joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410bc8
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xfb
xor eax, 0x40dbbe1b
push esp
xor cl, dh
add eax, 0xea078648
cli
mov al, 0x94
lcall 0xb81e, 0x86b26954
xchg byte [esi + 0x238b64fd], ch
mov al, byte [0x109c0493]
push es
lea esp, [ecx - 0x75a648bf]
sbb byte [ebx - 0x5dd5841c], bh
pop es
ljmp 0x6954
mov bh, 0x59
mov bl, byte [eax]
mov ebx, 0xa22a7be4
loopne 0x410b83
add dword [edi], esi
aaa
pop ebx
and al, 0x3b
in al, 0x28
inc eax
push cs
push esi
jmp dword cs:[esi - 0x51]
ja 0x410c45
mov ecx, ebx
cmp cl, bh
stc
ja 0x410b76
je 0x410bcd
test byte [edi], dh
jne 0x410ba0
and edx, ebx
mov byte [0xe2fa6c9b], al
aaa
cmp al, 8
jae 0x410b9e
inc edx
sub eax, dword [esi]
pop edx
cdq
pop eax
mov eax, 0xa744874
aad 0xba
stc
sbb byte [edi + 0x75], dh
mov ebx, 0x3e0979f8
loop 0x410c4d
clc
in eax, 0x37
fild dword [edx - 0x13]
xor al, 0x98
xor bh, byte [edi + 0x77]
wait
test eax, 0x5aba7c42
xor al, 0x9e
lodsb al, byte [esi]
lahf
or eax, 0x2fb9fcaf
mov edi, 0xa2ad806
cmp cl, ch
in eax, dx
cdq
pushfd
jns 0x410c10
insd dword es:[edi], dx
xchg ebx, eax
jecxz 0x410baa
sbb eax, 0x7db82ff9
lcall 0xae9d, 0x2425871e
invalid
cmp esi, ebx
pop esi
jecxz 0x410cb1
test dword [ebp + 0x67], edi
sub al, 0xfa
invalid
cmp byte [ebx], bh
sti
xchg edi, eax
fisub word [eax + 0x7c]
adc al, 0x21
ret

Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x652eb4
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSID8c3eda3f_f182_4617_a352_00b48a8e49f2InprocServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa531b0], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x652eb4
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa531b0], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa531b0]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa531b0], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x459133
Capabilities:
Encode data using xor

Disassembly:
ror dword [ecx + 0x710b5a37], 1
popal
push es
xor dl, byte [ecx - 0x2d]
xchg edi, eax
mov dword [ecx + 0x2e6e1a23], ecx
mov ecx, 0x98348b08
pop ebp
movsd dword es:[edi], dword [esi]
xor ah, byte [edi + ebx*8 - 0x1b96adf2]
invalid

Function at 0x45ca7c
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edx + 0x52], edi
mov dh, 0x78
sar byte [edx + ecx - 0x295d0d60], 1
cmp dl, byte [ebx]
aad 0x97
sbb dword [eax + 0x1b], eax
aam 0x34
cld
bound esi, qword [ebx - 0x7f]
cmp dl, byte [eax - 0x64]
Function at 0x4e86ed
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [edi + 0x30]
pop esp
ret 0xbe01
sub bl, byte [ebx]
xchg ebx, eax
invalid
cmp eax, dword [edx + 0x5ac03317]
adc eax, 0x2ccbca50
loop 0x4e8680
xor dword [eax - 0x552744a], esi
pop ebp
or ecx, edx
push esp
loope 0x4e86d2
add eax, 0x7d2193d3
cmc
push ss
and byte [ebx - 0x7d52f8c0], 0xc2
adc cl, cl
mov cl, 0xd9
stc
jno 0x4e875e
add esp, esp
jmp [eax + 0x68bca30a]
nop
xchg ecx, eax
jae 0x4e877a
imul esp, dword [di], 0xffffffa4
idiv cl
and al, byte [eax + 0x77ec314b]
mov al, 0x82
ror dword [ebp - 0x2c02362e], 1
invalid
fisub word [edx]
mov al, byte [0x458c4e66]
jo 0x4e87ee
jb 0x4e87ae
sahf
mov dword [0x4d1fa511], eax
cmp dl, byte [ecx - 0x31]
mov al, byte [0xd6f84d0e]
mov al, 0xc7
and byte [eax], ah
aaa
add byte [eax], dh
push ecx
mov ebx, edx
clc
sbb ebp, ecx
jb 0x4e87c1
leave
inc esp
shl dword [ebp - 0x669e5f36], 1
cmp al, 0x41
aaa
mov edx, 0xcd20e1ea
wait
cld
insb byte es:[edi], dx
int 0xeb
mov ah, 0x4f
cmc
xchg edi, eax
pushfd
mov dl, 0x82
test al, 0x8b
aam 0x3f
ljmp 0x6cfc:0x9bcd20e1
aas
or ah, bl
xchg edx, eax
fistp qword [ebx - 0x71d68633]
jg 0x4e87e1
mov byte [0x3bbc629], al
sbb dword [eax - 0x30], 0x40df57f5
mov bl, 0xd0
dec eax
pop esp
pop ss
add esp, dword [esi + 0x52f96334]
arpl cx, di
push edx
cli
insd dword es:[edi], dx
ja 0x4e8830
push eax
in al, dx
mov dword [0xb7087763], eax
sbb al, 2
or ecx, dword [ebx + 0x2d63bbef]
rcr dword [edi + 0x11], cl
push 0xffffffffffffff8e
mov bh, 0x1c
add cl, byte [ebx]
mov ebp, edi
mov ebx, 0x5fd32d63
adc dword [edx - 0x72], ebp
mov ch, 0xaf
sub ebx, dword [edi + edi*4]
mov byte [ecx - 0x7a], dh
xchg edi, eax
dec esp
invalid
sal ah, cl
xchg ebx, eax
invalid
jp 0x4e887a
invalid
Function at 0x4e97d4
Capabilities:
Encode data using xor

Disassembly:
adc dword [ecx], esp
cmp dh, al
and al, 0x17
mov esi, 0xe3ffb4c3
pop eax
mov ch, 0xc6
adc eax, 0x558fc389
mov esp, 0x1e2d3da1
das
adc al, 0x97
invalid
sub eax, 0x97142f1e
jl 0x4e97d0
fst qword [eax + 0x2c]
cmp ecx, dword [ebp + 2]
das
stosb byte es:[edi], al
aam 0xd4
cmc
fst qword [edx]
xchg edi, eax
mov ecx, 0xfdf10319
test byte [ebp - 0x4ad012f6], cl
jecxz 0x4e97bd
adc eax, 0x4c2bcf29
push dword [ecx - 0x2a]
jno 0x4e975e
push es
and byte [ebx + 0x52], al
test dword [esp + edx*4], edi
cmp dl, dl
mov ah, byte [eax + 0x5a3e803]
cmp byte [esp + ebp*4 - 0x60cb496b], 0x84
into
inc ebx
jae 0x4e9748
push edx
jecxz 0x4e9759
jge 0x4e97ea
push eax
sbb al, 0x12
push 0x1b415551
adc al, 0x58
cmpsd dword [esi], dword es:[edi]
je 0x4e97a0
loop 0x4e97a0
out dx, al
xchg ebp, eax
lodsb al, byte [esi]
adc al, 0x33
leave
ret
shl ecx, 1
pop ebx
out 0xac, eax
lodsb al, byte [esi]
insd dword es:[edi], dx
jbe 0x4e97b3
jo 0x4e97f6
sbb byte [esi + 0x249b9c74], dl
xor byte [edi + 0x3a], bh
jnp 0x4e9864
push ebp
add byte [edi - 0x8effd4f], cl
invalid
adc bh, dh
rol dword [ecx + 0x11], 0x18
hlt
lds edi, [edi - 0x4268477f]
push esi
mov ebp, 0xc7b88b8f
inc eax
jge 0x4e9786
inc ecx
xor dl, dl
push ebp
dec eax
mov edi, 0x7aafe06d
push eax
jl 0x4e9836
adc ebp, esp
retf 0x1bbd
retf
mov word [edi], ds
test bl, 0x28
push ecx
pop esp
inc eax
insb byte es:[edi], dx
adc bh, byte [edi - 0x1d4ce1b5]
sbb esi, dword [edi]
sub dl, ah
dec esp
mov eax, dword [0x313ee8e3]
mov bh, pe_nt_image_headers32
mov ecx, 0x9f404375
pop edi
inc edx
scasd eax, dword es:[edi]
mov bh, 0x53
jo 0x4e98d5
mov bl, 0xa1
test edi, ecx
in al, dx
sub ah, ch
xchg ecx, eax
xchg ebx, eax
xor esi, dword [edi - 0xed4f2c4]
mov dword [0xfc3c8573], eax
mov ds, word [esi + 0x6e13ffcc]
fistp word [esi]
cwde
mov ah, 0x69
xchg ebx, eax
dec ebp
insd dword es:[edi], dx
xchg esp, eax
popfd
jge 0x4e98b8
cmp eax, 0x3b60285b
mov ebp, 0x8c6acdc5
invalid
and eax, 0xb5162be4
or eax, 0x2c5b3717
add eax, edx
popal
and edi, edi
bound esi, qword [ebx + ecx*8 + 0x30]
lodsd eax, dword [esi]
adc byte [eax], bl
int 0x25
jbe 0x4e98c4
mov edi, 0x5797a30d
xchg edi, eax
push edi
popfd
jnp 0x4e985d
fimul dword [edx + 0x308613f1]
mov cl, 0xd8
dec ebx
popfd
jnp 0x4e9907
bound ecx, qword [ebp - 0x5f]
mov ebp, 0x6263d386
cmp byte [ecx], bl
cmp dword [esi + 0x2c25a9b8], 0x2142f168
loope 0x4e98c4
aas
sbb eax, 0x44349c90
nop
pushfd
xor al, 0x44
inc edx
jb 0x4e98fe
les eax, [ebp - 0x51153bbf]
xor dword [esi], ebp
mov bh, 0xb3
mov bl, 0xef
mov dh, 0x79
invalid
inc ecx
invalid

Function at 0x4f86f3
Capabilities:
Encode data using xor

Disassembly:
out dx, al
leave
sbb al, 0x59
push esi
mov cl, 0xcf
cmp byte [eax], 0xcb
push es
mov cl, 0x67
push ecx
xchg edi, eax
xor eax, 0xe6b0a0fe
mov ah, ah
outsb dx, byte [esi]
add ecx, dword [ebp + 0x2da4b866]
std
pop esi
mov bh, 0x39
mov ecx, 0x1a9ed29c
mov ebx, 0x88112d95
xchg ebp, eax
imul eax, esp, 0x7519f9d5
dec ecx
jno 0x4f86fe
mov word [0xbba62419], ds
mov byte gs:[0xc5116d1f], al
mov ah, 0xea
dec ecx
fiadd word [edx - 0x72]
cld
pop esp
hlt
Function at 0x536efe
Capabilities:
Encode data using xor

Disassembly:
push edx
xor byte [ecx + 0x45], cl
cmp eax, 0xf65d9fe
fldenv [ebp + 0xf]
push ebp
movsd dword es:[edi], dword [esi]
rcr dword [edx + edi*8 - 0x7c6ab166], cl
movsb byte es:[edi], byte [esi]
out 0xf4, al
jle 0x536eab
push esp
loope 0x536ec7
or eax, dword [ebx + eax - 0x5b439063]
movsb byte es:[edi], byte [esi]
dec ecx
inc edi
lcall 0xea8d, 0xfb67c950
lcall 0xc002, 0x938bac0b
jns 0x536ea5
mov ebx, 0x92b0fa54
jo 0x536f5d
mov ch, 0xa
pop ebx
inc eax
lds edi, fs:[ecx + 0x39]
aas
outsd dx, dword [esi]
xor eax, ebx
pop edx
jo 0x536ee4
inc ebp
out 0x80, eax
dec esi
xchg esp, eax
add al, 0xc4
fcmovbe st(0), st(7)
fidivr dword [ebx]
lahf
xor dh, ah
std
mov al, 0xaf
enter 0xd0c, 0x5e
push ds
sbb ebp, esp
js 0x536f48
movsd dword es:[edi], dword [esi]
pushfd
test ebx, ebp
jne 0x536ed2
add dl, 0xb0
f2xm1
leave
mov edi, 0xa0d20368
nop
aaa
xor eax, 0x5fb66935
aaa
sub al, byte [ecx + 0x5a]
inc esi
mov edi, 0x7929b5
add al, 0xfb
wait
adc eax, 0xdeb3cd15
imul edi, ebx, 0xffffffd6
salc
xchg byte [edi], dl
test dword [esi + 0x4d0c990b], eax
add byte [edi - 0x13], bl
wait
inc ebp
aaa
inc esp
stosd dword es:[edi], eax
push eax
jle 0x536f7a
inc eax
nop
adc eax, 0x2bdd662b
aam 0xf9
xchg esi, eax
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
push esi
daa
adc ah, bh
scasd eax, dword es:[edi]
add dword [eax - 0x5851a316], esi
mov ch, 0x89
int1
retf
add byte [ecx], ch
adc eax, 0x354af5cc
invalid
Function at 0x582f62
Capabilities:
Encode data using xor

Disassembly:
sub eax, dword [edi - 0x54ae14a0]
sbb byte [ebx + 0x6b], 0x1f
push esi
das
inc esp
rcr byte [ecx], 0xdf
out dx, eax
inc esi
cmc
xchg byte [edi], bh
mov ecx, 0x54a1eb64
xor byte [esi + 0x3f], dl
sahf
pop eax
std
pushfd
push ss
sbb byte [ebp - 0x7b036810], dl
call 0xca5f56df
popfd
push ecx
push edi
sbb esi, dword [edi - 0x68357d2c]
xor ecx, ebp
and eax, 0xee81a176
xor dword [ebp - 0x6a], ebx
adc al, 0xbd
mov esi, 0xae5f5478
push esp
push edi
and edx, dword [esp + esi*8 - 0x469648c3]
in eax, 0xcb
xchg byte [ecx + edi*4 - 0x4eab358a], ch
add edx, ebx
daa
jbe 0x582f84
push esp
mov cl, 1
fisub dword [edi]
pop edi
add ebp, dword [ebx + 0x9b67729]
or al, 0xce
lcall 0xcb24, 0xe228b636
in al, 0x6f
pop eax
aas
mov bh, 0x29
add al, 0xbc
not dword [esi - 0xe]
pop ecx
pop ss
lea ebp, [edx + 0x2421e77e]
dec esp
jbe 0x582f84
jg 0x583041
test eax, 0x53259678
or bl, 0x7a
jbe 0x58303f
pop edx
add eax, 0xdb902eb6
mov esp, 0xc41951d6
imul ebp, edi, 0x362eb634
out 0x47, eax
out dx, eax
xor al, 0xb6
out 0x47, eax
jae 0x582fb8
mov dh, 0xf3
jp 0x582ffe
mov edx, 0xcd676773
push esi
aas
cmpsb byte [esi], byte es:[edi]
pop eax
xor bh, byte [ebx - 0x19]
xchg esi, eax
out 0x17, al
sub dl, dh
jne 0x583065
pop ebp
mov ch, 0x6d
or edi, 0x9e678f34
les ecx, [eax - 0x75]
dec esp
pop ebp
out 0xa6, eax
or eax, 0x2af151
pop ecx
test al, 0x2f
fst qword [eax]
pop esi
rcr byte [ebx], 1
push esi
nop
and eax, 0x2ee307f0
invalid
jecxz 0x583071
invalid
lea ecx, [edx]
push 0xb34872b1
movsd dword es:[edi], dword [esi]
pushal
and dword [ecx + 0x60d1abdb], 0x288daf17
stosd dword es:[edi], eax
shl dword [eax + 0x17], 1
scasd eax, dword es:[edi]
lea ebp, [eax]
fcmove st(0), st(6)
add dword [esi + 0x2f796787], edi
dec eax
mov eax, dword [0x65407107]
add byte [ebp + 0x7631abbd], dh
xor al, 0x3c
fldcw word [ebp - 0x5f]
test dword [eax + eax - 0x40], ecx
out dx, al
push 0x480d1424
aad 0x2b
pop ss
push cs
jl 0x583120
adc bl, dl
lcall 0x23a3, 0x5ee63831
mov word [ecx - 0x7913b764], fs
cld
mov dh, 0x9f
cmp ebp, dword [esi]
xchg ebx, eax
fsub dword [edx - 0x25e989ba]
xor dword [esi + 0x39], edx
mov dh, 0xb
clc
outsd dx, dword [esi]
invalid
jbe 0x5830d2
push ss
fidiv dword [ecx]
push esi
cmp dword [esi - 0x719007f5], esi
jge 0x58312d
pop ds
int1
mov dword [0xe6ca5560], eax
fdivp st(4)
add eax, 0x868c468a
push cs
sub bl, byte [esi]
jecxz 0x583145
inc esi
mov word [esi - 0x1ce1d5f2], es
imul edx, esp, 0x4a
aam 0x4a
and ecx, dword [ebp + 0x3f]
cmp al, 0xbb
mov esi, 0x8b9d016d
inc ebx
out dx, al
jl 0x58310e
jbe 0x5830bb
sahf
adc byte [ebp + 0x35], cl
push esi
salc
inc edx
retf
add eax, 0x7ec40395
mov eax, dword [0x1fd10f37]
push esi
cmpsd dword [esi], dword es:[edi]
cwde
inc esi
sbb eax, 0xc86c510d
adc edx, ebx
mov ebp, 0xbf62bf19
out 0xc1, al
enter 0xffffffffffffda11, 0xffffffffffffffbd
sbb dword [edi - 0x3e19409e], edi
jo 0x5830ba
mov bl, 0x1f
pop ds
outsb dx, byte [esi]
fst dword [esi + 5]
dec ecx
psubusw mm4, qword [eax]
fcmovne st(0), st(7)
ret
jb 0x5831c2
mov dh, 0x54
iretd
hlt
Function at 0x5cbe90
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
xor eax, 0xffa6a973
imul esi, dword [ecx], 0xffffffe9
mov esi, 0x8b47913e
or dh, byte [ecx + 0x63]
test eax, 0x45e26012
sub edx, dword [ebp - 0x6e62cf28]
xchg dword [edx], edi
pop ds
and dl, byte [edi + 0xc]
invalid

Function at 0x5d3ab5
Capabilities:
Encode data using xor

Disassembly:
int3
mov esp, 0x2773fee6
cwde
inc ecx
pop ds
add al, 0x2e
les ecx, es:[esi - 0x34cd3bb4]
lodsd eax, dword [esi]
push esp
and dword [esi], edi
jo 0x5d3a57
nop
fdivr dword [0xda6185d7]
lea esi, [eax + edx*8]
sub ax, 0xa276
sub bh, byte [esi - 0x2b]
push cs
mov bh, 0xbd
ja 0x5d3b51
sub esi, dword [eax - 7]
xchg ebx, eax
push cs
pop edx
dec ebp
push edx
jp int.005d3ab5
add eax, 0x9b8ea822
or al, 0xa7
xchg esi, eax
mov ah, 0x71
sbb ecx, esp
invalid
xlatb
pop edi
push cs
in al, 5
stosb byte es:[edi], al
aaa
mov ecx, 0xa442d0fa
pop es
lodsb al, byte [esi]
lodsb al, byte [esi]
xchg ebx, eax
pop ss
arpl word [esi + 0x71419828], bp
js 0x5d3bca
jge 0x5d3beb
loop 0x5d3b72
sbb al, 0x88
fst qword [eax]
adc al, 0xa0
and al, 0x80
and edx, dword [edx]
salc
rcr ecx, 0xb2
xchg ebp, eax
dec eax
dec edi
scasd eax, dword es:[edi]
and edi, dword [ebx + esi + 0x2f]
das
xor al, byte [ebp + 0x655ede36]
invalid
cmp dword [edx - 0x28283828], 0xffffffdc
dec edi
jne 0x5d3b83
cmp al, 0xad
wait
push eax
pop edx
pop ss
aaa
mov bl, 0x5a
retf
adc ecx, dword [edx]
pop ss
ja 0x5d3b8f
add eax, 0xd4a39394
adc eax, 0x82cf8b41
push es
hlt
mov ah, bh
sbb al, 0xff
sbb edx, dword [ecx - 0x11]
adc ah, byte [esi + 0x18303bca]
iretd

Function at 0x60df3d
Capabilities:
Encode data using xor

Disassembly:
push cs
pop ds
add dword [esi], esp
cmp al, 0xdd
mov eax, dword [0x408f4a42]
and dl, byte [edx]
add edx, dword [ebp - 0x6653a5e3]
iretd
sbb al, dh
sbb dword [edx - 0x17b43386], 0xffffff92
aam 0x43
jle 0x60dee4
cld
nop
aad 0x87
sbb eax, 0xa75f8ec3
mov edx, 0xa3cff48b
dec edi
add dword [esi + 0x1d], ebp
mov ch, 0x2b
dec esi
adc dword [ecx + 0x4fb55ecd], esi
fimul dword [edi - 0x13c2e65]
cmp eax, 0x3d67ce54
adc eax, 0xe81735d6
xsave [edi + 0x525a6ee2]
fisub dword [ecx - 0x2b]
in al, dx
mov cl, 0xd7
imul edi, dword [ecx - 0x49f5fba8], 0xd16adf76
dec esi
push eax
fnstcw word [edx*4 + 0x2cdcbbdd]
jg 0x60dfcd
jl 0x60df98
and dh, bl
inc edi
mov cs, word [eax + edi - 0x74]
cmpsb byte [esi], byte es:[edi]
mov edx, 0x5eea1f64
mov ch, byte [esi + 0x38]
cmp ebp, eax
invalid
push ebp
ret
Function at 0x402c0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e004]
jne 0x402c16
repz ret
jmp fcn.004030aa

Function at 0x40690c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403cc2
and dword [ebp - 0x14], 0
cmp dword [0x44f87c], 0
mov dword [ebp - 0x18], eax
jne 0x4069bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406a67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406a67
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44f87c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44f880], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44f884], eax
call edi
push eax
call esi
mov dword [0x44f88c], eax
test eax, eax
je 0x4069bf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44f888], eax
mov eax, dword [0x44f888]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406a18
cmp dword [0x44f88c], ecx
je 0x406a18
push eax
call esi
push dword [0x44f88c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406a18
test ebx, ebx
je 0x406a18
call edi
test eax, eax
je 0x406a0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406a0f
test byte [ebp - 8], 1
jne 0x406a18
or dword [ebp + 0x10], 0x200000
jmp 0x406a4b
mov eax, dword [0x44f880]
cmp eax, dword [ebp - 0x18]
je 0x406a4b
push eax
call esi
test eax, eax
je 0x406a4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406a4b
mov eax, dword [0x44f884]
cmp eax, dword [ebp - 0x18]
je 0x406a4b
push eax
call esi
test eax, eax
je 0x406a4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44f87c]
call esi
test eax, eax
je 0x406a67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406a69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402c0c
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x1477625d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x135c6bd7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5eec751a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7ebe24c5
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1a9ccd7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, ebx
movzx eax, word [ebx + 0x3c]
add ebx, eax
mov ebx, dword [ebx + 0x78]
add ebx, edx
or edi, edi
je 0x1a9cd36
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x20]
add esi, edx
push ebx
xor ebx, ebx
lodsd eax, dword [esi]
add eax, edx
push esi
push edi
xchg edi, esi
xchg edi, eax
lodsb al, byte [esi]
or al, al
jne 0x1a9cd15
cmp byte [edi], 0
je 0x1a9cd1e
jmp 0x1a9cd1c
cmp byte [edi], al
jne 0x1a9cd1c
inc edi
jmp 0x1a9cd09
mov al, 1
pop edi
pop esi
or al, al
je 0x1a9cd27
inc ebx
loop 0x1a9cd01
xchg ebx, eax
pop ebx
mov esi, dword [ebx + 0x24]
add esi, edx
inc eax
shl eax, 1
add esi, eax
movzx ecx, word [esi]
mov esi, dword [ebx + 0x1c]
add esi, edx
sub ecx, dword [ebx + 0x10]
xchg ecx, eax
shl eax, 2
add esi, eax
mov eax, dword [esi]
add eax, edx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x10005bd9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10005c18
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005c18
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005c18
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10005c18
cmp dword [ecx + 0x74], 0xe
jbe 0x10005c18
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008619
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100086b6
push ebx
push esi
call fcn.100085e2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10008576
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10008663
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100086b5
push edi
push eax
call fcn.10006f17
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10008683
call fcn.100070be
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100086b4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10008576
add esp, 0x20
test eax, eax
jne 0x100086a2
push edi
call fcn.100070be
jmp 0x100086aa
push ebx
call fcn.100070be
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10008923
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a30
push 0x10010a28
push str.FlsAlloc
push 0x1f
call fcn.1000883f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008957
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f158]
call esi
jmp 0x1000895d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100089a1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a40
push 0x10010a38
push str.FlsGetValue
push 0x21
call fcn.1000883f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100089d8
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100089e0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010a48
push 0x10010a40
push str.FlsSetValue
push 0x22
call fcn.1000883f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008a1a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000df30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000df5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000df5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret