joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423bc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46b410
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x20]
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x471834
mov dword [esi + 4], eax
call fcn.0041bd60
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x24], 0
call fcn.0041d270
mov edx, esp
mov dword [esp + 0x18], esp
push str.LogsOnlineInstall.txt
push eax
push edx
mov byte [esp + 0x30], 1
call fcn.0041b9b0
add esp, 0xc
mov byte [esp + 0x24], 2
call fcn.0041d300
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0xc
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423c61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0
push 0
push 0
push esi
push 0x422f70
call fcn.004386e0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 8
Function at 0x424560
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x46b5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x50]
mov ebx, 0x10
or ebp, 0xffffffff
mov dword [esp + 0x44], 0
cmp dword [esp + 0x64], ebx
jae 0x4245ad
lea eax, [esp + 0x50]
lea ecx, [esp + 0x24]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x424665
push esi
call fcn.0042bcf8
mov edi, eax
mov eax, dword [esp + 0x54]
add esp, 4
mov dword [esp + 0x18], edi
cmp dword [esp + 0x64], ebx
jae 0x4245df
lea eax, [esp + 0x50]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x424632
push 0x34
mov dword [esp + 0x24], 0x34
call fcn.0042bcbe
add esp, 4
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x47cfd8
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x424632
mov eax, dword [esp + 0x14]
movzx ebp, word [eax + 0x12]
movzx ebx, word [eax + 0x10]
movzx edi, word [eax + 0x16]
movzx esi, word [eax + 0x14]
jmp 0x42463e
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0042bced
add esp, 4
test ebp, ebp
jl 0x424665
mov edx, dword [esp + 0x1c]
push esi
push edi
push ebx
push ebp
push 0x47195c
push edx
call fcn.0044d3e4
add esp, 0x18
cmp dword [esp + 0x64], 0x10
jb 0x424679
mov eax, dword [esp + 0x50]
push eax
call fcn.0042bced
add esp, 4
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x4248d0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x46b628
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x58]
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov ebp, dword [esp + 0x50]
push ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], ebp
call fcn.0042bcf8
mov esi, eax
mov eax, dword [esp + 0x44]
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x24], esi
jae 0x424937
lea eax, [esp + 0x40]
push ebp
push eax
push esi
call fcn.0044d4a0
push ebp
call fcn.0042bcf8
push ebp
mov ebx, eax
push edi
push ebx
mov dword [esp + 0x38], ebx
call fcn.0044d020
push 8
call fcn.0042bcf8
mov edi, eax
mov eax, dword [esp + 0x7c]
mov edx, dword [eax]
mov dword [edi], edx
mov eax, dword [eax + 4]
add esp, 0x20
mov dword [edi + 4], eax
test ebp, ebp
jbe 0x4249ee
dec ebp
shr ebp, 3
sub ebx, esi
inc ebp
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + edi]
xor byte [esi + eax], cl
inc eax
cmp eax, 8
jl 0x424980
mov edx, dword [esp + 0x18]
push 0
push edx
call fcn.0040c6c0
push edi
push esi
call fcn.0040cc80
mov eax, dword [esp + 0x28]
add eax, 8
push 1
push eax
call fcn.0040c6c0
push esi
push edi
call fcn.0040cc80
mov eax, dword [esp + 0x38]
add eax, 0x10
push 0
push eax
call fcn.0040c6c0
push edi
push esi
call fcn.0040cc80
mov eax, dword [edi]
mov dword [ebx + esi], eax
mov ecx, dword [edi + 4]
mov dword [ebx + esi + 4], ecx
add esp, 0x30
add esi, 8
sub ebp, 1
jne 0x424978
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push ebp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push ebx
mov byte [ecx + 4], 0
call fcn.004036c0
push esi
call fcn.0042bced
push ebx
call fcn.0042bced
push edi
call fcn.0042bced
add esp, 0xc
cmp dword [esp + 0x54], 0x10
jb 0x424a34
mov edx, dword [esp + 0x40]
push edx
call fcn.0042bced
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x424a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46b658
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
xor edx, edx
mov dword [esp + 0xc], edx
push eax
mov eax, dword [esp + 0x44]
push eax
sub esp, 0x1c
mov dword [esp + 0x30], esp
mov edi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], 0xf
push edx
mov dword [esp + 0x60], edx
mov byte [ecx + 4], dl
lea edx, [esp + 0x6c]
push edx
call fcn.004035e0
push edi
call fcn.004247f0
add esp, 0x20
push esi
call fcn.004248d0
add esp, 0x28
cmp dword [esp + 0x3c], 0x10
jb 0x424add
mov eax, dword [esp + 0x28]
push eax
call fcn.0042bced
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x424b00
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x46b688
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48b998]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov eax, dword [0x47193c]
mov edx, dword [0x471944]
mov ecx, dword [0x471940]
mov dword [esp + 0x10], eax
mov eax, dword [0x471948]
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x5c]
mov dword [esp + 0x18], edx
mov edx, dword [0x471950]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x47194c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
cdq
mov ecx, 0x18
idiv ecx
push 0x471954
mov dword [esp + 0x38], ebx
movzx eax, dl
and byte [esp + eax + 0x14], dl
lea eax, [esp + eax + 0x14]
lea edx, [esp + 0x14]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x6c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.004035e0
push esi
call fcn.00424a50
add esp, 0x28
cmp dword [esp + 0x58], 0x10
jb 0x424bda
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0042bced
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044b1f7
add esp, 0x2c
ret 0x24
Function at 0x425c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46b979
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0042c5e3
xor ecx, ecx
xor edi, edi
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x425cd5
push 0x80004005
call fcn.0041af40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x18], edi
call fcn.0042c5e3
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x425d01
push 0x80004005
call fcn.0041af40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 4], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
push edi
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.00429450
mov dword [esi + 0x28], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x425d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46b9b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x48b998]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 1
call fcn.004259c0
cmp dword [esi + 0x2c], 0
lea edi, [esi + 0x2c]
je 0x425d89
mov ecx, edi
call fcn.00425bf0
mov dword [edi], 0
mov eax, dword [esi + 4]
sub eax, 0x10
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x425db3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
sub eax, 0x10
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x425dd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x427070
Capabilities:
Download url
Receive data

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x44]
push esi
push edi
mov edi, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], vtable.CBindCallback.0
cmp dword [esp + 0x2c], edi
jae 0x427098
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x4270ad
lea ecx, [esp + 0x34]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x4270bb
lea eax, [esp + 0x18]
lea edx, [esp + 8]
push edx
push 0
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov esi, eax
mov dword [esp + 8], vtable.CBindCallback.0
mov dword [esp + 0xc], 0
cmp dword [esp + 0x2c], edi
jb 0x4270f0
mov eax, dword [esp + 0x18]
push eax
call fcn.0042bced
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
cmp dword [esp + 0x48], edi
jb 0x427118
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0042bced
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x429a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
call fcn.0042e580
mov esi, dword [eax + 8]
mov eax, dword [esp + 0x14]
movzx ecx, word [esp + 0x18]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x429b42
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x429b41
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x429b41
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x429aea
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x429b08
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
pop ecx
ret
push ebx
push edi
push eax
call fcn.0044d4a0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x429b41
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00429a10
mov ecx, dword [esp + 0x1c]
add esp, 8
mov dword [ecx], eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x42d084
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x42d0af
call fcn.0042e580
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x42d0d2
push eax
push dword [esi + 4]
call fcn.0042d00a
push esi
push eax
mov ecx, 0x48e138
call fcn.0042ccbe
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x42f6d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42f6f9
cmp dword [edi + 0x54], 0
jne 0x42f6f9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0042e580
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042f696
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x430bc1
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46c2df
call fcn.00452e2b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x430be6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x430c2c
lea ecx, [ebp - 0x10]
call fcn.0041b300
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042bd9e
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0041b010
mov eax, esi
call fcn.00452f03
ret 8

Function at 0x43647b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4364c2
call fcn.0042e580
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4364c2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4364de
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00435ff5
mov esi, eax
test edi, edi
je 0x4364dc
test ebx, ebx
je 0x4364dc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x439206
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x43924e
call fcn.0042e580
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43924e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x439291
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x43927a
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x43927a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x43928e
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44b1f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48b998]
jne 0x44b201
repz ret
jmp fcn.0045981c
Function at 0x463e42
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00456a24
and dword [ebp - 4], 0
cmp dword [0x490a30], 0
mov ebx, eax
jne 0x463ef3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x463fa4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x478130
push edi
call esi
test eax, eax
je 0x463fa4
push eax
call fcn.004569b2
mov dword [esp], 0x478120
push edi
mov dword [0x490a30], eax
call esi
push eax
call fcn.004569b2
mov dword [esp], 0x47810c
push edi
mov dword [0x490a34], eax
call esi
push eax
call fcn.004569b2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x490a38], eax
call esi
push eax
call fcn.004569b2
pop ecx
mov dword [0x490a40], eax
test eax, eax
je 0x463ef3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004569b2
pop ecx
mov dword [0x490a3c], eax
mov eax, dword [0x490a3c]
cmp eax, ebx
je 0x463f4b
cmp dword [0x490a40], ebx
je 0x463f4b
push eax
call fcn.00456a2d
push dword [0x490a40]
mov esi, eax
call fcn.00456a2d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x463f4b
test edi, edi
je 0x463f4b
call esi
test eax, eax
je 0x463f42
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x463f42
test byte [ebp - 0xc], 1
jne 0x463f4b
or dword [ebp + 0x10], 0x200000
jmp 0x463f84
mov eax, dword [0x490a34]
cmp eax, ebx
je 0x463f84
push eax
call fcn.00456a2d
pop ecx
test eax, eax
je 0x463f84
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x463f84
mov eax, dword [0x490a38]
cmp eax, ebx
je 0x463f84
push eax
call fcn.00456a2d
pop ecx
test eax, eax
je 0x463f84
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x490a30]
call fcn.00456a2d
pop ecx
test eax, eax
je 0x463fa4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x463fa6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x68f062
Capabilities:
Encode data using xor

Disassembly:
loop 0x68f0c7
xchg edx, eax
push ebx
mov al, 0x43
lds esi, [ebx + 0x13e20f70]
and eax, 0x92f3025f
invalid
insb byte es:[edi], dx
aas
push cs
fcomp dword [esp + ebx]
sbb al, 0x1c
or dh, byte [ebx]
pop eax
xor edx, ebp
in eax, 0xa5
xchg ecx, eax
jb 0x68f094
fiadd dword [edx + 0x62]
sub esp, dword [eax - 0x3188cdab]
jno 0x68f0bd
and eax, dword [edx]
adc edi, esi
add esi, eax
scasd eax, dword es:[edi]
pop ecx
mov edi, 0x1aa6f626
out 0x7f, al
and ah, cl
scasd eax, dword es:[edi]
lds esi, [esi - 0x31]
add dh, byte [ebx - 0x6a]
das
aas
pshufw mm3, qword [edi], 7
pop ds
pop es
pmaxsw mm5, mm3
loop 0x68f0e1
loopne 0x68f0d3
sar bh, cl
wait
loopne 0x68f0f7
std
xor dl, byte [0x1392624b]
rcl dword [edx], cl
mov dh, 0xdf
dec edi
mov esi, 0xdd7837f2
out dx, al
add ecx, esi
int1
jge 0x68f11e
ret
xor eax, 0x71b33fe0
wait
jb 0x68f08f
xchg edi, eax
add dh, byte [ebx - 0x5e89cf0f]
push edx
movsb byte es:[edi], byte [esi]
int 0x14
add al, 0x65
scasb al, byte es:[edi]
pop eax
inc ecx
pop es
retf
jae 0x68f176
salc
jnp 0x68f0f0
das
jecxz 0x68f1a0
in eax, dx
inc edi
cmp esi, dword ss:[esi]
push es
loop 0x68f15d
nop
add dword [edx*2 - 0x89c12ce], edi
xor bl, byte [edi]
pop edi
cmpsd dword [esi], dword es:[edi]
dec edx
mov bh, 0xc1
fisttp word [esi - 0x4ecf33be]
invalid
xchg ebp, eax
xor al, byte [ebx + 0x5fbcb1c4]
jno 0x68f0e8
jne 0x68f1ae
xchg edx, eax
int3
test dword [edx], ebp
inc ebx
mov bl, 0xe0
mov dh, 0xa2
lahf
or al, 0x8c
mov bl, 0x72
xchg edx, eax
inc ebx
mov byte [0xbb70bd03], al
push ebp
ror byte [ebp - 0x7d], 0x15
xor byte [ecx + 0x22], 0xf1
je 0x68f1e7
in al, 0x29
xor al, byte [ecx]
dec esi
in eax, 0x44
xor eax, 0x16170503
in al, 0x15
adc al, 0x67
mov al, 0x7e
xor byte [eax], 0xce
aad 0xb3
or cl, byte [ebp - 0x5beedcde]
and edx, dword [ecx]
movsb byte es:[edi], byte [esi]
jbe 0x68f1c5
ljmp 0xb254:0x44c6a399
hlt
and al, 0xc1
inc eax
rcr byte [eax], 0xe5
daa
mov bh, 0x54
inc esp
add dword [edx - 0x30], 0xab56490a
mov byte [0xd2b170ee], al
push dword [ebx + 0x43ae93e6]
push ss
ret 0xc775
jmp 0x68f1be
Function at 0x5f8d66
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xb8
mov ah, 7
sub byte [eax], 0xe6
sub eax, 0x7d172df0
pop es
pop ss
jge 0x5f8d7a
lea esp, [edx + 0x7f69e9b6]
arpl dx, si
jle 0x5f8dec
bnd jle 0x5f8dec
shl dword [edx + 0x68], cl
mov al, byte [0xf3f570bf]
fldcw word [0x85032dca]
inc eax
pushal
jge 0x5f8d70
and eax, 0x56678ed
push es
adc byte [ecx - 0x3a76f511], bh
in eax, 0x30
mov eax, dword [0xc3fc3b5d]
pop ecx
or edi, dword [ecx]
jnp 0x5f8dbc
js 0x5f8df9
and byte [eax], ch
in al, 3
mov bh, 0x88
push ebp
jge 0x5f8db8
int3
inc esi
cmp dl, bl
inc ax
inc eax
hlt
insd dword es:[edi], dx
dec esi
mov eax, dword [0x1ef84785]
add al, ah
push edi
daa
in eax, dx
mov cl, 0xc1
or ebp, ecx
ror dword [ecx], 0xcd
add byte [esi], bl
movsb byte es:[edi], byte [esi]
inc ecx
mov bh, bh
ror edi, 0xa7
push ebp
pop ss
invalid

Function at 0x6432b6
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xb2
mov bh, 0x70
mov esi, 0x3d498b42
lodsb al, byte [esi]
inc edi
popal
cmp eax, 0x71b023c9
xor ebp, ebx
in al, dx
xchg esp, eax
les esi, [edi - 0x6d]
cmovg esp, dword cs:[eax]
nop
les ecx, [eax - 0x7a8a39b3]
inc ebp
push ebp
push ecx
xchg ecx, eax
xchg edx, eax
and dword [ebp - 0x50], edx
cmp dh, byte [ecx + 0x63]
or dword [ecx - 0x2d86f7df], 0x76eb7e69
xor al, 0x38
adc ah, al
jle 0x64335b
invalid
mov ah, 0x41
mov ah, 0x60
int1
out 0xcf, al
dec edx
pop es
sub al, byte [edi]
daa
jle 0x6433df
in eax, 0x54
inc edx
cmp eax, 0xfb250c00
xlatb
sbb esi, edi
and byte [edx + 0x4b0c5171], al
mov ebx, 0xaee602d6
add dl, byte [ebx + 0x13]
xchg ebp, eax
insb byte es:[edi], dx
sub eax, 0xffffffe1
ror word [ebp + esi*8 - 0x25], 0xc3
adc ah, cl
push edi
xchg esp, eax
invalid
mov bh, 0xba
inc byte [edi + 0x70c04c]
add ah, dh
add byte [eax + ebx*8], dl
add byte [edx], al
out 0, al
adc al, 0xd8
jb 0x6433e6
ret