joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb9fd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb9fd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb9fd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb9fd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb9fd94
push eax
push esi
call fcn.00ba220b
add esp, 8
pop esi
ret 0x10

Function at 0xb9fda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb9fe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb9fe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xbb8320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ba1dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb9fdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb9fe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb9fec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb9feb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xbb8320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ba1dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb9feab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb9fe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xba0000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xba0131
push esi
call fcn.00ba3145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b92080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xba0131
push 0
push ebp
call fcn.00b923a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b92260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xba008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b922f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xba0121
push 0xbb8918
push edi
call fcn.00ba13f0
push eax
push ebx
push esi
call fcn.00b9ff60
push 0xbb88f8
push edi
call fcn.00ba13f0
push eax
push ebx
push esi
call fcn.00b9ff60
push 0xbb88d8
push edi
call fcn.00ba13f0
push eax
push ebx
push esi
call fcn.00b9ff60
push 0xbb88c0
push edi
call fcn.00ba13f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b9ff60
push 0xbb88a0
push edi
call fcn.00ba13f0
push eax
push ebx
push esi
call fcn.00b9ff60
push 0xbb8888
push edi
call fcn.00ba13f0
push eax
push ebx
push esi
call fcn.00b9ff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xba11b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ba1140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ba1140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ba1140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ba1140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xba1bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xba1c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xbb387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xba1c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xba1c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x404541
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dl, 0x5c
cmp byte [ebp - 0x12c], dl
jne 0x40459d
cmp byte [ebp - 0x12b], dl
jne 0x40459d
mov cl, byte [ebp - 0x12a]
lea eax, [ebp - 0x12a]
mov dword [ebp + 8], eax
test cl, cl
je 0x404596
cmp cl, dl
je 0x404596
inc eax
mov dword [ebp + 8], eax
mov cl, byte [eax]
jmp 0x404586
cmp byte [eax], 0
je 0x4045a6
jmp 0x4045b0
lea eax, [ebp - 0x12c]
mov dword [ebp + 8], eax
mov cl, byte [eax]
test cl, cl
je 0x4045b3
cmp cl, dl
je 0x4045b3
inc eax
jmp 0x4045a3
cmp byte [eax], 0
je 0x4045bf
inc eax
mov dword [ebp + 8], eax
and byte [eax], 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x404612
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x404612
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x12c]
push eax
call edi
test eax, eax
je 0x404633
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push 0xa
pop ecx
call fcn.00405010
jmp 0x40464e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x404638
or eax, 0xffffffff
jmp 0x40464e
mov eax, dword [ebp - 4]
push 0x400
imul eax, dword [ebp - 8]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
pop edi
pop esi
leave
ret 4

Function at 0x40484a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push pe_nt_image_headers32
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404878
xor eax, eax
xor edx, edx
jmp 0x4048b2
lea eax, [ebp + 8]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 1
push esi
push esi
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00404fd0
mov esi, eax
xor eax, eax
add esi, dword [ebp - 4]
mov edi, edx
push ebx
adc edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4048ad
xor esi, esi
xor edi, edi
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404bf4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0xac]
push pe_nt_image_headers32
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov dword [ebp + 8], eax
call edi
mov esi, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
call edi
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x408aa4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push esi
call ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
inc eax
push 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
dec eax
push dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x2c]
push eax
push 2
push 1
push 4
push esi
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
push dword [0x408aac]
sub eax, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], esi
call ebx
mov edi, 0xf00021
mov dword [ebp - 0x14], eax
push edi
push esi
push 1
mov esi, dword [sym.imp.GDI32.dll_PatBlt]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call esi
push edi
push 1
push dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call esi
push dword [0x408aa0]
push dword [ebp + 0xc]
call ebx
mov eax, dword [ebp - 0x1c]
push edi
dec eax
push eax
mov eax, dword [ebp - 0xc]
inc eax
push 1
push eax
mov eax, dword [ebp - 8]
dec eax
push eax
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 8]
push edi
dec eax
push 1
push eax
mov eax, dword [ebp - 4]
dec eax
push eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
push dword [ebp + 0xc]
call esi
cmp dword [ebp - 0x18], 0
je 0x404d23
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call ebx
cmp dword [ebp - 0x14], 0
je 0x404d31
push dword [ebp - 0x14]
push dword [ebp + 0xc]
call ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406bc0
push 0x405080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x408ac0], 0xffffffff
mov dword [0x408ac4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x408abc]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x408ab8]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x408ac8], ecx
call fcn.00405070
mov eax, dword [0x408030]
test eax, eax
jne 0x404ea1
push 0x405060
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00405040
push 0x40800c
push 0x408008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x408ab4]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x408ab0]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x408004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x404faf
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x404f15
cmp al, 0x22
jne 0x404f07
cmp byte [esi], 0x22
jne 0x404f1e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x404f2e
cmp al, 0x20
ja 0x404f2e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x404f1e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x404f4f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x404f54
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x404f94
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x404f1e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x404faf

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6b0b733f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x29757303
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0xc6
add esi, 0x75
sub ebx, 3
inc edx
rcr esi, 0x3a
imul edi
or edi, 0xbb
mov esi, 0xf5
imul esi
neg esi
inc ebx
sub edx, 0xf9
rcr ebx, 0x3e
mov edx, 0x35
neg edx
sub ebx, 0x2a
sbb edx, 0xf4
imul ebx
not ebx
and esi, 0x79
neg edi
sub eax, 0xbb
imul edi
add ebx, 0x4b
neg edx
imul esi
bswap ebx
bswap edi
dec ebx
not ebx
not esi
bswap edx
not ebx
bswap edx
ror eax, 0x4f
dec edi
inc esi
rcl edx, 0x74
imul ebx
and ebx, 0x27
and eax, 0x13
not ebx
imul edx
rcr eax, 0xec
add eax, 0xaa
bswap ebx
imul edx
rol edx, 0x80
rcr ebx, 0xdc
neg edx
xor ecx, ecx
xor edi, edi
add ebx, 0x47
imul eax
sbb esi, 0x39
rcr edi, 0x8b
imul ebx
dec esi
imul esi
sub ebx, 0x88
dec edx
bswap eax
imul edx
dec ebx
or ebx, 0xe0
neg edx
imul esi
ror eax, 0x5b
and ebx, 0x35
rol esi, 0xf3
dec eax
add edx, 0x74
rol esi, 0x66
imul eax
rol edi, 0x2d
sub ebx, 0xd1
and esi, 0x2f
rcr edi, 0x22
sub ebx, 0x64
neg edx
rol edx, 0xa2
bswap eax
sbb eax, 0x7d
and edi, 0xf3
dec ebx
imul ebx
not ebx
inc edi
sub edx, 0xc3
sub ebx, 0xa
rcr esi, 0x74
mov edx, 0xfe
dec esi
rol esi, 0xda
neg ebx
imul eax
dec edx
rcl edx, 0xd5
sbb edi, 0x4a
sbb ebx, 0x49
bswap eax
ror eax, 0
mov ecx, dword [ebp + 0xc]
rcl ebx, 0xe3
add eax, 0xb8
dec edi
dec eax
inc ebx
rcl ebx, 0x5e
neg edi
neg ebx
ror ebx, 0x8f
imul edi
imul edi
rcl eax, 0x77
sub edi, 0xce
bswap ebx
not ebx
rcr edx, 0xf1
bswap ebx
rol eax, 0
dec edx
and esi, 0xe7
dec edx
inc esi
mov esi, 4
dec edi
imul edx
bswap eax
not edx
dec ebx
bswap edx
or edi, 0x8b
bswap edx
add ebx, 0xa2
imul edx
or edi, 0x44
sub eax, 0x1e
not edx
not esi
dec eax
add edi, 0x58
inc ebx
dec edi
and edx, 0x10
dec esi
not esi
add eax, 0x31
rcr ebx, 0x14
dec ebx
sbb edi, 0xc5
rcl eax, 0x55
imul eax
mov edi, dword [ebp + 8]
mov esi, eax
mov esi, esi
mov eax, eax
not byte [edi]
xor esi, ebx
mov eax, ebx
xor esi, ebx
mov esi, ebx
xor esi, ebx
mov eax, eax
mov eax, esi
mov esi, ebx
mov eax, eax
add byte [edi], 0x26
xor esi, ebx
xor eax, ebx
mov ebx, eax
mov ebx, eax
mov eax, esi
xor eax, ebx
mov eax, esi
mov esi, ebx
mov eax, eax
sub byte [edi], 0x87
xor eax, eax
mov ebx, ebx
mov esi, ebx
mov esi, esi
xor eax, ebx
xor eax, ebx
xor ebx, eax
mov ebx, ebx
mov ebx, esi
imul byte [edi]
inc edi
loop 0x4013b4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406224
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446e5c]
jne 0x40622e
repz ret
jmp fcn.00407f25
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408933
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.00408950
dec edi
push 0x11773527
pop ecx
xor dword [eax], ebx
sub ecx, edi
inc eax
cmp eax, edx
jne fcn.00408933
mov ecx, edi
ret
Function at 0x409d90
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push 4
push 0
push dword [0x413646]
push 0
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x409df2
push 0x19
push 0x4018c89
push 6
call fcn.0040be83
add esp, 0xc
mov dword [ebp - 4], eax
push VariantClear
push 0
push 0x4127f6
push 1
mov ebx, 0x194
call fcn.0040c520
add esp, 0x10
mov dword [ebp - 0xc], eax
fild dword [ebp + 0xc]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 0xc]
fstp qword [ebp - 0x1c]
fadd qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x28], esp
fld qword [ebp - 0x24]
call fcn.00401921
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
xor eax, eax
call dword [0x413672]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x409e63
push 0xba
push 0x4018c89
push 6
call fcn.0040be83
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x409e92
push 0xd5
push 0x4018c89
push 6
call fcn.0040be83
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x409e9a
mov esp, ebp
pop ebp
ret 8

Function at 0x40a182
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jl 0x40a1aa
cmp dword [ebp + 0x14], 3
jg 0x40a1aa
xor eax, eax
jmp 0x40a1af
mov eax, 1
test eax, eax
je 0x40a1c3
mov dword [ebp - 4], 1
jmp 0x40a234
fild dword [ebp + 0x14]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x4122e5]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.00401921
cmp eax, 1
jl 0x40a1e7
cmp eax, 5
jl 0x40a1fe
push 0xb7
push 0x4019b7b
push 9
call fcn.0040be83
add esp, 0xc
dec eax
call 0x40a204
pop ebx
add ebx, dword [eax*4 + 0x4130f6]
jmp ebx
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
mov eax, str.Open
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405647
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40a264
push ebx
call fcn.0040be9b
add esp, 4
push 0x4122cd
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ecx, 2
call fcn.00401948
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0x4122cd
test eax, eax
je 0x40a290
add eax, 8
push eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40a29b
add eax, 8
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x40a2a8
add eax, 8
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40a2b3
add eax, 8
push eax
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40a2df
push 0x152
push 0x4019b7b
push 6
call fcn.0040be83
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40a2f2
push ebx
call fcn.0040be9b
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40a302
push ebx
call fcn.0040be9b
add esp, 4
cmp dword [ebp - 0x1c], 2
mov eax, 0
setne al
jmp 0x40a313
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40f6a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x40f732
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x40f724
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x40f71c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x40f6e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x40f740
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret