joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40bdc8
pop dword [ebp - 0x18]
mov eax, 0x9d7a4d44
sub eax, 0x9d398f7c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xa25ac618
add dword [ebp - 0x28], 0xabf77f33
mov dword [ebp - 0x24], 0xbc960adc
add dword [ebp - 0x24], 0x759d4169
mov dword [ebp - 0x20], 0x1e9d0329
add dword [ebp - 0x20], 0x2daf4105
mov dword [ebp - 0x1c], 0x26cc261
add dword [ebp - 0x1c], 0xfd933d9f
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4a66736f
add dword [ebp - 0x28], 0x2a0bf5e7
mov dword [ebp - 0x24], 0xae566521
add dword [ebp - 0x24], 0x9315fc54
mov dword [ebp - 0x20], 0x7faa0dc6
add dword [ebp - 0x20], 0xe3c55ea6
mov dword [ebp - 0x1c], 0xa4affc3
sub dword [ebp - 0x1c], 0xa4affc3
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xbcaa6863
sub eax, 0xbc699817
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c54e
push 0
call eax
mov ecx, 0x3be2dc07
sub ecx, 0x3be288c8
xor edx, edx
add edx, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x18]
mov edi, 0x71d6cb19
add edi, 0xdb3a9530
xor dword [ebp - 8], 0xf467929
mov esi, dword [ebx]
xor dword [ebp - 0x10], esi
sub esi, edi
sub dword [ebp - 0x10], eax
mov dword [edx], esi
add dword [ebp - 4], 0x242dea2a
add edx, 0xe0761d08
sub edx, 0xe0761d04
add ebx, 0xe5e7b1e9
sub ebx, 0xe5e7b1e5
loop 0x40bee1
add eax, 0x48cba413
sub eax, 0x48ca6444
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
Function at 0x4fa280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9f000]
push edi
jmp 0x4fa29a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fa2a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa290
mov eax, 1
add ebx, ebx
jne 0x4fa2b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fa2c4
jne 0x4fa2e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa2e3
dec eax
add ebx, ebx
jne 0x4fa2d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fa2a8
add ebx, ebx
jne 0x4fa2df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fa335
xor ecx, ecx
sub eax, 3
jb 0x4fa2fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fa36a
sar eax, 1
mov ebp, eax
jmp 0x4fa306
add ebx, ebx
jne 0x4fa306
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa2d4
inc ecx
add ebx, ebx
jne 0x4fa314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fa2d4
add ebx, ebx
jne 0x4fa321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fa316
jne 0x4fa332
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fa316
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fa354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fa346
jmp 0x4fa296
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fa354
add edi, ecx
jmp 0x4fa296
pop esi
mov edi, esi
mov ecx, 0x3b6c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fa372
cmp byte [edi], 0x17
jne 0x4fa372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fa377
lea edi, [esi + 0xf4000]
mov eax, dword [edi]
or eax, eax
je 0x4fa3e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1131a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11323c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fa3a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x113244]
or eax, eax
je 0x4fa3e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4fa3c1
call dword [esi + 0x113240]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fa417
cmp al, 0xef
ja 0x4fa40a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fa3ec
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fa3f9
mov ebp, dword [esi + 0x113248]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fa44b
sub esp, 0xffffff80
jmp 0x435126
Function at 0x401510
Capabilities:
Encode data using xor

Disassembly:
salc
push ss
push esi
cld
out 0xbc, eax
loopne 0x40157b
adc eax, 0x972438fc
ret
mov dh, 0x32
cli
mov byte [0x8c8e2fb7], al
lds edi, [eax + ecx*8 - 0x3e]
sahf
sub eax, 0x7238869b
dec eax
les eax, [edx]
or eax, 0x42448fae
xlatb
js 0x4014ff
stosd dword es:[edi], eax
retf
Function at 0x401490
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x10
mov eax, 0x41607e
call fcn.00410be3
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
call fcn.00402039
push eax
lea ecx, [ebp - 0x14]
call fcn.00401e4f
mov esi, 0xf6
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x14]
call fcn.0040238a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.00401cb3
test esi, esi
je 0x4014e2
cmp esi, 0xf6
jbe 0x4014f8
mov esi, 0x41b87c
push esi
call fcn.00407811
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00401d8e
call fcn.00402039
push eax
lea ecx, [ebp - 0x10]
call fcn.00401e4f
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
push edi
mov edi, dword [ebp - 0x14]
jmp 0x401528
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401573
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push eax
push 0x41baac
push edi
lea eax, [ebp - 0x10]
push str._s_s_d.tmp
push eax
call fcn.00401aeb
mov esi, dword [ebp - 0x10]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401513
push ecx
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.004019f4
pop ecx
lea ecx, [esi - 0x10]
call fcn.00402405
lea ecx, [edi - 0x10]
call fcn.00402405
mov eax, ebx
call fcn.00410bb1
ret
push 0x41b9bc
mov ecx, ebx
call fcn.00401cdf
jmp 0x40155b

Function at 0x401811
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push ebx
push esi
mov esi, dword [0x420568]
mov ebx, ecx
push edi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
movzx eax, di
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x401844
pop edi
pop esi
xor edx, edx
mov ecx, eax
pop ebx
jmp fcn.004017a1
push 0
mov edx, edi
mov ecx, ebx
call fcn.004017e8
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x401854
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
push ecx
push dword [0x420568]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x4018cb
lea edx, [ebp - 4]
mov ecx, eax
call fcn.004017a1
mov esi, eax
test esi, esi
je 0x4018cb
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4018cb
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4018c2
mov al, 1
jmp 0x4018cd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4020cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402128
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402119
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x402115
cmp esi, ecx
jae 0x402119
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x402105
cmp esi, ecx
jb 0x40211d
xor eax, eax
jmp 0x402127
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40286b
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov ecx, dword [esi + 0xfc]
cmp dword [ecx - 0xc], eax
je 0x40289b
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x402e04
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
call fcn.0040286b
test al, al
jne 0x402e72
cmp byte [ebx + 0x100], al
je 0x402e67
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [ebx + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x3f9
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x3fc
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x3fb
push dword [ebx + 4]
call edi
push 5
push eax
call esi
pop edi
pop esi
jmp 0x402e72
push 6
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop ebx
ret 0x10
Function at 0x404adc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov bl, 1
mov ecx, dword [edi + 0x54]
mov eax, ecx
and eax, 0xc
cmp al, 0xc
jne 0x404b28
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [edi + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call esi
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push esi
push 0x4e
push eax
jmp 0x404b53
shr ecx, 2
test cl, 1
je 0x404b5b
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [edi + 4]
mov ecx, eax
movzx eax, si
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x404b8a
push 1
xor esi, esi
push esi
push esi
push dword [edi + 0x28]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x404b8a
or byte [edi + 0x58], 2
push 1
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407079
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x4164c7
call fcn.00410c82
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4070f6
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4070f6
call fcn.004038f1
mov esi, eax
jmp 0x407201
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x407119
call fcn.004038f1
jmp 0x4071f4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x40710f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea ecx, [ebx + 1]
cmp ecx, ebx
jae 0x40714c
mov esi, 0x8007000e
jmp 0x4071f6
xor eax, eax
mov byte [ebp - 4], 2
shld eax, ecx, 1
add ecx, ecx
cmp eax, esi
ja 0x407185
cmp ecx, 0xffffffff
ja 0x407185
cmp ecx, 0x400
jbe 0x407177
push ecx
lea ecx, [ebp - 0x418]
call fcn.00405b44
jmp 0x4071a3
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x4071a3
push 0x80070216
call fcn.004023c2
mov eax, 0x407195
ret
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x407142
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40710f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00406f22
mov esi, eax
test edi, edi
je 0x407201
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40721a
lea ecx, [ebp - 0x418]
call fcn.00405b2f
mov eax, esi
call fcn.00410bd4
ret 0x10
Function at 0x4109cb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040d5c6
mov dword [ebp - 0x14], eax
cmp dword [0x421468], esi
jne 0x410abe
push 0x800
push esi
push 0x41b798
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x410a4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x410b9e
push esi
push esi
push 0x41b798
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x410b9e
push 0x41b7b0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410b9e
push eax
call ebx
push 0x41b7bc
push edi
mov dword [0x421468], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42146c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x421470], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x421478], eax
test eax, eax
je 0x410abb
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x421474], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410ae3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410ad6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x410af8
push 4
pop eax
jmp 0x410ba0
cmp dword [ebp - 0x14], esi
je 0x410af8
push dword [0x421468]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410add
mov eax, dword [0x421474]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x410b56
cmp dword [0x421478], edi
je 0x410b56
push eax
call ebx
push dword [0x421478]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x410b56
test eax, eax
je 0x410b56
call ecx
test eax, eax
je 0x410b4b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x410b4b
test byte [ebp - 8], 1
jne 0x410b56
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x410b86
mov eax, dword [0x42146c]
cmp eax, edi
je 0x410b83
push eax
call ebx
test eax, eax
je 0x410b83
call eax
mov esi, eax
test esi, esi
je 0x410b83
mov eax, dword [0x421470]
cmp eax, edi
je 0x410b83
push eax
call ebx
test eax, eax
je 0x410b83
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x421468]
call ebx
test eax, eax
je 0x410b9e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x410ba0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040768c
mov esp, ebp
pop ebp
ret
Function at 0x402450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402489
push 0
call fcn.00401da0
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x40e2be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426ad0]
jne 0x40e2c8
repz ret
jmp fcn.00413d4c

Function at 0x419cff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413734
and dword [ebp - 4], 0
cmp dword [0x42d6f0], 0
mov ebx, eax
jne 0x419db0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x419e61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x421ce0
push edi
call esi
test eax, eax
je 0x419e61
push eax
call fcn.004136c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d6f0], eax
call esi
push eax
call fcn.004136c2
mov dword [esp], 0x421cbc
push edi
mov dword [0x42d6f4], eax
call esi
push eax
call fcn.004136c2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d6f8], eax
call esi
push eax
call fcn.004136c2
pop ecx
mov dword [0x42d700], eax
test eax, eax
je 0x419db0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004136c2
pop ecx
mov dword [0x42d6fc], eax
mov eax, dword [0x42d6fc]
cmp eax, ebx
je 0x419e08
cmp dword [0x42d700], ebx
je 0x419e08
push eax
call fcn.0041373d
push dword [0x42d700]
mov esi, eax
call fcn.0041373d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x419e08
test edi, edi
je 0x419e08
call esi
test eax, eax
je 0x419dff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x419dff
test byte [ebp - 0xc], 1
jne 0x419e08
or dword [ebp + 0x10], 0x200000
jmp 0x419e41
mov eax, dword [0x42d6f4]
cmp eax, ebx
je 0x419e41
push eax
call fcn.0041373d
pop ecx
test eax, eax
je 0x419e41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x419e41
mov eax, dword [0x42d6f8]
cmp eax, ebx
je 0x419e41
push eax
call fcn.0041373d
pop ecx
test eax, eax
je 0x419e41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d6f0]
call fcn.0041373d
pop ecx
test eax, eax
je 0x419e61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x419e63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x14f81270
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x14f81334
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x14fa126c], eax
call fcn.14f82440
test eax, eax
jne 0x14f81294
ret 0xc
mov ecx, dword [0x14fa126c]
xor edx, edx
mov eax, ecx
mov dl, ch
and eax, 0xff
mov dword [0x14fa1278], edx
mov dword [0x14fa1274], eax
shl eax, 8
add eax, edx
shr ecx, 0x10
mov dword [0x14fa1270], eax
mov dword [0x14fa126c], ecx
call fcn.14f815e0
test eax, eax
jne 0x14f812d6
call fcn.14f82480
xor eax, eax
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x14ff8950], eax
call fcn.14f822e0
mov ecx, dword [0x14ff8950]
mov dword [0x14fa1258], eax
test ecx, ecx
je 0x14f81325
test eax, eax
je 0x14f81325
call fcn.14f817c0
call fcn.14f822d0
call fcn.14f81b20
call fcn.14f81a30
call fcn.14f81480
mov eax, dword [0x14fa1254]
inc eax
mov dword [0x14fa1254], eax
mov eax, 1
ret 0xc
call fcn.14f81640
call fcn.14f82480
xor eax, eax
ret 0xc
test eax, eax
jne 0x14f81374
mov eax, dword [0x14fa1254]
test eax, eax
jle 0x14f8136f
mov ecx, eax
mov eax, dword [0x14fa12a4]
dec ecx
test eax, eax
mov dword [0x14fa1254], ecx
jne 0x14f81358
call fcn.14f814d0
call fcn.14f819d0
call fcn.14f81640
call fcn.14f82480
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc
cmp eax, 3
jne 0x14f81383
push 0
call fcn.14f81710
add esp, 4
mov eax, 1
ret 0xc

Function at 0x14f814e0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.14f815a0
mov eax, dword [0x14fa12a8]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x14f81504
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x14fa12a4], 1
mov byte [0x14fa12a0], bl
jne 0x14f8155e
mov ecx, dword [0x14ff8948]
test ecx, ecx
je 0x14f8154c
mov esi, dword [0x14ff8944]
sub esi, 4
cmp esi, ecx
jb 0x14f8154c
mov eax, dword [esi]
test eax, eax
je 0x14f81545
call eax
mov ecx, dword [0x14ff8948]
sub esi, 4
cmp esi, ecx
jae 0x14f81537
push 0x14f8901c
push 0x14f89014
call fcn.14f815c0
add esp, 8
push 0x14f89024
push 0x14f89020
call fcn.14f815c0
add esp, 8
test ebx, ebx
je 0x14f8157d
call fcn.14f815b0
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x14fa12a8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14f815e0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.14f826e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x14f8a884], eax
je 0x14f81638
push 0x74
push 1
call fcn.14f82910
mov esi, eax
add esp, 8
test esi, esi
je 0x14f81638
mov eax, dword [0x14f8a884]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14f81638
push esi
call fcn.14f81670
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x401ce6
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + 8]
test eax, eax
jbe 0x401ca3
mov ecx, eax
mov eax, dword [edi]
cmp ecx, eax
jbe 0x401c86
mov ecx, eax
mov eax, dword [edi + 0xc]
push ecx
add eax, dword [ebp + 8]
push eax
push ebx
call fcn.00402430
push dword [esi + 0x38]
push dword [edi]
call fcn.00401cca
add esp, 0x14
jmp 0x401cb4
mov eax, dword [edi]
test eax, eax
je 0x401cb6
push dword [esi + 0x38]
push eax
call fcn.00401cca
pop ecx
pop ecx
add ebx, eax
movzx eax, word [esi + 6]
inc dword [ebp + 0x18]
add edi, 0x28
cmp dword [ebp + 0x18], eax
jl 0x401c75
pop edi
pop esi
pop ebx
pop ebp
ret
or bh, byte [eax + edi*4 - 0x24]
xor al, 0xe8
lahf
mov dl, bl
mov cl, byte [edi]
mov eax, 0x1a1fe1c4
sbb dword [ebp + 0x22], eax
arpl word [ebx + 0x73], bp
bound edx, qword [ecx]
out dx, al
cmp eax, 0xcafbe832
sub esi, 0x41
sar dword [edx - 0x5d], 0x7d
mov bh, 0x1a
jp 0x401ca1
fnsave dword fs:[ebx]
nop
add byte [eax + 0x3c], dl
and eax, 0x2572c89f
outsb dx, byte [esi]
mov ecx, 0x44b85c5c
dec ebx
jge 0x401d65
outsb dx, byte [esi]
sbb esi, ebp
adc byte [ecx - 0x3de26a01], bl
aam 0x1f
jg 0x401d6b
pop eax
cmp ah, cl
inc esp
push 0xffffffffffffffa0
xchg ebx, eax
js 0x401d6d
enter 0x3f89, 0xffffffffffffff8e
inc edx
dec esi
scasb al, byte es:[edi]
fist dword [esp + edx - 0x40]
mov edi, esp
or byte [edx - 0xd614731], 0x86
inc edx
sub dl, byte [edx + 0x114963aa]
fsubr qword [0x41564a20]
pop es
or eax, 0x2c70634c
jmp 0x401de2
sub dword [ebx - 0x2f2e544a], ebp
fild dword es:[0x45439a57]
add eax, 0x45439a57
mov bh, 0xbc
lahf
pop ds
xor dl, byte [edi + 0x44eb6d0a]
mov bh, 0xb1
invalid
fcmovnb st(0), st(5)
test eax, 0xa803dc0e
lds ebp, [ecx - 0x57fc23f2]
or al, 0xd9
inc esp
mov ch, 0xd2
fsubr st(7)
xor bl, ch
lds esi, [eax - 0x28]
lahf
sub dword [eax], 0xc9327a5b
outsd dx, dword [esi]
insd dword es:[edi], dx
lcall 0x7a1a, 0x6bb382ab
mov edx, 0x6e8c2408
out dx, eax
pop ebx
cmp ah, al
sub al, 0x44
mov ebp, 0xdc56fd4e
dec ebx
fsub dword [ecx]
sti
lodsb al, byte [esi]
xchg edx, eax
pop ss
cmp bl, byte [ebp + 0x4d3fb71e]
pop esi
dec edi
jno 0x401de3
mov eax, dword [0xe8fbda5a]
outsb dx, byte [esi]
sbb dword [edi + edi*2 - 0x60fa1d63], ecx
sbb cl, bl
in eax, dx
iretd