joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b629
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0
jmp 0x43a3ab
push 0
jmp 0x43a4a9
call fcn.0043a3b0
jmp 0x43b200
call 0x43a48b
jmp 0x43b3cf
call 0x43a4ae
jmp 0x43b400
call 0x43a4cb
call 0x43a50f
jmp 0x43b60a
mov edx, dword [esp + 0x24]
pop eax
sub eax, 0x801ec226
call dword [eax - 0x7fe2f8b8]
jmp 0x43b224
test eax, eax
jmp 0x43b294
call 0x43b26f
push edx
inc esp
insb byte es:[edi], dx
je 0x43b2cf
dec ebx
jns 0x43b2af
add byte [eax - 0x18], dl
sbb eax, 0xe9fffef9
pop edi
int1
invalid
je 0x43a168
jne 0x43b25c
push esi
pushal
mov dl, byte [esp]
and al, 0x8a
invalid
mov al, ah
jmp 0x43b2fc
mov dword [esi], eax
pop esi
jmp 0x43b334
push esp
xor ecx, esi
jg 0x43b2a0
jnp 0x43b2a1
invalid
add byte [eax], al
mov ax, di
mov dword [esp + 4], ecx
pushal
lea esp, [esp + 0x20]
popal
lea esi, [esi + 0x10015aba]
jmp 0x43b2a5
mov edx, dword [esp]
bswap edx
mov dx, word [esp]
lea edx, [eax + 0xd9]
not dx
push edx
jmp 0x43b0b8
movzx ebx, byte [eax]
add ebx, 0xf49c93af
jmp 0x43b350
cmp ebx, 0xf49c947b
jmp 0x43b36f
je 0x43b3b4
jne 0x43a427
pop ecx
fisttp qword [ebp + 0x14]
out 0x57, eax
test eax, 0x36dbbc2e
cmp byte [edi + 0x3bb8ba86], 0x80
push ss
mov dx, 0x53f7
mov dx, word [esp]
mov edx, dword [esp]
not dh
not dx
jmp 0x43b31c
cmp dword [esp + 4], 0
jne 0x43b3ea
pushal
jmp 0x43a486
add byte [ebx], bh
mov bh, 0x27
inc edx
mov cl, 0x7a
sub al, byte [ebp - 0xc]
pushfd
pushal
push word [esp + 0x1b]
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x43b39c
pop eax
sub eax, 0xaa901740
jmp 0x43b427
inc dword [esp + 8]
jmp 0x43b7d1
lea eax, [ebp + 0x275e27f7]
lea eax, [ebx*4]
call fcn.0043b45e
xor bh, byte [esi + 0x5c64b2c]
add byte [ebx + 0x25956603], dl
xchg byte [edx + ecx*4], dl
in eax, dx
sbb al, 0xaf
add eax, eax
sub eax, 0xd
add byte [eax], al
add byte [ecx + 0x44], al
call 0x43b439
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
xchg dword [ebx - 0x72], ebx
stosb byte es:[edi], al
test eax, eax
jmp 0x43b4a9
je 0x43a1a8
jne 0x43b54e
push eax
call fcn.0042ab92
jmp 0x43a4c6
call fcn.0043b563
push edx
inc ebx
jb 0x43b5be
popal
je 0x43b5c1
dec ebx
jns 0x43b5a5
js 0x43b5a3
add cl, ch
dec ebp
invalid
add byte [esi - 0x18], ch
jle 0x43b5c1
call 0x5b2bcf28
test dword [edi], esi
call 0x27783b07
dec esi
fnstcw word [eax]
je 0x43b63b
push ds
lahf
punpckhdq mm3, qword [ecx + 0x66f07411]
add eax, esi
inc ebp
push 0xffffffffffffffed
jge 0x43b5d4
test dword [edi + 0x7c], 0x82444ff
inc esp
and al, 8
popfd
jmp 0x43b68a
pop eax
sub eax, 0x6edce7d7
jmp 0x43b617
call 0x43b629
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
leave
wait
adc al, byte [eax + 0x1fa412e7]
xchg edi, eax
pop es
bound edx, qword [ecx + 0x54258a20]
invalid
pushal
jmp 0x43a50a
popfd
ret

Function at 0x453db6
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
add esp, 1
lea esp, [esp + 1]
and edx, ecx
push edx
jmp 0x453dd4
jmp 0x453d95
Function at 0x453f0a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + 0x431168]
and ebx, ecx
lea esp, [esp + 0x80]
jmp 0x453d7f
and edi, ecx
sub esp, 0x1a
mov word [esp + 6], sp
pushal
sub esp, 0xa
jmp 0x453d15
mov edi, dword [edi*4 + 0x430d68]
sub esp, 0
sub esp, 0x1e
sub esp, 8
sub esp, 2
jmp 0x453d39
xor edi, dword [ebx*4 + 0x431968]
xchg bl, bh
pushal
xchg word [esp + 8], bx
mov bx, word [esp + 0x1c]
lea esp, [esp + 2]
jmp 0x453d50

Function at 0x453f30
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
and ebx, ecx
sub esp, 8
mov byte [esp + 6], ch
push word [esp + 3]
jmp 0x453fa7
push word [esp + 1]
mov byte [esp + 3], bh
jmp 0x453f13
mov bl, 0xde
movzx ebx, byte [esi + 0xd]
call 0x453f3b
mov edx, dword [edx*4 + 0x430d68]
jmp 0x453f81
cmc
push esp
mov dword [esp], esi
and edx, ecx
stc
jmp 0x453f8f
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x431d68]
setbe dh
mov dx, word [esp]
jmp 0x453fdf
lea esp, [esp + 2]
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x431568]
xchg bl, bh
cmc
jmp 0x453f53
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x430d68]
jmp 0x45403e
mov dh, bh
ror dh, 5
jmp 0x453fbb
shr edi, 0x18
cmc
call fcn.00454008
cmp dword [ebp + 0x6b7443d], ebp
sub dword [esi + 0x75c64b2c], edi
setbe byte [ecx]
rol byte [ebx - 0x5cf030f1], 0xdf
bswap edi
bt edi, ebx
inc di
mov edi, edx
jmp 0x454024

Function at 0x453f5e
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
and ebx, ecx
sub esp, 8
mov byte [esp + 6], ch
push word [esp + 3]
jmp 0x453fa7
push word [esp + 1]
mov byte [esp + 3], bh
jmp 0x453f13
mov bl, 0xde
movzx ebx, byte [esi + 0xd]
call 0x453f3b
mov edx, dword [edx*4 + 0x430d68]
jmp 0x453f81
cmc
push esp
mov dword [esp], esi
and edx, ecx
stc
jmp 0x453f8f
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x431d68]
setbe dh
mov dx, word [esp]
jmp 0x453fdf
lea esp, [esp + 2]
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x431568]
xchg bl, bh
cmc
jmp 0x453f53
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x430d68]
jmp 0x45403e
mov dh, bh
ror dh, 5
jmp 0x453fbb
shr edi, 0x18
cmc
call fcn.00454008
cmp dword [ebp + 0x6b7443d], ebp
sub dword [esi + 0x75c64b2c], edi
setbe byte [ecx]
rol byte [ebx - 0x5cf030f1], 0xdf
bswap edi
bt edi, ebx
inc di
mov edi, edx
jmp 0x454024

Function at 0x454008
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.00454066
mov dword [esp + 0x18], edi
sub esp, 0xc
mov byte [esp + 6], bh
add esp, 5
jmp 0x454049
pop word [esp + 2]
lea esp, [esp + 1]
lea esp, [esp + 4]
popal
jmp 0x45406a
lea ecx, [ecx*4]
lea ecx, [ecx + 0x430d68]
mov edi, dword [ecx]
pop ecx
call fcn.00454225
das
mov ebx, 0x7dbd4e2b
pop es
pushfd
xor dl, byte [ebp - 0x5c]
adc dword [ebx - 0x17], esi
jns 0x4540a7
jmp 0x4540e9
and al, 9
movzx ebx, byte [esi + 0xe]
call fcn.00454118
and edx, ecx
pushal
mov byte [esp + 3], ch
pop dword [esp + 0x10]
call fcn.004540fd
inc esp
jecxz 0x45415b
push ss
in eax, 0x27
mov edx, 0x2cddba24
out dx, eax
rcl dword [eax + 0x66]
bsf ebx, esi
lea esp, [esp + 4]
jmp 0x4540cc
adc al, 0x66
push dword [esp + 3]
Function at 0x4540b9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
mov edi, dword [edi*4 + 0x431168]
cmc
jmp 0x4540a0

Function at 0x454167
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], ecx
lea esp, [esp + 3]
add esp, 0
lea esp, [esp + 1]
jmp 0x45414e

Function at 0x454225
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
call fcn.004540b9
jmp 0x454188

Function at 0x4548ad
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0xc]
push word [esp + 1]
push dword [esp + 4]
lea esp, [esp + 2]
jmp 0x45446c

Function at 0x454bf8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [ebp - 4], ecx
cmc
not dh
mov ecx, 0xff
jmp 0x426aad
lea esp, [esp + 4]
lea ecx, [eax - 1]
setl bh
not dh
mov bl, byte [esp]
jmp 0x453c10
jmp 0x453c78

Function at 0x4fb09c
Capabilities:
Encode data using xor

Disassembly:
call fcn.004fb0b4
call 0x4fb0a6
jmp 0x4fb34e
mov dword [esp + 0x24], eax
jmp 0x4fb394
pop ecx
sub ecx, 0x4fb0a6
jmp 0x4fb3b0
popal
inc dword [esp + 8]
push edx
lea esp, [esp + 4]
jmp 0x4fb3bc
mov dword [ecx + 0x4fb288], eax
jmp 0x4fb3be
popfd
ret
movzx ebx, byte [eax]
add ebx, 0xa165b390
jmp 0x4fb4bc
cmp ebx, 0xa165b45c
je 0x4fb520
jne 0x4fb0bb
call 0x4fb4da
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
xchg ecx, eax
add al, byte [eax]
add dh, bl
sub dword [eax - 0x15], ecx
add bh, byte [ebp - 0x621d14a0]
jmp 0x4fb50a
ret
add byte [eax], al
adc byte [ebx - 0x167ea6f6], dl
fdiv qword [eax - 0x2f14ffb1]
call 0x4fb533
jmp 0x4fcdf6
mov dword [esp + 0x24], eax
jmp 0x4fce3a
pop ecx
jmp 0x4fce5a
popal
inc dword [esp + 8]
pushal
mov dword [esp + 0xd], ebp
jmp 0x4fce6c
sub ecx, 0x4fb533
mov dword [ecx + 0x4fcd20], eax
jmp 0x4fce8a
lea esp, [esp + 0x20]
jmp 0x4fce88
popfd
ret
movzx ebx, byte [eax]
add ebx, 0x35c345e4
jmp 0x4fcf7e
cmp ebx, 0x35c346b0
je 0x4fcfe2
jne 0x4fb573
xor edi, dword [esi]
sub eax, 0xf044afe8
in al, 0x98
call 0xe5401496
cwde
push ds
jb 0x4fcfe8
stosd dword es:[edi], eax
outsb dx, byte [esi]
jae 0x4fcfdf
add dword [ebx + 0x78956603], edx
xchg esi, eax
add ecx, ebp
or edi, edi
invalid

Function at 0x507b86
Capabilities:
Encrypt data using des

Disassembly:
call 0x507184
jmp 0x5073c9
cmp eax, 0x41363c
jmp 0x507341
call 0x5071c7
jmp 0x507349
push ebx
pushfd
push eax
jmp 0x5071c2
pop eax
sub eax, 0x666689e9
add eax, 0x6666885d
jmp 0x5073a6
popfd
pop ebx
jmp 0x50719e
add eax, 0x6666885d
mov dword [eax], ebx
pop eax
jmp 0x507369
pushal
lea esp, [esp + 0x11]
pop dword [esp + 6]
lea esp, [esp + 3]
lea esp, [esp + 8]
jmp 0x507459
mov ebx, dword [eax]
sub ebx, 0x99a9e7de
xchg dword [esp + 8], ebx
jmp 0x50738f
pop eax
sub eax, 0x666689a6
jmp 0x507385
push eax
jmp 0x50717f
pop eax
popfd
ret
xchg dword [esp], ebx
pushfd
add ebx, 0x99a9e7de
jmp 0x5073e1
push word [esp + 1]
pop word [esp]
xchg bl, bh
lea esp, [esp + 2]
mov ebx, dword [esp + 0x4c]
lea esp, [esp + 0x60]
jmp 0x507510
mov edi, dword [esp + 0x44]
push edx
pop word [esp]
xchg word [esp], bx
xchg word [esp], bx
jmp 0x507911
Function at 0x5115cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0x29]
push word [esp + 0x17]
pop word [esp + 0xf]
lea esp, [esp + 2]
mov dword [esp + 6], edx
jmp 0x5115f2
mov dword [esp + 9], ecx
jmp 0x511558
lea esp, [esp + 2]
mov dword [esp + 0xa], eax
xchg edx, eax
mov dh, 2
lea eax, [ebx + edi]
rdtsc
jmp 0x5115ac
lea edx, [eax + 0x7deef951]
mov dx, 0x772f
mov edx, dword [esp + 5]
pushal
mov dword [esp + 0xb], esi
push word [esp + 1]
jmp 0x51157c
add eax, 0x24748960
or esp, dword [esi - 1]
je 0x5115cd
add ebx, ebp
ror byte [edx - 0x76abdbec], 1
sub al, 0x24
mov dl, byte [esp]
push esp
mov dword [esp], ebp
lea eax, [ecx + 0x8b]
mov dx, 0x4831
not edx
jmp 0x5115d1
push ecx
jmp 0x511592
mov byte [esp + 2], bh
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp], ebp
lea eax, [eax*4]
jmp 0x5116b4
lea edx, [esp + edi]
lea edx, [ecx*4]
lea edx, [edi + edi]
mov dx, word [esp]
mov dx, 0x6019
push edx
call 0x5115cf
push ds
mov ebx, dword [ebx]
jle 0x51159f
and ch, byte [esi + 0x52fb98b9]
mov edx, dword [esp]
mov dl, 0x44
mov edx, 0x2047758c
mov dh, byte [esp]
not edx
lea edx, [eax - 0x31]
jmp 0x511695
lea edx, [edi + ebp]
push esp
lea edx, [ebx + ebx]
mov eax, dword [esp + 3]
mov edx, dword [esp + 3]
mov eax, dword [esp + 0xe]
jmp 0x511621
lea eax, [edx + ebx]
lea edx, [ecx + edx]
setg dh
rdtsc
mov eax, esp
mov al, ah
jmp 0x51164a
not dh
xchg dh, dl
pop ax
setne dh
lea esp, [esp + 2]
pop ebp
jmp 0x51166b
mov dl, byte [esp]
mov dx, 0x340f
mov edx, dword [esp + 0x32]
lea esp, [esp + 0x5c]
jmp 0x5116fe
lea ebp, [ebx*4]
lea ebp, [ecx + edi]
mov dh, bh
setnp dh
push esp
xchg byte [esp + 1], al
jmp 0x511685
pop eax
popfd
ret
Function at 0x51801b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edx*4]
xchg ch, cl
bsr bp, bp
jmp 0x518061
btc edi, esp
xchg cl, ch
cmc
lea edi, [edx*4]
mov edi, dword [esp + 0x52]
mov ch, 0xde
jmp 0x5180b7
mov ebp, dword [esp + 0x42]
neg cl
inc ch
lea edi, [ebx*4]
mov cx, 0x5dfb
bswap ecx
jmp 0x518043
mov word [esp + 0xd], dx
lea esp, [esp + 3]
mov ecx, dword [esp + 0x78]
jmp 0x518199
mov ch, 0x1e
rol cl, 3
sub esp, 0x16
bswap ecx
push word [esp + 7]
add esp, 1
jmp 0x518078
bsf cx, si
lea ecx, [edx + edi]
bswap ecx
xor cx, 0x733c
sub esp, 0
inc cl
jmp 0x51808e
pop word [esp + 0x1b]
mov ebx, 0x4fad3400
push dword [esp + 0x12]
lea edx, [esi + 0x3d]
mov bl, 0x90
cpuid
jmp 0x518176
mov ecx, eax
cpuid
mov eax, esi
mov al, ah
pushal
push dword [esp + 0x14]
jmp 0x518137
push esp
rdtsc
setg ah
cpuid
mov ecx, 0xb7d487e4
pop esi
jmp 0x5181d3
lea esp, [esp + 0x80]
popfd
push 0x568693d5
add dword [esp], 0xa9bb54fd
pushal
jmp 0x518157
mov si, word [esp + 8]
setne ch
mov ebx, 0x5ccc9dca
mov dx, 0x6f07
setns bh
mov word [esp + 0x20], sp
jmp 0x518245
mov ebx, ecx
pop word [esp + 0xd]
xchg byte [esp + 9], al
setp bh
mov dh, byte [esp + 0x13]
mov bh, byte [esp + 0x1f]
jmp 0x5181b0
xchg byte [esp + 2], cl
xchg ecx, eax
push word [esp + 3]
pop eax
xchg dword [esp], edi
mov dword [esp + 5], ecx
jmp 0x518547
push dword [esp + 2]
mov bl, bh
xchg di, bp
xchg edx, eax
xchg dword [esp + 8], edx
rdtsc
jmp 0x51820e
cpuid
popal
push word [esp + 3]
xchg di, cx
push dword [esp]
mov word [esp + 6], sp
jmp 0x518226
mov ebx, ebp
setnp bh
lea esp, [esp + 5]
mov dh, byte [esp + 2]
setl ah
xchg byte [esp], cl
call fcn.0051829c
push edx
xchg byte [esp + 1], al
bswap edx
pop word [esp + 1]
not dh
mov ecx, dword [esp + 5]
jmp 0x51831a
mov di, word [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
call 0x518346
wait
push cs
pushfd
sti
push ss
mov edi, 0x1091661f
pop esi
mov si, 0x5f3
not bh
mov dx, word [esp]
call fcn.00518314
call fcn.005183da
mov edx, dword [edi]
xchg edx, esp
adc dword [ecx + 0x791e8813], esp
mov byte [ecx], ah
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
stc
mov cx, 0x3ee9
lea ebp, [ebp - 0x5fd80d21]
mov ah, byte [esp + 1]
setno ch
xchg byte [esp], al
mov dx, di
jmp 0x518336
mov dh, byte [esp + 0xb]
xchg edx, edi
bswap ebp
pop dword [esp]
xchg dword [esp], esi
mov dx, di
jmp 0x5182e3
Function at 0x518b37
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xe
stc
pop word [esp + 3]
mov word [esp + 4], di
lea esp, [esp + 7]
jmp 0x518af5
lea esp, [esp + 2]
lea esp, [esp + 3]
pushal
lea ebx, [eax + 0x69]
sete ch
bsr ax, cx
jmp 0x518b63
call 0x518b37
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor dword cs:[esi], ebp
cmp dword [esi], ebp
xor byte [eax], al
pushfd
jmp 0x518ad2
cpuid
mov esi, 0xc1155d4e
shr dh, 7
add esp, 0x33
mov bx, sp
mov edi, eax
jmp 0x518c59
neg dh
sub esp, 0x16
sub esp, 0x1e
mov ebx, 0x7ffc1a8
lea esi, [ebp*4]
mov byte [esp + 7], dh
jmp 0x518b3a
lea ebx, [ebx + ebp]
cmc
cld
mov ebp, dword [esp]
rdtsc
mov edx, dword [esp]
jmp 0x518c31
inc cx
lea esp, [esp]
neg dh
mov byte [esp], ah
rdtsc
neg eax
jmp 0x518b8b
mov ebx, ebp
xchg byte [esp], al
lea edi, [ecx + 0x83]
call fcn.00518bb6
xchg ebx, eax
pop ss
xchg edx, esp
adc ebx, ecx
or ecx, dword [eax + 0x6e88791e]
movsd dword es:[edi], dword [esi]
clc
add esp, 0
neg eax
lea edi, [esi + 0x75]
not bx
cld
jmp 0x518bce
mov ax, word [esp]
neg dh
bswap ebp
and esi, ecx
ror ah, 1
mov ax, word [esp]
jmp 0x518beb
mov ax, 0xadfb
setbe dh
lea esp, [esp]
cpuid
mov bl, 0x28
xchg byte [esp], cl
jmp 0x518c03
btc eax, edi
bsr dx, cx
mov cl, 0x92
lea esp, [esp]
mov bp, 0x8de1
mov cl, 0x9a
jmp 0x518ba6

Function at 0x519390
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], bh
mov dl, 0x9c
lea esi, [esi*4]
sub esp, 0x1a

Function at 0x519741
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xb7f450c4
popal
mov bp, 0x8713
xchg edi, ebx
mov word [esp], bx
xchg ebp, esi
jmp 0x519785
pop dword [esp + 8]
mov bh, byte [esp + 0x1b]
jmp 0x51971a
add esp, 3
mov di, 0x6581
pop word [esp + 1]
xchg word [esp + 4], bp
jmp 0x519792
pop esi
xchg esi, ebx
mov cl, 0xa2
neg dh
inc eax
rcr edx, 7
jmp 0x51976d
add al, dh
sub esp, 0xe
rdtsc
mov dword [esp + 6], eax
neg ch
inc al
jmp 0x5197e5
shl cx, cl
mov byte [esp + 0xf], ah
add esp, 0x15
lea esi, [ecx*4]
rdtsc
call fcn.00519849
sbb eax, 0x9d6e0b9b
popfd
dec edi
jne 0x5197da
xchg edx, eax
cmc
add al, 0xeb
dec ecx
call 0x3e6e24f3
lea ebx, [esi + edi]
mov cl, ch
bswap ecx
inc al
mov si, di
mov word [esp + 0x18], sp
jmp 0x5197be

Function at 0x519adc
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x519b18
mov dl, dh
push word [esp + 0x14]
mov si, 0x31cd
push dword [esp + 2]
push dword [esp + 0x1a]
ror ch, 5
jmp 0x519b6f
mov ebx, dword [esp + 0x21]
sub bp, 0xa570
bsr di, cx
jmp 0x519b56

Function at 0x519ec0
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Parse pe header

Disassembly:
pop word [esp + 5]
pushal
pop dword [esp + 0x1c]
pop word [esp + 0xf]
mov dword [esp + 3], eax
mov dword [esp + 0x17], esi
jmp 0x519ec3
push esp
jmp 0x519ea3
pop word [esp + 9]
lea esp, [esp + 2]
mov dword [esp + 0x9c], esi
push edx
mov dword [esp], ebp
push edx
jmp 0x519ef0
Function at 0x409f20
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x529bf8]
sub esp, 0x134
test eax, eax
jne 0x409ff5
lea eax, [esp]
mov dword [0x529bf8], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409ff5
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409fe8
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x409fe8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409fe8
mov dword [0x529bf4], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x529bf4]
add esp, 0x134
ret

Function at 0x40ab30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a5f3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4b3ae8
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x40abc0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x40ab87
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x40abb1
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x40abc6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x40abc6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4b3a7c
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x4b3570
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40e560
Capabilities:
Persist via run registry key
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a6910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040ea80
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x190]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [eax + 0x94]
push eax
push ecx
push str.HotkeyMode
push str.Setup
call edi
mov dword [esi + 0x190], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x94]
mov eax, dword [esi + 0x194]
push edx
push eax
push str.ProcessPriority
push str.Setup
call edi
mov dword [esi + 0x194], eax
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
mov edx, dword [esi + 0x198]
mov ecx, dword [eax + 0x94]
push ecx
push edx
push str.Beep
push str.Setup
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
lea ecx, [esp + 0x10]
mov dword [esi + 0x198], eax
call sub.MFC42.DLL_CString::CString_1
push 0x52ac8c
lea eax, [esp + 0x14]
xor ebx, ebx
push str.MyMacro_
push eax
mov dword [esp + 0x50], ebx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.004585f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], bl
call sub.MFC42.DLL_CString::CString
push 0x80000002
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x529b90
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x58], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], bl
call fcn.004599f0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
mov byte [esp + 0x48], 3
call fcn.00459d60
mov byte [esp + 0x44], 4
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 6
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x14]
push 0x529b90
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x40e6d1
mov dword [esi + 0x19c], ebx
jmp 0x40e6db
mov dword [esi + 0x19c], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], bl
call fcn.00459b70
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c
ret
Function at 0x41aee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a854b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4b5d40
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x41af70
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x41af37
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x41af61
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x41af76
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x41af76
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4b3a7c
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x4b3570
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41cc59
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41ccb1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x529b90
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41cca4
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x41ccb3
xor eax, eax
pop esi
leave
ret 4