joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6440a9b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6452e064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6452e05c]
sub esp, 4
test ebx, ebx
je 0x6440aa05
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6440a9fe
test esi, esi
je 0x6440a9fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6440a9e0
mov dword [esp], 0x6452e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6440ad30
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x64400000], 0x5a4d
jne 0x6440ad55
mov ecx, dword [0x6440003c]
cmp dword [ecx + 0x64400000], 0x4550
lea edx, [ecx + 0x64400000]
je 0x6440ad60
ret
cmp word [ecx + 0x64400018], 0x10b
jne 0x6440ad55
push esi
movzx eax, word [ecx + 0x64400014]
push ebx
movzx esi, word [ecx + 0x64400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x64400000
test esi, esi
je 0x6440ada8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6440ad9e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6440adaa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6440ad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6440b320
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x6452e060]
test eax, eax
jne 0x6440aa30
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0xc
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x6440aa90
mov eax, dword [esp + 0x20]
mov dword [esp], 0x6452e064
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6452e05c]
mov dword [0x6452e05c], ebx
sub esp, 4
mov dword [ebx + 8], eax
mov dword [esp], 0x6452e064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
add esp, 0x18
pop ebx
ret
or eax, 0xffffffff
jmp 0x6440aa8b
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x6440b350
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp 0x6441ad80
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 8]
test eax, eax
jne 0x6441ad90
xor eax, eax
ret
jmp 0x6440aa20

Function at 0x6440b390
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6440b3d0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x6440b3f8
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6441add8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [0x6452e02c]
mov dword [esp + 0x4c], eax
xor eax, eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6441ae40
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x644e8432
mov ecx, eax
call fcn.644a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469930
jmp 0x6441afb0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6441ae92
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x644e8432
mov ecx, eax
call fcn.644a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469930
jmp 0x6441afb0
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetClipboardData]
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6441aeed
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x644e8432
mov ecx, eax
call fcn.644a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469930
jmp 0x6441afb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
jne 0x6441af45
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469900
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov dword [esp], 0x644e8432
mov ecx, eax
call fcn.644a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469930
jmp 0x6441afb0
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469900
lea eax, [esp + 0x34]
lea edx, [esp + 0x2b]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov ecx, eax
call fcn.644a6b20
sub esp, 8
lea eax, [esp + 0x2b]
mov ecx, eax
call fcn.64469930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.644a6a50
sub esp, 4
lea eax, [esp + 0x34]
mov ecx, eax
call fcn.644a7640
mov eax, dword [esp + 0x4c]
sub eax, dword [0x6452e02c]
je 0x6441afc1
call fcn.644015c0
mov eax, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x6441f590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x644e9e11
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x644e9e75]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6440b010
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.644deae0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x644e726c], 0
jne 0x6441f6b6
mov byte [0x644e726c], 1
call fcn.644dcbd0
test eax, eax
je 0x6441f684
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6440a220
mov dword [esp], 2
mov esi, dword [fcn.6441ab80]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6441f674
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x644ea555
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x644df360
jmp 0x644df358
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6441f63a
mov dword [esp], 2
call dword [0x644e6178]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x644df353
mov dword [esp], 2
call dword [0x644e6178]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x644ea504
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.6441a428
call fcn.644dcfa0
call fcn.644dcab0
call fcn.644dcc20
jmp 0x644df353
Function at 0x64430bd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, edx
mov byte [esp + 0x10], al
mov eax, dword [0x6452e02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.644d84f0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.644a6ee0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x14]
je 0x64430c78
mov eax, dword [esp + 0x18]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp], edx
mov ecx, eax
call fcn.6442a10c
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.64429ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.644a7a60
sub esp, 4
add dword [esp + 0x18], 1
jmp 0x64430c1c
mov dword [esp + 0x2c], str.dwsmaklthrtter
mov dword [esp + 0x24], 0x644f2ec0
mov dword [esp + 0x30], 0x644f2f38
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x30]
je 0x64430d80
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.644d9074
test al, al
je 0x64430d76
cmp byte [esp + 0x10], 0
je 0x64430d41
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.644ab530
sub esp, 8
lea eax, [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 3
mov ecx, eax
call fcn.644ab530
sub esp, 8
mov eax, dword [esp + 0x34]
add eax, 4
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov ecx, eax
call fcn.64430a40
sub esp, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp], edx
mov ecx, eax
call fcn.64430b18
sub esp, 4
test al, al
je 0x64430d41
mov eax, 1
jmp 0x64430d46
mov eax, 0
test al, al
je 0x64430d6d
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 4
mov ecx, eax
call fcn.644ab530
sub esp, 8
mov ebx, dword [esp + 0x40]
jmp 0x64430da1
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 4]
jmp 0x64430da1
add dword [esp + 0x24], 8
jmp 0x64430c90
lea eax, [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.644ab530
sub esp, 8
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.644a7640
mov eax, ebx
mov ebx, dword [esp + 0x5c]
sub ebx, dword [0x6452e02c]
je 0x64430dbf
call fcn.644015c0
add esp, 0x68
pop ebx
ret 0xc
Function at 0x64430f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x10], eax
mov eax, dword [0x6452e02c]
mov dword [esp + 0x5c], eax
xor eax, eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.644d84f0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.644a6ee0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
je 0x64430fcd
mov eax, dword [esp + 0x14]
movzx eax, byte [eax]
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.64429ff0
sub esp, 8
movsx edx, al
lea eax, [esp + 0x44]
mov dword [esp], edx
mov ecx, eax
call fcn.644a7a60
sub esp, 4
add dword [esp + 0x14], 1
jmp 0x64430f85
mov dword [esp + 0x38], 0x644e7280
mov dword [esp + 0x30], 0x644e7280
mov dword [esp + 0x3c], 0x644e7480
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x3c]
je 0x6443107b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.644d9074
test al, al
je 0x64431071
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.64469900
mov eax, dword [esp + 0x40]
sub eax, 0x644e7280
sar eax, 2
movsx edx, al
mov eax, dword [esp + 0x34]
mov dword [esp], edx
mov ecx, eax
call fcn.64429f20
sub esp, 4
movsx edx, al
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x2f]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], 1
mov ecx, eax
call fcn.644a6e40
sub esp, 0xc
lea eax, [esp + 0x2f]
mov ecx, eax
call fcn.64469930
jmp 0x64431086
add dword [esp + 0x30], 4
jmp 0x64430fe5
mov eax, dword [esp + 0x1c]
mov ecx, eax
call fcn.644a6ee0
lea eax, [esp + 0x44]
mov ecx, eax
call fcn.644a7640
mov eax, dword [esp + 0x5c]
sub eax, dword [0x6452e02c]
je 0x644310a2
call fcn.644015c0
mov eax, dword [esp + 0x1c]
add esp, 0x6c
ret 0xc
Function at 0xf6d263
Capabilities:
Check for software breakpoints

