joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533d44
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x533dec
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040ede8
mov ebx, eax
test bl, bl
jne 0x533dd1
mov bl, 1
push 4
lea eax, [ebp - 4]
push eax
push 0x533dfc
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x533dd1
push 4
lea eax, [ebp - 4]
push eax
push 0x533e14
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x533dd1
call fcn.00403544
mov esi, eax
test esi, esi
jle 0x533dcf
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004035a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427d08
mov eax, dword [ebp - 8]
mov edx, 0x533e30
call fcn.00405458
je 0x533dd1
inc dword [ebp - 4]
dec esi
jne 0x533da4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533df3
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret

Function at 0x533f18
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
call fcn.0040f860
test al, al
jne 0x533f90
cmp dword [0x687bc4], 0
je 0x533f90
mov eax, dword [0x687bc4]
call fcn.00444e00
mov eax, dword [0x5857f8]
call fcn.0041be74
test al, al
jne 0x533f6f
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x58253c]
cmp eax, dword [edx]
jne 0x533f63
mov eax, dword [0x687bc4]
mov eax, dword [eax + 4]
call fcn.00533ebc
jmp 0x533f86
mov eax, dword [0x687bc4]
call fcn.00444e08
jmp 0x533f86
push 0x64
call sub.kernel32.dll_Sleep_2
push 1
mov eax, dword [0x687bc4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, 0x687bc4
call fcn.0040f894
pop ebp
ret

Function at 0x537a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x537aee
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005340bc
call fcn.00488fac
test al, al
je 0x537ad3
call fcn.0040f584
lea edx, [ebp - 4]
call fcn.0040f2e8
mov eax, dword [ebp - 4]
call fcn.00457ef4
test al, al
je 0x537a94
call fcn.0040f584
cmp eax, dword [0x5857f8]
je 0x537ad3
lea edx, [ebp - 8]
mov eax, dword [0x5857f8]
call fcn.0040f2e8
mov eax, dword [ebp - 8]
call fcn.00457ef4
test al, al
jne 0x537ad3
push 0
call fcn.005340bc
lea ecx, [ebp - 0xc]
mov dl, 2
call fcn.00489a00
mov eax, dword [ebp - 0xc]
push eax
call fcn.005340bc
lea ecx, [ebp - 0x10]
mov dl, 0x99
call fcn.00489a00
mov eax, dword [ebp - 0x10]
mov ecx, 0x10
pop edx
call fcn.0041bbf4
push 0xb
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537af5
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405050
ret
Function at 0x56d1b4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x56d290
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x56d2a4
mov eax, ebx
call fcn.00428ee0
mov eax, dword [ebp - 4]
call fcn.00428bec
test al, al
je 0x56d229
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x56d2b4
call fcn.00429a7c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x263064]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x56d2dc
call fcn.00429a7c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x263064]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_MoveFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d297
lea eax, [ebp - 0x14]
call fcn.0040502c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x7b040c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esi, ebx
push dx
jmp 0x7b003b
lea esp, [esp + 2]
jmp 0x7b0072
push esi
jmp 0x7b00c5
mov dword [ebp - 4], esi
js 0x7afc23
mov cl, byte [esp]
jmp 0x7b005c
add esi, ebx
not cx
adc ecx, edx
jmp 0x7b00a9
mov cl, byte [esp]
mov cl, 0x31
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov ecx, 0x188032df
jmp 0x7b0080
lea ecx, reloc.RASAPI32.dll_RasHangUpA
sub eax, ecx
sub esp, 0x12
pushal
jmp 0x7b00e5
mov esi, ebp
add esi, 8
mov eax, dword [esi]
pop esi
jmp 0x7b0096
mov dword [ebp - 0x10], eax
jmp 0x7afcef
lea esp, [esp + 2]
lea esp, [esp + 0x30]
lea esi, reloc.RASAPI32.dll_RasHangUpA
clc
jmp 0x7b00cf
not eax
lea edi, [edx - 0x66]
lea eax, [ebp + ebp]
mov edi, dword [ebp + 8]
mov ax, 0x6a05
jmp 0x7b01ad
lea esp, [esp + 4]
jbe 0x7afc4b
ja 0x7b023b

Function at 0x7b041c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x7b0453
jbe 0x7afcd9
bsr di, si
mov ah, byte [esp]
jmp 0x7b043d

Function at 0x82ea5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, eax
lea esp, [esp + 3]
mov eax, dword [esp]
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x82ea9b
bsf edx, edi
not edx
mov bp, bx
mov byte [esp + 2], bl
jmp 0x82ea49
add esp, 0
mov byte [esp], ch
mov ah, al
rdtsc
shl ecx, 0x1e
mov dh, 0xcd
call fcn.0082eaad
lodsb al, byte [esi]
mov edi, 0x310fa20f
cpuid
rdtsc
and al, 0xfa
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov edi, ebp
mov edx, esp
jmp 0x82ea6d
pop bp
add esp, 0
mov ebx, 0xec3d260e
xchg ecx, edx
not bh
not eax
jmp 0x82ea83

Function at 0x82ef11
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov dx, word [esp + 0x1d]
push word [esp + 1]
jmp 0x82efa5
xchg dword [esp + 0x12], edi
std
jmp 0x82eefb
mov word [esp + 7], bx
lea ecx, [eax*4]
jmp 0x82ef78
mov eax, ecx
xchg dx, si
xchg byte [esp + 0xb], ah
pop esi
lea esp, [esp + 0xc]
rcr bx, 9
jmp 0x82ef18
lea eax, [ebx + esi]
mov edx, dword [esp + 0x20]
lea esp, [esp + 5]
mov byte [esp + 0x1a], cl
mov dl, byte [esp + 0xc]
pop dword [esp + 4]
jmp 0x82ef2e
not esi
add esp, 0
not di
cmc
xchg byte [esp], cl
add esp, 2
jmp 0x82ef8d
pop word [esp + 5]
add esp, 3
mov ebx, ecx
xchg dword [esp], ebx
mov bh, 0xc3
pop word [esp]
jmp 0x82ef62
xor esi, 0xba57afd4
mov bp, word [esp]
cpuid
xchg dx, cx
jmp 0x82efd3
pop dword [esp + 1]
push ax
seto ch
mov dword [esp + 1], eax
xor bh, 0x8b
adc si, bx
jmp 0x82ef49
mov ax, 0x6a70
xchg byte [esp], bl
mov esi, 0x525d9b93
neg bh
mov si, word [esp]
jmp 0x82efe5
mov bp, word [esp]
bswap eax
clc
lea ebp, [esp + eax]
cpuid
mov bp, 0x16fc
jmp 0x82efba
mov di, cx
mov ch, byte [esp]
dec ah
mov bh, 0x5c
xchg ebx, eax
setle ah
jmp 0x82f33a

Function at 0x82f139
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 3], eax
rdtsc
mov ah, 0x8c
mov dx, 0xa1e8
jmp 0x82f159
Function at 0x82f46d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax + ecx]
mov edx, 0x6476f493
ror bl, cl
rcl cx, 0xd
jmp 0x82f477
pop ebx
mov bp, word [esp + 1]
rol eax, cl
jmp 0x82f457
add esp, 0x1b
mov ebp, dword [esp]
rcl dh, 2
not esi
lea esi, [esi*4]
mov byte [esp], bh
jmp 0x82f4c6
bswap eax
add esp, 1
or bh, al
bsr bx, sp
sub esp, 0xf
xchg esi, eax
jmp 0x82f533
bswap edx
sub esp, 2
not eax
rdtsc
xchg ebx, esi
cld
jmp 0x82f49e
push dword [esp + 0x11]
mov edi, esp
mov ax, word [esp + 0x17]
pop bx
and edi, ebp
jmp 0x82f50f
rdtsc
mov dword [esp + 5], eax
mov cl, 0x2c
not cl
xchg esi, edx
pushfd
jmp 0x82f4d4
setbe dh
mov bp, 0x1b96
push esi
xchg byte [esp + 0x30], bl
lea eax, [ebx + edi]
jmp 0x82f556
not al
rdtsc
rdtsc
push dword [esp + 0x10]
sub esp, 0x18
push dword [esp + 0x24]
jmp 0x82f4f9
push eax
bswap ecx
bswap edi
not esi
lea ecx, [ecx + 0x45]
cld
jmp 0x82f4ea
push dword [esp + 3]
lea esp, [esp + 0x43]
mov cl, al
mov bl, byte [esp]
sub esp, 0xd
jmp 0x82f581
cpuid
mov edi, 0x27177530
mov ax, 0x54f
setl bl
xchg ecx, esi
neg bp
jmp 0x82f540
not ax
neg cl
xchg dx, bp
mov bp, word [esp + 1]
pop dword [esp]
jmp 0x82f5be
bsf esi, ecx
xchg si, dx
cpuid
pop word [esp + 2]
xchg word [esp + 8], dx
mov byte [esp + 5], bl
jmp 0x82f56b

