joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554a40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5d25
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push 0xa
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 1
call fcn.005991e0
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.00556bb0
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x150], edi
mov dword [esi + 0x154], edi
mov dword [esi + 0x158], edi
mov dword [esi + 0x15c], edi
push 0x80
push 0x5e07f0
push 0x6f8df0
mov byte [ebp - 4], 9
call fcn.005a0c60
add esp, 0xc
mov dword [0x6f8dec], 0x32
cmp dword [0x6f8de4], edi
jne 0x554bcb
push 0x64
push 0x6f8de4
call fcn.00556220
mov eax, dword [0x6f8de4]
add esp, 8
mov dword [0x6f8de8], eax
push 0x1e
lea ecx, [esi + 0x94]
mov dword [esi + 0x64], edi
call fcn.004ccf50
push 0x1e
lea ecx, [esi + 0xb8]
call fcn.004ccf50
push 0x1e
lea ecx, [esi + 0xdc]
call fcn.004ccf50
push 0x1e
lea ecx, [esi + 0x100]
call fcn.004ccf50
push 3
lea ecx, [esi + 0x124]
call fcn.004ccf50
mov dword [esi + 0x16c], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5626c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6946
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CEngineObject.0
mov edx, 0xffff
push 0xa
lea ecx, [esi + 0x40]
mov dword [esi + 0x30], 1
mov word [esi + 0x34], dx
call fcn.005991e0
xor ebx, ebx
push 0xa
lea ecx, [esi + 0x5c]
mov dword [ebp - 4], ebx
call fcn.005991e0
push 0xa
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 1
call fcn.005991e0
fld1
fstp dword [esi + 8]
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], 0xffffffff
mov byte [esi + 0x28], bl
mov dword [esi + 0x20], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x94], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x564040
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x56406d
mov ecx, esi
call fcn.00564000
push 0x5e21b0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x564310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c69ce
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
xor edi, edi
mov dword [esi], vtable.CMHAudioManager.0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [0x737fd8], edi
push 0x20
mov dword [ebp - 4], edi
mov dword [esi + 0x48], edi
call fcn.004ccf50
fld1
xor eax, eax
fst dword [esi + 0x28]
fst dword [esi + 0x2c]
mov word [esi + 0x40], ax
fstp dword [esi + 0x30]
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x567180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp dword [eax], 0x10
je 0x5672ff
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
push 0x94
mov dword [ebp + 8], esi
add esi, 0x364
push 0
push esi
call fcn.0059eb30
add esp, 0xc
mov ecx, edi
call fcn.005654c0
push 0
mov ecx, edi
call fcn.005654d0
test eax, eax
je 0x5672e7
push ebx
jmp 0x5671d0
mov edi, dword [eax]
mov ecx, eax
call fcn.00565110
mov ecx, dword [ebp + 8]
mov bl, al
add bl, byte [ecx + 0x536]
mov ecx, 0x738038
mov byte [ebp - 4], bl
mov edx, dword [ebp - 4]
push edx
call fcn.00566950
test eax, eax
je case.0x567214.10
movzx ecx, word [edi + 0x2c]
add ecx, 0xfffffffd
cmp ecx, 0x75
ja case.0x567214.10
movzx ecx, byte [ecx + 0x56734c]
jmp dword [ecx*4 + 0x567308]
movzx edx, word [edi + 0x30]
mov eax, dword [eax]
mov dword [esi + edx*4 - 4], eax
jmp case.0x567214.10
movzx ecx, word [edi + 0x30]
fld dword [eax + 8]
fstp dword [ebp - 8]
test cx, cx
je case.0x567214.10
fld dword [eax + 4]
fstp dword [esi + ecx*4 + 0x24]
fld dword [ebp - 8]
fstp dword [esi + ecx*4 + 0x3c]
jmp case.0x567214.10
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x5c], ecx
jmp case.0x567214.10
mov edx, dword [eax + 0x10]
mov dword [esi + 0x58], edx
jmp case.0x567214.10
mov eax, dword [eax + 0x14]
mov dword [esi + 0x60], eax
jmp case.0x567214.10
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
jmp case.0x567214.10
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x68], edx
jmp case.0x567214.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x6c], eax
jmp case.0x567214.10
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x70], ecx
jmp case.0x567214.10
mov edx, dword [eax + 0x20]
mov dword [esi + 0x74], edx
jmp case.0x567214.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x78], eax
jmp case.0x567214.10
fld dword [eax + 0x24]
movzx ecx, bl
fstp dword [esi + 0x7c]
mov word [esi + 0x80], cx
jmp case.0x567214.10
fld dword [eax + 0x28]
fstp dword [esi + 0x84]
jmp case.0x567214.10
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x88], edx
jmp case.0x567214.10
mov eax, dword [eax + 0x30]
mov dword [esi + 0x8c], eax
jmp case.0x567214.10
mov ecx, dword [eax + 0x34]
mov dword [esi + 0x90], ecx
mov ecx, dword [ebp + 0x10]
push 0
call fcn.005654d0
test eax, eax
jne 0x5671d0
pop ebx
mov ecx, dword [0x6fd2e4]
call fcn.0044fd40
mov ecx, dword [0x6fd2e4]
call fcn.0044fa00
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5691a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x5691b3
xor eax, eax
pop ebp
ret 8
pop ebp
jmp fcn.0056d160
Function at 0x56a8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x56a94d
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x56a94d
push 0
push 1
push 0x738100
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x56a94d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [0x7380ac], ecx
mov edx, dword [eax + 4]
mov dword [0x7380b0], edx
mov eax, dword [eax + 8]
mov dword [0x7380b4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [0x7380a0], ecx
mov edx, dword [eax + 4]
mov dword [0x7380a4], edx
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x14]
mov dword [0x7380a8], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0x56a810
push 0
push 0
mov dword [0x7380fc], ecx
mov dword [0x7380f8], edi
mov dword [0x6f9b84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x56a955
push eax
push 0x738100
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x5752b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c73b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], vtable.CEffectManager.0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push fcn.00574a60
push 0x574710
push 2
mov dword [ebp - 4], eax
push 0xc
lea eax, [esi + 0x34]
push eax
call fcn.005a0ffc
xor eax, eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
push 0xa
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 2
call fcn.005991e0
push 0x20
lea ecx, [esi + 4]
mov byte [ebp - 4], 3
call fcn.004ccf50
push 0x20
lea ecx, [esi + 0x4c]
call fcn.004ccf50
push 0x190
call fcn.0059ebc0
xor edi, edi
add esp, 4
cmp eax, edi
je 0x57536e
mov dword [eax], vtable.CMemoryPoolTempl_class_CDamageNumber_.0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov byte [eax + 0x10], 0
jmp 0x575370
xor eax, eax
push 0x190
mov dword [esi + 0x2c], eax
call fcn.0059ebc0
add esp, 4
cmp eax, edi
je 0x575396
mov dword [eax], vtable.CMemoryPoolTempl_class_CEffect_.0
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov byte [eax + 0x10], 0
jmp 0x575398
xor eax, eax
mov edi, dword [esi + 0x2c]
push 0x80
lea ecx, [edi + 0x10]
push str.CDamageNumber
push ecx
mov dword [esi + 0x28], eax
call fcn.005a0c60
lea ebx, [edi + 4]
add esp, 0xc
cmp dword [ebx], 0
mov dword [edi + 0xc], 0x28
jne 0x5753d3
push 0x3c
push ebx
call fcn.00576460
mov edx, dword [ebx]
add esp, 8
mov dword [edi + 8], edx
mov edi, dword [esi + 0x28]
push 0x80
lea eax, [edi + 0x10]
push str.CEffect
push eax
call fcn.005a0c60
lea ebx, [edi + 4]
add esp, 0xc
cmp dword [ebx], 0
mov dword [edi + 0xc], 0x32
jne 0x57540b
push 0x64
push ebx
call fcn.00576580
mov ecx, dword [ebx]
add esp, 8
mov dword [edi + 8], ecx
mov eax, esi
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57f780
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x57f7a0
push 0
push 0x72
push 0x5e4090
call fcn.0053ecf0
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x57f7b8
cmp esi, 0x11
je 0x57f7b8
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x587270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7e0e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6fb05c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
push 0x40
mov byte [ebp - 4], 2
call fcn.004ccf50
push 0x40
lea ecx, [esi + 0x24]
call fcn.004ccf50
push 0x40
lea ecx, [esi + 0x48]
call fcn.004ccf50
mov ecx, esi
call fcn.00586dd0
mov ecx, esi
call fcn.00586c30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x597f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [0x6fb05c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x597f36
xor eax, eax
jmp 0x59819b
cmp dword [ebp + 0xc], 0
jne 0x597f43
xor eax, eax
jmp 0x59819b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x331]
push edx
call fcn.0059f4ab
add esp, 0x10
mov eax, dword [ebp - 0x74c]
add eax, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x33c], 0
push 0x200
push 0
lea ecx, [ebp - 0x330]
push ecx
call fcn.0059eb30
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
push str._02X
mov eax, dword [ebp - 4]
push eax
call fcn.005a0c36
add esp, 0xc
test eax, eax
jle 0x597fe4
cmp dword [ebp - 0x33c], 0x200
jge 0x597fe4
mov ecx, dword [ebp - 0x33c]
mov dl, byte [ebp - 0x130]
mov byte [ebp + ecx - 0x330], dl
mov eax, dword [ebp - 0x33c]
add eax, 1
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
jmp 0x597f8f
push 0x100
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.005969b0
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 5], cl
mov dword [ebp - 0x338], 0
jmp 0x598020
mov edx, dword [ebp - 0x338]
add edx, 0x10
mov dword [ebp - 0x338], edx
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x744]
jge 0x59811a
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x740]
push edx
call fcn.0059f4ab
add esp, 0x10
cmp eax, 0x10
je 0x598095
push 0
push 0x5e6388
push 0x5e6390
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea eax, [ebp - 0x740]
push eax
call fcn.0059eb30
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.0059eb30
add esp, 0xc
xor eax, eax
jmp 0x59819b
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x740]
push eax
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.00596cb0
add esp, 0x10
mov dword [ebp - 0x748], 0
jmp 0x5980cf
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
cmp dword [ebp - 0x748], 0x10
jge 0x598115
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x748]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x748]
mov dl, byte [ebp + edx - 0x740]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x748]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 5], al
jmp 0x5980c0
jmp 0x598011
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x129]
push eax
call fcn.0059f4ab
add esp, 0x10
movsx ecx, byte [ebp - 0x331]
movsx edx, byte [ebp - 0x129]
cmp ecx, edx
jne 0x598152
movsx eax, byte [ebp - 0x331]
movsx ecx, byte [ebp - 5]
cmp eax, ecx
je 0x598196
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea edx, [ebp - 0x740]
push edx
call fcn.0059eb30
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0059eb30
add esp, 0xc
xor eax, eax
jmp 0x59819b
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059eb13
mov esp, ebp
pop ebp
ret 0x10
Function at 0x59eb13
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6fb05c]
jne 0x59eb1d
repz ret
jmp fcn.005a709c

Function at 0x5acae3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6fb05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005a6a95
and dword [ebp - 0x14], 0
cmp dword [0x73b6ec], 0
mov dword [ebp - 0x18], eax
jne 0x5acb96
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5acc3e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5acc3e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5e760c
push ebx
mov dword [0x73b6ec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x73b6f0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x73b6f4], eax
call edi
push eax
call esi
mov dword [0x73b6fc], eax
test eax, eax
je 0x5acb96
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x73b6f8], eax
mov eax, dword [0x73b6f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5acbef
cmp dword [0x73b6fc], ecx
je 0x5acbef
push eax
call esi
push dword [0x73b6fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5acbef
test ebx, ebx
je 0x5acbef
call edi
test eax, eax
je 0x5acbe6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5acbe6
test byte [ebp - 8], 1
jne 0x5acbef
or dword [ebp + 0x10], 0x200000
jmp 0x5acc22
mov eax, dword [0x73b6f0]
cmp eax, dword [ebp - 0x18]
je 0x5acc22
push eax
call esi
test eax, eax
je 0x5acc22
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5acc22
mov eax, dword [0x73b6f4]
cmp eax, dword [ebp - 0x18]
je 0x5acc22
push eax
call esi
test eax, eax
je 0x5acc22
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x73b6ec]
call esi
test eax, eax
je 0x5acc3e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5acc40
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059eb13
leave
ret
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10003ece
pop dword [ebp - 0x44]
mov eax, 0xda741bc5
add eax, 0x358c2309
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x85d2f7ad
sub dword [ebp - 0x54], 0x3780b262
mov dword [ebp - 0x50], 0x645b648e
add dword [ebp - 0x50], 0xcdd7e7b7
mov dword [ebp - 0x4c], 0xe6051547
add dword [ebp - 0x4c], 0x66472ee7
mov dword [ebp - 0x48], 0xaf5d5c1
sub dword [ebp - 0x48], 0xaf5d5c1
lea eax, [ebp - 0x54]
push eax
mov eax, 0xf36e5cf0
add eax, 0x1c91f354
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x286fe71b
add dword [ebp - 0x54], 0x4c02823b
mov dword [ebp - 0x50], 0x62030b84
sub dword [ebp - 0x50], 0x2096aa0f
mov dword [ebp - 0x4c], 0x99f923df
sub dword [ebp - 0x4c], 0x3689b773
mov dword [ebp - 0x48], 0xe0c6c6f7
sub dword [ebp - 0x48], 0xe0c6c6f7
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x32c9a
push 0
call eax
mov ecx, 0x389e
xor esi, esi
add esi, eax
mov edi, 0x3bb84e77
sub edi, 0x2bb79877
add edi, dword [ebp - 0x44]
mov edx, 0xed33536d
xor dword [ebp - 0x34], 0x5b876342
mov ebx, dword [edi]
add dword [ebp - 0xc], esi
add ebx, edx
xor dword [ebp - 0x30], ebx
mov dword [esi], ebx
xor dword [ebp - 4], edi
add esi, 0x82a5bc16
sub esi, 0x82a5bc12
add edi, 0xb2952322
sub edi, 0xb295231e
loop 0x10003fe1
add eax, 0xab45ce27
add eax, 0x54bb0724
mov ebx, eax
add eax, 0x95fe8dfe
add eax, 0x6a017207
mov ecx, 0x8f4c1362
add ecx, 0x80b3ec9e
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a31be6f
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a31be6f
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a31be6f
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a31be6f
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a31be6f
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a31be6f
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret