joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6953f0
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
push edi
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x695418
xor eax, eax
pop edi
add esp, 0x10
ret 0xc
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x695464
xor ebp, ebp
mov ecx, dword [esp + 0x24]
test ecx, ecx
jge 0x695474
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jle 0x69547e
mov ebx, ecx
cmp edi, eax
jle 0x695484
mov edi, eax
mov edx, dword [esp + 0x24]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x28]
pop esi
sub eax, 0
pop ebp
pop ebx
je 0x69550c
dec eax
jne 0x695523
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x695523
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 4]
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esp + 8], 1
jmp 0x695523
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
push edx
call fcn.00695620
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 8]
pop edi
add esp, 0x10
ret 0xc
Function at 0x695540
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x69555c
xor eax, eax
pop edi
add esp, 8
ret 4
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x6955a8
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jge 0x6955b8
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
cmp ebx, ecx
jle 0x6955c2
mov ebx, ecx
cmp edi, eax
jle 0x6955c8
mov edi, eax
mov edx, dword [esp + 0x1c]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 4
Function at 0x69b8b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x9254e4]
xor edx, edx
cmp eax, edx
jne 0x69b8d6
xor eax, eax
mov byte [eax + 0x9253e4], al
inc eax
cmp eax, 0x100
jl 0x69b8be
mov dword [0x9254e4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x9253e4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x69b967
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x69b93a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x69b908
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x69b970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x69b9c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x69b9aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6a2370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6df69e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.006a2c90
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x8a90ac
call fcn.006c7e74
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x6a2403
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006c7e74
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x6a23fc
push 0
mov ecx, eax
call fcn.00699500
mov dword [esi + 0xc], eax
jmp 0x6a2405
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x6a2405
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6ca5a5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6ca5dd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006c858e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006c8566
jmp 0x6ca5e9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6cbe1b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6cbe5d
call fcn.006d2525
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6cbe5d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6cbe54
xor eax, eax
jmp 0x6cbe65
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006cbe6b
pop edi
pop esi
pop ebx
ret 4

Function at 0x6d2a55
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x6d2a83
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6d2aa1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006d29bb
jmp 0x6d2aa1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6d2aa1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006d29bb
test edi, edi
mov eax, edi
jne 0x6d2a8b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x6d543e
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x6d5466
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x6d5477
push 2
call edi
test ax, ax
jge 0x6d5477
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.006c9bdb
cmp dword [esi + 0x30], ebx
jne 0x6d5551
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.006c9bdb
cmp eax, dword [esp + 0x34]
jne 0x6d5551
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x6d54ed
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x6d5532
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x6d5551
cmp eax, 0x205
je 0x6d5551
cmp eax, 0x201
je 0x6d5551
cmp eax, 0x204
je 0x6d5551
cmp eax, ebx
jne 0x6d5518
cmp dword [esp + 0x1c], 0x1b
je 0x6d5551
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x937024]
jbe 0x6d5547
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x6d54aa
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x42304c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [0x44b0ec]
mov esi, eax
test esi, esi
jne 0x4230a0
call dword [0x44b0e8]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
push edi
push 0x140
push 0x44edd4
call fcn.0041b719
push 0x44f1cc
push edi
call 0x458075
pop ecx
pop ecx
jmp 0x4231ed
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x4230c9
mov esi, 0x8007000d
push esi
push 0x14a
push 0x44edd4
mov edi, esi
call fcn.0041b719
push 0x44ee50
push esi
jmp 0x423094
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x4230f3
mov esi, 0x8007000d
push esi
push 0x155
push 0x44edd4
mov edi, esi
call fcn.0041b719
push 0x44eec0
jmp 0x4230c6
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44efe4
push ebx
call 0x44785f
add esp, 0xc
test eax, eax
je 0x423138
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x42315f
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x42311f
cmp dword [ebx + 4], 0x6e727562
jne 0x42311f
cmp dword [ebx + 0x10], 0x34
jae 0x42317d
mov esi, 0x8007000d
push esi
push 0x17a
push 0x44edd4
mov edi, esi
call fcn.0041b719
push dword [ebx + 0x10]
push 0x44f010
jmp 0x4231a7
mov esi, 0x8007000d
push esi
push 0x16e
push 0x44edd4
mov edi, esi
call fcn.0041b719
push 0x44eff0
jmp 0x4231e4
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x4231b2
mov esi, 0x8007000d
push esi
push 0x184
push 0x44edd4
mov edi, esi
call fcn.0041b719
push dword [ebx + 4]
push 0x44f0b4
push esi
call 0x458075
add esp, 0xc
jmp 0x4231ec
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x4231c8
inc ecx
cmp ecx, 4
jne 0x4231b7
jmp 0x4231ec
mov esi, 0x8007000d
push esi
push 0x18a
push 0x44edd4
mov edi, esi
call fcn.0041b719
push 0x44f1f4
push esi
call 0x458075
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x427d6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [edi + 8]
call fcn.0042bb76
push eax
push dword [ebp + 0x18]
push dword [edi + 0x50]
push 0x20000172
push 3
call fcn.0041d455
add esp, 0x14
test byte [ebp + 0x18], 1
je 0x427dda
push dword [ebp + 8]
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
push dword [edi + 0x10]
push dword [edi + 0x48]
push dword [edi]
call fcn.00431a18
mov esi, eax
test esi, esi
jns 0x427dda
push dword [ebp + 8]
push 0x4516f8
push esi
call 0x458075
add esp, 0xc
jmp 0x42832a
lea eax, [ebp - 4]
push eax
push 0x20006
push dword [edi + 0x50]
push dword [edi + 0x4c]
call 0x4589ce
mov esi, eax
test esi, esi
jns 0x427e06
push 0x451720
push esi
call 0x458075
pop ecx
pop ecx
jmp 0x42832a
test byte [ebp + 0x18], 2
push ebx
je 0x42829e
push dword [edi + 0x54]
mov ebx, 0x450ae0
push ebx
push dword [ebp - 4]
call 0x4592d8
mov dh, 0x14
add eax, dword [eax]
Function at 0x40cad3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406f17
mov dword [ebp - 0x14], eax
cmp dword [0x4377b8], esi
jne 0x40cbc6
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40cb53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cca6
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cca6
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cca6
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4377b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4377bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4377c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4377c8], eax
test eax, eax
je 0x40cbc3
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4377c4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cbeb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cbde
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cc00
push 4
pop eax
jmp 0x40cca8
cmp dword [ebp - 0x14], esi
je 0x40cc00
push dword [0x4377b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cbe5
mov eax, dword [0x4377c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cc5e
cmp dword [0x4377c8], edi
je 0x40cc5e
push eax
call ebx
push dword [0x4377c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cc5e
test eax, eax
je 0x40cc5e
call ecx
test eax, eax
je 0x40cc53
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cc53
test byte [ebp - 8], 1
jne 0x40cc5e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cc8e
mov eax, dword [0x4377bc]
cmp eax, edi
je 0x40cc8b
push eax
call ebx
test eax, eax
je 0x40cc8b
call eax
mov esi, eax
test esi, esi
je 0x40cc8b
mov eax, dword [0x4377c0]
cmp eax, edi
je 0x40cc8b
push eax
call ebx
test eax, eax
je 0x40cc8b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4377b8]
call ebx
test eax, eax
je 0x40cca6
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cca8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403e59
mov esp, ebp
pop ebp
ret
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4039d0
pop dword [ebp - 0x24]
mov eax, 0x4039d0
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xaa1d5613
sub dword [ebp - 0x34], 0x5bcb10c8
mov dword [ebp - 0x30], 0x9d3dcaf
add dword [ebp - 0x30], 0x285f6f96
mov dword [ebp - 0x2c], 0xc1acd39e
add dword [ebp - 0x2c], 0x8a9f7090
mov dword [ebp - 0x28], 0x7dc4c2bd
sub dword [ebp - 0x28], 0x7dc4c2bd
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x8aec074a
add dword [ebp - 0x34], 0xe986620c
mov dword [ebp - 0x30], 0x2e156c9b
add dword [ebp - 0x30], 0x1356f4da
mov dword [ebp - 0x2c], 0xff0e8c37
sub dword [ebp - 0x2c], 0x9b9f1fcb
mov dword [ebp - 0x28], 0x63f2518b
sub dword [ebp - 0x28], 0x63f2518b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xb6275552
add eax, 0x4a18eb36
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3527c
push 0
call eax
mov ecx, 0x41c6
mov ebx, eax
mov edx, 0x45995141
sub edx, 0x4558c941
add edx, dword [ebp - 0x24]
mov edi, 0xe10bfb9c
add dword [ebp - 0x10], ebx
mov esi, dword [edx]
mov dword [ebp - 8], 0x6d9c8198
xor esi, edi
xor dword [ebp - 0x10], 0xac918682
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x403adc
add eax, 0xc441eff6
add eax, 0x3bbf09f5
mov ebx, eax
add eax, 0xdacafbf
sub eax, 0xdacafba
mov ecx, 0xd7241d3b
add ecx, 0x291be2c5
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40ece3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize], eax
call fcn.0040bf46
pop ecx
mov ecx, dword [sym.TestCeilingFloor.exe_gMozillaPoisonSize]
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40ed1b
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCeilingFloor.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xda4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00da41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda406a
add dl, dl
jne 0xda4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda40dc
xor eax, eax
add dl, dl
jne 0xda4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda417d
add dl, dl
jne 0xda40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda4075
mov eax, 1
add dl, dl
jne 0xda40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda40e1
sub eax, ebx
mov ebx, 1
jne 0xda4128
mov ecx, 1
add dl, dl
jne 0xda410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda4136
cmp eax, 0x7d00
jae 0xda416d
cmp eax, 0x500
jb 0xda4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda4075
cmp eax, 0x7f
ja 0xda4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401112
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e030]
jne 0x40111c
repz ret
jmp fcn.00401d31

Function at 0x409100
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040587e
and dword [ebp - 4], 0
cmp dword [0x810790], 0
mov ebx, eax
jne 0x4091b1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409262
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409262
push eax
call fcn.0040580c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x810790], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x810794], eax
call esi
push eax
call fcn.0040580c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x810798], eax
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x8107a0], eax
test eax, eax
je 0x4091b1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040580c
pop ecx
mov dword [0x81079c], eax
mov eax, dword [0x81079c]
cmp eax, ebx
je 0x409209
cmp dword [0x8107a0], ebx
je 0x409209
push eax
call fcn.00405887
push dword [0x8107a0]
mov esi, eax
call fcn.00405887
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409209
test edi, edi
je 0x409209
call esi
test eax, eax
je 0x409200
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409200
test byte [ebp - 0xc], 1
jne 0x409209
or dword [ebp + 0x10], 0x200000
jmp 0x409242
mov eax, dword [0x810794]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409242
mov eax, dword [0x810798]
cmp eax, ebx
je 0x409242
push eax
call fcn.00405887
pop ecx
test eax, eax
je 0x409242
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x810790]
call fcn.00405887
pop ecx
test eax, eax
je 0x409262
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409264
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret