joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449db0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x59d350]
mov dword [ebp - 0x24], esi
push edi
test esi, esi
je 0x449dd5
mov ebx, dword [esi + 0x74]
jmp 0x449dd7
xor ebx, ebx
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x20], xmm0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
movd xmm1, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
cmp byte [ebx + 0x26], 0
je 0x449e19
call fcn.00449ce0
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x10]
mov ecx, edi
sub ecx, dword [ebx + 0x10]
mov esi, dword [ebp - 0xc]
mov edx, esi
sbb edx, dword [ebx + 0x14]
call fcn.00467fe0
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x28], xmm0
call fcn.00467fe0
movss xmm1, dword [ebp - 0x28]
cvtsd2ss xmm0, xmm0
mov eax, dword [ebp - 0x24]
divss xmm1, xmm0
movss dword [eax + 0x18], xmm1
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], esi
call fcn.00449240
mov eax, dword [0x59d350]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax + 0x2ecc], 0
je 0x449ec2
push 0xa0
call edi
shr eax, 0xf
test al, 1
jne 0x449ec2
mov esi, dword [0x59d350]
xorps xmm3, xmm3
push 0
push 0x210
lea ecx, [esi + 8]
call fcn.00416ff0
mov dword [esi + 0x33c], 0x210
mov dword [esi + 0x8fc], 0xa0
mov eax, dword [0x59d350]
cmp byte [eax + 0x2f0c], 0
je 0x449f0a
push 0xa1
call edi
shr eax, 0xf
test al, 1
jne 0x449f0a
mov esi, dword [0x59d350]
xorps xmm3, xmm3
push 0
push 0x214
lea ecx, [esi + 8]
call fcn.00416ff0
mov dword [esi + 0x340], 0x214
mov dword [esi + 0x90c], 0xa1
mov eax, dword [0x59d350]
cmp byte [eax + 0x2eec], 0
je 0x449f4f
push 0x5b
call edi
shr eax, 0xf
test al, 1
jne 0x449f4f
mov esi, dword [0x59d350]
xorps xmm3, xmm3
push 0
push 0x212
lea ecx, [esi + 8]
call fcn.00416ff0
mov dword [esi + 0x228], 0x212
mov dword [esi + 0x904], 0x5b
mov eax, dword [0x59d350]
cmp byte [eax + 0x2f2c], 0
je 0x449f94
push 0x5c
call edi
shr eax, 0xf
test al, 1
jne 0x449f94
mov esi, dword [0x59d350]
xorps xmm3, xmm3
push 0
push 0x216
lea ecx, [esi + 8]
call fcn.00416ff0
mov dword [esi + 0x22c], 0x216
mov dword [esi + 0x914], 0x5c
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x60], 0
je 0x449fa2
or eax, 0xffffffff
jmp 0x449fad
mov eax, dword [0x59d350]
mov eax, dword [eax + 0x428c]
cmp dword [ebx + 0x20], eax
je 0x449fba
mov dword [ebx + 0x20], eax
call fcn.00449110
call fcn.00449520
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
Function at 0x44b0d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
mov eax, dword [0x47400c]
xor eax, esp
mov dword [esp + 0x14c], eax
cmp dword [0x59d3bc], 0
jne 0x44b182
lea eax, [esp + 5]
mov dword [esp + 4], 0x64746e40
push eax
mov dword [esp + 0xc], 0x642e6c6c
mov word [esp + 0x10], 0x6c6c
mov byte [esp + 0x12], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x44b167
movaps xmm0, xmmword [0x46fc80]
xor eax, eax
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0x676f486f
mov word [esp + 0x24], 0x6e
mov cl, byte [esp + 0x10]
xor byte [esp + eax + 0x11], cl
inc eax
cmp eax, 0x14
jb 0x44b141
lea eax, [esp + 0x11]
mov byte [esp + 0x25], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59d3bc], eax
jmp 0x44b16c
mov eax, dword [0x59d3bc]
test eax, eax
jne 0x44b182
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
push 0x110
lea eax, [esp + 0x38]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x28], 0x11c
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], 3
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 3
lea eax, [esp + 0x34]
push eax
call dword [0x59d3bc]
mov ecx, dword [esp + 0x14c]
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
Function at 0x44b1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
mov esi, ecx
mov dword [ebp - 8], 0x60
mov dword [ebp - 0xc], 0x60
call fcn.0044b0d0
add esp, 4
test eax, eax
je 0x44b2d9
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x59d3d0]
cmp eax, dword [ecx + 4]
jle 0x44b27f
push 0x59d3d0
call fcn.00467026
add esp, 4
cmp dword [0x59d3d0], 0xffffffff
jne 0x44b27f
lea eax, [ebp - 0x1b]
mov dword [ebp - 0x1c], 0x63687363
push eax
mov dword [ebp - 0x18], 0x2e65726f
mov dword [ebp - 0x14], 0x6c6c64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x59d3d0
mov dword [0x59d3d4], eax
call fcn.00466fdc
add esp, 4
mov eax, dword [0x59d3b8]
test eax, eax
jne 0x44b2ca
mov edx, dword [0x59d3d4]
test edx, edx
je 0x44b2d9
movaps xmm0, xmmword [0x46f8f0]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x48
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x44b2a5
lea eax, [ebp - 0x1f]
mov byte [ebp - 0xf], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59d3b8], eax
test eax, eax
je 0x44b2d9
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push esi
call eax
jmp 0x44b302
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0x58
push edi
call esi
push 0x5a
push edi
mov dword [ebp - 8], eax
call esi
push edi
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
pop esi
addsd xmm0, qword [eax*8 + 0x46f640]
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x46e550]
call fcn.00466a4b
mov esp, ebp
pop ebp
ret
Function at 0x44f7b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [0x59d350]
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, dword [esi + 0x3f04]
test eax, eax
jne 0x44f7e7
mov dword [ebp - 0x1c], 0x43532330
lea ebx, [ebp - 0x1b]
mov dword [ebp - 0x18], 0x4c4c4f52
mov word [ebp - 0x14], 0x58
jmp 0x44f7fe
mov dword [ebp - 0x2c], 0x43532369
lea ebx, [ebp - 0x2b]
mov dword [ebp - 0x28], 0x4c4c4f52
mov word [ebp - 0x24], 0x59
mov ecx, dword [edi + 0xfc]
xor edx, edx
mov eax, dword [edi + 0x104]
mov dword [ebp - 0xc], ebx
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.00417220
mov ebx, eax
add esp, 4
cmp dword [esi + 0x3f28], ebx
jne 0x44f840
push ecx
push dword [ebp - 0xc]
mov edx, 0xb
mov ecx, ebx
call fcn.004374d0
mov esi, dword [0x59d350]
add esp, 8
cmp dword [esi + 0x3f40], ebx
jne 0x44f84e
mov dword [esi + 0x3f44], ebx
cmp dword [esi + 0x3f84], ebx
jne 0x44f85d
mov byte [esi + 0x3f88], 1
mov ecx, dword [ebp - 4]
mov eax, ecx
movups xmm0, xmmword [edi + 0x1ec]
xor eax, 1
movss xmm2, dword [edi + 0x40]
movss xmm1, dword [edi + 0x44]
movss xmm3, dword [edi + 0x48]
movss xmm4, dword [edi + 0x4c]
addss xmm3, xmm2
movss xmm5, dword [edi + 0x7c]
addss xmm4, xmm1
movss xmm6, dword [edi + eax*4 + 0xb8]
movups xmmword [ebp - 0x20], xmm0
test ecx, ecx
jne 0x44f8e0
movss xmm0, dword [ebp - 0x20]
mov esi, 0x1c0
cmp byte [edi + 0xc1], cl
mov eax, 0x140
movss dword [ebp - 0x30], xmm0
movaps xmm0, xmm4
subss xmm0, xmm5
movss dword [ebp - 0x24], xmm4
cmovne esi, eax
subss xmm0, xmm6
maxss xmm1, xmm0
movss xmm0, dword [ebp - 0x18]
movss dword [ebp - 0x28], xmm0
movss dword [ebp - 0x2c], xmm1
jmp 0x44f933
mov esi, dword [edi + 8]
movaps xmm0, xmm3
subss xmm0, xmm5
movss dword [ebp - 0x28], xmm3
and esi, 0x401
dec esi
neg esi
subss xmm0, xmm6
sbb esi, esi
and esi, 0xffffffe0
add esi, 0x120
cmp byte [edi + 0xc0], 0
maxss xmm2, xmm0
movss xmm0, dword [ebp - 0x1c]
movss dword [ebp - 0x2c], xmm0
movss xmm0, dword [ebp - 0x14]
movss dword [ebp - 0x24], xmm0
movss dword [ebp - 0x30], xmm2
jne 0x44f933
or esi, 0x80
movss xmm0, dword [edi + ecx*4 + 0x90]
call fcn.00467d48
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push esi
mov esi, eax
mov dword [ebp - 0xc], edx
movss xmm0, dword [edi + eax*4 + 0x70]
addss xmm0, xmm0
addss xmm0, dword [edi + esi*4 + 0x58]
call fcn.00467d48
movss xmm0, dword [edi + esi*4 + 0x1f4]
subss xmm0, dword [edi + esi*4 + 0x1ec]
push edx
push eax
call fcn.00467d48
push edx
push eax
lea eax, [ebp - 0x10]
mov edx, ebx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.0044f9b0
mov edx, dword [ebp - 0xc]
add esp, 0x1c
mov ecx, dword [ebp - 0x10]
call fcn.00467fe0
cvtsd2ss xmm0, xmm0
movss dword [edi + esi*4 + 0x90], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d8b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
mov dword [ebp - 0x64], eax
jmp fcn.007102f7

Function at 0x45e220
Capabilities:
Encode data using xor
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x46f140]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x23c], eax
movups xmmword [ebp - 0x228], xmm0
mov dword [ebp - 0x218], 0x36773724
mov byte [ebp - 0x214], 0
mov al, byte [ebp - 0x228]
xor byte [ebp + ecx - 0x227], al
inc ecx
cmp ecx, 0x13
jb 0x45e260
push dword [ebp + 8]
lea eax, [ebp - 0x227]
mov byte [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00415080
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
mov eax, dword [0x59d374]
mov eax, dword [eax + 0x7c]
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x45e423
push 0
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x218], 0
push eax
push 8
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 0
push eax
push 0xc
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0
push eax
mov eax, dword [0x59d374]
xorps xmm0, xmm0
push 0x2d1400
push edi
movlpd qword [ebp - 0x234], xmm0
mov eax, dword [eax + 0x110]
mov dword [ebp - 0x22c], 0
call eax
test eax, eax
jne 0x45e353
mov eax, dword [0x59d374]
mov eax, dword [eax + 0xc4]
call eax
mov esi, eax
mov ecx, dword [0x59d374]
push edi
mov ecx, dword [ecx + 0x98]
call ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466a4b
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 0x230]
push esi
call fcn.00466ac2
add esp, 4
mov ebx, eax
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
push 0
push eax
push esi
push ebx
push 0xc
lea eax, [ebp - 0x220]
push eax
mov eax, dword [0x59d374]
push 0x2d1400
push edi
mov eax, dword [eax + 0x110]
call eax
test eax, eax
jne 0x45e3b8
mov eax, dword [0x59d374]
mov eax, dword [eax + 0xc4]
call eax
push ebx
mov esi, eax
call fcn.00466a8d
add esp, 4
jmp 0x45e32f
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x45e40c
add eax, ebx
mov dword [ebp - 0x238], 0x73253d
push eax
lea eax, [ebp - 0x237]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040dbc0
lea edx, [ebp - 0x108]
add esp, 0xc
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x45e3f0
sub edx, ecx
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 0x23c]
push edx
push eax
call fcn.00402bd0
push ebx
call fcn.00466a8d
mov eax, dword [0x59d374]
add esp, 4
mov eax, dword [eax + 0x98]
push edi
call eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466a4b
mov esp, ebp
pop ebp
ret 8
Function at 0x460100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push esi
mov edi, ecx
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
je 0x460191
movaps xmm0, xmmword [0x46eff0]
xor ecx, ecx
movups xmmword [ebp - 0x118], xmm0
mov byte [ebp - 0x108], 0
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp - 0x118]
xor byte [ebp + ecx - 0x117], al
inc ecx
cmp ecx, 0xf
jb 0x460150
push esi
lea eax, [ebp - 0x117]
mov byte [ebp - 0x108], 0
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0040dbc0
add esp, 0xc
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
push 1
call fcn.0045f060
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00466a4b
mov esp, ebp
pop ebp
ret 8

Function at 0x4601b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], 0x3f340651
mov dl, 0x51
mov dword [ebp - 0xc], 0x30381b71
mov dword [ebp - 8], 0x24381d71
xor eax, eax
mov byte [ebp - 4], 0
xor byte [ebp + eax - 0xf], dl
inc eax
cmp eax, 0xb
jae 0x4601e6
mov dl, byte [ebp - 0x10]
jmp 0x4601d7
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xf]
push eax
push edi
mov byte [ebp - 4], 0
call fcn.00460100
lea eax, [ebp - 0xb]
mov dword [ebp - 0xc], 0x69674f04
push eax
push edi
mov ecx, esi
mov dword [ebp - 8], 0x6569766c
mov byte [ebp - 4], 0
call fcn.00460100
lea eax, [ebp - 0xb]
mov dword [ebp - 0xc], 0x4c455463
push eax
push edi
mov ecx, esi
mov dword [ebp - 8], 0x4b495245
mov byte [ebp - 4], 0
call fcn.00460100
mov cl, 0x6f
mov dword [ebp - 0x10], 0xa072c6f
mov dword [ebp - 0xc], 0x2a4f1b0e
xor eax, eax
mov dword [ebp - 8], 0x1060801
mov word [ebp - 4], 0xa
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xc
jae 0x460261
mov cl, byte [ebp - 0x10]
jmp 0x460252
lea eax, [ebp - 0xf]
mov byte [ebp - 3], 0
push eax
push edi
mov ecx, esi
call fcn.00460100
lea eax, [ebp - 0xf]
mov dword [ebp - 0x10], 0x72695766
push eax
push edi
mov ecx, esi
mov dword [ebp - 0xc], 0x61687365
mov word [ebp - 8], 0x6b72
mov byte [ebp - 6], 0
call fcn.00460100
lea eax, [ebp - 7]
mov dword [ebp - 8], 0x374b5866
push eax
push edi
mov ecx, esi
mov word [ebp - 4], 0x32
call fcn.00460100
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x460390
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x471bb0
push 0x467285
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x47400c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], ecx
jmp fcn.00734bad
Function at 0x465630
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 8]
or byte [ebx + 0x55890c45], cl
cld
mov dword [ebp - 8], eax
push ebx
push esi
push edi
test edx, edx
je 0x465701
mov eax, dword [edx + 0x3c]
add eax, 0x78
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, dword [eax]
mov eax, dword [ebp - 8]
mov ecx, dword [esi + edx + 0x1c]
mov edi, dword [esi + edx + 0x20]
add ecx, edx
mov ebx, dword [esi + edx + 0x24]
add edi, edx
add ebx, edx
mov dword [ebp - 0xc], ecx
cdq
mov edx, dword [ebp - 4]
and eax, 0xffff0000
or eax, 0
jne 0x46568f
mov eax, dword [ebp - 8]
movzx eax, ax
sub eax, dword [esi + edx + 0x10]
mov ecx, dword [ecx + eax*8]
jmp 0x4656f6
mov esi, dword [esi + edx + 0x18]
test esi, esi
je 0x465701
mov eax, dword [edi]
dec esi
mov ecx, dword [ebp - 8]
add eax, edx
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4656c0
test dl, dl
je 0x4656bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4656c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4656a0
xor eax, eax
jmp 0x4656c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4656d8
mov edx, dword [ebp - 4]
add edi, 4
add ebx, 2
test esi, esi
jne 0x465697
jmp 0x465701
movzx eax, word [ebx]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, ecx
ja 0x4656f3
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jb 0x465701
mov edx, dword [ebp - 4]
lea eax, [edx + ecx]
test eax, eax
jne 0x46579b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0xc], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x10], ecx
cmp ecx, edx
je 0x465774
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x465774
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x8642f0a7
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x46576d
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x465750
cmp esi, 0xbd2db123
je 0x465778
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x465735
mov eax, dword [eax]
jmp 0x465710
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
push dword [ebp - 8]
mov eax, dword [esi + 0x24]
push dword [ebp - 4]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4657b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 4], ecx
cmp ecx, esi
je 0x465834
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x465834
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x8b2f48e9
mov cl, byte [edx]
inc edx
test cl, cl
je 0x46582d
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x465810
cmp esi, 0x4b083d98
je 0x465838
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4657f5
mov eax, dword [eax]
jmp 0x4657d0
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
test eax, eax
jne 0x4658f8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x4658d4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4658d4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x17b7ad11
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x4658cd
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x4658b0
cmp esi, 0xe382349b
je 0x4658d8
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x465895
mov eax, dword [eax]
jmp 0x465870
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x465910
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46983b
mov eax, dword fs:[0]
push eax
mov eax, 0x1060
call fcn.00467c50
mov eax, dword [0x47400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x1068], eax
mov dword [ebp - 4], 1
mov eax, dword [0x59d37c]
mov dword [ebp - 0x1060], eax
jmp fcn.0074d6d9
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x41b010]
xor eax, esp
mov dword [esp + 0x1bc], eax
push esi
mov esi, dword [esp + 0x1cc]
push 0x94
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004061d0
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [esp + 0x28]
cmp eax, 5
ja 0x401070
jne 0x401055
cmp dword [esp + 0x2c], 1
jae 0x401070
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.004061bd
add esp, 0x1c0
ret
mov eax, dword [esp + 0x1c8]
lea edx, [esp + 0xb8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401080
push 0x5c
push esi
call fcn.00406190
add esp, 8
test eax, eax
jne 0x4010a8
push 0x2f
push esi
call fcn.00406190
add esp, 8
test eax, eax
je 0x4010ab
inc eax
jmp 0x4010ad
mov eax, esi
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010b0
push edi
lea edi, [esp + 0xbc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4010c2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xbc]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4010e2
mov edx, dword [str..manifest]
mov ecx, dword [0x414200]
mov dword [eax], edx
mov dx, word [0x414204]
push ebx
mov dword [eax + 4], ecx
push str.kernel32
mov word [eax + 8], dx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
push str.CreateActCtxA
push esi
call ebx
push str.ActivateActCtx
push esi
mov edi, eax
call ebx
mov esi, eax
pop ebx
test edi, edi
je 0x4011af
test esi, esi
je 0x4011af
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 8]
lea eax, [esp + 0xbc]
push ecx
mov dword [esp + 0xc], 0x20
mov dword [esp + 0x14], eax
call edi
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x4011a5
push 0x41c020
push eax
call esi
test eax, eax
je 0x4011a5
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.004061bd
add esp, 0x1c0
ret
mov dword [section..data], 0xffffffff
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004061bd
add esp, 0x1c0
ret