joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007cc79
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100a23b0]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x18], esi
call fcn.10036460
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov cl, byte [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov byte [esi + 0x28], cl
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.0
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov byte [esp + 0x30], 3
mov byte [ecx], bl
call fcn.100040b0
push 0xffffffffffffffff
lea ecx, [esi + 0x50]
push ebx
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push ebp
mov byte [esp + 0x30], 4
mov byte [ecx], bl
call fcn.100040b0
mov eax, dword [esp + 0x38]
mov byte [esp + 0x24], 5
cmp eax, ebx
jge 0x1003523d
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x10035258
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 0xc], ecx
jmp 0x1003525f
mov edx, dword [esp + 0x30]
mov dword [esi + 0xc], edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10069cdb
add esp, 0x14
ret 0x18

Function at 0x10035ee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007cd38
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x20]
mov edx, dword [eax + 0x24]
push ebx
call edx
mov esi, eax
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x28]
mov eax, dword [esi]
mov edx, dword [esp + 0x24]
mov eax, dword [eax + 0xc]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], 0
call eax
mov eax, dword [esp + 0x2c]
mov edx, dword [edi]
mov edx, dword [edx + 0x30]
push 0
push eax
push esi
push ebx
mov ecx, edi
call edx
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
call edx
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x10
Function at 0x10036090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007cd98
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
call edx
mov edi, eax
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
push ecx
push edx
push edi
mov ecx, esi
mov dword [esp + 0x28], 0
call eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push eax
push ecx
mov ecx, edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push edi
mov ecx, esi
call edx
mov bl, al
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
mov dword [esp + 0x20], 0xffffffff
call edx
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x10038800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007d481
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.100428c0
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ecx
mov ecx, eax
mov dword [esp + 0x2c], 1
call fcn.100350b0
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.100428e0
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 0
test ecx, ecx
je 0x1003887c
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x10039070
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
test dl, 3
mov eax, 0
sete al
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
test eax, eax
je 0x100390d0
test bl, 3
mov eax, 0
sete al
test eax, eax
je 0x100390d0
mov ecx, ebp
push edi
shr ecx, 2
xor edi, edi
test ecx, ecx
je 0x100390c0
mov esi, ebx
mov eax, edx
sub esi, edx
mov edi, ecx
mov ebx, dword [esi + eax]
xor dword [eax], ebx
add eax, 4
dec ecx
jne 0x100390b1
mov ebx, dword [esp + 0x18]
lea eax, [edi*4]
sub ebp, eax
pop edi
je 0x100390e9
add edx, eax
add ebx, eax
test ebp, ebp
je 0x100390e9
mov ecx, ebx
mov eax, edx
sub ecx, edx
mov esi, ebp
lea esp, [esp]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x100390e0
pop esi
pop ebp
pop ebx
ret
Function at 0x100390f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
test dl, 3
mov eax, 0
sete al
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
test eax, eax
je 0x1003916f
test bl, 3
mov eax, 0
sete al
test eax, eax
je 0x1003916f
test cl, 3
mov eax, 0
sete al
test eax, eax
je 0x1003916f
mov esi, dword [esp + 0x20]
shr esi, 2
xor eax, eax
test esi, esi
je 0x1003915f
mov edi, ebx
sub edi, ecx
mov eax, ecx
sub edx, ecx
mov dword [esp + 0xc], esi
push ebp
mov ebp, dword [edi + eax]
xor ebp, dword [eax]
add eax, 4
dec esi
mov dword [edx + eax - 4], ebp
jne 0x10039147
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub dword [esp + 0x20], eax
je 0x1003918d
add edx, eax
add ebx, eax
add ecx, eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1003918d
mov esi, ebx
sub esi, ecx
mov eax, ecx
sub edx, ecx
nop
mov cl, byte [eax + esi]
xor cl, byte [eax]
inc eax
dec edi
mov byte [eax + edx - 1], cl
jne 0x10039180
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1003c770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007df70
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a23b0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
xor ebx, ebx
push str.BER_decode_error
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.100041a0
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.10069cea
mov eax, 1
mov dword [esi + 0xc], eax
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov byte [esp + 0x3c], al
mov dword [esi], vtable.CryptoPP::Exception.0
push ebx
lea eax, [esp + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [ecx], bl
call fcn.100040b0
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x1003c81b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1006a385
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10069cdb
add esp, 0x30
ret
Function at 0x10042310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007df70
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a23b0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
push eax
lea eax, [esp + 0x14]
mov esi, ecx
push str.IteratedHashBase:_input_data_exceeds_maximum_allowed_by_hash_function
push eax
mov dword [esp + 0x18], esi
call fcn.10004b40
add esp, 0xc
mov edi, eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.10069cea
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 4
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov byte [esp + 0x44], 1
mov byte [ecx], 0
call fcn.100040b0
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.CryptoPP::InvalidDataFormat.0
jb 0x100423b8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1006a385
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::HashInputTooLong.0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10069cdb
add esp, 0x30
ret 4

Function at 0x10054f30
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
push edi
xor esi, esi
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov edi, edx
shl edi, 0x19
xor ecx, edi
mov edi, edx
shl edi, 8
or edi, edx
shl edi, 8
or ecx, edi
lea edi, [edx + edx]
xor eax, edi
xor eax, edx
or eax, ecx
xor edx, edx
xor edi, edi
or edx, ecx
or eax, edi
mov dword [esi*8 + 0x100ac000], edx
mov dword [esi*8 + 0x100ac004], eax
inc esi
cmp esi, 0x100
jl 0x10054f34
xorpd xmm0, xmm0
movlpd qword [0x100ac808], xmm0
xorpd xmm0, xmm0
pop edi
movlpd qword [0x100ac800], xmm0
mov byte [0x100ac810], 1
pop esi
ret
Function at 0x10054fb0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x10089848]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x100ab800], edx
mov dword [eax*8 + 0x100ab804], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x10054fc0
pop edi
pop esi
pop ebp
mov byte [0x100ac811], 1
pop ebx
add esp, 0x10
ret
Function at 0x1005dbb0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 0xffffffffffffffff
push 0x1007f858
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100a23b0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebp
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
mov esi, ecx
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x1005dc7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebp, eax
call edi
test eax, eax
jne 0x1005dc7d
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
jne 0x1005dc7d
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x13
push str.CryptAcquireContext
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.100041a0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x68], 0
call fcn.1005d9d0
push 0x10099814
lea ecx, [esp + 0x30]
push ecx
call fcn.1006b4c5
mov eax, esi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10069cdb
add esp, 0x58
ret

Function at 0x1005de00
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x1007f8c6
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100a23b0]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
test byte [0x100ac830], 1
mov esi, dword [esp + 0x68]
jne 0x1005de61
or dword [0x100ac830], 1
lea ecx, [esp + 0xb]
mov dword [esp + 0x60], 0
call fcn.1005dd20
mov dword [0x100ac82c], eax
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [0x100ac82c]
mov ecx, dword [esp + 0x6c]
mov eax, dword [eax]
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1005debe
push 0xe
push 0x1008920c
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], eax
mov byte [esp + 0x14], al
call fcn.100041a0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x64], 1
call fcn.1005d9d0
push 0x10099814
lea eax, [esp + 0x2c]
push eax
call fcn.1006b4c5
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.10069cdb
add esp, 0x5c
ret 8
Function at 0x10060b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007f9c1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 1
call fcn.10036460
lea eax, [esi + 8]
mov ecx, eax
neg ecx
and ecx, 0xf
mov dword [esi], vtable.CryptoPP::RandomPool.0
add ecx, eax
mov dword [eax + 0x20], 0x10
mov byte [eax + 0x19], 1
mov dword [eax + 0x24], ecx
lea eax, [esi + 0x30]
mov ecx, eax
neg ecx
and ecx, 0xf
add ecx, eax
mov dword [esp + 0x1c], 0
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x29], 1
mov dword [eax + 0x34], ecx
push 0x128
mov byte [esp + 0x20], 1
call fcn.1006a405
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov byte [esp + 0x1c], 2
test edi, edi
je 0x10060c3b
mov ecx, edi
call fcn.10056e10
mov dword [edi], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.0
mov dword [edi + 4], vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.0
jmp 0x10060c3d
xor edi, edi
mov dword [esi + 0x68], edi
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x64]
push eax
push 0
push ecx
mov byte [esi + 0x6c], 0
call fcn.1006b520
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
push edx
push 0
push eax
call fcn.1006b520
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x10069cdb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a23b0]
jne 0x10069ce5
repz ret
jmp fcn.1006d601
Function at 0x10078b1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100a23b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1006f186
and dword [ebp - 0x14], 0
cmp dword [0x100ad650], 0
mov dword [ebp - 0x18], eax
jne 0x10078bcf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10078c77
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10078c77
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100ad650], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100ad654], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100ad658], eax
call edi
push eax
call esi
mov dword [0x100ad660], eax
test eax, eax
je 0x10078bcf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100ad65c], eax
mov eax, dword [0x100ad65c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10078c28
cmp dword [0x100ad660], ecx
je 0x10078c28
push eax
call esi
push dword [0x100ad660]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10078c28
test ebx, ebx
je 0x10078c28
call edi
test eax, eax
je 0x10078c1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10078c1f
test byte [ebp - 8], 1
jne 0x10078c28
or dword [ebp + 0x10], 0x200000
jmp 0x10078c5b
mov eax, dword [0x100ad654]
cmp eax, dword [ebp - 0x18]
je 0x10078c5b
push eax
call esi
test eax, eax
je 0x10078c5b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10078c5b
mov eax, dword [0x100ad658]
cmp eax, dword [ebp - 0x18]
je 0x10078c5b
push eax
call esi
test eax, eax
je 0x10078c5b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100ad650]
call esi
test eax, eax
je 0x10078c77
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10078c79
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10069cdb
leave
ret
Function at 0x4d0c90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004090f0
xor eax, eax
push ebp
push 0x4d0dcf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4d0da2
xor edx, edx
push ebp
push 0x4d0d9b
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x4d0cdd
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d0d70
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4d0d5f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x4d0d22
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00409e7c
lea ecx, [esi + 2]
mov edx, ebx
call fcn.00404844
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0d66
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x681bb8]
mov dl, 1
mov eax, dword [0x41c6ac]
call fcn.00428950
call fcn.00408704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0dd6
lea eax, [ebp - 4]
call fcn.0040900c
ret

Function at 0x4f80a0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.004f8150
test eax, eax
je 0x4f80db
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.004f8150
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409194
jmp 0x4f80e9
mov ecx, esi
mov edx, 0x4f8108
mov eax, ebx
call fcn.004f7fec
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.004093ec
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x504b3e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x504b3e
add byte [eax], bh
dec esp
cmp eax, dword [ebx + 0x3c]
cmp dword [ebx - 0x74a1fb3c], eax
lea eax, [eax - 4]
invalid

Function at 0x504b84
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push eax
push ecx
add esp, 4
sub eax, 0x5f78
and eax, 0xb60a
or eax, 0xed8b
or eax, 0xf2ce
pop eax
push edi
xor edi, 0x73f0
or edi, 0x15b62
xor edi, 0x14a08
pop edi
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x504bd9
push edx
push ebx
add esp, 4
jmp 0x504bae
and edx, 0x15529
pop edx
push esi
push esi
add esp, 4
jmp 0x504bc1
pop esi
push edx
push ebx
add esp, 4
invalid
ret 0x9eda
invalid
Function at 0x504cc3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc08], 0
jle 0x504dad
push eax
push edi
add esp, 4
xor eax, 0x5385
pop eax
push edx
xor edx, 0x17204
sub edx, 0x105f8
jmp 0x504cb7
call 0x504cc3
add byte [eax + 0x37], dl
cmp dh, byte [esi]
cmp al, 0x44
add esp, 4
pop edx
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x504d49
push edi
push edi
add esp, 4
call fcn.00504cef
add byte [0x4e50353f], bh
cmp eax, 0x4e50353f
xor eax, dword [esi - 0x7d]
add esp, 4
and edi, 0x3844
call 0x504d05
push ecx
jmp 0x504d53
add ecx, 0x16ca9
call fcn.00504d69
add byte [esi + 0x4d], al
dec eax
inc esi
dec eax
dec ebp
xor al, 0x4e
dec ebp
xor eax, dword [ebx - 0xe7efb3c]
add esp, 4
invalid
int1
push ecx
jecxz 0x504d71
add esp, 4
xor ecx, 0xe351
pop ecx
push edi
add byte [ecx + 0x57], bl
add edi, 0xdc0e
pop edi
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x504c88
Function at 0x504d69
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc08], 0
jle 0x504dad
push eax
push edi
add esp, 4
xor eax, 0x5385
pop eax
push edx
xor edx, 0x17204
sub edx, 0x105f8
jmp 0x504cb7
call 0x504cc3
add byte [eax + 0x37], dl
cmp dh, byte [esi]
cmp al, 0x44
add esp, 4
pop edx
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x504d49
push edi
push edi
add esp, 4
call fcn.00504cef
add byte [0x4e50353f], bh
cmp eax, 0x4e50353f
xor eax, dword [esi - 0x7d]
add esp, 4
and edi, 0x3844
call 0x504d05
push ecx
jmp 0x504d53
add ecx, 0x16ca9
call fcn.00504d69
add byte [esi + 0x4d], al
dec eax
inc esi
dec eax
dec ebp
xor al, 0x4e
dec ebp
xor eax, dword [ebx - 0xe7efb3c]
add esp, 4
invalid
int1
push ecx
jecxz 0x504d71
add esp, 4
xor ecx, 0xe351
pop ecx
push edi
add byte [ecx + 0x57], bl
add edi, 0xdc0e
pop edi
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x504c88

Function at 0x504e21
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x504e2c
sub esi, 0xf856
and esi, 0x17540
pop esi
mov dword [ebp - 0x3cc], 0
Function at 0x50520e
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50521a
sub edx, 0x10fc5
pop edx
mov dword [ebp - 0xa5c], 0