joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10127680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1012771b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x101276d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x101276d2
cmp esi, ebx
jge 0x101276d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10127715
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10127715
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x10155aa8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1012772d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10127950
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
mov eax, dword [ebp + 8]
je 0x10127978
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10127992
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10147db0
leave
ret 4

Function at 0x10127b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10127b96
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10127bf5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 0x10
Function at 0x10127c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10127c3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10127c6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10127c6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10127c6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10147db0
leave
ret 8
Function at 0x10136c00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor ebx, ebx
inc edx
mov edi, dword [esi]
cmp dword [edi + 0x254], ebx
je 0x10136c60
cmp dword [edi + 0x264], ebx
je 0x10136c59
cmp byte [0x107d44f4], 0
push edi
push dword [edi + 0x250]
je 0x10136c48
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10136c4e
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
xor edx, edx
inc edx
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
jmp 0x10136d40
mov eax, dword [edi + 0x25c]
test eax, eax
je 0x10136dcf
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x260], ebx
je 0x10136cae
lea eax, [ebp - 0x234]
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov ecx, dword [esi]
add esp, 0xc
test byte [ecx + 0x268], 1
push 0x10
pop eax
lea edx, [eax + 0x70]
cmove eax, edx
mov dword [ecx], eax
cmp byte [0x107d44f4], 0
je 0x10136cda
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10136cfc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d2a
mov dword [eax + 0x250], ebx
mov eax, dword [esi]
xor edx, edx
inc edx
mov dword [eax + 0x254], edx
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d40
mov dword [esi + 4], edx
mov ecx, eax
cmp dword [eax + 0x264], ebx
je 0x10136d67
cmp byte [0x107d44f4], 0
jne 0x10136d67
push dword [eax + 0x258]
add eax, 0x2c
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov ecx, dword [esi]
xor edx, edx
inc edx
mov eax, dword [ecx]
mov dword [ecx + 0x26c], eax
mov edi, dword [esi]
mov ebx, dword [edi + 0x26c]
shr ebx, 4
and ebx, edx
je 0x10136d9c
push esi
xor ebx, ebx
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
xor edx, edx
inc edx
cmp word [eax], 0x2e
je 0x10136d98
test byte [edi + 0x268], 3
jne 0x10136da6
mov ebx, edx
jmp 0x10136da6
test byte [edi + 0x268], 1
cmovne ebx, edx
mov eax, dword [edi + 0x264]
test eax, eax
je 0x10136dca
push 0
test ebx, ebx
pop ebx
jne 0x10136c20
test byte [edi + 0x26c], 2
jne 0x10136c20
test eax, eax
setne al
jmp 0x10136dd1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 4
Function at 0x6e946be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x6e946bef
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
invalid
inc ebp

Function at 0x6e946ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.6e946911
push eax
push esi
push dword [ebp + 8]
call fcn.6e9468c6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x6e946d9c

Function at 0x6e946da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72

Function at 0x6e946fb0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x6e946fb5
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae sym.libgcc_s_dw2_1.dll___floatdidf
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x6e946f9a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x6e946fa2
cmp edx, ebx
jne 0x6e9470f0
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x6e946f71
add eax, dword [eax + 4]
jmp 0x6e946f5e
mov dword [ebp + 0xc], ebx
jmp 0x6e946fc0
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x6e946fd8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x6e946ff6
movzx eax, ax
lea eax, [eax + eax*4]
invalid
invalid
Function at 0x6e947010
Capabilities:
Inspect section memory permissions

Disassembly:
inc ebp
mov esp, 0xd78b4077
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x6e94703b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x6e947044
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x6e94704e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x6e947030
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
Function at 0x6e94e890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x40
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
test edx, edx
je 0x6e94e973
mov edi, edx
mov ecx, edx
shr edi, 0x1f
neg ecx
mov ebx, edi
test bl, bl
cmovne edx, ecx
bsr ebx, edx
xor ebx, 0x1f
lea esi, [ebx + 0x70]
mov dword [esp + 4], 0x401e
sub dword [esp + 4], ebx
add ebx, 0x51
mov ecx, ebx
cmovns esi, ebx
sar ecx, 0x1f
shr ecx, 0x1b
add ebx, ecx
and ebx, 0x1f
sar esi, 5
sub ebx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], esi
mov dword [esp], ebx
jne 0x6e94e9c6
cmp esi, 3
jg 0x6e94ea34
mov ecx, esi
neg ecx
lea edx, [esp + 0x30]
lea ebx, [esp + esi*4 + 0x20]
shl ecx, 2
mov edi, dword [edx + ecx]
sub edx, 4
mov dword [edx + 4], edi
cmp edx, ebx
jne 0x6e94e929
sub esi, 1
test esi, esi
js 0x6e94e94e
lea ebp, [esp + 0x24]
mov dword [ebp + esi*4], 0
sub esi, 1
jns 0x6e94e941
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
movzx esi, word [esp + 0x30]
mov dword [esp], edi
movzx edi, word [esp + 4]
movzx ebp, byte [esp + 0x10]
and di, 0x7fff
jmp 0x6e94e984
xor ebp, ebp
xor edi, edi
xor esi, esi
xor ecx, ecx
mov dword [esp], 0
xor ebx, ebx
mov word [esp + 0x20], si
movzx esi, word [esp + 0x22]
shl ebp, 7
and si, 0x8000
or esi, edi
mov edi, dword [esp]
mov word [esp + 0x22], si
shr si, 8
and esi, 0x7f
or esi, ebp
mov edx, esi
mov byte [esp + 0x23], dl
mov edx, dword [esp + 0x20]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0xc], edx
add esp, 0x40
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 2
jg 0x6e94ea25
mov edx, 3
mov edi, dword [esp]
lea ebp, [esp + 0x24]
sub edx, esi
mov dword [esp + 8], 0x20
lea edx, [ebp + edx*4]
sub dword [esp + 8], edi
mov edi, eax
mov eax, dword [edx - 4]
movzx ecx, byte [esp + 8]
mov ebx, dword [edx]
shr eax, cl
movzx ecx, byte [esp]
shl ebx, cl
or eax, ebx
mov dword [edx + esi*4], eax
sub edx, 4
cmp edx, ebp
jne 0x6e94e9eb
mov edx, dword [esp + 0x24]
mov eax, edi
sub esi, 1
movzx ecx, byte [esp]
mov edi, dword [esp + 0xc]
shl edx, cl
mov dword [esp + edi*4 + 0x24], edx
jmp 0x6e94e939
mov esi, 2
mov dword [esp + 0xc], 3
jmp 0x6e94ea12
mov esi, 3
jmp 0x6e94e93d
Function at 0x6e94ea40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
test edx, edx
je 0x6e94eb07
bsr ecx, edx
xor ecx, 0x1f
lea esi, [ecx + 0x70]
mov dword [esp + 4], 0x401e
sub dword [esp + 4], ecx
add ecx, 0x51
mov ebx, ecx
cmovns esi, ecx
sar ebx, 0x1f
shr ebx, 0x1b
add ecx, ebx
and ecx, 0x1f
sar esi, 5
sub ecx, ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], esi
mov dword [esp], ecx
jne 0x6e94eb50
cmp esi, 3
jg 0x6e94ebc0
mov ebx, esi
neg ebx
lea edx, [esp + 0x2c]
lea edi, [esp + esi*4 + 0x1c]
shl ebx, 2
mov ecx, dword [edx + ebx]
sub edx, 4
mov dword [edx + 4], ecx
cmp edx, edi
jne 0x6e94eac5
sub esi, 1
test esi, esi
js 0x6e94eaea
lea ebp, [esp + 0x20]
mov dword [ebp + esi*4], 0
sub esi, 1
jns 0x6e94eadd
movzx edi, word [esp + 4]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
movzx edx, word [esp + 0x2c]
and di, 0x7fff
jmp 0x6e94eb11
xor edi, edi
xor edx, edx
xor ecx, ecx
xor ebx, ebx
xor esi, esi
mov word [esp + 0x1c], dx
movzx edx, word [esp + 0x1e]
and dx, 0x8000
or edx, edi
mov word [esp + 0x1e], dx
shr dx, 8
and edx, 0x7f
mov byte [esp + 0x1f], dl
mov edx, dword [esp + 0x1c]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 2
jg 0x6e94ebb0
mov edx, 3
mov edi, dword [esp]
lea ebp, [esp + 0x20]
sub edx, esi
mov dword [esp + 8], 0x20
lea edx, [ebp + edx*4]
sub dword [esp + 8], edi
mov edi, eax
mov eax, dword [edx - 4]
movzx ecx, byte [esp + 8]
mov ebx, dword [edx]
shr eax, cl
movzx ecx, byte [esp]
shl ebx, cl
or eax, ebx
mov dword [edx + esi*4], eax
sub edx, 4
cmp edx, ebp
jne 0x6e94eb75
mov edx, dword [esp + 0x20]
mov eax, edi
sub esi, 1
movzx ecx, byte [esp]
mov edi, dword [esp + 0xc]
shl edx, cl
mov dword [esp + edi*4 + 0x20], edx
jmp 0x6e94ead5
mov esi, 2
mov dword [esp + 0xc], 3
jmp 0x6e94eb9c
mov esi, 3
jmp 0x6e94ead9
Function at 0x6e950b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6e950b5f
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
leave
ret
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x6e954ce0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], 0x6e957a1c
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6e954d40
Function at 0x6e955630
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x6e955668
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x6e95565e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x6e95566a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x6e955650
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x40e28b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409441
mov dword [ebp - 0x14], eax
cmp dword [0x4afc9c], esi
jne 0x40e37e
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e30b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e45e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e45e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e45e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4afc9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4afca0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4afca4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4afcac], eax
test eax, eax
je 0x40e37b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4afca8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e3a3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e396
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e3b8
push 4
pop eax
jmp 0x40e460
cmp dword [ebp - 0x14], esi
je 0x40e3b8
push dword [0x4afc9c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e39d
mov eax, dword [0x4afca8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e416
cmp dword [0x4afcac], edi
je 0x40e416
push eax
call ebx
push dword [0x4afcac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e416
test eax, eax
je 0x40e416
call ecx
test eax, eax
je 0x40e40b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e40b
test byte [ebp - 8], 1
jne 0x40e416
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e446
mov eax, dword [0x4afca0]
cmp eax, edi
je 0x40e443
push eax
call ebx
test eax, eax
je 0x40e443
call eax
mov esi, eax
test esi, esi
je 0x40e443
mov eax, dword [0x4afca4]
cmp eax, edi
je 0x40e443
push eax
call ebx
test eax, eax
je 0x40e443
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4afc9c]
call ebx
test eax, eax
je 0x40e45e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e460
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404493
mov esp, ebp
pop ebp
ret
Function at 0x417015
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x421dc0
call fcn.00417964
push 1
call fcn.004173af
pop ecx
test al, al
jne 0x416ebe
push 7
call fcn.00417ad7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041737a
mov byte [ebp - 0x24], al
mov eax, dword [0x424890]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x416eb7
test eax, eax
jne 0x416f28
mov dword [0x424890], ecx
push 0x41a404
push 0x41a3ec
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x416f0b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41700f
push 0x41a3e8
push 0x41a3bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x424890], 2
jmp 0x416f2d
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041750c
pop ecx
call fcn.00417acb
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x416f5d
push esi
call fcn.0041747f
pop ecx
test al, al
je 0x416f5d
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00417d06
call esi
call fcn.00417ad1
mov esi, eax
cmp dword [esi], edi
je 0x416f7b
push esi
call fcn.0041747f
pop ecx
test al, al
je 0x416f7b
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00417bec
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00417c1f
test al, al
jne 0x416fb4
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x416fbd
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00417529
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41700f
call fcn.004179aa
ret
call fcn.00416d24
jmp 0x416e9f

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx