joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f300
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b55b0]
cmp dword [eax + 0x30], 0
je 0x45f3aa
cmp dword [ebx + 0x94], 0
jne 0x45f3a4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f290
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f3a4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f36a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f3a4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418ef4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f379
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4600c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4600f9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049b0
jmp 0x460106
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404914
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x461480
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4614ee
mov eax, esi
call fcn.0044bb70
test al, al
je 0x4614ee
mov eax, dword [ebx + 0x84]
call fcn.0044b7d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4614ee
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4614e2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044b7d0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00443b84
jmp 0x4614ee
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004612bc
pop esi
pop ebx
ret

Function at 0x466f7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466fec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.0040500c
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x466fb6
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.00404d84
push eax
push esi
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
xchg edx, eax
call fcn.0040500c
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00466c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466ff3
lea eax, [ebp - 8]
call fcn.004048c0
ret
Function at 0x470184
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x47018c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47037e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x470394
mov eax, esi
call fcn.0046dddc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404914
lea ecx, [ebp - 0x10]
mov edx, 0x4703a8
mov eax, esi
call fcn.0046dddc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404914
lea ecx, [ebp - 0x14]
mov edx, 0x4703c0
mov eax, esi
call fcn.0046dddc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404914
lea ecx, [ebp - 0x18]
mov edx, 0x4703dc
mov eax, esi
call fcn.0046dddc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404914
lea ecx, [ebp - 0x1c]
mov edx, 0x4703f8
mov eax, esi
call fcn.0046dddc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404914
lea ecx, [ebp - 0x24]
mov edx, 0x470410
mov eax, esi
call fcn.0046dddc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409124
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004096f8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x470428
mov eax, esi
call fcn.0046dddc
mov eax, dword [ebp - 0x28]
call fcn.00467948
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x470438
mov eax, esi
call fcn.0046dddc
mov eax, dword [ebp - 0x2c]
call fcn.00467948
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x470450
mov eax, esi
call fcn.0046dddc
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004096f8
inc eax
je 0x470321
lea ecx, [ebp - 0x34]
mov edx, 0x470450
mov eax, esi
call fcn.0046dddc
mov eax, dword [ebp - 0x34]
call fcn.004096bc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
call fcn.0040ac9c
fstp qword [ebp - 0x3c]
wait
call fcn.0040b004
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x47033c
lea ecx, [ebp - 0x40]
mov edx, 0x470450
mov eax, esi
call fcn.0046dddc
mov eax, dword [ebp - 0x40]
call fcn.00467948
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x470460
mov eax, esi
call fcn.0046dddc
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470385
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004048e4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004048e4
ret
Function at 0x47ad8c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4078d4]
call fcn.0040537c
xor eax, eax
push ebp
push 0x47af2d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a3fa8], 0
jne 0x47ade7
mov ecx, dword [0x4b1468]
mov dl, 1
mov eax, dword [0x408094]
call fcn.0040ce9c
call fcn.00404234
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004032dc
mov eax, ebx
call fcn.0040522c
mov dword [ebp - 0x24], eax
mov esi, 0x47af3c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040645c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.0040523c
test eax, eax
jle 0x47aed0
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x47aebc
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404b30
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x47ae62
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404b48
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x47ae78
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404b48
mov eax, dword [ebp - 0x54]
call fcn.00404d84
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404b30
mov eax, dword [ebp - 0x58]
call fcn.00404d84
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x47aebe
xor eax, eax
test al, al
je 0x47aec9
mov ebx, 0x15
jmp 0x47aed5
mov ebx, 0x10
jmp 0x47aed5
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4a3fa8]
call fcn.0047ac10
mov eax, dword [ebp - 4]
call fcn.0047ac10
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47af34
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004048e4
lea eax, [ebp - 0xc]
mov edx, dword [0x4078d4]
call fcn.0040544c
ret
Function at 0x47e6b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0047e110
test byte [ebx + 0x285], 4
jne 0x47e745
mov edx, esp
mov eax, ebx
call fcn.00443574
push esp
mov eax, ebx
call fcn.0044b5c0
push eax
push 0
mov eax, ebx
test eax, eax
je 0x47e6e5
sub eax, 0xfffffd34
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x260]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x274], 0
jne 0x47e716
mov ecx, dword [0x4b1788]
mov dl, 1
mov eax, dword [0x47a8cc]
call fcn.0040ce9c
call fcn.00404234
mov eax, ebx
call fcn.0047ec88
cmp byte [ebx + 0x57], 0
jne 0x47e74c
mov eax, ebx
call fcn.0044b7d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47e74c
push 0
mov eax, ebx
call fcn.0044b7d0
push eax
call sub.user32.dll_ShowWindow
jmp 0x47e74c
mov eax, ebx
call fcn.00447db4
add esp, 0x10
pop ebx
ret

Function at 0x4899cc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4899fa
mov eax, ebx
call fcn.0048a480
cmp dword [ebx + 0x40], 0
je 0x4899f3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x489a6b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x489a5d
cmp dword [ebx + 8], 0
je 0x489a1c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x489a2e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x489a5d
cmp dword [ebx + 8], 0
je 0x489a0f
cmp eax, 3
je 0x489a41
dec eax
jne 0x489a0f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x489a0f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x489a0f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x489a89
cmp dword [ebx + 0x14], 0xcc
je 0x489a89
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00489a94
pop ebx
ret
Function at 0x49a1d8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d74
mov eax, dword [ebp - 8]
call fcn.00404d74
xor eax, eax
push ebp
push 0x49a2a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, dword [ebp - 8]
call fcn.00404d84
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x49a2b0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404d84
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a2aa
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e4
ret

Function at 0x49a2b8
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d74
mov eax, dword [ebp - 8]
call fcn.00404d74
mov eax, dword [ebp - 0xc]
call fcn.00404d74
mov eax, dword [ebp + 0xc]
call fcn.00404d74
xor eax, eax
push ebp
push 0x49a3c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 8]
call fcn.00404d84
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 3
mov eax, 0x49a3d8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404d84
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404d84
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404d84
push eax
movzx eax, word [ebp + 8]
push eax
push edi
push ebx
call sub.wininet.dll_InternetConnectA
push esi
lea eax, [ebp - 0x20]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a3cc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004048e4
lea eax, [ebp + 0xc]
call fcn.004048c0
ret
Function at 0x49ba7c
Capabilities:
Create http request

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov esi, 0x14
mov dword [esp], 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 3
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 2
mov eax, 0x49bb10
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 3
mov eax, 0x49bb14
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
push 0
push 0
push 0
push 1
push 0x49bb10
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [esp + 4]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
add esp, 0x38
pop esi
pop ebx
ret

Function at 0x49bc64
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.004032dc
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x49bc92
mov al, 1
jmp 0x49bc94
xor eax, eax
add esp, 0xc
ret
Function at 0x496d30
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x514690], 0
jne 0x496d53
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x496ca4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x514690], eax
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
mov ecx, 0x5dad44de
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section._RDATA
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xb2b4d29
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x429777
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x429786
pop dword [ebp - 0x4c]
mov eax, 0xff4c0f71
sub eax, 0xff0977eb
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x635f83f5
sub dword [ebp - 0x5c], 0x150d3eaa
mov dword [ebp - 0x58], 0x36651a0
add dword [ebp - 0x58], 0x2eccfaa5
mov dword [ebp - 0x54], 0x61f16274
add dword [ebp - 0x54], 0xea5ae1ba
mov dword [ebp - 0x50], 0xf93bfd
sub dword [ebp - 0x50], 0xf93bfd
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xce14454d
sub eax, 0xcdd09339
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe6566d96
sub dword [ebp - 0x5c], 0x71e40440
mov dword [ebp - 0x58], 0x45828bde
add dword [ebp - 0x58], 0xfbe9d597
mov dword [ebp - 0x54], 0x24e66956
add dword [ebp - 0x54], 0x3e890316
mov dword [ebp - 0x50], 0x3af05e6d
add dword [ebp - 0x50], 0xc50fa193
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xb4c381b4
add eax, 0x4b8030bc
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x454df
push 0
call eax
mov ecx, 0x342f55b7
add ecx, 0xcbd0f5c6
mov edi, eax
mov ebx, 0x4c329140
add ebx, 0xb413bcc0
add ebx, dword [ebp - 0x4c]
mov esi, 0x9061c6fc
add esi, 0x8ab0dbbc
xor dword [ebp - 8], 0x98cf0646
mov edx, dword [ebx]
xor dword [ebp - 0x2c], 0x97a8ea11
xor edx, esi
sub dword [ebp - 0x48], 0x5678bb0b
mov dword [edi], edx
sub dword [ebp - 4], 0xc9587416
add edi, 0x177265ea
add edi, 0xe88d9a1a
add ebx, 4
loop 0x4298a8
add eax, 0x539988d0
sub eax, 0x53986809
xor ebx, ebx
add ebx, eax
add eax, 0x75f2f906
sub eax, 0x75f2f901
mov ecx, 0x47947c94
sub ecx, 0x47547c94
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc
Function at 0x10003ae0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 4]
sub ecx, 1
js 0x10003b0b
mov eax, dword [esi + 8]
lea edx, [eax + ecx*4]
mov eax, dword [edx]
movzx eax, word [eax + 6]
cmp eax, 4
je 0x10003b1e
cmp eax, 0xd
je 0x10003b1e
sub edx, 4
sub ecx, 1
jns 0x10003af3
mov eax, dword [esi]
sub eax, 1
je 0x10003b2c
sub eax, 2
je 0x10003b25
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
mov edx, 0x100040e0
jmp 0x10003b31
mov edx, 0x10004020
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x18]
sub edx, eax
sub edx, 0xa
mov dword [ecx + 1], eax
mov eax, dword [esp + 0x10]
mov byte [ecx], 0xb8
mov byte [ecx + 5], 0xe9
mov dword [ecx + 6], edx
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x14], eax
xor eax, eax
pop esi
ret

Function at 0x10004c6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10004c7e
pop dword [ebp - 0x14]
mov eax, 0xd629802c
add eax, 0x39d6cc52
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x327e6
push 0
mov eax, 0x94a43c29
add eax, 0x7b5c13df
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x71bc147d
sub ecx, 0x71bbdc85
xor edx, edx
add edx, eax
mov ebx, 0x10007400
add ebx, dword [ebp - 0x14]
mov edi, 0x694a0cfc
sub edi, 0xb76cd4
sub dword [ebp - 4], eax
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0x8c7bf0d0
add esi, edi
add dword [ebp - 8], eax
mov dword [edx], esi
xor dword [ebp - 4], 0x73c42086
add edx, 0x59f987da
sub edx, 0x59f987d6
add ebx, 0xce184669
add ebx, 0x31e7b99b
loop 0x10004cd9
add eax, 0x35344a2f
sub eax, 0x3533777c
xor ebx, ebx
add ebx, eax
add eax, 0xd06bc630
add eax, 0x2f9439d5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x6e019afa
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04be97
call fcn.6e049338
mov ebx, 0x6e06f2fc
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
mov edi, dword [0x6e06ea58]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
jmp 0x6e019b3c
mov ecx, dword [eax + 8]
lea edx, [esi + 1]
mov eax, dword [eax]
cmp byte [ecx + 0x168], 0
cmove edx, esi
mov esi, edx
cmp eax, edi
jne 0x6e019b28
mov edi, dword [0x6e06ea60]
mov eax, dword [edi]
jmp 0x6e019b5e
mov ecx, dword [eax + 8]
lea edx, [esi + 1]
mov eax, dword [eax]
cmp byte [ecx + 0x168], 0
cmove edx, esi
mov esi, edx
cmp eax, edi
jne 0x6e019b4a
cmp byte [0x6e07047b], 0
jne 0x6e019b74
cmp byte [0x6e07047a], 0
je 0x6e019ba8
push esi
push str._AcroPDFImpl__CAcroPDFModule::GetOpenCountDocShimList_count___d
mov edi, 0x6e06ee88
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e019b98
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e019ba8
push edi
call fcn.6e003fc0
pop ecx
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e049301
ret

Function at 0x6e019ce2
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04be97
call fcn.6e049338
mov edi, 0x6e06f2a0
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
and dword [ebp - 4], 0
cmp byte [0x6e07047b], 0
jne 0x6e019d17
cmp byte [0x6e07047a], 0
je 0x6e019d50
push dword [0x6e06f2ec]
mov esi, 0x6e06ee88
push str._AcroPDFImpl__GetPerProcessObjectCount_Object_count___d
push esi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e019d40
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e019d50
push esi
call fcn.6e003fc0
pop ecx
mov esi, dword [0x6e06f2ec]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e049301
ret