joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0x40e90c
push str.Jul_26_2013
push str.date
push 0x40e930
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x40e938
push str.13:36:59
push str.time
push str.build
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00402eef
push 0x4a5548
call fcn.00409660
add esp, 4
mov dword [0x4a6140], 0
jmp 0x401068
mov eax, dword [0x4a6140]
add eax, 1
mov dword [0x4a6140], eax
cmp dword [0x4a6140], 0x10
jge 0x401078
call fcn.00402f01
jmp 0x40105b
mov dword [0x4a6140], 0
call fcn.00402614
call fcn.00402a14
call fcn.00402bde
call fcn.00402d0f
push 5
mov ecx, dword [0x4a5540]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov edx, dword [0x4a5d48]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0x4020a6
push 1
push 0x28
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [ebp - 0x3ec], 0
jmp 0x4010e2
mov eax, dword [ebp - 0x3ec]
add eax, 1
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x10
jge 0x401109
push 1
mov ecx, dword [ebp - 0x3ec]
add ecx, 0xbe8
push ecx
mov edx, dword [0x4a5540]
push edx
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x4010d3
push 0x4a5548
call fcn.00409660
add esp, 4
mov eax, dword [0x4a5540]
push eax
call fcn.00408b60
add esp, 4
push 0x3e8
lea ecx, [ebp - 0x3e8]
push ecx
push 0xc6b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [ebp - 0x3e8]
push edx
push 0xc06
mov eax, dword [0x4a5540]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0
push 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401196
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401163
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403202
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d54
call fcn.0040be90
push 0xc2d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x4033ca
push 0x3e8
lea ecx, [ebp - 0x7d0]
push ecx
push 0xc0f
mov edx, dword [0x4a5d48]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x4a5d40
push 0x40ead4
lea eax, [ebp - 0x7d0]
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
je 0x4032af
push 0x3e8
lea ecx, [ebp - 0x2d54]
push ecx
push 0xca7
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [ebp - 0x2d54]
push edx
call fcn.004081f7
add esp, 4
push 0
push 0xc2d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x40341a
push 0x3e8
lea ecx, [ebp - 0x3e8]
push ecx
push 0xbdf
mov edx, dword [0x4a5d48]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x4a6164
lea eax, [ebp - 0x3e8]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x403318
push 0xcaa
call fcn.00409a9b
add esp, 4
push eax
call fcn.004081f7
add esp, 4
push 0
push 0xc2d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x40341a
push 0x40ead8
lea edx, [ebp - 0x3e8]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 0
jne 0x403368
push 0xcab
call fcn.00409a9b
add esp, 4
push eax
call fcn.004081f7
add esp, 4
push 0
push 0xc2d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x40341a
mov ecx, dword [ebp - 0x7d4]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0xbdf
mov edx, dword [0x4a5d48]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004097e3
add esp, 4
push 0xc0f
mov eax, dword [0x4a5d48]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004097e3
add esp, 4
push 0xc2c
mov ecx, dword [0x4a5d48]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004097e3
add esp, 4
jmp 0x40341a
push 0xbdf
mov edx, dword [0x4a5d48]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004097d2
add esp, 4
push 0xc0f
mov eax, dword [0x4a5d48]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004097d2
add esp, 4
push 0xc2c
mov ecx, dword [0x4a5d48]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004097d2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x405247
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push 0x3e8
lea eax, [ebp - 0x3e8]
push eax
push 0xc12
mov ecx, dword [0x4a5d2c]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x3f0]
push edx
push 0x40ec28
lea eax, [ebp - 0x3e8]
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
je 0x4052bb
push 0
push 0x4a6188
push 0xcac
call fcn.00409a9b
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ax, ax
jmp 0x4054c2
mov ecx, dword [0x4a6140]
imul ecx, ecx, 0x9650
mov edx, dword [ecx + 0x41866c]
mov dword [ebp - 0x3f4], edx
cmp dword [ebp - 0x3f4], 4
ja case.default.0x4052e6
mov eax, dword [ebp - 0x3f4]
jmp dword [eax*4 + 0x4054c6]
fld dword [ebp - 0x3f0]
fdiv dword [0x40d210]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
jmp case.default.0x4052e6
mov ecx, dword [0x4a6140]
imul ecx, ecx, 0x9650
movsx edx, byte [ecx + 0x418662]
test edx, edx
jne 0x405367
fld dword [ebp - 0x3f0]
fmul dword [0x40d208]
mov eax, dword [0x4a6140]
imul eax, eax, 0x9650
xor ecx, ecx
mov cx, word [eax + 0x418660]
mov dword [ebp - 0x3f8], ecx
fidiv dword [ebp - 0x3f8]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
jmp 0x4053a0
mov edx, dword [0x4a6140]
imul edx, edx, 0x9650
xor eax, eax
mov ax, word [edx + 0x418660]
mov dword [ebp - 0x3fc], eax
fild dword [ebp - 0x3fc]
fdivr dword [ebp - 0x3f0]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
jmp case.default.0x4052e6
mov ecx, dword [0x4a6140]
imul ecx, ecx, 0x9650
movsx edx, byte [ecx + 0x418662]
test edx, edx
jne 0x4053f6
mov eax, dword [0x4a6140]
imul eax, eax, 0x9650
xor ecx, ecx
mov cx, word [eax + 0x418660]
mov dword [ebp - 0x400], ecx
fild dword [ebp - 0x400]
fdivr dword [ebp - 0x3f0]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
jmp 0x405435
fld dword [ebp - 0x3f0]
fdiv dword [0x40d208]
mov edx, dword [0x4a6140]
imul edx, edx, 0x9650
xor eax, eax
mov ax, word [edx + 0x418660]
mov dword [ebp - 0x404], eax
fidiv dword [ebp - 0x404]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
jmp case.default.0x4052e6
fld dword [ebp - 0x3f0]
fdiv dword [0x40d204]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
jmp case.default.0x4052e6
fld dword [ebp - 0x3f0]
fdiv dword [0x40d200]
fmul dword [0x40d20c]
call sub.MSVCRT.dll__ftol
mov word [ebp - 0x3ec], ax
movsx ecx, word [ebp - 0x3ec]
cmp ecx, 0x1000
jle 0x4054a3
push 0
push 0x4a618c
push 0xcad
call fcn.00409a9b
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4054bb
movsx edx, word [ebp - 0x3ec]
cmp edx, 0xfff
jle 0x4054bb
mov word [ebp - 0x3ec], 0xfff
mov ax, word [ebp - 0x3ec]
mov esp, ebp
pop ebp
ret
Function at 0x40640e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
push 0x3e8
lea eax, [ebp - 0x3ec]
push eax
push 0xc12
mov ecx, dword [0x4a5d2c]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 4]
push edx
push 0x40ecf8
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
je 0x406479
push 0
push 0x4a61a4
push 0xcac
call fcn.00409a9b
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4064f3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x3f0], edx
cmp dword [ebp - 0x3f0], 0xffffffff
je 0x406499
cmp dword [ebp - 0x3f0], 1
je 0x4064a7
jmp 0x4064b3
fld dword [ebp - 4]
fadd dword [0x40d214]
fstp dword [ebp - 4]
jmp 0x4064b3
fld dword [ebp - 4]
fsub dword [0x40d214]
fstp dword [ebp - 4]
fld dword [ebp - 4]
sub esp, 8
fstp qword [esp]
push 0x40ecfc
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x3ec]
push ecx
push 0xc12
mov edx, dword [0x4a5d2c]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.0040981e
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x40ab98
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x40abaa
cmp dword [ebp + 0xc], 0
jne 0x40abb1
xor eax, eax
jmp 0x40ac36
push 6
mov eax, dword [ebp + 0xc]
push eax
call fcn.00409ad0
add esp, 8
and eax, 0xffff
sar eax, 8
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 6], al
push 6
mov edx, dword [ebp + 0xc]
push edx
call fcn.00409ad0
add esp, 8
and eax, 0xffff
and eax, 0xff
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 7], al
push 0xf
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0
lea eax, [ebp - 8]
push eax
push 8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40ac15
xor eax, eax
jmp 0x40ac36
push 0
lea eax, [ebp - 8]
push eax
push 0x64
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ac33
xor eax, eax
jmp 0x40ac36
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40efe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40efeb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x40f0b5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
dec edi
jne 0x40f000
pop edi
test esi, esi
je 0x40f0da
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x430800]
dec esi
jne 0x40f0c0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541

Function at 0x40335d
Capabilities:
Get number of processors

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
test eax, eax
je 0x40337e
cmp eax, 0xffffffff
ja 0x403379
push eax
call 0x4101ce
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x40337e
jmp 0x40e937
mov eax, ecx
ret
sal byte [ecx], 0xd2
mov ecx, eax
dec eax
add esp, 0x20
pop ebx
jmp 0x411e41
das

Function at 0x411d91
Capabilities:
Get number of processors

Disassembly:
or eax, 0xe010420
adc dword [eax - 0x6a7fee6f], eax
adc dword [eax + 0x2200599], eax
add al, byte [ecx]
sbb al, 0x18
or eax, dword [eax]
add eax, dword [ecx]
adc al, byte [eax + 0x120912a5]
and byte [ecx + 0x12010705], 0x80
movsd dword es:[edi], dword [esi]
add al, 0
add dword [ecx], eax
push cs
add eax, 0xe010200
Function at 0x411de1
Capabilities:
Get number of processors

Disassembly:
push cs
push cs
sbb eax, 0x5080e
add byte [edx], dl
xor byte [ebp + 0x12010008], 0x80
mov ecx, 0x8bd8011
and byte [edx], al
sbb eax, 0xb980121c

Function at 0x411e51
Capabilities:
Get number of processors

Disassembly:
sub dword [eax], esp
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
sub byte [edx + 0x29], dl
and byte [edi + 0x70], cl
jb 0x411ec5

Function at 0x411f51
Capabilities:
Get number of processors

Disassembly:
cmp byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
cmp dword [eax + esi], esi

Function at 0x411f81
Capabilities:
Get number of processors

Disassembly:
xor byte [eax], dh
xor byte [ecx], dh
xor byte [eax], dh
bound esi, qword [0x30396366]
aaa

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x13ed2320
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x1f7b0643
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x436cb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x436cdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x436cdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
mul byte [esi + 4]
mov edi, 0xec6af69e
in eax, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x763aed89]
wait
sahf
sahf
sahf
ja 0xdd0e3f
sahf
sahf
sahf
retf
Function at 0x422937
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419b87
and dword [ebp - 4], 0
cmp dword [0x42ffe0], 0
mov ebx, eax
jne 0x4229e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422a99
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422a99
push eax
call fcn.00419b15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42ffe0], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42ffe4], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42ffe8], eax
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42fff0], eax
test eax, eax
je 0x4229e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42ffec], eax
mov eax, dword [0x42ffec]
cmp eax, ebx
je 0x422a40
cmp dword [0x42fff0], ebx
je 0x422a40
push eax
call fcn.00419b90
push dword [0x42fff0]
mov esi, eax
call fcn.00419b90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422a40
test edi, edi
je 0x422a40
call esi
test eax, eax
je 0x422a37
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422a37
test byte [ebp - 0xc], 1
jne 0x422a40
or dword [ebp + 0x10], 0x200000
jmp 0x422a79
mov eax, dword [0x42ffe4]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422a79
mov eax, dword [0x42ffe8]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ffe0]
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a99
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422a9b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x23835f4f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2e26131b
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x402160
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40903c]
sub esp, 4
test ebx, ebx
je 0x4021ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4021a4
test esi, esi
je 0x4021a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402180
mov dword [esp], 0x409044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402390
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4023e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4024b4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40241e
cmp eax, 4
jne 0x402440
test esi, esi
je 0x402432
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x402424
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40247f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402471
cmp ecx, 0x40
je 0x402432
cmp ecx, 4
je 0x402432
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402390
lea esi, [esi]