joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40569c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, eax
test edx, edx
jne 0x4056a7
xor eax, eax
pop edi
ret
or eax, 0xffffffff
push esi
mov ecx, 0xff
cmp edi, 8
jb 0x40575a
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4152e8]
inc edx
sub edi, 8
dec esi
jne 0x4056bf
pop ebx
test edi, edi
je 0x405773
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4152e8]
inc edx
dec edi
jne 0x40575e
pop esi
not eax
pop edi
ret

Function at 0x4629ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx dx, dl
mov ebx, dword [esp + 0x24]
movsx dx, dl
rdtsc
lea esp, [esp + 0x28]
jp 0x46d7d0
mov edx, dword [esi]
jmp 0x42496d
mov al, bl
rdtsc
mov edx, dword [esi]
lahf
movzx ax, cl
bswap ecx
not cl
mov eax, dword [edx + 8]
lea ecx, [eax - 0x463dadd5]
mov ecx, esi
pushal
mov dword [esp], edi
pushal
call fcn.0048e1f3

Function at 0x496c86
Capabilities:
Encode data using xor

Disassembly:
add esp, 8
js 0x49f286
pushal
test si, si
pushal
mov word [esp], 0x7200
call fcn.0044e7cd
movzx ax, dl
cwde
mov dword [esi + 0x20], 0
lea eax, [edi*8 + 0x784f6474]
bswap ax
mov eax, dword [esi + 0x2c]
pushal
pushfd
push ebx
push dword [esp + 8]
mov dword [esp + 0x28], eax
call fcn.0046165c
mov dword [esp + 0x20], edi
jmp 0x4972a9
test si, si
call fcn.0048517c
add edx, 4
cmc
push 0xb034016d
add ecx, 4
jmp 0x4566cb
call fcn.0044f8b3
mov edi, dword [esp + 0x24]
mov word [esp], 0x7036
bswap ebx
push ebx
push edi
mov ebx, dword [esp + 0x30]
mov byte [esp], dl
call fcn.004a39a8
rcl dword [edi - 0x46], 0xc
mov dword [0x2fd9a5de], eax
test al, 0x63
cmp byte [ebx + 0x76c276ba], al
salc
mov dl, dl
aad 0xc0
mov bh, 0xf6
mov al, dh
cmp edx, dword [edi + 0x203f8530]
pop edi
cmp al, byte [ebp + 0x78]
sub byte [eax], dh
mov dword [0x51b38ef5], eax
cmpsb byte [esi], byte es:[edi]
pop esp
pop ebp
adc bh, ah
sbb dx, cx
mov cl, bl
sub al, 0x3a
mov byte [0xfed37475], al
adc al, 0x75
invalid
pushfd
push dword [esp]
jmp 0x466fa2

Function at 0x49ebe0
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx dx, bl
movzx edx, word [edi]
not al
movzx eax, word [edi + 2]
pushal
inc ebx
jmp 0x498cab
Function at 0x409b60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x4a99f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea edx, [ebp - 0x3f4]
push edx
push 0x20019
push 0
push str.TypeLib
push SysReAllocString
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x400], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocString
mov esi, eax
call edi
test esi, esi
je 0x409bc7
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468a81
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x3f4]
push edx
mov esi, eax
call edi
test esi, esi
jne 0x409bb5
mov edx, dword [ebp - 0x3f0]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x3ec]
push ecx
push esi
push edx
mov dword [ebp - 0x3f8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
mov eax, dword [ebp - 0x3f0]
push eax
call edi
test esi, esi
jne 0x409bb5
mov ecx, dword [ebp - 0x400]
mov edx, dword [ebp - 0x3fc]
push ecx
push edx
lea eax, [ebp - 0x3ec]
push str._d._d
push eax
call fcn.0046b490
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.00468a81
mov esp, ebp
pop ebp
ret
Function at 0x409c60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2720
call fcn.0047fa60
mov eax, dword [0x4a99f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x2720], eax
mov eax, dword [0x491ee4]
mov esi, ecx
mov ecx, dword [str.SoftwareClasses_]
mov ebx, edx
mov edx, dword [0x491ee0]
push 0x26fe
mov dword [ebp - 0x270c], eax
mov dword [ebp - 0x2714], ecx
mov ecx, dword [0x491ee8]
mov dword [ebp - 0x2710], edx
mov dx, word [0x491eec]
lea eax, [ebp - 0x2702]
push 0
push eax
mov byte [ebp - 0x2715], 0
mov dword [ebp - 0x2708], ecx
mov word [ebp - 0x2704], dx
call fcn.00472290
mov eax, esi
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409ce4
push edi
lea edi, [ebp - 0x2714]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409cf5
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x409d58
lea edi, [ebp - 0x2714]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409d16
mov cx, word [0x491ef0]
mov eax, ebx
mov word [edi], cx
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409d30
lea edi, [ebp - 0x2714]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409d42
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea edx, [ebp - 0x271c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x2714]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
test eax, eax
jne 0x409dfd
mov esi, dword [ebp - 0x2720]
test esi, esi
je 0x409db7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409d94
mov ecx, dword [ebp - 0x271c]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409dd8
mov edx, dword [ebp - 0x271c]
push edx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468a81
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x271c]
mov bl, byte [ebp - 0x2715]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468a81
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x2715]
pop esi
xor ecx, ebp
pop ebx
call fcn.00468a81
mov esp, ebp
pop ebp
ret
Function at 0x409e20
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2714
call fcn.0047fa60
mov eax, dword [0x4a99f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x491ee4]
mov eax, dword [str.SoftwareClasses_]
push esi
push edi
mov esi, ecx
mov ecx, dword [0x491ee0]
push 0x26fe
mov dword [ebp - 0x270c], edx
mov dword [ebp - 0x2714], eax
mov eax, dword [0x491ee8]
mov dword [ebp - 0x2710], ecx
mov cx, word [0x491eec]
lea edx, [ebp - 0x2702]
push 0
push edx
mov dword [ebp - 0x2708], eax
mov word [ebp - 0x2704], cx
call fcn.00472290
mov eax, esi
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409e91
lea edi, [ebp - 0x2714]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409ea1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x2714]
push eax
and ecx, 3
push SysReAllocString
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.00468a81
mov esp, ebp
pop ebp
ret
Function at 0x4199a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
lea eax, [edx + 5]
push esi
cmp eax, 4
ja case.0x4199b3.2
jmp dword [eax*4 + 0x419a5c]
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 0xffffffc0
cmp edx, 0xfffffffc
sete al
push eax
call fcn.0041a100
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 8]
push eax
call edx
test byte [esi + 0x68], 4
je 0x419a11
mov eax, dword [esi + 0x5c]
and dword [esi + 0x68], 0xfffffffb
test eax, eax
je 0x419a11
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x419a11
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, str.FAIL
test edx, edx
jle 0x419a3e
push 0x30b
push 0x4ab290
call fcn.00418ee0
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x317
push str.Unrecognized_Negative_verb_in_DoVerb__.__bad.
call fcn.00418ee0
add esp, 8
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x41f270
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4a99f8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x41f260
call fcn.0046beea
add esp, 4
call fcn.0041f120
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41f2fe
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x41f2c4
mov edx, dword [ebp - 0x18]
push edx
jmp 0x41f2f8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00445a90
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468a81
mov esp, ebp
pop ebp
ret
Function at 0x41f560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, ebx
sub esp, 0x10
lea edx, [eax + 1]
jmp 0x41f570
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f570
push esi
push edi
sub eax, edx
lea esi, [eax + ebx]
push 0x5c
push ebx
mov dword [ebp - 4], esi
call fcn.0046bf80
xor ecx, ecx
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
test eax, eax
jne 0x41f5a0
mov dword [ebp - 0xc], ebx
jmp 0x41f5a0
cmp byte [esi], 0x5c
jne 0x41f5b6
inc esi
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], esi
mov byte [esi], 0x5f
mov eax, dword [0x493d1c]
mov dword [ecx + esi], eax
mov edx, dword [0x493d20]
mov dword [ecx + esi + 4], edx
mov al, byte [0x493d24]
mov byte [ecx + esi + 8], al
test ebx, ebx
je 0x41f61f
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jle 0x41f61c
lea ecx, [esi + esi + 2]
push ecx
call fcn.0046aa8c
add esp, 4
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov word [edi + esi*2 - 2], dx
mov esi, dword [ebp - 4]
jmp 0x41f621
mov esi, dword [ebp - 4]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
mov dword [ebp - 0x10], eax
call fcn.0046aa52
add esp, 4
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41f65b
mov eax, dword [ebp - 0xc]
push 0x2e
push eax
call fcn.0046bb00
add esp, 8
test eax, eax
je 0x41f663
cmp eax, esi
ja 0x41f663
mov ecx, dword [ebp - 8]
mov byte [eax], 0x5c
jmp 0x41f5a0
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov esi, dword [eax*4 + 0x492808]
mov edi, esi
mov dword [esp + 0xc], esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x441ef8
sub edi, ecx
mov eax, edi
shr eax, 5
inc eax
mov ebx, edi
mov dword [esp + 0x14], edi
mov ecx, edi
cmp edi, eax
jb 0x441f36
movzx edx, byte [esi + ecx - 1]
mov esi, ebx
shl esi, 5
add edx, esi
mov esi, ebx
shr esi, 2
add edx, esi
mov esi, dword [esp + 0xc]
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x441f13
mov dword [esp + 0x14], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
dec ecx
and ecx, ebx
mov edx, dword [edx + ecx*4]
test edx, edx
je 0x441fc2
jmp 0x441f50
cmp dword [edx + 0xc], edi
jne 0x441fbc
test edi, edi
je 0x441f5f
test byte [edx + 7], 0x10
jne 0x441fbc
mov eax, edi
lea ecx, [edx + 0x10]
cmp edi, 4
jb 0x441f84
lea esp, [esp]
mov ebx, dword [esi]
cmp ebx, dword [ecx]
jne 0x441fb4
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x441f70
test eax, eax
je 0x442033
mov bl, byte [ecx]
cmp bl, byte [esi]
jne 0x441fb4
cmp eax, 1
jbe 0x442033
mov bl, byte [ecx + 1]
cmp bl, byte [esi + 1]
jne 0x441fb4
cmp eax, 2
jbe 0x442033
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x442033
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov edx, dword [edx]
test edx, edx
jne 0x441f50
mov edx, dword [ebp + 8]
push ebx
push edi
push esi
push edx
call fcn.00441250
add esp, 0x10
mov ecx, dword [esp + 0x10]
or byte [eax + 5], 0x20
lea edx, [ecx + 1]
inc ecx
mov byte [eax + 6], dl
mov dword [esp + 0x10], ecx
cmp ecx, 0x20
jl 0x441ee4
mov ecx, dword [str.type]
test ecx, ecx
je 0x44202c
mov esi, 0x492908
mov bl, 0x2e
mov edi, edi
mov eax, ecx
add esi, 4
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x442008
sub eax, edi
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
call fcn.00441320
or byte [eax + 5], 0x20
mov byte [eax + 6], bl
mov ecx, dword [esi]
add esp, 0xc
test ecx, ecx
jne 0x442000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov al, byte [edx + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx ecx, al
and ecx, 3
not ebx
test bl, cl
je 0x442051
xor al, 3
mov byte [edx + 5], al
mov eax, edx
jmp 0x441fd1
Function at 0x468a81
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a99f8]
jne 0x468a8b
repz ret
jmp fcn.0047233c

Function at 0x46bcc9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x46bcf0
call fcn.0046c45b
mov dword [eax], esi
call fcn.0046c448
push 0x16
pop esi
mov dword [eax], esi
call fcn.0046bf63
mov eax, esi
jmp 0x46bd45
test dword [ebp + 0xc], 0xfffffff9
jne 0x46bcd6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46bd1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046c46e
pop ecx
call fcn.0046c448
mov eax, dword [eax]
jmp 0x46bd45
test al, 0x10
jne 0x46bd43
test al, 1
je 0x46bd43
test byte [ebp + 0xc], 2
je 0x46bd43
call fcn.0046c45b
mov dword [eax], 5
call fcn.0046c448
mov dword [eax], 0xd
jmp 0x46bd14
xor eax, eax
pop esi
pop ebp
ret

Function at 0x47bf5d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x47bf84
call fcn.0046c45b
mov dword [eax], esi
call fcn.0046c448
push 0x16
pop esi
mov dword [eax], esi
call fcn.0046bf63
mov eax, esi
jmp 0x47bfd9
test dword [ebp + 0xc], 0xfffffff9
jne 0x47bf6a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47bfb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046c46e
pop ecx
call fcn.0046c448
mov eax, dword [eax]
jmp 0x47bfd9
test al, 0x10
jne 0x47bfd7
test al, 1
je 0x47bfd7
test byte [ebp + 0xc], 2
je 0x47bfd7
call fcn.0046c45b
mov dword [eax], 5
call fcn.0046c448
mov dword [eax], 0xd
jmp 0x47bfa8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x481997
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a99f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00474bf3
and dword [ebp - 0x14], 0
cmp dword [0x4ac2d0], 0
mov dword [ebp - 0x18], eax
jne 0x481a4a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x481af2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x490b5c
push ebx
call edi
test eax, eax
je 0x481af2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x490b4c
push ebx
mov dword [0x4ac2d0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4ac2d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4ac2d8], eax
call edi
push eax
call esi
mov dword [0x4ac2e0], eax
test eax, eax
je 0x481a4a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4ac2dc], eax
mov eax, dword [0x4ac2dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x481aa3
cmp dword [0x4ac2e0], ecx
je 0x481aa3
push eax
call esi
push dword [0x4ac2e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x481aa3
test ebx, ebx
je 0x481aa3
call edi
test eax, eax
je 0x481a9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x481a9a
test byte [ebp - 8], 1
jne 0x481aa3
or dword [ebp + 0x10], 0x200000
jmp 0x481ad6
mov eax, dword [0x4ac2d4]
cmp eax, dword [ebp - 0x18]
je 0x481ad6
push eax
call esi
test eax, eax
je 0x481ad6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x481ad6
mov eax, dword [0x4ac2d8]
cmp eax, dword [ebp - 0x18]
je 0x481ad6
push eax
call esi
test eax, eax
je 0x481ad6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4ac2d0]
call esi
test eax, eax
je 0x481af2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x481af4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468a81
leave
ret
Function at 0x95f390
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x785015
lea edi, [esi - 0x384015]
mov dword [edi + 0x5153f0], 0x288d181f
push edi
or ebp, 0xffffffff
jmp 0x95f3ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x95f3c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95f3b0
mov eax, 1
add ebx, ebx
jne 0x95f3d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x95f3e4
jne 0x95f403
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95f403
dec eax
add ebx, ebx
jne 0x95f3f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x95f3c8
add ebx, ebx
jne 0x95f3ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x95f455
xor ecx, ecx
sub eax, 3
jb 0x95f41b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x95f48a
sar eax, 1
mov ebp, eax
jmp 0x95f426
add ebx, ebx
jne 0x95f426
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95f3f4
inc ecx
add ebx, ebx
jne 0x95f434
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95f3f4
add ebx, ebx
jne 0x95f441
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x95f436
jne 0x95f452
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x95f436
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x95f474
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x95f466
jmp 0x95f3b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x95f474
add edi, ecx
jmp 0x95f3b6
pop esi
mov edi, esi
mov ecx, 0xe2a5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x95f492
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x95f497
lea edi, [esi + 0x55d000]
mov eax, dword [edi]
or eax, eax
je 0x95f4ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5a10e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5a11b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x95f4bd
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5a11b8]
or eax, eax
je 0x95f4f9
mov dword [ebx], eax
add ebx, 4
jmp 0x95f4da
call dword [esi + 0x5a11b4]
mov ebp, dword [esi + 0x5a11bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x55f55a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x95f54b
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x403010
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x45d1d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x150]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4030fa
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4030fa
push 2
push 0
push 0xffffffffffffffe0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4030f3
push 0
lea eax, [ebp - 0x154]
push eax
push 0x20
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4030f3
push 0
push esi
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x4030f3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x4c]
push eax
lea eax, [edi - 0x20]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00408ca0
add esp, 0xc
test eax, eax
je 0x4030fa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004171a4
add esp, 8
test eax, eax
jne 0x4030fa
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040acca
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040acca
mov esp, ebp
pop ebp
ret