joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e140
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4959c8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x43e179
inc eax
mov dword [esi + 0x10], eax
jmp 0x43e28c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x43e18d
mov eax, 0xffffffc7
jmp 0x43e28e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x43e19e
cmp dword [esi + 8], eax
jne 0x43e18d
cmp dword [esi + 8], eax
jne 0x43e1b7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x43e1b7
mov eax, 0xffffffc7
jmp 0x43e28e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x43e1cb
push eax
mov ecx, ebx
call fcn.0043d970
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.004075b0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x43e1fc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004075d0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0043d0e0
test eax, eax
mov dword [esp + 0x38], eax
je 0x43e22f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b9920
call fcn.004077b0
mov eax, dword [esp + 0x38]
jmp 0x43e28e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0043dfa0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x43e273
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0043dfc0
mov esi, eax
test esi, esi
jne 0x43e2a3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0043dfa0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x43e245
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b9920
call fcn.004077b0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x4b9920
call fcn.004077b0
mov eax, esi
jmp 0x43e28e

Function at 0x442a80
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x442ae0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x442ae0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x442ae0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x442ae0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x442b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x44e780
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x493168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0048ef19
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0044e140
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0048ee47
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0048b713
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0048b713
push 1
push 0
push 0
mov ecx, esi
call fcn.0048b6bb
push 1
push 0
push 1
mov ecx, esi
call fcn.0048b6bb
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048ef8b
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x44e900
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x493168
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0048ef19
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0044e140
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0048ee47
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x44e9c4
cmp dword [esp + 0x40], 1
jne 0x44e9c2
cmp ecx, eax
jge 0x44e9c4
mov eax, ecx
cmp eax, 0xc8
jge 0x44e9d0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0044e780
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048ef8b
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x44f180
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x495f73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00489b34
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0048f1c4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004907a3
test eax, eax
je 0x44f29c
mov ecx, dword [esp + 0x3c]
call fcn.0048f1f1
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x44f260
push edi
mov ecx, esi
call fcn.0048c85a
mov ecx, esi
call fcn.0044f440
cmp dword [esp + 0x38], 1
jne 0x44f295
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0048c995
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4513d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x451403
push esi
call fcn.0045f750
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4513fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x451489
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x451472
mov eax, dword [esi + 8]
test eax, eax
je 0x451427
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45146e
cmp eax, 2
je 0x451472
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45141a
cmp eax, 3
je 0x45144d
cmp eax, 1
jne 0x45141a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45141a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45141a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004514b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x451498
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004514b0
add esp, 4
pop esi
ret

Function at 0x451d20
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x451d41
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x451d41
mov eax, dword [eax + 0x44]
test eax, eax
je 0x451d41
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x452190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x45219b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x45229e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4bb5f0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4bb5f0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4bb5f0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4bb5f0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4bb5f0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4bb5f0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4bb5f0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4bb5f0]
xor eax, edx
inc ecx
dec edi
jne 0x4521b6
pop edi
test esi, esi
je 0x4522c0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4bb5f0]
xor eax, edx
inc ecx
dec esi
jne 0x4522a2
pop esi
pop ebx
not eax
ret
Function at 0x46ca40
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x46cae3
test eax, eax
jbe 0x46cae3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x46cae3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46ca8e
xor esi, esi
jmp 0x46ca94
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46cabf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0046e950
add esi, eax
push esi
mov ebx, esi
call fcn.0046e950
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x46caa0
pop ebp
test edi, edi
pop edi
jne 0x46cae3
test ebx, ebx
je 0x46cae3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004719c0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x46cc00
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46cd1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46cd1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00489f86
mov esi, eax
test esi, esi
je 0x46cd1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46cd1d
mov ecx, esi
call fcn.0046cb90
cmp edi, eax
jge 0x46cd1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46cca3
mov dword [esp + 0x34], 1
jmp 0x46ccfe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46cd1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046c180
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x482002
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e0bcc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004772aa
mov dword [ebp - 0x14], eax
cmp dword [0x502ea4], edi
jne 0x4820f3
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x482080
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4821d3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4821d3
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4821d3
push eax
call ebx
push 0x4c53bc
push esi
mov dword [0x502ea4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4c53cc
push esi
mov dword [0x502ea8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x502eac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x502eb4], eax
test eax, eax
je 0x4820f0
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x502eb0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x482118
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48210b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x48212d
push 4
pop eax
jmp 0x4821d5
cmp dword [ebp - 0x14], edi
je 0x48212d
push dword [0x502ea4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x482112
mov eax, dword [0x502eb0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x48218b
cmp dword [0x502eb4], esi
je 0x48218b
push eax
call ebx
push dword [0x502eb4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x48218b
test eax, eax
je 0x48218b
call ecx
test eax, eax
je 0x482180
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x482180
test byte [ebp - 8], 1
jne 0x48218b
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4821bb
mov eax, dword [0x502ea8]
cmp eax, esi
je 0x4821b8
push eax
call ebx
test eax, eax
je 0x4821b8
call eax
mov edi, eax
test edi, edi
je 0x4821b8
mov eax, dword [0x502eac]
cmp eax, esi
je 0x4821b8
push eax
call ebx
test eax, eax
je 0x4821b8
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x502ea4]
call ebx
test eax, eax
je 0x4821d3
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4821d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047affe
leave
ret
Function at 0x48a929
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48a961
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004889e1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004889b9
jmp 0x48a96d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48c017
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48c059
call fcn.00491b70
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48c059
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48c050
xor eax, eax
jmp 0x48c061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048c067
pop edi
pop esi
pop ebx
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol esi, 0x4e
rcr ebx, 0xc4
imul edx
dec edx
inc edi
add eax, 0xff
bswap edx
dec ebx
neg edx
not edx
imul edi
inc esi
neg ebx
or edx, 0x4f
bswap esi
sbb edx, 0x2a
or edi, 0x7c
neg edi
ror edi, 9
dec edx
not edx
mov esi, 0xf9
dec eax
add ebx, 0xaa
mov edi, 0x4e
imul edi
imul eax
imul eax
not edx
not ebx
bswap esi
not edx
bswap esi
neg esi
rol esi, 0x2a
imul eax
dec esi
mov edi, 0x8f
bswap edx
dec ebx
or ebx, 0
rol edx, 0x2e
ror ebx, 0xe9
rcr esi, 0x1d
mov edi, 0x73
bswap edx
and edx, 0xc7
mov edi, 0x38
inc edx
bswap ebx
xor ecx, ecx
xor edi, edi
sbb edx, 0x31
neg esi
imul edi
rcr edi, 0xc4
inc esi
not edx
neg edi
or esi, 0xf4
dec edi
neg eax
or eax, 0xd7
add ebx, 0xda
rol eax, 0x79
inc edx
imul ebx
rcr ebx, 0xf6
or edi, 0xa6
ror edi, 0xad
and esi, 5
sub esi, 0x99
ror esi, 0x90
neg esi
neg eax
mov esi, 0x90
rcr eax, 0xed
dec edi
or eax, 0xa4
rcl eax, 0x60
not edx
inc edi
bswap edi
mov eax, 9
rcl esi, 0x66
add edi, 0x70
rcl eax, 0x6a
neg eax
sbb edi, 0x3e
inc edx
or edi, 0x12
or edi, 0x99
rcr edi, 0x15
bswap edx
sub ebx, 0x9c
inc ebx
inc eax
inc esi
rol eax, 7
bswap edi
not edi
sub eax, 0xc0
mov ecx, dword [ebp + 0xc]
rcr eax, 0xeb
dec ebx
not edi
imul edx
rol edi, 0x1e
not esi
ror ebx, 0x7c
bswap esi
inc edi
sbb esi, 0xf4
mov eax, 0x1e
or ebx, 0xec
add esi, 0x84
mov edi, 0x6f
bswap ebx
imul edi
neg edx
not esi
rcr edx, 0xf5
rcr edx, 0x7d
add edx, 0xf2
neg edi
sbb edx, 0xba
and ebx, 0x81
rol ebx, 0xc6
mov ebx, 0xcf
rcr esi, 0x6d
dec edx
rcl edi, 0x16
and edx, 0xcf
rcr edx, 0xa9
neg eax
dec edx
ror edx, 0xa2
add edx, 0x5b
dec edi
inc eax
bswap eax
rol ebx, 0x25
sbb eax, 0x3a
rcr ebx, 0x19
sbb edx, 0x6a
inc ebx
add eax, 0xbe
add eax, 0x2d
ror edx, 0xe3
mov eax, 0xc8
ror ebx, 0x6c
and eax, 0xe5
bswap ebx
mov edi, dword [ebp + 8]
xor eax, esi
mov esi, eax
xor eax, eax
not byte [edi]
mov ebx, eax
xor esi, eax
xor ebx, esi
xor eax, ebx
xor esi, ebx
xor eax, ebx
xor ebx, esi
mov eax, eax
mov eax, esi
add byte [edi], 0x34
xor eax, ebx
xor esi, esi
mov ebx, esi
xor esi, eax
mov eax, eax
mov ebx, eax
xor esi, esi
mov ebx, eax
mov ebx, ebx
sub byte [edi], 0x75
xor esi, ebx
mov ebx, ebx
mov eax, eax
xor ebx, eax
mov eax, esi
xor esi, ebx
xor esi, esi
xor eax, ebx
mov esi, esi
imul byte [edi]
inc edi
loop 0x4013d5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407644
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40764e
repz ret
jmp fcn.0040bb45
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x36344f8f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5ae4ec9
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40320c
Capabilities:
Check os version

Disassembly:
sub esp, 0x184
push ebx
push esi
push edi
xor ebx, ebx
push 0x8001
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x20], ebx
mov byte [esp + 0x14], 0x20
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xbfffffff
cmp ax, 6
mov dword [0x42f40c], eax
jmp 0x40a629
Function at 0x1000ad90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000ad9f
pop dword [ebp - 0x50]
mov eax, 0x9a3eaf71
sub eax, 0x8a3e01d2
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb83308c4
add dword [ebp - 0x60], 0x961f3c87
mov dword [ebp - 0x5c], 0xea7ab3c6
add dword [ebp - 0x5c], 0x47b8987f
mov dword [ebp - 0x58], 0x9e0a5d2e
add dword [ebp - 0x58], 0xae41e700
mov dword [ebp - 0x54], 0xb2276bda
add dword [ebp - 0x54], 0x4dd89426
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x3aa5858e
sub dword [ebp - 0x60], 0xc6331c38
mov dword [ebp - 0x5c], 0xc9b6b803
sub dword [ebp - 0x5c], 0x884a568e
mov dword [ebp - 0x58], 0xb577cb45
sub dword [ebp - 0x58], 0x52085ed9
mov dword [ebp - 0x54], 0xfe400905
add dword [ebp - 0x54], 0x1bff6fb
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3d301d0d
add eax, 0xd2d61313
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x508f3
push 0
call eax
mov ecx, 0x367f3f05
add ecx, 0xc980faef
xor edx, edx
add edx, eax
mov edi, 0x46e7578b
add edi, 0xc9222e75
add edi, dword [ebp - 0x50]
mov esi, 0xe0632cd8
add esi, 0x34dbb494
add dword [ebp - 8], 0xe50817cf
mov ebx, dword [edi]
xor ebx, esi
add dword [ebp - 0x34], ebx
mov dword [edx], ebx
add dword [ebp - 0x3c], 0x48f1c8ee
add edx, 4
add edi, 4
loop 0x1000aebe
add eax, 0xecc4b39e
add eax, 0x133c2705
xor ebx, ebx
add ebx, eax
add eax, 0x9cfc64cd
sub eax, 0x9cfc64c8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret