joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c4d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414cc4], al
inc ecx
cmp byte [ecx + 0x414cc3], 0
jne 0x401c6e
mov eax, 0x414cc4
leave
ret

Function at 0x401c8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x4116a0]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x3b3a3c21
mov dword [ebp - 8], 0x313b341d
mov dword [ebp - 4], 0x55273039
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x55
mov byte [ecx + 0x414d90], al
inc ecx
cmp byte [ecx + 0x414d8f], 0
jne 0x401cb3
mov eax, 0x414d90
leave
ret

Function at 0x401cfa
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414ca4], al
inc ecx
cmp byte [ecx + 0x414ca3], 0
jne 0x401d1b
mov eax, 0x414ca4
leave
ret

Function at 0x401d38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x4116d0]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x21253036
mov dword [ebp - 0xc], 0x1d3b3a3c
mov dword [ebp - 8], 0x39313b34
mov word [ebp - 4], 0x2730
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 0x20]
xor al, 0x55
mov byte [ecx + 0x414a90], al
inc ecx
cmp byte [ecx + 0x414a8f], 0
jne 0x401d6a
mov eax, 0x414a90
leave
ret

Function at 0x401db1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414c04], al
inc ecx
cmp byte [ecx + 0x414c03], 0
jne 0x401dd2
mov eax, 0x414c04
leave
ret

Function at 0x401def
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x411710]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x25343b06
mov dword [ebp - 8], 0x213a3d26
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x1c]
xor al, 0x55
mov byte [ecx + 0x414ce0], al
inc ecx
cmp byte [ecx + 0x414cdf], 0
jne 0x401e14
mov eax, 0x414ce0
leave
ret

Function at 0x401e5b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x3b27301e
xor ecx, ecx
mov dword [ebp - 0xc], 0x67663930
mov dword [ebp - 8], 0x3939317b
mov byte [ebp - 4], 0x55
mov al, byte [ebp + ecx - 0x10]
xor al, 0x55
mov byte [ecx + 0x414cfc], al
inc ecx
cmp byte [ecx + 0x414cfb], 0
jne 0x401e7c
mov eax, 0x414cfc
leave
ret
Function at 0x4042ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6536257b
xor ecx, ecx
mov word [ebp - 4], 0x5565
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414db8], al
inc ecx
cmp byte [ecx + 0x414db7], 0
jne 0x4042e2
mov eax, 0x414db8
leave
ret

Function at 0x4042ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6536257b
xor ecx, ecx
mov word [ebp - 4], 0x5564
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dd0], al
inc ecx
cmp byte [ecx + 0x414dcf], 0
jne 0x404317
mov eax, 0x414dd0
leave
ret

Function at 0x404334
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6536257b
xor ecx, ecx
mov word [ebp - 4], 0x5567
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dc0], al
inc ecx
cmp byte [ecx + 0x414dbf], 0
jne 0x40434c
mov eax, 0x414dc0
leave
ret

Function at 0x404369
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6531257b
xor ecx, ecx
mov word [ebp - 4], 0x5565
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dd8], al
inc ecx
cmp byte [ecx + 0x414dd7], 0
jne 0x404381
mov eax, 0x414dd8
leave
ret

Function at 0x40439e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x6531257b
xor ecx, ecx
mov word [ebp - 4], 0x5564
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414de0], al
inc ecx
cmp byte [ecx + 0x414ddf], 0
jne 0x4043b6
mov eax, 0x414de0
leave
ret

Function at 0x4043d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], 0x2d30217b
xor ecx, ecx
mov word [ebp - 4], 0x5521
mov byte [ebp - 2], 0x55
mov al, byte [ebp + ecx - 8]
xor al, 0x55
mov byte [ecx + 0x414dc8], al
inc ecx
cmp byte [ecx + 0x414dc7], 0
jne 0x4043eb
mov eax, 0x414dc8
leave
ret

Function at 0x404b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x10
push edi
push 0x10
mov dword [ebp - 4], ecx
mov edx, eax
mov dword [ebp - 8], eax
pop ebx
mov cl, byte [esi]
mov al, byte [edx]
xor al, cl
mov byte [edx + 0x10], cl
inc esi
mov byte [edx + 0x20], al
inc edx
sub ebx, 1
jne 0x404b5c
mov ebx, dword [ebp - 8]
xor eax, eax
mov edi, dword [ebp - 4]
mov ecx, eax
push 0x30
mov edx, ebx
pop esi
mov al, byte [eax + edi]
xor byte [edx], al
movzx eax, byte [edx]
inc edx
sub esi, 1
jne 0x404b7e
add eax, ecx
inc ecx
movzx eax, al
cmp ecx, 0x12
jl 0x404b79
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x10
pop esi
movzx edx, byte [eax + 0x4f]
lea ecx, [eax + 0x40]
movzx eax, byte [edi]
xor eax, edx
mov edx, dword [ebp - 4]
mov al, byte [eax + edx]
xor byte [ecx], al
inc edi
movzx edx, byte [ecx]
inc ecx
sub esi, 1
jne 0x404ba7
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404bc5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
cmp dword [ebp + 0xc], 0
jle 0x404d35
lea eax, [ecx + 8]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x190]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x134]
push esi
sub eax, ebx
push edi
mov dword [ebp - 8], eax
push 0x10
pop esi
add eax, ebx
push eax
push ebx
call fcn.00404ed5
mov eax, dword [ebp - 8]
add ebx, 4
sub esi, 1
jne 0x404bfb
push 0x30
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x130]
pop ebx
mov ecx, dword [edi]
mov esi, ecx
mov edx, dword [edi + 0x34]
lea edi, [edi + 4]
mov eax, ecx
ror esi, 0x12
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
ror eax, 0x11
ror ecx, 0x13
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [edi + 0x1c]
add esi, dword [edi - 8]
mov dword [edi + 0x38], esi
sub ebx, 1
jne 0x404c1b
mov esi, dword [ebp - 0x10]
lea edi, [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp + 8]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 0x20]
mov edi, edx
ror edi, 0x19
mov eax, edx
ror eax, 0xb
mov ecx, edx
xor edi, eax
not ecx
and ecx, dword [ebp - 0x18]
mov eax, edx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x1c]
and eax, edx
xor ecx, eax
mov eax, dword [ebp - 4]
add edi, ecx
add dword [ebp - 4], 4
add edi, dword [ebp + esi*4 - 0x134]
mov esi, dword [ebp - 0x2c]
add edi, dword [eax]
add edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x2c], eax
ror eax, 0xd
ror ecx, 0x16
xor ecx, eax
mov eax, dword [ebp - 0x30]
ror eax, 2
xor ecx, eax
mov eax, esi
xor eax, edx
and esi, edx
and eax, dword [ebp - 0x30]
add ecx, edi
xor eax, esi
mov esi, dword [ebp - 0xc]
add eax, ecx
inc esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], esi
cmp esi, 0x40
jl 0x404c6e
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + ecx*4 - 0x30]
add dword [edx], eax
inc ecx
lea edx, [edx + 4]
cmp ecx, 8
jl 0x404d10
mov eax, dword [ebp - 8]
sub eax, 0x40
sub dword [ebp + 0xc], 1
mov dword [ebp - 8], eax
jne 0x404bf8
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404f02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
cmp dword [ebp + 0xc], 0
jle 0x405072
lea eax, [ecx + 8]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x190]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x134]
push esi
sub eax, ebx
push edi
mov dword [ebp - 8], eax
push 0x10
pop esi
add eax, ebx
push eax
push ebx
call fcn.00405212
mov eax, dword [ebp - 8]
add ebx, 4
sub esi, 1
jne 0x404f38
push 0x30
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x130]
pop ebx
mov ecx, dword [edi]
mov esi, ecx
mov edx, dword [edi + 0x34]
lea edi, [edi + 4]
mov eax, ecx
ror esi, 0x12
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
ror eax, 0x11
ror ecx, 0x13
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [edi + 0x1c]
add esi, dword [edi - 8]
mov dword [edi + 0x38], esi
sub ebx, 1
jne 0x404f58
mov esi, dword [ebp - 0x10]
lea edi, [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ebx, dword [ebp + 8]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 0x20]
mov edi, edx
ror edi, 0x19
mov eax, edx
ror eax, 0xb
mov ecx, edx
xor edi, eax
not ecx
and ecx, dword [ebp - 0x18]
mov eax, edx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x1c]
and eax, edx
xor ecx, eax
mov eax, dword [ebp - 4]
add edi, ecx
add dword [ebp - 4], 4
add edi, dword [ebp + esi*4 - 0x134]
mov esi, dword [ebp - 0x2c]
add edi, dword [eax]
add edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov dword [ebp - 0x2c], eax
ror eax, 0xd
ror ecx, 0x16
xor ecx, eax
mov eax, dword [ebp - 0x30]
ror eax, 2
xor ecx, eax
mov eax, esi
xor eax, edx
and esi, edx
and eax, dword [ebp - 0x30]
add ecx, edi
xor eax, esi
mov esi, dword [ebp - 0xc]
add eax, ecx
inc esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], esi
cmp esi, 0x40
jl 0x404fab
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + ecx*4 - 0x30]
add dword [edx], eax
inc ecx
lea edx, [edx + 4]
cmp ecx, 8
jl 0x40504d
mov eax, dword [ebp - 8]
sub eax, 0x40
sub dword [ebp + 0xc], 1
mov dword [ebp - 8], eax
jne 0x404f35
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x407e6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00401029
push 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.00401220
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x14], 0x20
lea edi, [eax + 0x2f0]
lea ebx, [eax + 0x2e8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx]
mov esi, dword [ebp - 0xc]
xor eax, ecx
ror edx, 9
sub edx, eax
mov dword [ebp - 0x20], ecx
xor edx, dword [edi - 4]
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
xor eax, edx
ror esi, 0x1b
sub esi, eax
ror ecx, 0x1d
xor esi, dword [edi + 4]
mov eax, dword [edi + 8]
xor eax, esi
mov dword [ebp - 0x1c], edx
sub ecx, eax
mov dword [ebp - 0x18], esi
xor ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00401029
push 0x10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401220
sub dword [ebp + 0x14], 1
lea ebx, [ebx - 0x18]
lea edi, [edi - 0x18]
jne 0x407e9d
pop edi
pop esi
pop ebx
call fcn.00401029
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call fcn.00401220
leave
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb8d2685
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x559200fa
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401a80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4ec
call fcn.00410ca0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x4ec
call fcn.00410c70
push eax
lea ecx, [ebp - 8]
call fcn.0043fc90
movzx ecx, al
test ecx, ecx
je 0x401ae2
lea ecx, [ebp - 8]
call fcn.00410d60
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx + 0x2c]
cmp ecx, dword [eax + 4]
jne 0x401ae2
xor eax, eax
jmp 0x401ba8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x2c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00407cb0
movzx ecx, word [ebp + 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0xfa0
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 4
ja case.default.0x401b0d
mov eax, dword [ebp - 0x20]
jmp dword [eax*4 + 0x401bb0]
push 0x12f
movzx ecx, word [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00418b40
jmp case.default.0x401b0d
push 0x193
movzx edx, word [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.00418f00
jmp case.default.0x401b0d
push 0x1f7
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0041e330
jmp case.default.0x401b0d
push 0x323
movzx ecx, word [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00420210
jmp case.default.0x401b0d
push 0x387
movzx edx, word [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.004225f0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00402520
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.00402290
push 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [ebp - 0x10]
call fcn.00406550
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405be0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x455848
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x46c864]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x20]
call fcn.00417270
push 1
push 1
push 1
push 1
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [ebp - 0x10]
call fcn.00407cb0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x40]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetWindowRgn]
push 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00406730
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x2c]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00417520
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add eax, dword [edx + 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00417550
push 0x10
lea ecx, [ebp - 0x20]
call fcn.00412080
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x24]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.004064a0
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00412080
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00406510
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x50], 1
jne 0x405cda
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x50], 0
mov ecx, dword [ebp - 0x24]
call fcn.00405d00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004254a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4142a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00426030
cmp eax, 0xffffffff
je 0x414325
cmp dword [ebp - 0x14], 8
jne 0x414325
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jl 0x414325
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.00416000
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x414340
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x20
jne 0x414386
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00426000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x414386
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jl 0x414386
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
call fcn.00416000
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x414e00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x46c864]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.00446420
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x414e80
cmp dword [ebp - 0x11c], 5
jae 0x414e74
cmp dword [ebp - 0x11c], 4
jne 0x414e80
cmp dword [ebp - 0x118], 0x5a
jb 0x414e80
mov dword [ebp - 0x128], 0
jmp 0x414e8a
mov dword [ebp - 0x128], 1
mov al, byte [ebp - 0x128]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445d4c
mov esp, ebp
pop ebp
ret
Function at 0x4196d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456cba
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46c864]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
call fcn.004253a0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.004253a0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.004253a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.004253a0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004253a0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004253a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004254a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.004222f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x41a880
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x2c], ecx
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00426100
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.0041c500
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jle 0x41a8ed
push 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
push edx
push 0
push 2
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_SetScrollRange]
push 1
push 0
mov ecx, dword [ebp - 0xc]
call fcn.0041ab90
jmp 0x41a8fc
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4
Function at 0x426d30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00423d60
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call sub.gdiplus.dll_GdiplusStartup
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00427260
add esp, 4
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov ecx, 0x46dcf0
call fcn.00427290
mov dword [ebp - 0x20], eax
push 0x45bf80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x426dda
push 0
push 0
push str.CoolPad_CDS_client_system_already_running...
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
jmp 0x426e1a
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00426c20
add esp, 8
mov dword [ebp - 4], eax
mov ecx, 0x46dcf0
call fcn.00427450
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.gdiplus.dll_GdiplusShutdown
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10