Function at 0x830d70
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edi
cpuid
xchg dword [esp + 6], edi
shr si, 7
mov bh, 0x11
pop esi
jmp 0x82f38a
std
mov dword [esp + 8], esp
add esp, 0xc
pushfd
pop si
xchg word [esp + 3], si
jmp 0x82f3bf
sete ah
bsf bx, bp
mov edi, esp
or bh, 0x34
bswap esi
sub esp, 0x15
jmp 0x82f3fb
pop esi
lea eax, [esi + ebp]
mov dh, cl
mov ecx, esp
pop ecx
adc bx, bp
jmp 0x82f683
setbe bl
add esp, 0x16
push ax
xchg cl, dh
cld
cpuid
jmp 0x83054e
mov esi, 0xd51f5c16
pop ebp
bts cx, bp
xchg byte [esp + 7], al
xchg byte [esp + 0xe], al
jmp 0x830873

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x216e1fe8
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x188f12d9
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x472008], 0x8088405
inc edx
mov dword [ebx + 0x472008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x45654a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4578af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x47454c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x47454c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x473378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4578b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1463700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0146378f
jae 0x146370e
xor ecx, ecx
call fcn.0146378f
jae 0x146373d
xor eax, eax
call fcn.0146378f
jae 0x146374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0146378f
adc al, al
jae 0x146372f
jne 0x1463779
stosb byte es:[edi], al
jmp 0x1463711
call fcn.0146379b
sub ecx, ebx
jne 0x1463756
call fcn.01463799
jmp 0x1463775
lodsb al, byte [esi]
shr eax, 1
je 0x1463783
adc ecx, ecx
jmp 0x1463772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01463799
cmp eax, 0x7d00
jae 0x1463772
cmp ah, 5
jae 0x1463773
cmp eax, 0x7f
ja 0x1463774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1463711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40bff4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42cac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d8a
mov dword [ebp - 0x14], eax
cmp dword [0x2c892f0], esi
jne 0x40c0e7
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c074
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c1c7
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c1c7
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c1c7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x2c892f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x2c892f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x2c892f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2c89300], eax
test eax, eax
je 0x40c0e4
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2c892fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c10c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c0ff
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c121
push 4
pop eax
jmp 0x40c1c9
cmp dword [ebp - 0x14], esi
je 0x40c121
push dword [0x2c892f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c106
mov eax, dword [0x2c892fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c17f
cmp dword [0x2c89300], edi
je 0x40c17f
push eax
call ebx
push dword [0x2c89300]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c17f
test eax, eax
je 0x40c17f
call ecx
test eax, eax
je 0x40c174
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c174
test byte [ebp - 8], 1
jne 0x40c17f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c1af
mov eax, dword [0x2c892f4]
cmp eax, edi
je 0x40c1ac
push eax
call ebx
test eax, eax
je 0x40c1ac
call eax
mov esi, eax
test esi, esi
je 0x40c1ac
mov eax, dword [0x2c892f8]
cmp eax, edi
je 0x40c1ac
push eax
call ebx
test eax, eax
je 0x40c1ac
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x2c892f0]
call ebx
test eax, eax
je 0x40c1c7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c1c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403e3e
mov esp, ebp
pop ebp
ret