joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67ced0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test ecx, ecx
je 0x67cf01
mov edx, dword [ebp + 8]
push esi
push edi
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + reloc.KERNEL32.dll_LockFile]
inc edx
dec ecx
jne 0x67cee4
pop edi
pop esi
pop ebp
ret

Function at 0x7475e2
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [esp], edi
lea esp, [esp + 4]
jmp fcn.005d9a40

Function at 0x747728
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x74778b
mov di, 0xdf1e
mov edx, dword [esp]
lea edi, [edx + edi]
mov edx, dword [esp + 8]
jmp 0x747aeb
setl dh
lea edi, [ecx*4]
mov ebp, dword [esp + 4]
mov dx, sp
jmp 0x747775
mov edi, 0x35daa48a
mov di, word [esp]
mov di, dx
mov edi, dword [esp + 0xc]
lea esp, [esp + 0x10]
jmp fcn.005d9a40

Function at 0x758b48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.00758bd8
leave
inc ecx
sal dword [eax + reloc.KERNEL32.dll_LockFile], 1
nop
test dword [edx], reloc.KERNEL32.dll_LockFile
xor al, cl
sbb edi, edx
aad 0x44

Function at 0x759b4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
jmp 0x759b80
bswap eax
bswap eax
mov ah, dl
push edx
mov dl, 0xe4
lea edx, reloc.KERNEL32.dll_LockFile
jmp 0x759c3a
push edx
pop word [esp]
lea esp, [esp + 2]
push eax
mov ah, 0x13
mov ah, byte [esp]
jmp 0x759b4f
mov cl, byte [esp]
lea eax, [edi + 0x27]
pop ecx
mov eax, dword [esp]
setbe dl
mov al, bh
call fcn.00759ba1
lea esp, [esp + 0xc]
jmp 0x759c13
lea edx, [eax*4]
mov ax, word [esp]
bswap eax
mov cx, dx
rdtsc
xchg edx, eax
jmp 0x759bb7
lea esp, [esp + 4]
push bp
mov byte [esp], al
mov word [esp], bp
push word [esp + 1]
jmp 0x759cd1
mov dh, 0xbd
xchg ah, dl
push ecx
not dx
mov dl, 0x42
rdtsc
jmp 0x759bfd
push edx
call fcn.00759c6f
push cx
push word [esp]
mov ecx, dword [esp + 0xe]
lea esp, [esp + 0x14]
jmp 0x6094e8

Function at 0x75c751
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
mov ah, byte [esp]
mov al, bl
jmp 0x75c795
mov al, ch
push edx
mov edx, dword [esp]
mov ah, 0x1c
rdtsc
mov edx, ebp
jmp 0x75c7a7
pop edx
lea eax, reloc.KERNEL32.dll_LockFile
mov ax, 0x940f
mov ax, cx
call fcn.0075c7f1
lea ebx, [edi + ebp*2]
jbe 0x75c820
add byte [eax], al
add byte [ebp + 0x36dbbc2e], ah
xchg ecx, eax
mov edi, 0x33303186

Function at 0x75d421
Capabilities:
Encrypt data using rc4 prga

Disassembly:
popal
mov al, byte [0x52661ae3]
push dx
push esp
call fcn.0075d45f
cmc
or al, 0xff
pop edx
ja 0x75d415
je 0x75d444
out dx, al
pop ds
sbb dword [ebx], 0xffffff8b
out dx, al
sbb eax, 0x5766feae
push di
invalid

Function at 0x762e95
Capabilities:
Enumerate pe sections

Disassembly:
lea esi, [eax + edi]
lea esi, reloc.KERNEL32.dll_LockFile
lea edi, [ebp + 0xca]
pushfd
mov esi, 0x5d48cb63
not ebp
jmp 0x762d99
lea esi, [eax + edx]
xchg esi, ebp
jmp 0x762daf
Function at 0x762f9b
Capabilities:
Enumerate pe sections

Disassembly:
xchg ebp, edi
lea ebp, [eax + 0x4f]
mov ebp, 0xf1a8fbdb
mov edi, ecx
xchg bp, di
jmp 0x762d6b
mov bp, 0xd007
mov ebp, 0xa47b4f2a
lea ebp, reloc.KERNEL32.dll_LockFile
mov ebp, 0xfd3fb985
push edi
bswap edi
jmp 0x762d3b
shl byte [esi + 0x54], 1
push sp
pushal
lea esp, [esp + 2]
mov dword [esp], esi
call fcn.00762e95
jp 0x762d6a
jl 0x762d99
test byte [ebp + 0x7f], 0x9c
pushfd
push dword [esp + 3]
mov dword [esp + 3], ebp
lea ebp, [edx*4]
mov ebp, dword [esp]
lea ebp, [edx + edi]
jmp 0x762d51
mov esi, dword [esp + 8]
lea edi, [ebx*4]
mov bp, dx
jmp 0x762dde
lea ebp, [eax + ecx]
bswap ebp
push ebp
mov bp, sp
mov ebp, dword [esp + 0x33]
jmp 0x762e45
lea edi, [esi + ebp]
lea ebp, [eax*4]
push di
mov bp, 0x1110
pop di
mov edi, dword [esp + 0x28]
jmp 0x762dc8
lea esp, [esp + 0x38]
jmp fcn.00622120
push si
lea esp, [esp + 2]
jmp 0x762d81

Function at 0x76759f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
lea esp, [esp + 0x20]
call 0x7675a1
nop
add eax, 0xa40ffc95
xor al, 0x27
dec esi
fnstcw word [eax]
sbb ebp, ebx
jmp 0x767589
lea esp, [esp + 4]
jmp fcn.00617bb0
jmp 0x767589

Function at 0x76dfa2
Capabilities:
Encrypt data using rc4 ksa
Hash data with crc32

Disassembly:
push sp
setb ah
mov word [esp + 2], bx
lea esp, [esp + 2]
mov dword [esp], ebp
push di
jmp 0x76dfba
jmp 0x76df7f
mov bp, bx
mov eax, dword [esp]
lea esp, [esp + 2]
push edx
mov dword [esp], edx

Function at 0x770706
Capabilities:
Encrypt data using rc4 ksa
Hash data with crc32

Disassembly:
mov dword [esp], ebp
lea esp, [esp + 4]
jmp fcn.00631ed0

Function at 0x77087e
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Hash data with crc32

Disassembly:
mov ebp, dword [esp]
mov ebp, dword [esp]
mov ebp, dword [esp + 0x2c]
lea esp, [esp + 0x30]
jmp fcn.00631ed0
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp]
jmp 0x770812

Function at 0x77e2b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.0077e313
dec esp
fmul dword [esi + 0x29]
fsubr dword [ebx - 0x5e]
xor eax, 0x943fcca5
mov esp, 0x2ed3b426
cdq
xlatb
lea esp, ds:[esp + 4]
lea esp, [esp + 4]

Function at 0x77f9ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
lea esp, [esp + 1]
jmp 0x77fa16
mov edi, eax
not bh
xchg di, bx
push ebp
pushal
mov di, bx
jmp 0x77fa24
lea esp, [esp + 3]
push edi
not edi
bswap edi
bswap edi
push ebx
jmp 0x77f9f4
pop bp
lea esp, [esp + 2]
mov edi, 0xa990d889
mov di, si
lea edi, [edx + esi]
mov bx, word [esp]
jmp 0x77fa89
mov edi, dword [esp + 0x28]
lea esp, [esp + 0x2c]
jmp fcn.00652a20
mov ebx, dword [esp + 0x20]
mov di, word [esp]
lea edi, [edi + ebp]
pushfd
mov edi, 0xaacbb52f
lea edi, [eax + edx]
jmp 0x77fa57
setne bl
not bh
mov ebp, dword [esp + 0x1c]
mov ebx, 0x63261a5f
lea ebx, [eax + esi]
xchg edi, ebx
jmp 0x77fa6d

Function at 0x77fa0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
call fcn.0077f9bc
Function at 0x77ff6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x26]
mov ch, bl
mov ch, byte [esp]
sete cl
mov ecx, dword [esp + 0x37]
lea esp, [esp + 0x40]
jmp fcn.00652a20
mov ebp, dword [esp + 0xf]
lea ecx, reloc.KERNEL32.dll_LockFile
lea eax, [esp + ecx]
push si
xchg byte [esp], ch
lea esp, [esp + 2]
jmp 0x77fc35
xchg ah, cl
mov ch, 0xab
lea ebp, [ebp + ebp]
sete ah
not ecx
mov ax, sp
jmp 0x77fc5d
push dword [esp + 0x19]
mov dword [esp + 0x1e], ebx
mov dword [esp + 0xf], ebp
lea eax, [eax + ebp]
setnp ch
mov ch, byte [esp]
jmp 0x77fcd1
mov ch, 2
mov ch, dh
mov dword [esp + 2], eax
pushal
mov ch, byte [esp + 0x12]
lea eax, reloc.KERNEL32.dll_LockFile
jmp 0x77fd04
pushal
mov dword [esp + 0xd], edx
pop dword [esp + 5]
mov dword [esp + 0x13], ecx
mov ecx, dword [esp]
mov cl, 0x8f
jmp 0x77fd80
pushal
lea esp, [esp + 0x24]
jmp 0x77fe12

Function at 0x780d08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp fcn.00652a20

Function at 0x78b232
Capabilities:
Encode data using xor

Disassembly:
pop word [esp]
lea edi, [ebp + ebp]
mov di, 0xd796
mov di, bx
jmp 0x78b295
lea esp, [esp + 2]
mov edi, dword [esp + 8]
lea esp, [esp + 0xc]
jmp fcn.00668910

Function at 0x79d534
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, 0x58
rdtsc
mov ax, word [esp + 2]
not ax
xchg word [esp], dx
jmp 0x79d539
mov dx, 0x10ed
lea edx, [esi*4]
bswap edx
mov dx, word [esp]
push eax
push ebp
jmp 0x79d500
mov dword [esp], edx
jmp 0x79d516
mov dword [esp], ebp
bswap ebp
mov al, ch
mov dx, 0x273
xchg dx, ax
xchg dx, ax
jmp 0x79d592
sets ah
pop eax
setnp dh
pushal
xchg word [esp + 7], dx
mov dh, 0xa4
jmp 0x79d57c
mov edx, dword [esp + 0x20]
lea esp, [esp + 0x24]
jmp fcn.00668450
mov ebp, dword [esp]
rdtsc
lea eax, [eax + ebp]
pop ebp
mov dx, word [esp]
mov ah, byte [esp]
jmp 0x79d54b

Function at 0x79fad0
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 3]
jmp 0x79fa10

Function at 0x79fad9
Capabilities:
Enumerate pe sections

Disassembly:
push edi
not edi
jmp 0x79fae2
mov edi, dword [esp]
mov di, word [esp]
pushfd
mov di, 0x5522
pushal
jmp 0x79fafd
push word [esp + 0xc]
lea esp, [esp + 2]
mov dword [esp + 0x14], esi
mov di, 0xbfbc
lea edi, [ecx + ebp]
xchg di, si
jmp 0x79fcd7
lea edi, [ebp*4]
mov di, word [esp]
lea esp, [esp]
pop di
lea edi, [esp + edx]
mov si, di
jmp 0x79fc4d
mov edi, eax
mov di, word [esp]
not edi
push ebp
mov eax, dword [esp + 6]
push bx
jmp 0x79fb3c
mov edi, dword [esp + 0x28]
lea esp, [esp + 0x2c]
pushal
lea esp, [esp + 0x20]
jmp fcn.0066c5c0
xchg edi, esi
mov esi, dword [esp + 0x18]
lea edi, reloc.KERNEL32.dll_LockFile
bswap edi
mov di, cx
mov edi, esi
jmp 0x79fbaa
lea esi, [eax*4]
lea edi, [ecx + edi]
mov dword [esp + 2], eax
mov ah, 0x62
mov ax, sp
setge al
jmp 0x79fb66
Function at 0x7a4038
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, 0xa2
rdtsc
mov edx, dword [esp + 4]
mov esi, eax
mov ah, 0xe
mov ah, cl
jmp 0x7a4021
mov ax, di
lea eax, reloc.KERNEL32.dll_LockFile
mov esi, dword [esp + 8]
mov eax, edx
jmp 0x7a4071
rdtsc
rdtsc
setne dh
mov dx, 0xeabd
jmp 0x7a400d
mov ah, 0x97
mov eax, esp
mov al, 0x66
mov ax, 0x484c
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x28]
call fcn.007a4045

Function at 0x7ad583
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
rdtsc
cpuid
rdtsc
popal
call fcn.007ad406
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x7ad41f
Function at 0x7ed6a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], al
mov esi, esp
xchg cx, ax
rdtsc
setge ah
not edx
jmp 0x7ed68c
mov dl, 0x13
add esp, 1
stc
xchg word [esp + 2], di
lea esi, [eax + edx]
xchg byte [esp + 1], dl
jmp 0x7ed65f
mov dword [esp], edx
mov word [esp], si
neg dx
rdtsc
call fcn.007ed6b2
push ebx
je 0x7ed6e6
jbe 0x7ed708
outsb dx, byte [esi]
je fcn.007ed6a6
push word [esp + 1]
xchg dl, al
mov cx, di
jmp 0x7ed678
invalid
and esi, dword [eax - reloc.KERNEL32.dll_LockFile]
add byte [eax], al
add byte [esi - 0x7f], ah
xlatb
test al, 0x9c

Function at 0x7f1d66
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword fs:[0x30]
jmp 0x7f1d70
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x7f1d50
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x7f1d7e
mov eax, dword [eax + 8]
push eax
jmp 0x7f1015
Function at 0x402bc4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x455124]
push dword [0x455128]
call fcn.00402b42
push dword [0x455124]
mov edi, eax
add edi, 0x7d709031
push dword [0x455128]
call fcn.00402b42
push dword [0x455124]
add eax, 0x7d70906d
mov dword [ebp - 8], eax
push dword [0x455128]
call fcn.00402b42
push dword [0x455124]
mov ebx, eax
add ebx, 0x7d70900d
push dword [0x455128]
call fcn.00402b42
push dword [0x455124]
add eax, 0x7d709011
mov dword [ebp - 4], eax
push dword [0x455128]
call fcn.00402b42
push dword [0x455124]
add eax, 0x7d709015
mov dword [ebp - 0xc], eax
push dword [0x455128]
call fcn.00402b42
mov esi, dword [ebp + 8]
and dword [ebp + 8], 0
add eax, 0x7d709019
add esp, 0x30
mov ecx, dword [edi + esi]
add ecx, dword [ebp - 8]
mov ecx, dword [ecx + esi]
add ecx, esi
mov edx, dword [ecx + ebx]
mov ebx, dword [ecx + eax]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
add ebx, esi
mov edi, dword [ecx + edx]
mov edx, dword [ebp - 0xc]
add edi, esi
mov edx, dword [ecx + edx]
add edx, esi
cmp dword [ebp - 8], 0
jbe 0x402cc2
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push dword [0x455124]
mov eax, dword [eax]
add eax, esi
push eax
call fcn.00402b42
cmp eax, dword [ebp + 0xc]
pop ecx
pop ecx
je 0x402cc2
inc dword [ebp + 8]
add dword [ebp - 4], 4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
jb 0x402c99
mov eax, dword [ebp - 8]
cmp dword [ebp + 8], eax
jne 0x402cce
xor eax, eax
jmp 0x402ce4
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
movzx eax, word [ebx + eax*2]
mov eax, dword [edi + eax*4]
add eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402ce9
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xe7d8
call fcn.0040f150
push ebx
push esi
mov esi, 0xe7ce
push edi
push esi
call fcn.0040f0bf
pop ecx
xor ebx, ebx
mov ecx, eax
lea eax, [ebp - 0xe7d8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
sub dword [ebp - 4], eax
mov eax, dword [ebp - 4]
lea edi, [ebp + ebx - 0xe7d8]
mov byte [eax + edi], bl
mov eax, ebx
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
inc ebx
cmp ebx, esi
mov al, byte [edx + eax]
mov byte [edi], al
jl 0x402d18
lea eax, [ebp - 0xe7d8]
mov edi, ecx
sub eax, ecx
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], eax
mov dword [ebp + 0x14], esi
jmp 0x402d50
mov eax, dword [ebp - 4]
mov dl, byte [edi]
movzx ebx, byte [eax + edi]
movzx eax, dl
mov edx, dword [ebp - 8]
add edx, ebx
mov ebx, esi
add eax, edx
cdq
idiv ebx
mov al, byte [edi]
mov dword [ebp - 8], edx
lea ebx, [edx + ecx]
mov dl, byte [edx + ecx]
mov byte [ebx], al
mov byte [edi], dl
inc edi
dec dword [ebp + 0x10]
jne 0x402d4d
mov edx, dword [ebp + 0xc]
and dword [ebp - 8], 0
test edx, edx
jle 0x402dde
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov ebx, esi
inc eax
cdq
idiv ebx
mov dword [ebp + 0x14], edx
movzx eax, byte [edx + ecx]
add eax, dword [ebp - 8]
cdq
idiv ebx
mov ebx, dword [ebp + 0x14]
mov bl, byte [ebx + ecx]
mov dword [ebp - 8], edx
lea eax, [edx + ecx]
mov dl, byte [edx + ecx]
mov byte [eax], bl
mov ebx, dword [ebp + 0x14]
mov byte [ebx + ecx], dl
mov ebx, esi
movzx eax, byte [eax]
movzx edx, dl
add eax, edx
cdq
idiv ebx
mov al, byte [edx + ecx]
mov edx, dword [ebp + 0xc]
xor al, byte [edx + edi]
mov byte [edi], al
inc edi
dec dword [ebp + 0x10]
jne 0x402d93
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415c4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x456940
cmp edx, dword [eax]
je 0x415c6f
add eax, 8
inc ecx
cmp eax, 0x4569d0
jl 0x415c60
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x456940]
jne 0x415d9d
mov eax, dword [0x45a124]
cmp eax, 1
je 0x415d77
test eax, eax
jne 0x415ca0
cmp dword [0x4562f4], 1
je 0x415d77
cmp edx, 0xfc
je 0x415d9d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x415cd7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00415ed0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00415fc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x415d1a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00415fc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x449a94
push edi
call fcn.00419af0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00415ed0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00415ee0
lea eax, [ebp - 0xa0]
push 0x449a74
push eax
call fcn.00415ee0
push dword [esi + 0x456944]
lea eax, [ebp - 0xa0]
push eax
call fcn.00415ee0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041b1d8
add esp, 0x2c
pop edi
jmp 0x415d9d
lea eax, [ebp + 8]
lea esi, [esi + 0x456944]
push 0
push eax
push dword [esi]
call fcn.00415fc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x425370
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040f150
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42543b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42543b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4253ee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4253f9
or bh, 8
and edi, 0x8000000
je 0x425414
mov eax, dword [0x45bd5c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42543b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42583b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42585f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42587a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x42a0a1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42a0d9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042f05a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042f032
jmp 0x42a0e5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x42bea3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42bee5
call fcn.0043a213
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42bee5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42bedc
xor eax, eax
jmp 0x42beed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042bef3
pop edi
pop esi
pop ebx
ret 4
Function at 0x10001436
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10001470
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi], 0
mov eax, esi
leave
ret 0xc

Function at 0x10002948
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10001a62
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10001a94
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10001a49
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10001a84
xchg byte [edx + 0x4686c73], ah
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid