joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475160
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x475175
xor eax, eax
jmp 0x4751ea
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x4751a2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x4751e5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x4751e3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x4751df
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x4751e3
xor eax, eax
jmp 0x4751ea
jmp 0x475199
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x475c40
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004744b0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x50f5a8], 0
jne 0x475c7d
cmp dword [0x50f5a4], 0
je 0x475c7d
mov eax, dword [0x50f5a4]
mov dword [0x50f5a8], eax
cmp dword [0x50f5a8], 0
je 0x475cfa
mov ecx, dword [0x50f5a8]
cmp dword [ecx + 8], 0
je 0x475cfa
mov edx, dword [0x50f5a8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x475cfa
mov ecx, dword [0x50f5a8]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x475cfa
mov eax, dword [0x50f5a8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x475cc9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x475cd0
xor eax, eax
jmp 0x475e1d
mov ecx, dword [0x50f5a8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00460c60
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x475e1d
mov edx, dword [0x50f5a4]
mov dword [0x50f5a8], edx
jmp 0x475d16
mov eax, dword [0x50f5a8]
mov ecx, dword [eax + 4]
mov dword [0x50f5a8], ecx
cmp dword [0x50f5a8], 0
je 0x475d56
cmp dword [0x50f5a8], 0
je 0x475d54
mov edx, dword [0x50f5a8]
cmp dword [edx + 8], 0
je 0x475d54
mov eax, dword [0x50f5a8]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x475d54
mov edx, dword [0x50f5a8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x475d54
jmp 0x475cae
jmp 0x475d08
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00474590
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x475e1b
mov eax, dword [ebp - 4]
mov dword [0x50f5a8], eax
mov ecx, dword [0x50f5a8]
mov dword [ecx], 0x52727464
mov edx, dword [0x50f5a8]
mov dword [edx + 8], 0
mov eax, dword [0x50f5a8]
mov ecx, dword [0x50f5a4]
mov dword [eax + 4], ecx
mov edx, dword [0x50f5a8]
mov dword [0x50f5a4], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x50f5a8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x475de7
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x475e0b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x475dde
mov eax, dword [0x50f5a8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x475cae
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x47ae00
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047ab70
Function at 0x47b330
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00460c60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x47b5a0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.00460c60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x4b91c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4b91d9
mov esi, edi
mov edi, eax
jmp 0x4b91db
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4b91eb
mov eax, ebx
jmp 0x4b91f5
push eax
push ebx
call fcn.0047c2d0
add esp, 8
test eax, eax
jne 0x4b91fd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4b9219
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4b9204
cmp eax, dword [esi + 4]
jge 0x4b9230
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4b9220
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4b9251
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4b924e
dec eax
test eax, eax
jg 0x4b9240
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4c4920
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4c4940
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x51ec80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x51ed8c
test eax, eax
je 0x51ed8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x539ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x51ed73
lea edi, [eax + 4]
jmp 0x51ecd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x51ecec
mov dword [ebp - 4], 2
jmp 0x51ed0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x51ed03
mov dword [ebp - 4], 1
jmp 0x51ed0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x51ed83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x51ed46
mov byte [ecx], 0x3d
jmp 0x51ed52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x51ed5d
mov byte [ecx], 0x3d
jmp 0x51ed63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x51ecd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d0a70
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x809fec
call dword [0x4d0404]
push eax
call esi
mov edx, dword [esp + 0x28]
jmp loc.00421e1e
push 0x75d3807e
call fcn.00732ac2
jmp 0x74c795
push ebx
jmp 0x5cbb95
call fcn.0079b2e3
add esp, 0x18
push ebx
jmp 0x783186
push ebx
jmp 0x5affa7
push 0x4101d0
push ebx
jmp 0x65756c
Function at 0x675df8
Capabilities:
Authenticate hmac
Check http status code
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [ecx + 0xe4], eax
jmp 0x7eedcf
push 0x8727e2f3
call fcn.005d834f
jb 0x823510
mov esi, dword [esi + 0x3c]
jmp 0x7ee4a5
add esp, 4
mov esi, dword [esp + 0x68]
cmovl ax, cx
jmp 0x41cdbe
push esi
call fcn.0045bb01
mov ecx, dword [edi + 0x84]
jmp 0x58cd94
jmp 0x7d7265
add esi, 0x3c
jmp 0x7ee4a5
Function at 0x7af7c5
Capabilities:
Read file on windows

Disassembly:
xor eax, dword [ecx]
rcl cl, cl
mov cl, bl
cmc
jmp 0x59f282
inc eax
test si, 0x250f
cmp eax, 0x14
jmp 0x82037f
add edx, 4
test si, 0x79cd
cmp ecx, 0x5b2e5bf5
cmp ebx, 0x14
jmp 0x7a9377
call fcn.0043e281
add esp, 4
xchg edx, esi
rcr edx, cl
mov esi, eax
clc
sub eax, eax
setb dh
movzx edx, byte [esp + eax + 0x7c]
mov dword [esi + eax*4], edx
jmp 0x7184d9
rol eax, cl
mov ecx, eax
mov byte [edx - 1], al
sar ecx, 8
mov byte [edx], cl
bts ecx, edi
not cx
clc
mov ecx, eax
sar ecx, 0x10
sar eax, 0x18
cmp edi, ebp
mov byte [edx + 1], cl
rcr cl, cl
sbb cl, 0x96
xchg cl, cl
mov byte [edx + 2], al
and cl, dl
sub eax, eax
mov cl, byte [eax + edx - 5]
stc
clc
cmc
xor byte [eax + edx - 1], cl
jmp 0x7053e0
je 0x6cc267
push esi
jmp 0x6cc25d
call fcn.0045c9f0
lea ecx, [esp + 0xa4]
cmp ax, dx
stc
test esi, ecx
add esp, 0x14
jmp 0x7dc591
push edi
push edx
jmp 0x803fd7
call fcn.0043e28c
add esp, 4
neg dl
mov edi, dword [esp + 0x18]
or dl, 0x4c
mov esi, dword [esp + 0x14]
mov al, bl
inc cl
mov al, 0x63
xor dl, 4
or cl, bl
mov byte [esp + 0x38], al
jmp 0x76a289
inc eax
cmc
cmp dh, 0x75
test ch, al
cmp eax, 4
jl 0x59f2b0
inc ebx
jmp 0x56c54c
xor byte [eax], dl
inc eax
stc
sub edi, 1
jmp 0x74be07
mov byte [esp + eax + 0x7c], 0
jmp 0x527d7c
shl eax, 8
or eax, edi
shl eax, 0x10
or eax, ecx
bts cx, bx
movsx cx, bl
mov ecx, dword [esp + 0x1c]
jmp 0x527595
jne 0x816b5d
lea ebx, [edi + 1]
sal eax, 0xf2
lea edx, [esi + 5]
ror eax, 0x95
cmp bp, cx
adc ecx, 0x4dd961ee
movzx eax, byte [edx]
movzx ecx, byte [edx - 1]
btr di, 0xea
cmc
movzx edi, byte [edx + 1]
clc
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 2]
jmp 0x73f00d
mov byte [esp + 0x39], al
mov al, 0x64
jmp 0x4236df
call fcn.00437ba0
lea esp, [esp + 8]
cmp cx, 0x4ad5
test esi, esi
jmp 0x5c9c7b
push 0x50
jmp 0x5711a9
push edi
jmp 0x7e75ef
jl 0x74be22
push 0x50
push esi
xchg dl, dl
lea edx, [esp + 0x1c]
movzx ecx, si
mov cx, 0x23e8
setp ch
lea ecx, [esp + 0x20]
jmp 0x7705fb
push 0x8727e2f3
call fcn.005d834f
push esi
jmp 0x7a879b
lea edx, [esp + 0x94]
jmp 0x64c4cb
push ecx
call fcn.0047b5a0
add esp, 4
xchg edx, edx
movzx edx, dx
cmovo edx, ecx
push esi
jmp 0x7c7c98
call fcn.0045e10d
mov eax, dword [esp + 0x20]
push eax
jmp 0x649bc3
call fcn.0047b370
add esp, 0xc
xchg cx, ax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x80]
jmp 0x81e941
sub ecx, esi
bt edi, 0x25
sub dl, cl
mov edi, 4
mov dl, byte [ecx + eax]
stc
jmp 0x70c71e
push ecx
call fcn.0047b450
push edi
call fcn.0043e28c
add esp, 0xc
jmp 0x770f4d
jl 0x5711bd
mov ecx, dword [esp + 0x1c]
mov eax, esi
shld di, si, 0xa5
jmp 0x816b50
Function at 0x7c90ee
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mov byte [esp + 0x1aa7], 0x45
mov byte [esp + 0x1aa8], 0x52
jmp 0x5cfbed
mov byte [esp + 0x1aa9], 0x56
jmp 0x5d46f0
mov byte [esp + 0x1aaa], 0x45
jmp 0x686753
mov byte [esp + 0x1aae], 0x47
jmp loc.004037ae
mov byte [esp + 0x1aab], 0x52
jmp 0x761f94
mov byte [esp + 0x1aa4], 0x54
mov byte [esp + 0x1aa5], 0x5f
mov byte [esp + 0x1aa6], 0x53
jmp 0x563ba8
mov byte [esp + 0x1aad], 0x42
jmp 0x63cce8
mov byte [esp + 0x1aac], 0x5f
jmp 0x74f334
push 0x8727e2f3
call fcn.005d834f
mov byte [esp + 0x1aa2], 0x41
jmp 0x846a6f
mov byte [esp + 0x1aa3], 0x53
jmp 0x7122fa
Function at 0x846b25
Capabilities:
Parse pe header

Disassembly:
push edi
jmp 0x827da5
push esi
jmp 0x598448
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x2e
jmp 0x74c87b
mov byte [ebp - 0x12], 0x64
jmp loc.0040a9f4
push ebx
jmp 0x60e91c
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
jmp 0x780f00
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x6c
jmp 0x69d0a3
push eax
jmp 0x77e8d2
call fcn.005e6240
lea eax, [ebp - 0x18]
jmp 0x7f27dc
push ebp
sal ebp, 0x13
add ebp, 0x71af5e92
mov ebp, esp
or ah, 0x8e
sub esp, 0x16c
btr ax, cx
mov eax, dword [0x507628]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x77b61b
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, reloc.uxtheme.dll_HitTestThemeBackground
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7e8b32cb
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xce61ee
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40569b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40d0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404397
and dword [ebp - 0x14], 0
cmp dword [0x40e840], 0
mov dword [ebp - 0x18], eax
jne 0x40574e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4057f6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4057f6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40e840], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40e844], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40e848], eax
call edi
push eax
call esi
mov dword [0x40e850], eax
test eax, eax
je 0x40574e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40e84c], eax
mov eax, dword [0x40e84c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4057a7
cmp dword [0x40e850], ecx
je 0x4057a7
push eax
call esi
push dword [0x40e850]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4057a7
test ebx, ebx
je 0x4057a7
call edi
test eax, eax
je 0x40579e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40579e
test byte [ebp - 8], 1
jne 0x4057a7
or dword [ebp + 0x10], 0x200000
jmp 0x4057da
mov eax, dword [0x40e844]
cmp eax, dword [ebp - 0x18]
je 0x4057da
push eax
call esi
test eax, eax
je 0x4057da
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4057da
mov eax, dword [0x40e848]
cmp eax, dword [ebp - 0x18]
je 0x4057da
push eax
call esi
test eax, eax
je 0x4057da
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40e840]
call esi
test eax, eax
je 0x4057f6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4057f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a06
leave
ret

Function at 0x405a06
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d0f0]
jne 0x405a10
repz ret
jmp fcn.00406d43

Function at 0x414de5
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], esi
add ebx, 0xa32984cc
add eax, 4
add edi, 0x754da01d
cmp eax, edx
jne fcn.00414de5
ret