joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x41e10b
test byte [ebx + 0x20], 0x30
je 0x41e112
mov eax, dword [0x492e70]
test eax, eax
je 0x41e19b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x41e102
cmp dword [eax + 0x14], 0
je 0x41e125
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41e0f5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x41e16f
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x41e0ad
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x41e13c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x41e192
mov eax, dword [0x492e70]
test eax, eax
je 0x41e1c1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x41e102
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x41e14f
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x41e14f
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41e0c0
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x492e70], eax
jmp 0x41e158
Function at 0x420a40
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040dcc0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x420b2f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x420bd3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x420b68
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x420b60
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x420bd0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x420bea
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x420ba2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x420ba2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x420ba2
Function at 0x1003e1a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
push dword [ebp + 0xc]
mov esi, 0x2c8
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x1003f25
push 3
pop ecx
cmp dword [ebp - 0xc], ecx
jne 0x1003f25
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
push ebx
mov eax, dword [ebp - 4]
mov edi, dword [ebp + eax*8 - 0x38]
push 0x1001e5c
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1003ee9
push edi
call fcn.01003cfc
push 0x20
push 0x1001e78
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 6
jb 0x1003ebb
cmp dword [ebp - 8], esi
pop ebx
jae 0x1003f0d
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x48], eax
push esi
lea eax, [ebp - 0x304]
push eax
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
leave
ret 8

Function at 0x1003f2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp + 8]
push eax
push 0xf003f
push 0
push 0x1001d88
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1003f9f
push ebx
xor ebx, ebx
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
inc ebx
test esi, esi
jne 0x1003f95
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
jmp loc.01010000
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp esi, 2
jne 0x1003fa6
xor esi, esi
mov eax, esi
pop esi
leave
ret 4
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00401004
rcl dword [esi + 0x5e], 0x5d

Function at 0x40105b
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov dword [esp], 0x68707061
mov dword [esp + 4], 0x706c65
push esp
call dword [0x404010]
push esi
pop esi
add esp, 8
mov ebx, eax
mov eax, dword [0x401057]
call fcn.00401158
nop
nop
or eax, eax
je 0x401143
push esi
pop esi
push eax
mov eax, 0x337
pop eax
push 0x40110e
std
cld
push dword fs:[0]
push esi
pop esi
mov dword fs:[0], esp
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
std
cld
mov edx, 0x5658
in eax, dx
push eax
mov eax, 0x337
pop eax
cmp ebx, 0x564d5868
je 0x401143
mov dword [esp + 4], 0x401122
xchg ebx, eax
push ebx
push eax
pop ebx
pop eax
xor ebx, ebx
mov eax, 0xa
invalid
nop
push eax
mov eax, 0x337
pop eax
push 0
call dword [0x404050]
std
cld

Function at 0x401158
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
xchg ecx, ebx
xchg ebx, ecx
push ecx
push esi
push ebp
xchg ebx, eax
push ebx
push eax
pop ebx
pop eax
push edx
xchg ebp, eax
mov ecx, dword [ebx + 0x3c]
std
cld
