joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f900
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x47fa17
mov eax, dword [0x4d4a80]
test eax, eax
je 0x47fa08
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x47f9f9
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x47f9d0
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0047f5b0
cmp eax, 7
jne 0x47fa2c
mov eax, dword [0x4d4a80]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x47f9c0
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x47f9ad
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x47f990
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov ecx, dword [edx + 4]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
sub esp, 8
test eax, eax
jne 0x47f97e
call fcn.00471630
jmp 0x47f97e
call fcn.0047f0d0
mov eax, dword [0x4d4a80]
jmp 0x47f974
call fcn.0047ee10
mov eax, dword [0x4d4a80]
jmp 0x47f96d
mov ebx, dword [eax + 0x28]
call fcn.00471630
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.DLL_TlsGetValue
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov eax, ebx
jmp 0x47f943
call fcn.0047f0d0
mov eax, dword [0x4d4a80]
jmp 0x47f935
call fcn.0047ee10
mov eax, dword [0x4d4a80]
jmp 0x47f92a
mov dword [esp], edi
call fcn.0047f410
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.msvcrt.dll_abort
jmp fcn.0047fa40
Function at 0x4a8140
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x18]
sub esp, 0x78
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], 0x473640
mov dword [ebp - 0x38], 0x4b6348
mov dword [ebp - 0x30], 0x4a82da
mov dword [ebp - 0x2c], esp
mov dword [esp], eax
call fcn.0047f180
mov edx, dword [0x4b96b4]
test edx, edx
je 0x4a82b2
cmp dword [ebp + 8], 0x80
ja 0x4a8198
mov eax, dword [0x4b96b4]
test eax, eax
jle 0x4a81c8
mov dword [ebp - 0x50], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call fcn.00475ba0
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x54]
mov dword [esp], eax
call fcn.0047f230
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
add eax, 7
mov dword [ebp - 0x5c], eax
shr eax, 3
lea eax, [eax*4 - 4]
mov dword [ebp - 0x60], eax
mov eax, dword [0x4b96c0]
test eax, eax
je 0x4a829a
mov eax, dword [0x4b9690]
test eax, eax
jne 0x4a8282
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx + 0x4d48b0]
test edx, edx
je 0x4a8267
mov eax, dword [edx]
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 0x4d48b0], eax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4a8259
mov eax, dword [0x4b96c0]
test eax, eax
je 0x4a8244
mov eax, dword [0x4b9690]
test eax, eax
je 0x4a81ad
mov dword [esp], 0x4b96cc
mov dword [ebp - 0x50], 0xffffffff
call fcn.0047fe90
jmp 0x4a81ad
mov dword [esp], 0x4b96c0
mov dword [ebp - 0x50], 0xffffffff
call fcn.004a2c00
jmp 0x4a8223
mov dword [ebp - 0x50], 1
call fcn.00477070
jmp 0x4a821a
and dword [ebp - 0x5c], 0xfffffff8
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call fcn.004a8340
mov dword [ebp - 0x58], eax
jmp 0x4a8213
mov dword [esp], 0x4b96cc
mov dword [ebp - 0x50], 0xffffffff
call fcn.0047fe30
jmp 0x4a81f8
mov dword [esp], 0x4b96c0
mov dword [ebp - 0x50], 0xffffffff
call fcn.004a2c00
jmp 0x4a81eb
mov dword [esp], 0x475d80
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a82d3
mov eax, 1
lock add dword [0x4b96b4], eax
jmp 0x4a8186
mov eax, 0xffffffff
jmp 0x4a82c7
Function at 0x4a2c25
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4b1800
call fcn.004a6f80
call fcn.004a6c51
movzx esi, ax
push 2
call fcn.004a6a51
pop ecx
mov eax, 0x5a4d
cmp word [sym.imp.wtsapi32.dll_WTSVirtualChannelOpen], ax
je 0x4a2adc
xor ebx, ebx
jmp 0x4a2b0f
mov eax, dword [0x40003c]
cmp dword [eax + sym.imp.wtsapi32.dll_WTSVirtualChannelOpen], 0x4550
jne 0x4a2ad8
mov ecx, 0x10b
cmp word [eax + sym.imp.wtsapi32.dll_WTSQueryUserToken], cx
jne 0x4a2ad8
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4a2b0f
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004a6473
or eax, eax
jne 0x4a2b23
push 0x1c
call fcn.004a2bfe
pop ecx
call fcn.004a5ed6
or eax, eax
jne 0x4a2b34
push 0x10
call fcn.004a2bfe
pop ecx
call fcn.004a6b38
and dword [ebp - 4], 0
call fcn.004a6488
or eax, eax
jns 0x4a2b4e
push 0x1b
call fcn.004a2bfe
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5c1d30], eax
call fcn.004a6b78
mov dword [0x5bc4c8], eax
call fcn.004a6736
or eax, eax
jns 0x4a2b74
push 8
call fcn.004a5fb1
pop ecx
call fcn.004a696f
or eax, eax
jns 0x4a2b85
push 9
call fcn.004a5fb1
pop ecx
push 1
call fcn.004a5feb
pop ecx
or eax, eax
je 0x4a2b98
push eax
call fcn.004a5fb1
pop ecx
call fcn.004a6f28
push esi
push eax
push 0
push sym.imp.wtsapi32.dll_WTSVirtualChannelOpen
call main
push eax
pop esi
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x4a2bba
push esi
call fcn.004a6247
call fcn.004a5fdc
jmp 0x4a2bef
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.004a6fc5
ret
call fcn.004a6a9e
jmp 0x4a2aae
Function at 0x4afc40
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
sub esi, esi
push 1
push esi
push esi
push edi
push esi
pop ebx
mov dword [ebp - 8], esi
call fcn.004accbb
mov ecx, edx
mov dword [ebp - 0x18], eax
and eax, ecx
add esp, 0x10
mov dword [ebp - 0x14], ecx
cmp eax, 0xffffffff
je 0x4afcc8
push 2
push esi
push esi
push edi
call fcn.004accbb
push eax
pop ecx
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4afcc8
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub esi, ecx
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4afd5f
jg 0x4afca2
or esi, esi
je 0x4afd5f
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x4afcd4
call fcn.004a7784
mov dword [eax], 0xc
call fcn.004a7784
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push edi
call fcn.004afe1e
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
pop ecx
or eax, eax
jl 0x4afcfc
jg 0x4afcf5
cmp esi, 0x1000
jb 0x4afcfc
mov eax, 0x1000
jmp 0x4afcfe
mov eax, esi
push eax
push dword [ebp - 0xc]
push edi
call fcn.004ac0c8
add esp, 0xc
cmp eax, 0xffffffff
je 0x4afd25
cdq
sub esi, eax
mov eax, dword [ebp - 4]
sbb eax, edx
mov dword [ebp - 4], eax
js 0x4afd40
jg 0x4afce7
or esi, esi
je 0x4afd40
jmp 0x4afce7
call fcn.004a7750
cmp dword [eax], 5
jne 0x4afd3a
call fcn.004a7784
mov dword [eax], 0xd
or ebx, 0xffffffff
or dword [ebp - 8], ebx
push dword [ebp - 0x10]
push edi
call fcn.004afe1e
pop ecx
pop ecx
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4afdc5
or eax, eax
jg 0x4afdd1
jl 0x4afd69
or esi, esi
jae 0x4afdd1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004accbb
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4afcc8
push edi
call fcn.004af84a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov ebx, eax
mov eax, edx
push ebx
pop ecx
and ecx, eax
mov dword [ebp - 8], eax
cmp ecx, 0xffffffff
jne 0x4afdd1
call fcn.004a7784
mov dword [eax], 0xd
call fcn.004a7750
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
and ebx, dword [ebp - 8]
cmp ebx, 0xffffffff
je 0x4afcc8
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call fcn.004accbb
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x4afcc8
sub eax, eax
jmp 0x4afccf

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401819
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401858
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401858
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401858
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401858
cmp dword [ecx + 0x74], 0xe
jbe 0x401858
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4028ad
Capabilities:
Delete directory
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call reloc.KERNEL32.dll_InterlockedIncrement
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0xc530d4], 0x594
push edi
mov dword [ebp - 8], eax
jne 0x4028e4
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x80e078]
mov dword [ebp - 0x28], eax
mov eax, dword [0x80e07c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.004028a6
mov eax, dword [0x80e080]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x80e084]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0xc530d4], 0xc
mov dword [ebp - 4], eax
jne 0x402967
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0xc530d4]
cmp eax, 0xfa9
jne 0x402983
mov dword [0xc530d0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402990
mov dword [0xc2c270], esi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ebx
shr edx, cl
lea eax, [edi + ebx]
mov dword [ebp - 0x14], eax
mov dword [0xc530cc], 0xf4ea3dee
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0xc530d4], 0x213
mov dword [ebp - 0x14], edx
jne 0x4029d1
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0xc530d4], 0xc
jne 0x402a24
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push esi
lea eax, [ebp - 0x830]
push eax
push 0x402648
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
lea eax, [ebp - 0x1030]
push eax
push 0x4026a0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea eax, [edi + edx]
xor dword [ebp - 4], eax
mov edi, edx
shr edi, cl
add edi, dword [ebp - 0x24]
cmp dword [0xc530d4], 0x121
jne 0x402a62
push 0x4026c8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edx, dword [ebp - 8]
xor dword [ebp - 4], edi
sub ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0040289f
dec dword [ebp - 0x18]
jne 0x40291d
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ebx
leave
ret 4
Function at 0x402a88
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc530d4]
mov ecx, dword [0xc2c274]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402b61
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0xc530d4], 0x959
jne 0x402b4f
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.004028ad
add edi, 8
dec ebx
jne 0x402ab0
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403bc0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80d0c8]
jne 0x403bca
repz ret
jmp fcn.00406afe

Function at 0x406724
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040495f
and dword [ebp - 4], 0
cmp dword [0x80ecac], 0
mov ebx, eax
jne 0x4067d5
push 0x401a28
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406886
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a1c
push edi
call esi
test eax, eax
je 0x406886
push eax
call fcn.004048ed
mov dword [esp], 0x401a0c
push edi
mov dword [0x80ecac], eax
call esi
push eax
call fcn.004048ed
mov dword [esp], 0x4019f8
push edi
mov dword [0x80ecb0], eax
call esi
push eax
call fcn.004048ed
mov dword [esp], 0x4019dc
push edi
mov dword [0x80ecb4], eax
call esi
push eax
call fcn.004048ed
pop ecx
mov dword [0x80ecbc], eax
test eax, eax
je 0x4067d5
push 0x4019c4
push edi
call esi
push eax
call fcn.004048ed
pop ecx
mov dword [0x80ecb8], eax
mov eax, dword [0x80ecb8]
cmp eax, ebx
je 0x40682d
cmp dword [0x80ecbc], ebx
je 0x40682d
push eax
call fcn.00404968
push dword [0x80ecbc]
mov esi, eax
call fcn.00404968
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40682d
test edi, edi
je 0x40682d
call esi
test eax, eax
je 0x406824
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406824
test byte [ebp - 0xc], 1
jne 0x40682d
or dword [ebp + 0x10], 0x200000
jmp 0x406866
mov eax, dword [0x80ecb0]
cmp eax, ebx
je 0x406866
push eax
call fcn.00404968
pop ecx
test eax, eax
je 0x406866
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406866
mov eax, dword [0x80ecb4]
cmp eax, ebx
je 0x406866
push eax
call fcn.00404968
pop ecx
test eax, eax
je 0x406866
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80ecac]
call fcn.00404968
pop ecx
test eax, eax
je 0x406886
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406888
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401240
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcr edi, 0xb3
rcr ebx, 0xeb
inc ebx
bswap eax
rol edi, 0x27
mov edi, 0x9a
add edx, 0x1e
imul ebx
bswap edi
sbb eax, 0x9e
dec edx
rcr esi, 0x74
neg edx
imul ebx
neg ebx
inc eax
imul edx
imul edi
imul edx
dec edx
rol eax, 0x96
rol edx, 0x16
and ebx, 0x50
sub edi, 0x5b
sbb esi, 0x31
rcr edx, 0x52
rol ebx, 0xf7
rcr ebx, 0x6f
bswap esi
sub eax, 0xe2
rcr esi, 0xa3
add edx, 0x12
sub esi, 0x87
rol edx, 0xb2
mov eax, 0x1b
imul esi
dec ebx
sbb esi, 0x35
imul edi
and eax, 0x4a
or esi, 0xee
rcr eax, 0xcf
add ebx, 0x48
dec ebx
imul esi
add eax, 0x7b
bswap edi
and edi, 0xbd
rol eax, 0x84
sub eax, 0xa8
xor ecx, ecx
xor edi, edi
or edi, 0xed
add esi, 0x81
sbb edi, 0xab
rcr esi, 0x41
inc esi
and ebx, 0x57
neg ebx
or esi, 8
neg ebx
rol edi, 0xae
neg eax
sub eax, 0xe5
neg ebx
not edx
rcl esi, 0xcf
sub ebx, 0xdf
dec edi
mov eax, 0xb8
sbb ebx, 0xfa
dec esi
mov ebx, 0xb9
rol esi, 0x60
ror ebx, 0xc2
bswap esi
or ebx, 0x59
mov esi, 0xc9
sub edi, 0x14
imul esi
rcr eax, 0xcd
inc eax
mov edx, 0x46
imul edx
and ebx, 0xf1
and esi, 0xa0
ror ebx, 0x56
rcl eax, 0x76
sbb esi, 0xb5
ror ebx, 0xf7
or ebx, 0x5e
not eax
imul edi
sbb edi, 0x2f
mov edi, 0x6a
not ebx
neg eax
and edi, 0x61
rcr ebx, 0xa
imul esi
inc eax
inc edx
mov ecx, dword [ebp + 0xc]
bswap ebx
and esi, 0x43
rol esi, 0xa4
not edi
inc ebx
neg ebx
rol ebx, 0x1f
bswap esi
sub edx, 0x89
mov esi, 0x2f
neg edx
inc edi
rol edx, 0xd9
neg ebx
dec ebx
sbb edx, 0xf4
rcl ebx, 0x1a
not eax
inc edi
add edi, 0x73
imul edi
sbb ebx, 0x48
or ebx, 0x68
mov edx, 4
bswap esi
rcr edi, 0xe7
sub esi, 0x47
bswap edx
sbb eax, 0xa0
dec ebx
rcl esi, 0x85
mov ebx, 0xa2
bswap edx
rcr eax, 0x5c
ror eax, 4
inc edx
imul ebx
mov edi, 0xc
and esi, 0x5a
inc edx
not edi
or edi, 0xa0
imul edx
mov edi, 0x76
dec ebx
rol esi, 0x3b
mov edi, 0x81
and ebx, 0x12
ror esi, 0x4a
add edi, 0xe8
mov edi, dword [ebp + 8]
mov ebx, esi
mov ebx, eax
mov ebx, ebx
not byte [edi]
xor eax, esi
mov esi, ebx
xor esi, eax
mov esi, eax
xor esi, ebx
mov eax, esi
xor eax, esi
mov ebx, esi
mov ebx, ebx
add byte [edi], 0x34
mov eax, eax
mov esi, esi
xor esi, ebx
mov esi, esi
xor eax, ebx
mov ebx, ebx
mov esi, eax
mov eax, esi
mov esi, esi
sub byte [edi], 0x75
mov ebx, eax
mov esi, esi
mov esi, esi
xor eax, ebx
xor esi, eax
xor eax, esi
xor esi, ebx
xor ebx, ebx
mov esi, esi
imul byte [edi]
inc edi
loop 0x401418
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407694
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40769e
repz ret
jmp fcn.0040bb95
Function at 0x408003
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040592a
and dword [ebp - 4], 0
cmp dword [0x4115cc], 0
mov ebx, eax
jne 0x4080b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408165
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408165
push eax
call fcn.004058b8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4115cc], eax
call esi
push eax
call fcn.004058b8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4115d0], eax
call esi
push eax
call fcn.004058b8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4115d4], eax
call esi
push eax
call fcn.004058b8
pop ecx
mov dword [0x4115dc], eax
test eax, eax
je 0x4080b4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004058b8
pop ecx
mov dword [0x4115d8], eax
mov eax, dword [0x4115d8]
cmp eax, ebx
je 0x40810c
cmp dword [0x4115dc], ebx
je 0x40810c
push eax
call fcn.00405933
push dword [0x4115dc]
mov esi, eax
call fcn.00405933
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40810c
test edi, edi
je 0x40810c
call esi
test eax, eax
je 0x408103
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408103
test byte [ebp - 0xc], 1
jne 0x40810c
or dword [ebp + 0x10], 0x200000
jmp 0x408145
mov eax, dword [0x4115d0]
cmp eax, ebx
je 0x408145
push eax
call fcn.00405933
pop ecx
test eax, eax
je 0x408145
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408145
mov eax, dword [0x4115d4]
cmp eax, ebx
je 0x408145
push eax
call fcn.00405933
pop ecx
test eax, eax
je 0x408145
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4115cc]
call fcn.00405933
pop ecx
test eax, eax
je 0x408165
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408167
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]