joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40586b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx edx, byte [eax]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx]
mov byte [eax], dl
movzx edx, byte [eax + 1]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 1]
mov byte [eax + 1], dl
movzx edx, byte [eax + 2]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 2]
mov byte [eax + 2], dl
movzx edx, byte [eax + 3]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 3]
mov byte [eax + 3], dl
movzx edx, byte [eax + 4]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 4]
mov byte [eax + 4], dl
movzx edx, byte [eax + 5]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 5]
mov byte [eax + 5], dl
movzx edx, byte [eax + 6]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 6]
mov byte [eax + 6], dl
movzx edx, byte [eax + 7]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 7]
mov byte [eax + 7], dl
movzx edx, byte [eax + 8]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 8]
mov byte [eax + 8], dl
movzx edx, byte [eax + 9]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 9]
mov byte [eax + 9], dl
movzx edx, byte [eax + 0xa]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 0xa]
mov byte [eax + 0xa], dl
movzx edx, byte [eax + 0xb]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 0xb]
mov byte [eax + 0xb], dl
movzx edx, byte [eax + 0xc]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 0xc]
mov byte [eax + 0xc], dl
movzx edx, byte [eax + 0xd]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 0xd]
mov byte [eax + 0xd], dl
movzx edx, byte [eax + 0xe]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 0xe]
mov byte [eax + 0xe], dl
movzx edx, byte [eax + 0xf]
mov dl, byte [edx + 0x4141c0]
xor dl, byte [ecx + 0xf]
mov byte [eax + 0xf], dl
ret

Function at 0x4059b2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 0x415228
call fcn.00405000
call fcn.00405969
mov ecx, 0x415218
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x415208
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x4151f8
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x4151e8
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x4151d8
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x4151c8
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x4151b8
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x4151a8
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x415198
call fcn.0040586b
call fcn.0040542c
call fcn.00405969
mov ecx, 0x415188
jmp fcn.0040586b

Function at 0x405b6c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x415188
jmp fcn.00405a83
Function at 0x405c77
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xdc
push 0x40
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.004093bd
push 0x40
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.004093bd
push 0x14
push dword [ebp + 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.00409398
push 0x14
push dword [ebp + 0x78]
lea eax, [ebp - 0x34]
push eax
call fcn.00409398
add esp, 0x30
xor eax, eax
xor byte [ebp + eax - 0x74], 0x36
xor byte [ebp + eax - 0x34], 0x5c
inc eax
cmp eax, 0x40
jl 0x405cbd
lea eax, [ebp + 0xc]
push eax
call fcn.00406fef
push 0x40
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00407f79
push dword [ebp + 0x74]
lea eax, [ebp + 0xc]
push dword [ebp + 0x70]
push eax
call fcn.00407f79
lea eax, [ebp + 0xc]
push eax
call fcn.0040801b
push 0x14
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x7c]
call fcn.00409398
lea eax, [ebp + 0xc]
push eax
call fcn.00406fef
push 0x40
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00407f79
push 0x14
push dword [ebp + 0x7c]
lea eax, [ebp + 0xc]
push eax
call fcn.00407f79
lea eax, [ebp + 0xc]
add esp, 0x48
push eax
call fcn.0040801b
push 0x14
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x7c]
call fcn.00409398
add esp, 0x10
xor eax, eax
add ebp, 0x68
leave
ret

Function at 0x405ff1
Capabilities:
Encode data using xor

Disassembly:
push 0x70
push 0x415158
call fcn.00408700
mov edi, ecx
mov byte [ebp - 0x80], 0xb
mov byte [ebp - 0x7f], 0xcd
xor ebx, ebx
mov byte [ebp - 0x7e], bl
mov byte [ebp - 0x7d], 0x10
push 0x40
push ebx
lea eax, [ebp - 0x7c]
push eax
call fcn.004093bd
push ebx
call fcn.0040967e
push eax
call fcn.004096a2
add esp, 0x14
xor esi, esi
call fcn.004096a8
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fmul qword [0x4142f0]
fmul qword [0x4142e8]
call fcn.004096c6
mov byte [ebp + esi - 0x2c], al
inc esi
cmp esi, 0x10
jl 0x40602d
and byte [ebp - 0x2b], 0x7f
wait
mov dword [ebp - 4], ebx
push 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00409398
add esp, 0xc
wait
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov cl, byte [eax + 0x410834]
xor cl, 0x5b
mov byte [ebp + eax - 0x3c], cl
inc eax
cmp eax, 0x10
jl 0x406074
lea eax, [ebp - 0x3c]
push eax
call fcn.00405b6c
lea eax, [ebp - 0x2c]
push eax
call fcn.004059b2
push 0x10
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00409398
add esp, 0x14
lea ecx, [ebp - 0x80]
mov edx, edi
call fcn.00405f4c
jmp 0x4060c6
call fcn.0040873b
ret

Function at 0x406fef
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x58], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x409ae0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push 0x41484c
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x409b00
or eax, 0xffffffff
jmp 0x409b7a
push 0x414840
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x409afb
push edi
push 0x414824
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x409b33
push 0x414810
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
jne 0x409b38
or eax, 0xffffffff
jmp 0x409b79
push ebx
call eax
push 0
push 2
mov ebx, eax
call edi
push 0x414800
push esi
mov edi, eax
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x409b75
lea ecx, [ebp - 0x128]
push ecx
push edi
call eax
test eax, eax
je 0x409b75
push 0x4147f0
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x409b85
or eax, 0xffffffff
pop ebx
pop edi
pop esi
leave
ret
cmp dword [ebp - 0x120], ebx
je 0x409b95
lea eax, [ebp - 0x128]
push eax
push edi
call esi
test eax, eax
jne 0x409b7d
jmp 0x409b75
mov eax, dword [ebp - 0x110]
jmp 0x409b78

Function at 0x409cd3
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
je 0x409cec
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409d5b
push ebx
push 0x41489c
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x409d5a
push esi
push 0x41487c
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x409d59
call fcn.00409ae0
cmp eax, 0xffffffff
je 0x409d59
push eax
push 1
push 1
call esi
mov esi, eax
test esi, esi
jne 0x409d44
push 0x414870
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x409d59
push esi
call eax
push 0x41485c
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x409d59
push 0
push esi
call eax
pop esi
pop ebx
leave
ret
Function at 0x40a4ac
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push 0x41489c
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x40a5ae
push 0x414810
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x40a5ae
push esi
call eax
push 0x414994
mov dword [ebp - 8], eax
call fcn.00409b9d
mov dword [ebp - 0x14], eax
mov dword [esp], 0x41498c
call fcn.00409b9d
mov dword [ebp - 0x10], eax
mov dword [esp], 0x41497c
call fcn.00409b9d
mov dword [esp], 0x414824
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40a5ad
push edi
push 0x414800
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40a5ac
push 0x4147f0
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 4], eax
test eax, eax
je 0x40a5ac
push 0
push 2
call esi
mov esi, eax
lea eax, [ebp - 0x13c]
push eax
push esi
mov dword [ebp - 0x13c], 0x128
call edi
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x134], eax
jne 0x40a59d
xor eax, eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp + eax*4 - 0x14]
je 0x40a5ac
inc eax
cmp eax, 3
jb 0x40a577
push 0x414870
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x40a5ac
push 0
call eax
lea eax, [ebp - 0x13c]
push eax
push esi
call dword [ebp - 4]
test eax, eax
jne 0x40a56a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b65c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push ebx
push ebx
push ecx
push 0x40b698
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, 0
mov eax, 1
invalid

Function at 0x40b6e5
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
and dword [ebp - 0xc], 0
push 0x41489c
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b706
jmp 0x40b77b
push 0x414870
push dword [ebp - 4]
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40b71f
jmp 0x40b77b
push ebx
push ecx
push edx
push 0x40b763
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
pop dword fs:[0]
add esp, 4
cmp ebx, 0x564d5868
sete byte [ebp - 0xc]
pop edx
pop ecx
pop ebx
jmp 0x40b770
cmp dword [ebp - 0xc], 1
jne 0x40b77b
push 0
call dword [ebp - 8]
pop ebx
leave
ret

Function at 0x40bb22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x40bb3f
shr eax, 1
xor eax, 0xedb88320
jmp 0x40bb41
shr eax, 1
dec edx
test edx, edx
jg 0x40bb32
mov dword [ebp + ecx*4 - 0x400], eax
inc ecx
cmp ecx, 0x100
jl 0x40bb2d
or eax, 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x40bb81
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
dec dword [ebp + 0xc]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [ebp + edx*4 - 0x400]
inc ecx
cmp dword [ebp + 0xc], 0
jne 0x40bb62
not eax
leave
ret
Function at 0x40bd59
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
push edi
push 0x41489c
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x40bec1
push 0x414df8
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x40bec1
push ebx
push 0x414dec
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x40bec0
push 0x414de0
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x40bec0
push 0x414dd4
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x40bec0
push 0x414964
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x40bec0
push 0x414870
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x40bec0
push 0x414dc8
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x40bec0
push 0x414dbc
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x40bec0
call fcn.0040bad3
push 0x104
lea ecx, [ebp - 0x124]
push ecx
push eax
call dword [ebp - 4]
test eax, eax
je 0x40bec0
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x124]
push eax
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40bec0
push edi
push ebx
call dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40bec0
push eax
push edi
call dword [ebp - 0x1c]
mov esi, eax
cmp esi, edi
je 0x40bec0
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [ebp - 0xc]
push ebx
call dword [ebp - 0x10]
mov eax, dword [ebp + 8]
push dword [ebp - 4]
add eax, esi
mov ebx, dword [eax]
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + eax], edi
call fcn.0040bb22
pop ecx
pop ecx
push esi
cmp eax, ebx
jne 0x40beb9
call dword [ebp - 8]
jmp 0x40bec0
call dword [ebp - 8]
push edi
call dword [ebp - 0x14]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], esi
jne 0x40c02e
xor eax, eax
jmp 0x40c172
lea eax, [ebp + 8]
push eax
call fcn.0040bf5e
pop ecx
test eax, eax
jne 0x40c095
mov eax, dword [0x410868]
inc eax
push eax
call fcn.00409380
push dword [0x410868]
mov edi, eax
push 0x41086c
push edi
call fcn.00409398
mov eax, dword [0x410c6c]
inc eax
push eax
call fcn.00409380
push dword [0x410c6c]
mov ebx, eax
push 0x410c70
push ebx
call fcn.00409398
push esi
push ebx
push edi
push esi
push esi
call fcn.00410073
push edi
call fcn.0040938d
push ebx
call fcn.0040938d
add esp, 0x3c
jmp 0x40c027
mov al, byte [0x4155fc]
test al, 2
je 0x40c110
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x415608
call fcn.00406e86
test eax, eax
je 0x40c0f8
push dword [ebp + 8]
call fcn.00406cb4
mov eax, dword [0x411474]
inc eax
push eax
call fcn.00409380
push dword [0x411474]
mov edi, eax
push 0x411478
push edi
call fcn.00409398
push esi
push edi
push 0x414e0c
push esi
push esi
call fcn.00410073
push edi
call fcn.0040938d
add esp, 0x28
jmp 0x40c027
xor eax, eax
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
movsx edx, byte [ebp + eax - 0x14]
cmp edx, ecx
jne 0x40c177
inc eax
cmp eax, 8
jl 0x40c0fa
mov al, byte [0x4155fc]
test al, 1
je 0x40c134
mov ebx, dword [0x415604]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00406e86
test eax, eax
jne 0x40c0b5
cmp dword [ebp - 0x18], ebx
jne 0x40c0bd
push 0x10
call fcn.00409380
pop ecx
mov edi, eax
mov esi, 0x415618
push 0x10
sub esi, edi
pop ecx
mov dl, byte [esi + eax]
xor dl, bl
mov byte [eax], dl
inc eax
dec ecx
jne 0x40c148
push dword [ebp + 8]
call fcn.00406cb4
push 0x10
push edi
push dword [ebp + 0xc]
call fcn.00409398
push edi
call fcn.0040938d
xor eax, eax
add esp, 0x10
inc eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [0x411474]
inc eax
push eax
call fcn.00409380
push dword [0x411474]
mov edi, eax
push 0x411478
push edi
call fcn.00409398
push esi
push edi
push 0x414e0c
push esi
push esi
call fcn.00410073
push edi
call fcn.0040938d
add esp, 0x28
push dword [ebp + 8]
call fcn.00406cb4
jmp 0x40c027
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x115f5e02
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xd5302dd
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401010
repz ret
jmp fcn.0040176d

Function at 0x40655b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032f4
and dword [ebp - 4], 0
cmp dword [0x4290dc], 0
mov ebx, eax
jne 0x40660c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066bd
push eax
call fcn.00403282
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4290dc], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4290e0], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4290e4], eax
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4290ec], eax
test eax, eax
je 0x40660c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4290e8], eax
mov eax, dword [0x4290e8]
cmp eax, ebx
je 0x406664
cmp dword [0x4290ec], ebx
je 0x406664
push eax
call fcn.004032fd
push dword [0x4290ec]
mov esi, eax
call fcn.004032fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406664
test edi, edi
je 0x406664
call esi
test eax, eax
je 0x40665b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40665b
test byte [ebp - 0xc], 1
jne 0x406664
or dword [ebp + 0x10], 0x200000
jmp 0x40669d
mov eax, dword [0x4290e0]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40669d
mov eax, dword [0x4290e4]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4290dc]
call fcn.004032fd
pop ecx
test eax, eax
je 0x4066bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420b9d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x437044]
push dword [0x436d60]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x420c2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x420c56
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.00420c21
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x420c39
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
jne 0x420c6e
or dword [0x437054], 0xffffffff
mov dword [0x437050], 0xa62e7790
leave
ret
Function at 0xbe8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00be81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbe807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbe806a
add dl, dl
jne 0xbe8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbe80dc
xor eax, eax
add dl, dl
jne 0xbe8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbe817d
add dl, dl
jne 0xbe80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbe80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbe8075
mov eax, 1
add dl, dl
jne 0xbe80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbe80e1
sub eax, ebx
mov ebx, 1
jne 0xbe8128
mov ecx, 1
add dl, dl
jne 0xbe810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbe8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbe8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbe8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbe813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbe814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbe8136
cmp eax, 0x7d00
jae 0xbe816d
cmp eax, 0x500
jb 0xbe8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbe8075
cmp eax, 0x7f
ja 0xbe8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbe8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbe819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbe8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100774e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1006cb6c
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10002790
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x100022b4
jmp dword [ecx*4 + 0x1000241c]
mov al, byte [esi]
test al, al
je 0x100022e2
cmp al, 0x20
je 0x100022ce
cmp al, 0xa1
jne 0x100022e2
cmp byte [esi + 1], al
jne 0x100022e2
test al, 0x80
je 0x100022da
mov al, byte [esi + 1]
inc esi
test al, al
je 0x100022e2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x100022c1
test ecx, ecx
je case.default.0x100022b4
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x100022b4
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10002328
cmp dl, 0xa1
jne 0x1000231c
cmp byte [eax + 1], 0xa1
jne 0x1000231c
test ecx, ecx
jne 0x10002314
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1000233c
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10002356
jmp 0x1000233c
cmp dl, 0x20
jne 0x1000233a
test ecx, ecx
jne 0x10002333
mov edi, eax
mov ecx, 1
jmp 0x1000233c
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x100022fc
cmp ecx, 1
jne case.default.0x100022b4
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x100022b4
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x100022b4
mov al, byte [esi]
test al, al
je 0x100023ae
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10002394
mov cl, byte [esi + 1]
test cl, cl
je 0x100023ae
cmp al, 0xa1
jne 0x10002384
cmp cl, al
je 0x10002391
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10002a20
inc esi
jmp 0x100023a6
cmp al, 0x20
je 0x100023a6
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10002a60
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1000236d
push 0
lea ecx, [esp + 0x14]
call fcn.10002a60
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1000bbd0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x100023e1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x1007c468
call fcn.10002990
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1006cafe
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret