joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402540
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x402579
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push esi
push 0xf01ff
push str.InpaintMAXSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4025ab
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4025d9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
dec eax
je 0x4025f7
sub eax, 3
jne 0x402607
test ebx, ebx
je 0x402607
lea eax, [ebp - 0x3c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x402607
cmp ebx, 1
je 0x402607
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00404280
mov esp, ebp
pop ebp
ret

Function at 0x402630
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, 3
call fcn.00402730
push 0xf003f
test eax, eax
mov ecx, 2
push 0
push 0
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40267b
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push esi
push 0xf01ff
push str.InpaintMAXSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4026ad
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0x41e318
push 1
push ebx
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x4026ed
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], str.InpaintMAX_Service
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00404280
mov esp, ebp
pop ebp
ret
Function at 0x402820
Capabilities:
Modify service

Disassembly:
push ebx
push edi
push 0xf003f
test ecx, ecx
mov eax, 2
push 0
mov ebx, 3
push 0
cmovne ebx, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x402849
pop edi
pop ebx
ret
push esi
push 0xf01ff
push str.InpaintMAXSvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40286e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
xor eax, eax
pop ebx
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0x41e318
push 1
push ebx
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4028a1
call esi
push edi
call esi
pop esi
pop edi
xor eax, eax
pop ebx
ret
call esi
push edi
call esi
pop esi
pop edi
mov eax, 1
pop ebx
ret
Function at 0x403560
Capabilities:
Create thread
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0x10], 0
xor ebx, ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.004037b0
test eax, eax
jne 0x4035a0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push esi
call fcn.00403850
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4035c3
push 0x32
push dword [0x41e524]
call esi
call fcn.00403850
test eax, eax
je 0x4035b0
push edi
call fcn.004030f0
call fcn.00402f90
mov edi, eax
call fcn.00402f90
mov dword [ebp - 0x14], eax
mov eax, dword [0x41e520]
test eax, eax
jne 0x4035f2
push eax
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x41e520], eax
push 0xffffffffffffffff
push eax
call esi
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
call fcn.004039d0
cmp dword [eax], 1
jne 0x40360f
xor esi, esi
jmp 0x403626
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
call fcn.004039d0
mov esi, 1
mov dword [eax], 1
push dword [0x41e520]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test esi, esi
jne 0x403649
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 4
push edi
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x40366c
mov eax, dword [ebp - 0x10]
push eax
mov edi, dword [eax]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
mov esi, 1
test eax, eax
je 0x4036a7
mov ecx, dword [ebp - 0xc]
call fcn.00403010
test eax, eax
mov dword [0x41e548], esi
cmovne ebx, esi
test ebx, ebx
jne 0x4036a7
push ebx
push ebx
push ebx
push 0x403910
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4036b5
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404280
mov esp, ebp
pop ebp
ret
Function at 0x4036d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x234], 0
test edi, edi
jne 0x403705
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40373a
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40374c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00405354
add esp, 8
test eax, eax
je 0x403777
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x403753
jmp 0x403783
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop ebx
pop esi
pop edi
call fcn.00404280
mov esp, ebp
pop ebp
ret

Function at 0x4037b0
Capabilities:
Get logon sessions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.Secur32.dll_LsaEnumerateLogonSessions]
test eax, eax
je 0x4037e9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404280
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.Secur32.dll_LsaFreeReturnBuffer]
cmp dword [ebp - 8], esi
jbe 0x40384b
push ebx
mov ebx, dword [sym.imp.Secur32.dll_LsaGetLogonSessionData]
nop
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + esi*8]
push eax
call ebx
test eax, eax
mov eax, dword [ebp - 0x10]
jne 0x40381a
cmp dword [eax + 0x24], 2
je 0x403841
test eax, eax
je 0x403821
push eax
call edi
inc esi
cmp esi, dword [ebp - 8]
jb 0x403800
xor esi, esi
pop ebx
push dword [ebp - 0xc]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00404280
mov esp, ebp
pop ebp
ret
push eax
mov esi, 1
call edi
jmp 0x403829
xor esi, esi
jmp 0x40382a
Function at 0x403850
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
xor ebx, ebx
call fcn.00402f90
push ebx
push 2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4038f5
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4038ee
push 0xc
lea eax, [ebp - 0x210]
push str.explorer.exe
push eax
call fcn.00405926
add esp, 0xc
test eax, eax
jne 0x4038d5
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4038d5
cmp dword [ebp - 8], edi
je 0x4038e9
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4038a2
jmp 0x4038ee
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404280
mov esp, ebp
pop ebp
ret
Function at 0x40e81f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040ae17
mov dword [ebp - 0x14], eax
cmp dword [0x41e2b0], esi
jne 0x40e912
push 0x800
push esi
push 0x415544
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e89f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e9f2
push esi
push esi
push 0x415544
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e9f2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e9f2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41e2b0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41e2b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41e2b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41e2c0], eax
test eax, eax
je 0x40e90f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41e2bc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e937
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e92a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e94c
push 4
pop eax
jmp 0x40e9f4
cmp dword [ebp - 0x14], esi
je 0x40e94c
push dword [0x41e2b0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e931
mov eax, dword [0x41e2bc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e9aa
cmp dword [0x41e2c0], edi
je 0x40e9aa
push eax
call ebx
push dword [0x41e2c0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e9aa
test eax, eax
je 0x40e9aa
call ecx
test eax, eax
je 0x40e99f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e99f
test byte [ebp - 8], 1
jne 0x40e9aa
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e9da
mov eax, dword [0x41e2b4]
cmp eax, edi
je 0x40e9d7
push eax
call ebx
test eax, eax
je 0x40e9d7
call eax
mov esi, eax
test esi, esi
je 0x40e9d7
mov eax, dword [0x41e2b8]
cmp eax, edi
je 0x40e9d7
push eax
call ebx
test eax, eax
je 0x40e9d7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41e2b0]
call ebx
test eax, eax
je 0x40e9f2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e9f4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404280
mov esp, ebp
pop ebp
ret
Function at 0x7d3539
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.007d2210
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x7d3576
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x7d3576
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x7d357a
xor eax, eax
jmp 0x7d35f8
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.007b1e9b
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x7d35b2
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x7d359c
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.007d36e9
push ebx
mov edi, eax
call fcn.007b1ec4
test edi, edi
pop ecx
je 0x7d35f4
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.007d34b2
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.007d35fd
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x7d4e7b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x7d4ea9
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x7d4ec7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.007d4de1
jmp 0x7d4ec7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x7d4ec7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.007d4de1
test edi, edi
mov eax, edi
jne 0x7d4eb1
pop edi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x7d5458
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x7d5508
mov ecx, 0x903e20
call fcn.007d4f95
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, eax
cmp word [esi + 8], 0
jne 0x7d54e6
push 0x831990
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x7d54c4
mov ecx, dword [ebp + 0x10]
push 5
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
movzx ecx, cx
push ecx
push eax
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x7d54c4
push ebx
push edi
push eax
call fcn.007b8d2c
add esp, 0xc
mov eax, dword [edi]
mov eax, dword [eax - 8]
inc eax
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [esi + 4], eax
push dword [edi]
push eax
call dword [sym.imp.kernel32.dll_lstrcpy]
mov ax, word [ebx]
mov word [esi + 8], ax
push dword [esi + 4]
mov ecx, edi
call fcn.007b22e3
mov si, word [esi + 8]
xor eax, eax
mov word [ebx], si
cmp si, 0xffff
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
Function at 0x7e4419
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.user32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x7e4441
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x7e4452
push 2
call edi
test ax, ax
jge 0x7e4452
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.kernel32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.user32.dll_SetCapture]
push eax
call fcn.007b3624
cmp dword [esi + 0x30], ebx
jne 0x7e452c
mov edi, dword [sym.imp.user32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.user32.dll_GetCapture]
push eax
call fcn.007b3624
cmp eax, dword [esp + 0x34]
jne 0x7e452c
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x7e44c8
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x7e450d
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x7e452c
cmp eax, 0x205
je 0x7e452c
cmp eax, 0x201
je 0x7e452c
cmp eax, 0x204
je 0x7e452c
cmp eax, ebx
jne 0x7e44f3
cmp dword [esp + 0x1c], 0x1b
je 0x7e452c
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.user32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x94845c]
jbe 0x7e4522
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x7e4485
call dword [sym.imp.user32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x9d8692
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
pop dword [esp - 4]
jmp 0x9d86a3
shl edi, 0x20
xchg al, ah
xchg ah, al
mov eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jbe 0x9d9093
ja 0x9d86bc
cpuid
mov edi, 0xc033f8c3
clc
xor eax, eax
jb 0x9d9b3c
jno 0x9d89f7
jo 0x9d86d0
dec ecx
xor ecx, ecx
jo 0x9d89f7
add eax, 0x506e8f8
add byte [eax], al
call 0x9d8be3
xor al, 0xd2
mov cx, cx
jno 0x9d86d8
xchg cx, ax
xchg cx, ax
jo 0x9d86ee
imul ebp, dword [edx - 0x178feb10], 0xe8501b82
mov eax, dword [0x83fffffd]
les ecx, [edx + edx*2]
jo 0x9d86d8
sbb byte [ebx], 0x50
call fcn.009d8499
add esp, 0xc
push edx
pop edx
mov cx, cx
mov dword [ebp - 0xc], eax
shr bp, 0x40
ja 0x9d81ca
mov eax, eax
jbe 0x9d8715
in eax, 0xc8
add eax, 0xaf860f98
cli
invalid
jbe 0x9d81ca
and eax, 0xe8d28b83
xchg ebp, eax
adc byte [eax], al
add byte [0x84d03e6], ah
mov ecx, dword [ebp - 4]
js 0x9d95dd
jns 0x9d8a06
and esp, dword [esi + 0x42]
sub byte [edi], cl
mov ecx, edx
or eax, dword [eax]
add bh, al
and eax, edi
inc ebp
hlt
jns 0x9d95dd
invalid
mov dh, dh
imul ecx, ecx, 0xab2f39d5
add eax, 0xfc085c8
add byte [edx], 0xf7
invalid

Function at 0x9e1a3c
Capabilities:
Encode data using xor

Disassembly:
pop dword [esp - 4]
shr di, 0x40
jmp 0x9df051
Function at 0x9e9fd0
Capabilities:
Check for software breakpoints

Disassembly:
pop dword [esp - 4]
mov byte [edx + ecx], al
mov eax, dword [ebp - 4]
shl cl, 0x20
js 0x9eced0
jns 0x9e9fe9
cpuid
ret
jns 0x9eced0
xor eax, 0xfc03333
xor byte [ebx + 0x66000021], 0xc1
in eax, dx
inc eax
mov ecx, dword [ebp + 8]

Function at 0x9ea7db
Capabilities:
Check for software breakpoints

Disassembly:
pop dword [esp - 4]
call fcn.009ed275
mov dword [ecx - 0x75], 0xc5811045
mov eax, dword [0x81b62d75]
in eax, dx
mov eax, dword [0x39b62d75]
inc ebp
cld

Function at 0x9eb9fb
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x14
lea ecx, [ecx]
push ebx
push esi
push edi
mov di, di
shr bh, 0x40
mov dword [ebp - 8], 0xffffffff
shl si, 0x20
mov dword [ebp - 0xc], 1
mov cx, cx
stc
jb 0x9eb047
retf
jb 0x9ec8da
cmp byte [ecx - 0x75], 0x45
fadd qword [eax - 0x36ccff39]
pop dword [esp - 4]
mov ebp, esp
clc
ja 0x9eb01d
jbe 0x9eba0d
jnp 0x9eba1f
or dword [edi], 0xffffff86
or dh, dh
invalid
jbe 0x9eb01d
and eax, 0xf3cde999
invalid
jge 0x9eba15
add byte [edi], cl
test byte [ecx + 0x75ffffc7], ch
add ecx, dword [edx - 0x7ef0f17f]
dec esi
fdivp st(7)
push dword [eax + 2]
xchg ebx, eax
sub ecx, dword [edi]
add byte [esi + ebx*8 - 1], 0xff
and eax, 0xee9de984
invalid
test ch, 0x26

Function at 0x9ed19b
Capabilities:
Check for software breakpoints

Disassembly:
pop dword [esp - 4]
je 0x9e7970
shl cx, 0x20
mov ah, ah
shr di, 0x40
jne 0x9e7967
add bl, byte [edx]
mov eax, dword [0xe9c08bd4]
inc esi
inc ecx
add byte [eax], al
jl 0x9e79e3
mov eax, eax
jmp 0x9ebab4
lea edi, [edi]
mov ecx, ecx
mov eax, dword [ebp + 8]
jno 0x9ed14c
jo 0x9e7983
mov byte [0xfe5477b], al
add bl, 0x57
add byte [eax], al
jo 0x9ed14c
fcomp st(6)
mov dword [ebp - 8], 0
mov cl, cl
shl si, 0x20
jmp 0x9e873b
in al, 0x66
xchg ebx, ebp
inc dword [ebp - 4]
js 0x9ea27c
jns 0x9ebabf
xlatb
sbb dword [edx + 0xf], ebx
mov dword [edi - 0x38000019], esi
nop
mov eax, dword [ebp + 0x10]
js 0x9ed187
jns 0x9ea27c
invalid
mov bp, bp
jns 0x9ebad7
push 0xaa890fad
push ss
add byte [eax], al
jns 0x9ed187
and eax, 0xe3efe867
invalid
mov dword [ebp - 0x20], eax
jno 0x9e7d68
jo 0x9ec9be
mov edi, 0x800f40d9
movsb byte es:[edi], byte [esi]
mov bl, 0xff
invalid
jo 0x9e7d68
fadd dword [ebx - 0x6aaa313d]
mov dh, dh
xchg ebp, eax
shr bp, 0x40
sub eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
shr dh, 0x40
shr eax, 0xc
cmp eax, dword [ebp - 0x14]
call fcn.009e8afe
xor al, 0xe5

Function at 0x9fca57
Capabilities:
Parse pe header

Disassembly:
push ecx
call dword [fcn.00a2b3f4]
mov edx, dword [ebp + 8]
pop dword [esp - 4]
push 0
push 3
push 0
push 3
push 0xc0000000
push 0xa29f10
jmp 0xa030d3
call dword [fcn.00a2b3f0]
cmp eax, 0xffffffff
mov dword [0xa1e19e], eax
jne 0xa0f8ef
jno 0x9fc319
jo 0xa030f3
movsd dword es:[edi], dword [esi]
dec byte [edi]
and byte [eax], 0x92
invalid
jo 0x9fc319
fmul dword [esi]
mov ecx, dword [0xa1e19e]
jmp 0x9f6bf9
push eax
call fcn.00a0bfdf
add esp, 4
cmp ax, 0x33c
jae 0xa0835d
mov edx, dword [0xa1e19e]
call fcn.009fc11c
invalid