mov ecx, dword [ebx + ecx + 0x78]
add ecx, ebx
nop
nop
xor esi, esi
lea edx, [ebx + esi*4]
std
cld
add edx, dword [ecx + 0x20]
mov edx, dword [edx]
add edx, ebx
nop
xor eax, eax
xchg ebx, eax
push ebx
push eax
pop ebx
pop eax
rol eax, 0xd
xor al, byte [edx]
inc edx
push esi
pop esi
cmp byte [edx], 0
jne 0x401184
xor eax, 0x6165425b
cmp eax, ebp
je 0x4011b3
inc esi
xchg ebx, eax
push ebx
push eax
pop ebx
pop eax
cmp esi, dword [ecx + 0x18]
jb 0x401175
xor eax, eax
std
cld
jmp 0x401268
mov edx, dword [ecx + 0x24]
add edx, ebx
push esi
pop esi
movzx edx, word [edx + esi*2]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
std
cld
add eax, ebx
mov ecx, dword [ebx + 0x3c]
push eax
mov eax, 0x337
pop eax
mov edx, dword [ebx + ecx + 0x7c]
mov ecx, dword [ebx + ecx + 0x78]
add ecx, ebx
nop
nop
cmp eax, ecx
jb 0x401268
xchg ecx, ebx
xchg ebx, ecx
add ecx, edx
cmp eax, ecx
ja 0x401268
nop
sub esp, 0x78
mov esi, esp
cmp byte [eax], 0x2e
je 0x401218
push eax
mov eax, 0x337
pop eax
push word [eax]
pop word [esi]
inc esi
xchg ecx, ebx
xchg ebx, ecx
inc eax
jmp 0x4011fb
mov byte [esi], 0
push eax
push eax
mov eax, 0x337
pop eax
push esp
add dword [esp], 4
nop
nop
call dword [0x404010]
pop edx
push esi
pop esi
inc edx
add esp, 0x78
push ebx
mov ebx, eax
xchg ecx, ebx
xchg ebx, ecx
xor eax, eax
rol eax, 0xd
xor al, byte [edx]
push eax
mov eax, 0x337
pop eax
inc edx
cmp byte [edx], 0
jne 0x401246
nop
xor eax, 0x6165425b
call fcn.00401158
xchg ecx, ebx
xchg ebx, ecx
pop ebx
pop edx
push esi
pop esi
pop ebp
pop esi
pop ecx
ret

Function at 0x401271
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
cmp dword [ebp + 0xc], edx
jle 0x40129f
push esi
mov eax, dword [ebp + 8]
lea ecx, [edx + eax]
mov eax, dword [ecx]
mov esi, eax
shl esi, 0x19
shr eax, 7
add esi, eax
xor esi, 0x47500b0e
add edx, 4
cmp edx, dword [ebp + 0xc]
mov dword [ecx], esi
jl 0x40127c
pop esi
pop ebp
ret
Function at 0x4012a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 3
pop ecx
cmp dword [ebp + 0xc], ecx
jle 0x4012c4
mov eax, dword [ebp + 8]
sub ecx, eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 0x2c]
xor dword [eax], edx
add eax, 4
lea edx, [ecx + eax]
cmp edx, dword [ebp + 0xc]
jl 0x4012b1
pop ebp
ret

Function at 0x401740
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x404080]
shr eax, 6
add eax, 0x159
mov dword [0x404084], eax
je 0x40175d
mov dword [0x404080], eax
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
push esi
lea esi, [edx + ecx + 0x18]
xor edx, edx
mov dword [ebp - 4], 0
cmp dx, word [ecx + 6]
jae 0x401855
add esi, 0x10
push edi
cmp dword [esi], 0
jne 0x4017d3
mov ecx, dword [ebp + 0xc]
mov edi, dword [ecx + 0x38]
test edi, edi
jle 0x401839
mov edx, dword [esi - 4]
push 4
push 0x1000
push edi
add edx, ebx
push edx
call dword [0x404018]
mov ecx, dword [0x404080]
shr ecx, 6
push edi
add ecx, 0x159
push 0
mov dword [0x404084], ecx
push eax
mov dword [esi - 8], eax
call fcn.00402b40
add esp, 0xc
jmp 0x401834
add eax, 0x7c0
mov dword [0x404080], eax
shr eax, 6
add eax, 0x159
push 4
mov dword [0x404084], eax
mov edx, dword [esi]
mov eax, dword [esi - 4]
push 0x1000
push edx
add eax, ebx
push eax
call dword [0x404018]
mov edx, dword [esi + 4]
mov ecx, dword [esi]
add edx, dword [ebp + 8]
push ecx
mov edi, eax
push edx
push edi
call fcn.00402b10
mov ecx, dword [0x404080]
mov eax, dword [0x404084]
inc ecx
xor edx, edx
div ecx
add esp, 0xc
mov dword [0x404080], ecx
inc eax
mov dword [0x404084], eax
mov dword [esi - 8], edi
mov eax, dword [0x404084]
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov ecx, dword [ebp - 4]
movzx edx, word [edx + 6]
inc ecx
add esi, 0x28
cmp ecx, edx
mov dword [ebp - 4], ecx
jl 0x401786
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x401e67
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x401e7c
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x404084]
push edi
push 4
add edx, 0x7c0
mov dword [0x404080], edx
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
push 0x2000
push eax
push ecx
call dword [0x404018]
mov edx, dword [0x404084]
mov edi, eax
add edx, 0x7c0
mov dword [0x404080], edx
test edi, edi
jne 0x401ed0
mov eax, dword [ebx + 0x50]
push 4
push 0x2000
push eax
push edi
call dword [0x404018]
mov edi, eax
mov ecx, dword [0x404080]
mov eax, dword [0x404084]
inc ecx
xor edx, edx
div ecx
mov dword [0x404080], ecx
inc eax
mov dword [0x404084], eax
test edi, edi
jne 0x401ef8
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0xc
push 0
call dword [0x404048]
push eax
call dword [0x40404c]
mov esi, eax
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov ecx, dword [0x404084]
push 4
add ecx, 0x7c0
mov dword [0x404080], ecx
mov edx, dword [ebx + 0x50]
push 0x1000
push edx
push edi
call dword [0x404018]
mov eax, dword [0x404084]
inc dword [0x404080]
xor edx, edx
div dword [0x404080]
push 4
push 0x1000
inc eax
mov dword [0x404084], eax
mov eax, dword [ebx + 0x54]
push eax
push edi
call dword [0x404018]
mov ecx, dword [0x404084]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x401f78
mov dword [0x404080], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + 0x54]
add edx, dword [ecx + 0x3c]
push edx
push ecx
push eax
call fcn.00402b10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi], ecx
mov edx, dword [0x404084]
add edx, 0x7c0
mov dword [0x404080], edx
mov ecx, dword [esi]
mov dword [ecx + 0x34], edi
mov ecx, dword [0x404084]
test ecx, ecx
je 0x401fbe
mov dword [0x404080], ecx
push esi
push ebx
push eax
call fcn.00401740
mov eax, dword [0x404084]
add esp, 0xc
add eax, 0x7c0
mov dword [0x404080], eax
je 0x401fe2
add eax, 7
mov dword [0x404084], eax
mov eax, edi
sub eax, dword [ebx + 0x34]
je 0x401ff4
push eax
mov eax, esi
call fcn.00401990
add esp, 4
mov edx, dword [0x404084]
add edx, 0x7c0
mov eax, esi
mov dword [0x404080], edx
call fcn.00401d30
test eax, eax
jne 0x402018
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x404080]
lea eax, [ecx + 7]
test ecx, ecx
jne 0x40202a
mov eax, dword [0x404084]
inc ecx
xor edx, edx
div ecx
push esi
mov dword [0x404080], ecx
inc eax
mov dword [0x404084], eax
call fcn.00401860
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
add esp, 4
test eax, eax
je 0x402089
mov edx, 0x2000
test word [ecx + 0x16], dx
je 0x40206d
mov ecx, dword [ebp + 0xc]
push 0
push 1
push ecx
add eax, edi
call eax
mov dword [esi + 8], 1
jmp 0x402089
push 0xffffffffffffffff
push 0
push 0
push 0
add edi, eax
push edi
push 0
push 0
call dword [0x404014]
push eax
call dword [0x404028]
mov eax, dword [0x404080]
test eax, eax
je 0x40209a
add eax, 7
mov dword [0x404084], eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403090
push 0x402db0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x404610], 0xffffffff
mov dword [0x404614], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40460c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x404608]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x404618], ecx
call fcn.00402da0
mov eax, dword [0x404078]
test eax, eax
jne 0x402c41
push 0x402d90
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00402d70
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x404604]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x404600]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x402d4f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x402cb5
cmp al, 0x22
jne 0x402ca7
cmp byte [esi], 0x22
jne 0x402cbe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x402cce
cmp al, 0x20
ja 0x402cce
inc esi
mov dword [ebp - 0x74], esi
jmp 0x402cbe
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x402cef
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x402cf4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x402d34
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x402cbe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x402d4f
Function at 0x406555
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431764]
jne 0x40655f
repz ret
jmp fcn.0040aec6

Function at 0x409d47
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b4e
and dword [ebp - 4], 0
cmp dword [0x43681c], 0
mov ebx, eax
jne 0x409df8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409ea9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409ea9
push eax
call fcn.00404adc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43681c], eax
call esi
push eax
call fcn.00404adc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x436820], eax
call esi
push eax
call fcn.00404adc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x436824], eax
call esi
push eax
call fcn.00404adc
pop ecx
mov dword [0x43682c], eax
test eax, eax
je 0x409df8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404adc
pop ecx
mov dword [0x436828], eax
mov eax, dword [0x436828]
cmp eax, ebx
je 0x409e50
cmp dword [0x43682c], ebx
je 0x409e50
push eax
call fcn.00404b57
push dword [0x43682c]
mov esi, eax
call fcn.00404b57
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409e50
test edi, edi
je 0x409e50
call esi
test eax, eax
je 0x409e47
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409e47
test byte [ebp - 0xc], 1
jne 0x409e50
or dword [ebp + 0x10], 0x200000
jmp 0x409e89
mov eax, dword [0x436820]
cmp eax, ebx
je 0x409e89
push eax
call fcn.00404b57
pop ecx
test eax, eax
je 0x409e89
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409e89
mov eax, dword [0x436824]
cmp eax, ebx
je 0x409e89
push eax
call fcn.00404b57
pop ecx
test eax, eax
je 0x409e89
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43681c]
call fcn.00404b57
pop ecx
test eax, eax
je 0x409ea9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409eab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4077ac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x40c85c
call fcn.00409c40
mov esi, dword [eax]
push 0x40c85c
call fcn.00409c40
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.004095fc
call fcn.004093cc
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00409470
call fcn.00408018
test eax, eax
jne 0x4078ed
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.004095d4
call fcn.00408018
test eax, eax
jne 0x407863
cmp word [ebp - 0x190], 0x5a4d
jne 0x407863
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004094a8
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.004095d4
jmp 0x40786d
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.004094a8
call fcn.00408018
test eax, eax
jne 0x4078d1
cmp word [ebp - 0x190], 0x4550
jne 0x4078d1
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.004095d4
call fcn.00408018
test eax, eax
jne 0x4078d1
cmp dword [ebp - 0x288], 0x4550
jne 0x4078d1
cmp word [ebp - 0x22c], 3
jne 0x4078d1
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.004094d8
push 0x40c854
call fcn.00409c40
mov dword [eax], 0
push 0x40c85c
call fcn.00409c40
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407a5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x21], 0x52414853
mov dword [ebp - 0x1d], 0x454d4445
mov dword [ebp - 0x19], 0x5356344d
call fcn.00409fec
push eax
push 0
lea eax, [ebp - 0x15]
push eax
push 0xb
call fcn.00408bd0
xor eax, eax
mov bl, 0
push 0x40c170
push 1
call fcn.0040745c
test eax, eax
jne 0x407ab0
push 0x2000
call fcn.004080ec
mov esi, eax
mov bl, 1
jmp 0x407ae6
lea ecx, [ebp - 0x21]
push ecx
push 0
push 6
call eax
test eax, eax
jne 0x407ad6
lea eax, [ebp - 0x21]
push eax
push 0x2000
push 0
push 4
push 0
push 0xffffffffffffffff
call fcn.00409f92
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call fcn.0040a0a6
mov esi, eax
test bl, bl
je 0x407b0f
push esi
push 0x2000
push 0xff
call fcn.00408c78
push esi
push 0x18
push 0
call fcn.00408c78
mov eax, esi
add eax, 0xc
push eax
call fcn.004081c4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret