joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009762
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, 0x200
push esi
mov dword [0x10039884], eax
call fcn.10013c63
push esi
push 0
push eax
mov dword [0x10039888], eax
call fcn.1001b930
add esp, 0x10
xor eax, eax
xor byte [eax + str.._._._.._._.__], 0x2e
inc eax
cmp eax, 0x1000
jl 0x10009791
push 0x1000
lea eax, [esp + 0x14]
push str.._._._.._._.__
push eax
call fcn.100068df
lea eax, [esp + 0x1c]
push eax
call fcn.1000693b
add esp, 0x10
jmp 0x10009860
lea eax, [esp + 0x10]
push eax
call fcn.1000693b
movzx edi, ax
lea eax, [esp + 0x14]
push eax
call fcn.1000693b
movsx ebx, si
pop ecx
pop ecx
movzx ecx, ax
mov eax, dword [0x10039888]
shl ebx, 3
lea esi, [ebx + eax]
movsx eax, di
dec eax
mov word [esi], di
je 0x1000983f
dec eax
je 0x10009828
dec eax
jne 0x10009855
movsx edi, cx
push edi
call fcn.10013c63
pop ecx
push edi
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.10006966
pop ecx
pop ecx
push eax
push dword [esi + 4]
call fcn.1001a750
add esp, 0xc
jmp 0x10009855
lea eax, [esp + 0x10]
push eax
call fcn.100068f8
pop ecx
mov ecx, dword [0x10039888]
mov dword [ebx + ecx + 4], eax
jmp 0x10009855
lea eax, [esp + 0x10]
push eax
call fcn.1000693b
pop ecx
mov ecx, dword [0x10039888]
mov word [ebx + ecx + 4], ax
lea eax, [esp + 0x10]
push eax
call fcn.1000693b
pop ecx
movzx esi, ax
test si, si
jg 0x100097c6
push 0x1000
push 0
push str.._._._.._._.__
call fcn.1001b930
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009b7f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
inc dword [0x10036824]
push 0x27
pop edx
call fcn.10009716
cmp ax, 1
jne 0x10009b9c
pop ebp
jmp fcn.10009b2a
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10009bb0
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x37
pop edx
call fcn.10009716
push 0x27
pop edx
cmp ax, 1
jne 0x10009be1
call fcn.10009716
cmp ax, 1
jne 0x10009bd9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009bcc
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.10009716
cmp ax, 1
jne 0x10009c09
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push eax
push dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10009f6b
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10009c55
push 0x1003682c
push 3
push 9
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x10009fa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x18
call fcn.10001e83
pop ecx
pop ecx
jmp 0x1000a084
push dword [0x1003682c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10009fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x19
jmp 0x10009f9b
push 0x800
call fcn.10006878
pop ecx
mov esi, 0x200
push esi
push eax
mov dword [0x1003683c], eax
call fcn.10006966
push esi
push dword [0x1003683c]
mov dword [0x10036830], eax
call fcn.10006966
push 0x400
push dword [0x1003683c]
mov dword [0x10036834], eax
call fcn.10006966
mov edi, 0x100
push edi
push dword [0x10036834]
mov dword [0x10036838], eax
push dword [ebp + 0xc]
call fcn.100027c3
add esp, 0x24
push edi
push dword [0x10036830]
push dword [ebp + 8]
call fcn.100027c3
add esp, 0xc
push esi
push dword [0x10036838]
push dword [ebp + 0x10]
call fcn.100027c3
add esp, 0xc
push dword [ebp + 0xc]
mov edi, 0x400
push dword [0x1003682c]
mov dword [0x10036840], 1
call fcn.10009c92
pop ecx
pop ecx
test eax, eax
je 0x1000a084
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000a06d
sub eax, ecx
push 0xf
push eax
push dword [ebp + 0xc]
call fcn.10001345
add esp, 0xc
pop edi
pop esi
pop ecx
pop ebp
ret

Function at 0x1000a125
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1000a183
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000a17a
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x1000a2a5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push 0
push 1
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000a2dd
add esi, eax
cmp esi, 2
jb 0x1000a2d5
cmp byte [esi + edi - 1], 0xa
jne 0x1000a2d5
cmp byte [esi + edi - 2], 0xd
je 0x1000a2e3
cmp esi, 0x800
jb 0x1000a2ab
or eax, 0xffffffff
pop esi
pop ebp
ret
mov byte [esi + edi - 2], 0
mov eax, esi
jmp 0x1000a2e0
Function at 0x1000a350
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.1000251a
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000a376
push eax
call sub.WS2_32.dll_closesocket
jmp 0x1000a3ca
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0xc], 0x100007f
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000a3a5
push esi
jmp 0x1000a36f
push 0x78
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1000a3a2
push dword [ebp + 0xc]
push esi
call fcn.1000a20c
push eax
push 0x1000a2ec
call fcn.10009b7f
add esp, 0x10
pop esi
leave
ret

Function at 0x1000a5aa
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x1000a5d4
push 6
mov dword [ecx], eax
pop eax
jmp 0x1000a6b6
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x1000a653
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x1000a5f6
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x1000a6a9
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x1000a665
movzx esi, byte [esi + 1]
jmp 0x1000a667
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000a69f
and esi, 0xf
movsx eax, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000a6a2
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000bf2b
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000c170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x10032c80]
mov ebx, eax
push edi
mov eax, esi
call fcn.1000cf20
test eax, eax
jne 0x1000c272
mov ecx, dword [0x10032c84]
cmp ecx, 1
jl 0x1000c26f
cmp ecx, 0x80
jg 0x1000c26f
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000c26f
test cl, 3
jne 0x1000c26f
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x10036880]
test edx, edx
je 0x1000c1e8
push 0x10032d08
push 0x10032c88
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000c272
cmp dword [ebp + 0xc], 0
je 0x1000c26b
mov edi, 0x10032c88
jmp 0x1000c1fb
mov esi, dword [0x10032c80]
xor edx, edx
test ecx, ecx
jle 0x1000c222
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x10032c88]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x10032c84]
jl 0x1000c206
mov esi, dword [0x10032c80]
imul esi, esi, 0x60
push 0x10032d08
push ebx
push edi
call dword [esi + 0x10036864]
add esp, 0xc
test eax, eax
jne 0x1000c272
mov ecx, dword [0x10032c84]
xor edx, edx
test ecx, ecx
jle 0x1000c261
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x10032c88]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x10032c84]
add edx, 4
cmp edx, ecx
jl 0x1000c249
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000c1f5
xor eax, eax
jmp 0x1000c272
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000c5b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10030370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x10033da8]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.1000cf20
test eax, eax
jne 0x1000c6be
mov ecx, dword [0x10033dac]
cmp ecx, 1
jl 0x1000c6bb
cmp ecx, 0x80
jg 0x1000c6bb
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000c6bb
test cl, 3
jne 0x1000c6bb
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x10036884]
test ecx, ecx
je 0x1000c63c
push 0x10033e30
push 0x10033db0
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000c6be
cmp dword [ebp + 8], 0
je 0x1000c6b7
jmp 0x1000c64a
mov esi, dword [0x10033da8]
imul esi, esi, 0x60
push 0x10033e30
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x10036868]
add esp, 0xc
test eax, eax
jne 0x1000c6be
mov eax, dword [0x10033dac]
xor edi, edi
test eax, eax
jle 0x1000c6a7
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x10033db0
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x10033db0]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x10033dac]
add edi, 4
cmp edi, eax
jl 0x1000c683
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000c644
xor eax, eax
jmp 0x1000c6be
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018068
leave
ret
Function at 0x1000d607
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000d4f7
test eax, eax
jne 0x1000d747
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x10037950]
push dword [esi + 0x10037954]
mov dword [ebp - 8], edi
call fcn.10013c63
push edi
mov dword [ebp - 4], eax
call fcn.10013c63
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000d738
test edi, edi
je 0x1000d72f
push edi
push ebx
call dword [esi + 0x100379a4]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000d70d
cmp dword [esi + 0x10037954], eax
jbe 0x1000d693
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x10037954]
jb 0x1000d678
push ebx
call dword [esi + 0x1003799c]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000d70d
push dword [esi + 0x10037954]
push dword [ebp - 4]
push ebx
call dword [esi + 0x100379a0]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000d70d
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x100379a0]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000d70d
push dword [ebp - 4]
push ebx
call dword [esi + 0x100379a4]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000d70d
cmp dword [ebp - 8], ecx
jbe 0x1000d706
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000d706
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000d6ef
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.10013b86
push dword [ebp - 0xc]
call fcn.10013b86
push dword [ebp - 4]
call fcn.10013b86
add esp, 0xc
mov eax, edi
jmp 0x1000d746
push dword [ebp - 4]
call fcn.10013b86
pop ecx
test edi, edi
je 0x1000d743
push edi
call fcn.10013b86
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000d74a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000d4f7
test eax, eax
jne 0x1000d785
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x10037950]
push dword [esi + 0x10037954]
mov dword [ebp - 4], eax
call fcn.10013c63
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000d788
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x10037954]
call fcn.10013c63
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000d7ae
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.10013b86
pop ecx
mov eax, ebx
jmp 0x1000d784
mov ecx, dword [esi + 0x10037954]
cmp ecx, 0x10
jae 0x1000d7f6
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x10035f88
mov eax, ebx
call fcn.1000c80d
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000d876
mov eax, dword [esi + 0x10037954]
cmp dword [ebp - 4], eax
jae 0x1000d826
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000d81e
push 0x10
push 0x10035f88
push eax
call fcn.1001a750
mov eax, dword [esi + 0x10037954]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000d826
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000d4c4
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x10037954], eax
jbe 0x1000d84b
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x10037954]
jb 0x1000d830
push edi
call dword [esi + 0x1003799c]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000d876
push dword [esi + 0x10037954]
push dword [ebp - 8]
push edi
call dword [esi + 0x100379a0]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000d7a1
push dword [edi + 0xe8]
call fcn.10013b86
pop ecx
jmp 0x1000d7a1
Function at 0x10018068
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10030370]
jne 0x10018072
repz ret
jmp fcn.1001d60d

Function at 0x1001c4f2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10017acd
and dword [ebp - 4], 0
cmp dword [0x100327dc], 0
mov ebx, eax
jne 0x1001c5a3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001c654
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001c654
push eax
call fcn.10017a5b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100327dc], eax
call esi
push eax
call fcn.10017a5b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100327e0], eax
call esi
push eax
call fcn.10017a5b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100327e4], eax
call esi
push eax
call fcn.10017a5b
pop ecx
mov dword [0x100327ec], eax
test eax, eax
je 0x1001c5a3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10017a5b
pop ecx
mov dword [0x100327e8], eax
mov eax, dword [0x100327e8]
cmp eax, ebx
je 0x1001c5fb
cmp dword [0x100327ec], ebx
je 0x1001c5fb
push eax
call fcn.10017ad6
push dword [0x100327ec]
mov esi, eax
call fcn.10017ad6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001c5fb
test edi, edi
je 0x1001c5fb
call esi
test eax, eax
je 0x1001c5f2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001c5f2
test byte [ebp - 0xc], 1
jne 0x1001c5fb
or dword [ebp + 0x10], 0x200000
jmp 0x1001c634
mov eax, dword [0x100327e0]
cmp eax, ebx
je 0x1001c634
push eax
call fcn.10017ad6
pop ecx
test eax, eax
je 0x1001c634
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001c634
mov eax, dword [0x100327e4]
cmp eax, ebx
je 0x1001c634
push eax
call fcn.10017ad6
pop ecx
test eax, eax
je 0x1001c634
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100327dc]
call fcn.10017ad6
pop ecx
test eax, eax
je 0x1001c654
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001c656
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
not ebx
imul ebx
sbb eax, 0x5c
neg eax
bswap esi
or esi, 0
inc eax
rcr edx, 0xf1
add esi, 0xc
bswap ebx
imul esi
inc ebx
rcr edx, 0xd3
or edi, 0x17
add edi, 0xa8
bswap ebx
dec edi
sbb eax, 0xbb
imul esi
rcl edi, 0x6e
add eax, 0xee
inc edx
or eax, 0xaa
bswap edi
bswap esi
rcl eax, 0x6b
dec ebx
bswap eax
sub esi, 0xc0
rcr edx, 0xb
sbb edi, 0x8b
or edi, 0x64
dec esi
inc edx
ror edx, 0x9b
ror edi, 0x13
mov esi, 0xbe
add edx, 0x6b
ror edx, 0xda
and edx, 0x43
ror esi, 0x71
neg eax
or edx, 0x6f
sbb edi, 0x89
sbb esi, 0x59
dec eax
rol edi, 0xec
imul edi
and edx, 0xf9
bswap edi
xor ecx, ecx
xor edi, edi
neg esi
rol edx, 0xbf
inc ebx
rcr eax, 0xc1
rcl eax, 0xbd
rol ebx, 0x27
add esi, 0x1c
sbb eax, 0xa1
sub ebx, 0xd4
inc esi
sub eax, 0x7c
rol edx, 0x3d
sbb esi, 0x76
dec ebx
bswap edx
imul edi
or eax, 0x9f
dec esi
neg esi
neg edx
sbb edi, 0x98
bswap edx
mov eax, 0xd1
bswap esi
sbb esi, 0x82
imul edi
inc esi
ror edx, 0x88
inc edi
neg ebx
rcl esi, 0xc6
dec esi
rcr eax, 0x6a
sub edi, 0xe5
mov edi, 0x53
mov edx, 0xe9
sbb edx, 0xd0
sbb edi, 0xdc
and edx, 0xcf
rol edi, 0x63
sub edx, 0x93
sbb esi, 0x84
sbb ebx, 0x5b
sub ebx, 0x4b
rol ebx, 0x34
neg eax
sub ebx, 0xab
sub ebx, 0x97
neg esi
rcr ebx, 0xb8
mov ecx, dword [ebp + 0xc]
rcl edi, 0x3e
ror esi, 0x7a
not edi
add ebx, 0x74
add edx, 0xf5
not esi
add ebx, 0xb1
sbb eax, 0xea
mov esi, 0xdb
bswap edi
rcr eax, 0x9d
rcl ebx, 0x6c
sub esi, 0x32
imul esi
ror ebx, 0x67
or ebx, 3
rol eax, 0x54
or edi, 0xf2
sub edx, 0x72
neg esi
add edx, 0xbf
sbb esi, 0x99
dec edx
rcr edi, 0x4d
sbb eax, 0x70
sbb edx, 0x85
neg edi
inc edi
bswap esi
ror ebx, 0xd0
rcr esi, 0x61
and eax, 0x11
dec esi
not ebx
ror eax, 0x82
imul eax
sbb edi, 0xe7
sbb ebx, 1
and ebx, 0x96
add edi, 0x89
rcr esi, 0x4d
not esi
sub esi, 0x5a
rcl ebx, 0xb
sbb eax, 0x14
and eax, 0xd2
ror edi, 0x71
add eax, 0x34
rcr esi, 0xb9
inc esi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, eax
mov ebx, eax
not byte [edi]
mov eax, esi
xor esi, esi
xor esi, esi
mov esi, esi
xor esi, ebx
xor ebx, eax
mov eax, ebx
mov eax, esi
xor eax, ebx
add byte [edi], 0x79
mov esi, eax
mov eax, eax
xor esi, ebx
mov esi, eax
xor eax, eax
xor ebx, esi
xor esi, esi
xor ebx, eax
mov esi, ebx
sub byte [edi], 0x30
mov esi, esi
mov esi, eax
xor esi, eax
mov ebx, ebx
xor ebx, esi
xor eax, eax
xor ebx, esi
mov esi, ebx
mov eax, eax
imul byte [edi]
inc edi
loop 0x401412
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404315
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4251d0]
jne 0x40431f
repz ret
jmp fcn.00406095
Function at 0x4049a6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403741
and dword [ebp - 4], 0
cmp dword [0x426068], 0
mov ebx, eax
jne 0x404a57
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404b08
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404b08
push eax
call fcn.004036cf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426068], eax
call esi
push eax
call fcn.004036cf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42606c], eax
call esi
push eax
call fcn.004036cf
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426070], eax
call esi
push eax
call fcn.004036cf
pop ecx
mov dword [0x426078], eax
test eax, eax
je 0x404a57
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004036cf
pop ecx
mov dword [0x426074], eax
mov eax, dword [0x426074]
cmp eax, ebx
je 0x404aaf
cmp dword [0x426078], ebx
je 0x404aaf
push eax
call fcn.0040374a
push dword [0x426078]
mov esi, eax
call fcn.0040374a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404aaf
test edi, edi
je 0x404aaf
call esi
test eax, eax
je 0x404aa6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404aa6
test byte [ebp - 0xc], 1
jne 0x404aaf
or dword [ebp + 0x10], 0x200000
jmp 0x404ae8
mov eax, dword [0x42606c]
cmp eax, ebx
je 0x404ae8
push eax
call fcn.0040374a
pop ecx
test eax, eax
je 0x404ae8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404ae8
mov eax, dword [0x426070]
cmp eax, ebx
je 0x404ae8
push eax
call fcn.0040374a
pop ecx
test eax, eax
je 0x404ae8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426068]
call fcn.0040374a
pop ecx
test eax, eax
je 0x404b08
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404b0a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret