joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a354
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46a3f3
cmp dword [ebx + 0x94], 0
jne 0x46a3ed
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46a2dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46a3ed
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46a3b3
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46a3ed
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e7a0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46a3c2
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46a60c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4f3cd0]
cmp dword [eax + 0x30], 0
je 0x46a769
test bl, bl
jne 0x46a6ba
cmp dword [esi + 0x9c], 0
jne 0x46a6af
mov eax, esi
call fcn.0046cf6c
push eax
push 0x46a538
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x46a680
mov eax, dword [0x4f3cd0]
call fcn.0046d64c
test al, al
je 0x46a680
mov eax, dword [0x4f3cf4]
call fcn.0040620c
mov edi, eax
cmp edi, 0
jl 0x46a680
push 0
mov eax, dword [0x4f3cf4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46a66a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46a6af
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041e7a0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46a68f
inc dword [esi + 0x9c]
jmp 0x46a769
cmp dword [esi + 0x9c], 0
jle 0x46a769
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x46a769
cmp dword [esi + 0x44], 0
je 0x46a715
mov eax, dword [0x4f3cd0]
call fcn.0046d64c
test al, al
je 0x46a715
mov eax, dword [0x4f3cf4]
call fcn.0040620c
mov edi, eax
cmp edi, 0
jl 0x46a715
push 5
mov eax, dword [0x4f3cf4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46a6ff
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46a744
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041e7a0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46a724
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4f3cf4
mov ecx, 1
mov edx, dword [0x46a518]
call fcn.004063c0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x46b250
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x46b2ba
mov eax, ebx
call fcn.0046d64c
test al, al
jne 0x46b2ba
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404d50
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x46b2a7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46b2c7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404cb4
jmp 0x46b2c7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404cb4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x46c770
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46c7de
mov eax, esi
call fcn.0044d810
test al, al
je 0x46c7de
mov eax, dword [ebx + 0x84]
call fcn.0044d470
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c7de
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46c7d2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044d470
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004452ec
jmp 0x46c7de
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046c5ac
pop esi
pop ebx
ret

Function at 0x49121b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x491273
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x491269
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x491277
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4a7928
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a7956
mov eax, ebx
call fcn.004a83dc
cmp dword [ebx + 0x40], 0
je 0x4a794f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a79c7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a79b9
cmp dword [ebx + 8], 0
je 0x4a7978
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a798a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a79b9
cmp dword [ebx + 8], 0
je 0x4a796b
cmp eax, 3
je 0x4a799d
dec eax
jne 0x4a796b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a796b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a796b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a79e5
cmp dword [ebx + 0x14], 0xcc
je 0x4a79e5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a79f0
pop ebx
ret
Function at 0x4c7540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4c756d
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4c75ec
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004c5524
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c75ba
mov cx, word [esp]
sub cx, si
jmp 0x4c75bc
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c75a3
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c75e2
mov cx, word [esp]
sub cx, si
jmp 0x4c75e4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c75cb
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4c7649
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004c7214
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4c7634
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4c7649
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4c754a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4cd200
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4f4c44
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4cd222
shr eax, 1
xor eax, 0xedb88320
jmp 0x4cd224
shr eax, 1
dec edx
jne 0x4cd210
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4cd209
mov byte [0x4f5044], 1
pop esi
pop ebx
ret

Function at 0x4cd240
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4f5044], 0
jne 0x4cd257
call fcn.004cd200
mov eax, edi
dec eax
test eax, eax
jl 0x4cd27f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f4c44]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4cd261
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4cfbbc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4cfc56.0
jmp dword [ecx*4 + 0x4cfbef]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4cfc21
sub dl, 8
je 0x4cfc30
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cf868
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cf8c0
jmp case.0x4cfc56.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4cfc56.0
movzx ecx, byte [ecx + 0x4cfc5d]
jmp dword [ecx*4 + 0x4cfc6e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cf96c
jmp case.0x4cfc56.0
cmp dl, 3
jne 0x4cfc9b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cf9c0
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cf97c
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cfa04
jmp case.0x4cfc56.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4cfcc6
sub dl, 8
je 0x4cfcd2
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cfa30
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cfa9c
jmp case.0x4cfc56.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4cfcf1
sub dl, 8
je 0x4cfcfd
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cfb58
jmp case.0x4cfc56.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4cfb80
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4cfda1
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004ced74
test eax, eax
je 0x4cfda1
mov eax, ebx
call fcn.004cfdac
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4cfd3a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4cfdac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4cfddd
dec al
je 0x4cfe18
dec al
je 0x4cfe5d
dec al
je 0x4cfec6
jmp 0x4cff50
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4cff50
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4cfded
jmp 0x4cff50
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cff50
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4cfe28
jmp 0x4cff50
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cff50
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4cfe8c
xor ebp, ebp
jmp 0x4cfe9c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4cfea5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4cfe6d
jmp 0x4cff50
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cff50
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4cff1f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004cd288
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4cfeda
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e1bc8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050e0
xor eax, eax
push ebp
push 0x4e1c89
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 2
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004050f0
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
movzx eax, byte [esi]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 0x1b4], 0
movzx eax, byte [esi + 1]
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 0x1ac], 0
movzx eax, byte [esi + 2]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 0x1a4], 0
movzx eax, byte [esi + 3]
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 0
lea edx, [ebp - 0x1b8]
mov ecx, 3
mov eax, 0x4e1ca0
call fcn.0040ade8
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1c90
lea eax, [ebp - 4]
call fcn.00404c60
ret

Function at 0x4e26dc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, edx
mov eax, ebx
call fcn.00404c60
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a55c
add esp, 0x18
pop ebx
ret
Function at 0x424ea2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x424ec6
xor eax, eax
jmp 0x42503a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x424ee4
xor eax, eax
jmp 0x42503a
push 0xb25
push 0x3b01
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
push 0x749e
call fcn.0042442e
add esp, 0x18
cmp dword [ebp - 0xc], 0
jne 0x424f11
xor eax, eax
jmp 0x42503a
push 1
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x3bf9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
push 0x2d4
push 0x20de
call fcn.0042451c
add esp, 0x24
push 0
push 0x5ede
push 0x4cb2
push dword [ebp + 8]
push 0x79a7
push 0x7b27
push 0x4b7c
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042451c
add esp, 0x24
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x424fb8
push 1
push 0xca9
push 0x1f95
push 0x5f0a
push dword [ebp - 4]
push 0x21bb
push 0x1a97
push dword [ebp - 0x14]
push 0x7cfe
push 0xa92
push 0x577
push 0x5eec
push 0x64f7
call fcn.00423da1
add esp, 0x34
push dword [ebp - 4]
call fcn.0042430e
pop ecx
test eax, eax
jne 0x424fc9
xor eax, eax
jmp 0x42503a
push dword [ebp - 4]
push 1
push 0x5729
push 0x1704
call fcn.004239dd
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x425022
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x424fff
xor eax, eax
jmp 0x42503a
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x425018
xor eax, eax
jmp 0x42503a
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x425033
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x425037
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x40af18
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040823a
xor ebx, ebx
cmp dword [0x414964], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40afee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40b0ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b0ce
push eax
call fcn.004081cc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x414964], eax
call esi
push eax
call fcn.004081cc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x414968], eax
call esi
push eax
call fcn.004081cc
mov dword [0x41496c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00408898
test eax, eax
pop ecx
pop ecx
je 0x40afbc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407c9f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40afee
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004081cc
cmp eax, ebx
pop ecx
mov dword [0x414974], eax
je 0x40afee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004081cc
pop ecx
mov dword [0x414970], eax
mov eax, dword [0x414970]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40b073
cmp dword [0x414974], ecx
je 0x40b073
push eax
call fcn.00408243
push dword [0x414974]
mov esi, eax
call fcn.00408243
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40b073
cmp edi, ebx
je 0x40b073
call esi
cmp eax, ebx
je 0x40b040
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b040
test byte [ebp - 0x18], 1
jne 0x40b073
lea eax, [ebp - 0x10]
push eax
call fcn.004088cf
test eax, eax
pop ecx
je 0x40b05b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407c9f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40b06a
or dword [ebp + 0x10], 0x200000
jmp 0x40b0ae
or dword [ebp + 0x10], 0x40000
jmp 0x40b0ae
mov eax, dword [0x414968]
cmp eax, dword [ebp - 8]
je 0x40b0ae
push eax
call fcn.00408243
cmp eax, ebx
pop ecx
je 0x40b0ae
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b0ae
mov eax, dword [0x41496c]
cmp eax, dword [ebp - 8]
je 0x40b0ae
push eax
call fcn.00408243
cmp eax, ebx
pop ecx
je 0x40b0ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x414964]
call fcn.00408243
cmp eax, ebx
pop ecx
je 0x40b0ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b0d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x468f31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x468f73
call fcn.0046bcf0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x468f73
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x468f6a
xor eax, eax
jmp 0x468f7b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00468f81
pop edi
pop esi
pop ebx
ret 4

Function at 0x46c286
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46c2b4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46c2d2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046c1ec
jmp 0x46c2d2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46c2d2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046c1ec
test edi, edi
mov eax, edi
jne 0x46c2bc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x1fb510e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x4f6817aa
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219