Disassembly:
clc
cmp ecx, dword [ebp - 8]
pushfd
pushfd
mov word [esp], 0xc8a2
pushfd
lea esp, [esp + 0xc]
jbe 0xd6c544
xor di, bx
rcr esi, cl
shld si, di, cl
sub ecx, 1
bswap si
dec esi
sub di, di
call fcn.00f6bbeb
lea esp, [esp + 0x28]
call fcn.00d6c7f5
pushfd
jmp 0xf3feb0
push 0xa52d3b3c
call fcn.00f3d0b0
adc dword [ecx + ebp*4], ebp
or byte [esi], bh
invalid
push esi
call fcn.00d69138
mov ecx, dword [ebp + 0xc]
test cl, 0xc2
cmc
cmp al, 0xcc
cmp ecx, 0xffff
push edx
lea esp, [esp + 0x4c]
jbe 0xf40b60
bsf ebx, esi
push ecx
mov edi, dword [edx + 0x24]
shl ecx, cl
add edi, eax
sal ch, cl
btr bx, si
mov ebx, dword [edx + 0x20]
rcl ecx, cl
pushfd
pushal
add ebx, eax
pop ecx
shrd ecx, esp, cl
sar ecx, 1
mov dword [ebp - 8], 0
bt ecx, 0x12
bsf ecx, edi
mov ecx, dword [edx + 0x18]
lea esp, [esp + 0x24]
jmp 0xd6b1d5

Function at 0xf7d142
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushal
lea esp, [esp + 0x2c]
ja 0xf17f78
xor ah, dl
ror ah, cl
mov ah, 0xc
add al, 0x20
jmp 0xf17f63
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x2f0c127a
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x47cb77b5
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
mov ebx, 0x40915c
nop
mov ecx, 0x12410961
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x24412638
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x10001f26
push ebx
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
push edi
cmp esi, edx
jle 0x10001ede
mov edi, dword [ecx]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x10027a40]
inc edx
cmp edx, esi
jl 0x10001ec0
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x10001f02
mov edi, dword [ecx + 8]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x10027a40]
inc edx
cmp edx, esi
jl 0x10001ee5
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop edi
shr eax, 0x18
pop esi
mov byte [ecx + 0x19], al
pop ebx
pop ebp
ret
Function at 0x10007b3b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b7bb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10004aa4
and dword [ebp - 0x14], 0
cmp dword [0x100b8d60], 0
mov dword [ebp - 0x18], eax
jne 0x10007bee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007c96
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007c96
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100b8d60], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100b8d64], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100b8d68], eax
call edi
push eax
call esi
mov dword [0x100b8d70], eax
test eax, eax
je 0x10007bee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100b8d6c], eax
mov eax, dword [0x100b8d6c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10007c47
cmp dword [0x100b8d70], ecx
je 0x10007c47
push eax
call esi
push dword [0x100b8d70]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10007c47
test ebx, ebx
je 0x10007c47
call edi
test eax, eax
je 0x10007c3e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10007c3e
test byte [ebp - 8], 1
jne 0x10007c47
or dword [ebp + 0x10], 0x200000
jmp 0x10007c7a
mov eax, dword [0x100b8d64]
cmp eax, dword [ebp - 0x18]
je 0x10007c7a
push eax
call esi
test eax, eax
je 0x10007c7a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10007c7a
mov eax, dword [0x100b8d68]
cmp eax, dword [ebp - 0x18]
je 0x10007c7a
push eax
call esi
test eax, eax
je 0x10007c7a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100b8d60]
call esi
test eax, eax
je 0x10007c96
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10007c98
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007ea6
leave
ret

Function at 0x10007ea6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b7bb0]
jne 0x10007eb0
repz ret
jmp fcn.10009797
Function at 0x100136f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100136c6
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100136e4
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10013742
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10013729
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10013732
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1001373c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1001371e
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
cmp ecx, dword [eax + 6]
jbe 0x100136a8
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1001378f
dec eax
je 0x10013786
sub eax, 3
je 0x1001377d
mov dword [ebp - 4], 0x40
jmp 0x100137ac
mov dword [ebp - 4], 4
jmp 0x10013792
mov dword [ebp - 4], 0x20
jmp 0x10013792
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100137de
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1001375e
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10012fef
xchg si, ax
pop es
mov ebp, 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x100137ea
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret