joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4119d7
cmp dword [esi + 0x14], 1
jne 0x41191b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x411998
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x411983
dec eax
je 0x41196c
sub eax, 2
je 0x411957
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00411520
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4119c5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x411941
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x4130d8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x41314d
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x4130f6
mov esi, 0x41500c
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x413144
call dword [sym.imp.USER32.DLL_EmptyClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x413144
push ebp
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.DLL_SetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 4
Function at 0x44b6ba
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b441

Function at 0x44d94e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d128

Function at 0x44d959
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d363

Function at 0x402aa0
Capabilities:
Accept command line arguments

Disassembly:
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004029e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
ret 0x10

Function at 0x402d76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x402d80
repz ret
jmp fcn.004031ad
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e004]
jne 0x401010
repz ret
jmp fcn.00401460

Function at 0x4082b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058a1
and dword [ebp - 4], 0
cmp dword [0x450798], 0
mov ebx, eax
jne 0x408366
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408417
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408417
push eax
call fcn.0040582f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x450798], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45079c], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4507a0], eax
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4507a8], eax
test eax, eax
je 0x408366
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4507a4], eax
mov eax, dword [0x4507a4]
cmp eax, ebx
je 0x4083be
cmp dword [0x4507a8], ebx
je 0x4083be
push eax
call fcn.004058aa
push dword [0x4507a8]
mov esi, eax
call fcn.004058aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083be
test edi, edi
je 0x4083be
call esi
test eax, eax
je 0x4083b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083b5
test byte [ebp - 0xc], 1
jne 0x4083be
or dword [ebp + 0x10], 0x200000
jmp 0x4083f7
mov eax, dword [0x45079c]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083f7
mov eax, dword [0x4507a0]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x450798]
call fcn.004058aa
pop ecx
test eax, eax
je 0x408417
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408419
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403080
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588393
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5f02d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0
mov edx, dword [ecx + 0x24]
lea eax, [ecx + 2]
cmp eax, edx
jne 0x4030cc
mov byte [ecx + 0x22], 0
jmp 0x4030e5
test edx, edx
je 0x4030e5
mov eax, dword fs:[0x18]
push edx
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [0x5942e4]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x24]
lea eax, [esi + 2]
cmp eax, ecx
jne 0x403114
mov byte [esi + 0x22], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x40312d
mov eax, dword fs:[0x18]
push ecx
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [0x5942e4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009276
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94c
mov eax, dword [0x10046040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100119dd
test eax, eax
js 0x10009504
push 0x104
lea eax, [ebp - 0x13c]
push eax
push dword [0x1004603c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov edi, 0x100012dc
push edi
lea eax, [ebp - 0x34]
push 0x2d
push eax
call fcn.1000a7cf
add esp, 0xc
xor ebx, ebx
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001354
push 2
push 0x10003584
mov byte [ebp - 0x2f], 0x5c
call fcn.1000a7cf
test eax, eax
je 0x100092f3
mov eax, 0x80040201
jmp 0x10009504
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x1000136c
push 3
push 0x10003234
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
push 1
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001388
push 4
mov esi, 0x10003304
push esi
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 5
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009357
mov byte [ebp - 0x93c], al
lea eax, [ebp - 0x93c]
push eax
push 0
push 0
push 0x100013a4
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
lea eax, [ebp - 0x2e]
push eax
push esi
call fcn.1000a7cf
lea eax, [ebp - 0x2e]
push eax
push edi
push 0
push 0x100013a4
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013c0
push 6
push 0x10003434
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013dc
push 7
push 0x10003444
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013fc
push 9
push 0x10003454
call fcn.1000a7cf
test eax, eax
jne 0x100092e9
push 0x10001424
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x94c], eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
lea eax, [ebp - 0x940]
push eax
push 1
push 0
push 0x10001434
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009502
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x944]
push eax
push 0
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
mov eax, dword [ebp - 0x944]
inc eax
add eax, esi
mov dword [ebp - 0x944], eax
call fcn.10009f0e
mov esi, esp
test esi, esi
je 0x10009502
lea eax, [ebp - 0x94c]
push eax
push esi
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
push dword [ebp - 0x940]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10001424
push dword [ebp - 0x944]
push esi
call fcn.1000a7cf
push 0x10001450
lea eax, [ebp - 0x13c]
push 0x106
push eax
call fcn.1000a7cf
add esp, 0xc
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 1
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009502
mov eax, 0xc7ce0017
jmp 0x10009504
xor eax, eax
lea esp, [ebp - 0x958]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f00
leave
ret
Function at 0x10009bb9
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10042958
call fcn.1000aecb
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10009c47
call fcn.1000ae99
test eax, eax
jne 0x10009bdd
xor eax, eax
jmp 0x10009d13
call fcn.1000a293
test eax, eax
jne 0x10009bed
call fcn.1000aeb7
jmp 0x10009bd6
call fcn.1000ae4d
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10049d38], eax
call fcn.1000a7cf
mov dword [0x10048aa4], eax
call fcn.1000a7cf
test eax, eax
jns 0x10009c17
call fcn.10009f6a
jmp 0x10009be6
call fcn.1000a7cf
test eax, eax
js 0x10009c40
call fcn.1000aa85
test eax, eax
js 0x10009c40
push 0
call fcn.1000a7cf
pop ecx
test eax, eax
jne 0x10009c40
inc dword [0x10048aa0]
jmp 0x10009d10
call fcn.1000aa32
jmp 0x10009c10
xor edi, edi
cmp eax, edi
jne 0x10009ca6
cmp dword [0x10048aa0], edi
jle 0x10009bd6
dec dword [0x10048aa0]
mov dword [ebp - 4], edi
cmp dword [0x10048ad8], edi
jne 0x10009c6b
call fcn.1000a7c0
cmp dword [ebp + 0x10], edi
jne 0x10009c7f
call fcn.1000aa32
call fcn.10009f6a
call fcn.1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.10009c92
jmp 0x10009d10
cmp eax, 2
jne 0x10009d04
call fcn.10009f36
push 0x214
push 1
call fcn.1000a7cf
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x10009bd6
push esi
push dword [0x10046048]
push dword [0x10048ab8]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10009cf8
push edi
push esi
call fcn.10009fad
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10009d10
push esi
call fcn.1000a7cf
pop ecx
jmp 0x10009bd6
cmp eax, 3
jne 0x10009d10
push edi
call fcn.1000a7cf
pop ecx
xor eax, eax
inc eax
call fcn.1000af10
ret 0xc

Function at 0x10009f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046040]
jne 0x1000b4a0
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10048cf8], eax
mov dword [0x10048cf4], ecx
mov dword [0x10048cf0], edx
mov dword [0x10048cec], ebx
mov dword [0x10048ce8], esi
mov dword [0x10048ce4], edi
mov word [0x10048d10], ss
mov word [0x10048d04], cs
mov word [0x10048ce0], ds
mov word [0x10048cdc], es
mov word [0x10048cd8], fs
mov word [0x10048cd4], gs
pushfd
pop dword [0x10048d08]
mov eax, dword [ebp]
mov dword [0x10048cfc], eax
mov eax, dword [ebp + 4]
mov dword [0x10048d00], eax
lea eax, [ebp + 8]
mov dword [0x10048d0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10048c48], 0x10001
mov eax, dword [0x10048d00]
mov dword [0x10048bfc], eax
mov dword [0x10048bf0], 0xc0000409
mov dword [0x10048bf4], 1
mov eax, dword [0x10046040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10046044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10048c40], eax
push 1
call fcn.1000ce11
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001564
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10048c40], 0
jne 0x1000b58c
push 1
call fcn.1000ce11
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1000a7cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000a7de
pop dword [ebp - 0x3c]
mov eax, 0x6314ec13
sub eax, 0x53144435
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb156d087
sub dword [ebp - 0x4c], 0x63048b3c
mov dword [ebp - 0x48], 0x56955085
add dword [ebp - 0x48], 0xdb9dfbc0
mov dword [ebp - 0x44], 0xbc277d8f
add dword [ebp - 0x44], 0x9024c69f
mov dword [ebp - 0x40], 0x73068792
sub dword [ebp - 0x40], 0x73068792
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x9148729e
add dword [ebp - 0x4c], 0xe329f6b8
mov dword [ebp - 0x48], 0xc6727266
sub dword [ebp - 0x48], 0x850610f1
mov dword [ebp - 0x44], 0x9167c100
add dword [ebp - 0x44], 0xd207ab6c
mov dword [ebp - 0x40], 0x6f9b8a8
add dword [ebp - 0x40], 0xf9064758
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xc23f3721
sub eax, 0xb23f2721
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x47671
push 0
call eax
mov ecx, 0x55b5
mov edx, eax
mov esi, 0x10051800
add esi, dword [ebp - 0x3c]
mov ebx, 0x7bf5dfab
sub ebx, 0x74826375
xor dword [ebp - 0x14], 0x395aea34
mov edi, dword [esi]
sub dword [ebp - 0xc], 0x1ae391b2
add edi, ebx
mov dword [ebp - 0x18], 0x709e063f
mov dword [edx], edi
add dword [ebp - 0x28], 0xef1ec401
add edx, 4
add esi, 4
loop 0x1000a8ef
add eax, 0x66bce739
sub eax, 0x66bb9d92
mov ebx, eax
add eax, 0x8559ae16
add eax, 0x7aa651ef
mov ecx, 0xb2e8c8d3
sub ecx, 0xa2e8c8d3
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1001100d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100418d8
call fcn.10037358
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1001106e
call fcn.1000e3e2
mov esi, eax
jmp 0x10011146
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001108c
call fcn.1000e3e2
jmp 0x1001113d
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x10011082
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100110bf
mov esi, 0x8007000e
jmp 0x1001113f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000a7cf
mov dword [ebp - 4], 1
jmp 0x100110f3
cmp dword [ebp - 0x418], 0
je 0x100110b5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10011082
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1000a7cf
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001115f
lea ecx, [ebp - 0x418]
call fcn.10011269
mov eax, esi
call fcn.100373b1
ret 0x10
Function at 0x406490
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx], dh
xor dword [eax], esi
xor byte [edi], dh
xor byte [eax], dh
xor byte [eax], dh
pop edx
pop ss
or eax, 0x32313032
xor esi, dword [ecx]
xor byte [edi], dh
xor byte [eax], dh
xor byte [eax], dh
pop edx
xor byte [eax + 0x31], dh
sub esi, dword [eax]
sub dword [esi], eax
add edx, dword [ebp + 4]
or edx, dword [ebx]
and al, byte [ebx + 0x6f]
jo 0x406534
jb 0x406526
push 0x63282074
sub dword [eax], esp
xor dword [ecx], edi
cmp dword [edi], esi
and byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x406540
je 0x4064f4
inc ebx
outsd dx, dword [esi]
jb 0x406548
xor dword cs:[esi], ebx
xor byte [esi + eax], bl
add edx, dword [ebp + 4]
or edx, dword [ebx]
adc eax, 0x7263694d
outsd dx, dword [esi]
jae 0x40655a
je 0x40650e
inc ebx
outsd dx, dword [esi]
jb 0x406562
outsd dx, dword [esi]
jb 0x406556
popal
je 0x406560
outsd dx, dword [esi]
outsb dx, byte [esi]
xor dword [ecx], esp
xor byte [edi], bl
push es
add edx, dword [ebp + 4]
add edx, dword [ebx]
sbb byte [ebp + 0x69], cl
arpl word [edx + 0x6f], si
jae 0x40657a
je 0x40652e
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x406533
inc ecx
jne 0x40658a
push 0x7469726f
jns 0x40654d
add byte [ecx], 0x22
xor byte [0x862a0906], cl
dec eax
xchg bh, dh
or eax, 0x5010101
add byte [ebx], al
add byte [ecx], 0xf
add byte [eax], dh
add byte [ecx], 0xa
xor byte [edx - 0x7dfdf5ff], al
add dword [ecx], eax
add byte [ecx + 0x70c1bd02], ch
out 0x3b, al
add al, byte [edx - 0x56fffeff]
add bh, byte [ebp + 0x3be670c1]
sal dword [eax - 0x1a], 0x3b
dec esi
sbb ebp, dword [eax]
lahf
xchg edi, eax
js 0x4065aa
xor dl, ch
mov byte [0x5f258da9], al
clc
invalid
ljmp 0xf85f:0x258da9a2
dec esp
mov dword [0xa29dfeb7], eax
and byte [esi], bh
jl 0x4065b1
popfd
mov byte [0x517c3e20], al
mov byte [0x608fa29b], al
xor ch, byte [ebx - 0x2f]
inc edx
jns 0x40655a
mov byte [0x6b32608f], al
rol dword [edx + 0x64], 1
jns 0x40655a
lodsb al, byte [esi]
jbe 0x406538
push esp
invalid
mov bl, 0xc5
imul edi, dword [edx + 0x62], 0x23
salc
sbb eax, 0x10fde3c
xchg edx, eax
call 0x2e002a22
lcall 0x9926, 0x689a
sar byte [edx], 1
mov edi, 0x9a9a662d
push 0x3ad09926
sub al, 0xbf
or al, 0xb5
pop eax
rol dword es:[esi - 0x19], 0xa
cmp byte ds:[esi + 0x3928a92c], dl
test al, 0xec
dec ecx
add dword [edx - 0x1d], 0xffffff84
jecxz 0x406530
btc dword [edx - 0x539eaa94], ebx
popal
lodsb al, byte [esi]
cmp byte [ecx + 0x60], 0x2d
ja 0x406606
jmp 0x3ba51a58
cmp al, 0x56
call [ebx - 5]
movsb byte es:[edi], byte [esi]
or cl, byte [eax]
cmpsb byte [esi], byte es:[edi]
rol byte [ecx - 0x4910a8aa], cl
cmp ebx, dword [esi + 0x16]
xor dword [edi + 4], 0xaebef6da
adc byte [ebp + 0x7fcdb0fe], 0xd6
cmpsd dword [esi], dword es:[edi]
sbb dh, byte [edx + 0x5c]
cmp al, 0xca
mov esp, 0x22a308f0
xor byte [ebx - 0x4c367afa], dh
and byte [edi + 0x13], dh
test edi, ebx
add al, byte [ebx]
add dword [eax], eax
add dword [ebx - 0x7ecf577f], esp
movsd dword es:[edi], dword [esi]
xor byte [ecx + 0x550306a2], al
sbb eax, 0x9a810401
xor byte [ecx + 0x5b108097], al
sal byte [eax - 0x11], 1
imul esi, dword [edx - 0x62], 0x147e5123
mov dl, 0x4d
invalid
Function at 0x413ba0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc ebx, dword [eax - 0x2b656cbd]
push es
pop eax
mov word [ebp - 0x25], ds
test eax, 0x8246daed
sub dl, byte [ebp + 0x38]
cmp cl, byte [esi + 0x49455d22]
inc esi
sub byte [edx], 0x55
cmp byte [edx], bh
mov fs, word [edx]
pop ebp
inc ebp
dec ecx
add dh, byte [edx - 0x53]
push ebp
popal
mov al, 0x52
inc esi
clc
inc eax
mov al, byte [0x9b459128]
adc al, 0xba
les ebx, [ebp - 0x79]
xor al, 0x6d
lcall 0xedb6, 0x9b4edb59
xchg byte [ecx - 0x49158cc1], dh
jnp 0x413baf
mov edi, 0xdd678982
dec esp
mov esp, 0x87a99ace
push esp
int 0xb8
sbb byte [edx + edx*4 + 0x686a013b], bh
sub byte [0xb5e470d2], dh
cmp byte [ebx - 0x25], ch
sbb dword [edi - 0x33d66772], esp
mov dword [0x289565b4], eax
loop 0x413c61
sbb eax, 0xcb1c00a0
push ebx
aas
sal byte [esi + 0x2367d00d], cl
std
insd dword es:[edi], dx
dec esp
mov bh, 0xd6
mov bh, 0xa6
rcr dword [edi], cl
std
int1
pop ds
std
lodsb al, byte [esi]
push edi
int1
loop 0x413ccb
jmp 0x415336
xchg edx, eax
mov ebp, dword [edx]
wait
adc eax, 0x140d55c8
inc ebp
cwde
aam 0xe
invalid
sub dl, bl
mov bl, 0x75
cmpsb byte fs:[esi], byte es:[edi]
insb byte es:[edi], dx
adc eax, 0xb5aea875
in al, 0x62
and eax, 0xbf6ee70f
mov ebp, 0x1f83ed4b
cli
xor dword [ebx + 0x67], 0x5e
or dword [edx], ebp
add byte [esp + esi - 0x66457fb6], dl
ror ebp, 0xb5
lcall 0xb85, 0x7a3a2f16
aam 0xc8
push ecx
nop
inc eax
push 0x66
dec esp
jne 0x415318
std
sub ah, byte [esi - 0x4504a17]
cmovp ebx, dword [0xf8f81f17]
into
mov ch, 0xa7
outsb dx, byte [esi]
aas
invalid
Function at 0x40e0a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
call fcn.0040e140
push dword [ebp + 8]
call fcn.004f4810
pop ecx
mov dword [ebp - 4], eax
call fcn.0040e150
cmp dword [ebp - 4], 0
jne 0x40e108
cmp byte [ebp + 0xc], 1
jne 0x40e0d7
mov eax, 0
leave
ret
call fcn.0040b620
push str.9This_application_has_run_out_of_memory_and_must_quit_now.
call fcn.0040da80
pop ecx
push 0x2dc
push str.utility.cpp
push 4
push 0x83
call fcn.004807b0
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40e160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
cmp dword [ebp + 8], 0
jg 0x40e17f
mov eax, 0
leave
ret
mov eax, dword [ebp + 8]
add eax, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jl 0x40e1aa
movzx eax, byte [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0040e0a0
pop ecx
pop ecx
mov eax, eax
leave
ret
call fcn.0040e140
mov eax, dword [ebp + 8]
add dword [0x502568], eax
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x502410], 0
je 0x40e1e6
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x502410]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x502410], edx
jmp 0x40e26b
mov edx, dword [ebp - 4]
lea edx, [edx*4]
mov dword [ebp + 8], edx
mov eax, dword [0x502514]
cmp dword [ebp + 8], eax
jle 0x40e251
inc byte [0x5280a0]
push 0x2000
call fcn.004f4810
pop ecx
mov dword [0x502510], eax
dec byte [0x5280a0]
cmp dword [0x502510], 0
jne 0x40e247
cmp byte [ebp + 0xc], 1
jne 0x40e22f
mov eax, 0
leave
ret
call fcn.0040b620
push str.9This_application_has_run_out_of_memory_and_must_quit_now.
call fcn.0040da80
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x502514], 0x2000
mov eax, dword [0x502510]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add dword [0x502510], eax
mov eax, dword [ebp + 8]
sub dword [0x502514], eax
call fcn.0040e150
mov eax, dword [ebp - 8]
leave
ret

Function at 0x40f9f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x95], 0
jne 0x40fa0f
leave
ret
push 0
mov eax, dword [ebp - 4]
push dword [eax + 0x58]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov byte [eax + 0x95], 0
leave
ret