eax
xor eax, eax
mov eax, dword [ebp + 0xb0c0ecd]
add bl, dh
stosd dword es:[edi], eax
out 6, al
push 0
push ebx
push 1
mov dword [eax + 0x4b], edx
mov ecx, dword [esi]
mov edx, dword [ecx + 0x14]
mov dword [edx], ebx
out 6, eax
and byte [eax + 0x34], al
add dword [eax], eax
pushfd
add byte [esi + 0x48c16662], ch
push ecx
sub al, 8
clc
push es
call [edi + 0x5e]
pop ebx
pop ebp
ret
Function at 0x4085e0
Capabilities:
Encode data using xor

Disassembly:
mov ebp, esp
xor al, 0x45
sbb al, 0x8b
imul ebx, dword [eax], 0xffffff8b
pop edi
pop ds
push eax
mov eax, dword [ebp + 0x10]
add byte [eax], 0x51
cmp al, 0x69
or al, 0x52
mov edx, dword [ebp - 0x1d]
push eax
push ecx
push edx
call fcn.00407ef0
add esp, 0x1c
pop ebp
ret
push ebp
mov ebp, esp
push ebx
mov edi, 0xc7c8b57
mov esi, 0x1c7101
mov ecx, edi
mov esp, dword [eax - 0x3d4344ec]
pop ebx
add byte [ebp - 0x1a], dl
mov bh, byte [esi]
adc byte [edx + 0x70], al
push edi
mov edi, dword [esp + ecx - 0x42]
add dword [ecx + 0x1c], esi
add byte [ebx + 0x14a08bcf], cl
mov ebx, 0x5bc2bc
push ebp
out 0x8a, al
adc byte ds:[edx + 0x70], al
stc
pop eax
je 0x4085b7
mov ebx, 0x40b9a8
mov edx, dword [ebp + 8]
ret
add byte [ebx - 0x313cf7ab], cl
dec eax
and ecx, dword [edi + eax*8 + 0x888190c]
mov ecx, edi
jnp 0x408561
test edx, edx
jne 0x408617
mov ecx, dword [ebp + 0x14]
std
push ebp
shr byte [ebx], cl
enter 0x5e5f, 0xffffffffffffff89
or ah, cl
and ebx, eax
nop
add eax, 0x8b559002
in al, dx
mov ecx, dword [ebp - 0xd]
stc
push esi
mov al, byte [ebp - 0xf]
push edi
in eax, dx
add dword [eax], esp
add byte [eax], al
mov edi, dword [esi]
sbb byte [ebx + 0x409ee4], bh
shl edi, cl
dec edi
cmp al, 1
mov esp, 0xc2d0bb05
inc eax
add byte [ebx + 0x458b0c55], cl
or byte [ebp + 0x72ec77d2], al
loope 0x408595
clc
push dword [edi + 0x1b]
mov edx, dword [ebp + 0x36]
push edx
push ebp
push edx
cmp dword [ebp + 0x18], edx
in al, dx
mov esi, ebp
adc al, 0x52
push ecx
push eax
call 0x3feae6
sub dword [edi], 0x14
mov byte [0xc32d5b5e], al
mov ecx, eax
dec esi
and ecx, edi
mov cl, byte [ecx + ebx]
mov byte [esi - 0x17ef1475], cl
xchg ecx, eax
xor dh, byte [esi]
stosb byte es:[edi], al
mov ecx, eax
or edx, ecx
jne 0x408631
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0x53]
sub ecx, dword [ecx + 0x5f]
mov dword [edx], eax
adc eax, esi
and bl, byte [ebx + 0x5d]
xor al, 0x90
nop
nop
push esi
xchg ecx, eax
nop
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test byte [ebp - 0x7d], dl
push ecx
mov eax, dword [eax]
pushfd
push 0x78
push 4
push eax
call 0xdc408650
aaa
les ecx, [esi + 0x5d]
ret
Function at 0x40a9a0
Capabilities:
Encode data using xor

Disassembly:
inc eax
add byte [ebx], al
ror byte [ecx + 0x5e037506], 0x5d
ret
push ebp
mov ebp, esp
sub esp, 0x14
div dword [edi + edx*2]
mov edi, dword [ebp + 0xc]
adc eax, 0x89d26217
movsd dword es:[edi], dword [esi]
sbb al, 0x75
push cs
aaa
pop esi
aas
rcr byte [ebx - 0x75], 0xe5
pop ebp
xor al, 0x10
add byte [ebx + 0x4d9ff855], cl
adc al, 0x83
cmp dword [eax], eax
je 0x40a9b5
or dword [ebx], 8
shr byte [eax + 6], 0x46
test dl, bh
mov dword [ebp - 0x7b], esi
js 0x40a9f3
je 0x40a965
add byte [ebx + 0x11894a11], cl
retf
mov ecx, eax
xor dword [ebx + 0x43], 0xfc0f980
test dword [edi + 0x5d000000], eax
mov edi, 0xea0000e0
mov ecx, eax
mov dword [eax + esi*8], edx
and ecx, edi
xor ebx, ebx
mov esi, 1
xor edx, edx
cmp ecx, edi
mov ebx, eax
cld
mov dword [eax], ebx
out dx, eax
mov edi, 0xa5d32634
xor byte [ebx - 0x462cda38], cl
xlatb
add byte [eax], al
add al, ch
fimul dword [0xf80b6100]
cmc
fiadd dword [esi - 0x7d]
inc byte [ebx]
sub dword [0x164877fc], esp
inc ebp
in al, dx
mov edx, ecx
invalid
Function at 0x414660
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41468d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41468d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret