joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413bd0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413df4
sub esp, 0x18
mov eax, dword [0x128db30]
test eax, eax
jne 0x413ddd
nop
lea eax, [0x128db1c]
mov dword [esp], eax
call fcn.00408f50
mov eax, dword [0x128db20]
test eax, eax
je 0x413c19
cmp dword [eax + 8], 0xcc
jne 0x413c8f
mov edx, dword [0x128db14]
test edx, edx
jne 0x413c71
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x1293610]
mov dword [esp + 8], eax
call fcn.0040b020
mov eax, dword [esp + 0xc]
mov dword [0x128db14], eax
mov ecx, dword [0x128dad8]
mov dword [eax], ecx
mov eax, dword [0x128db14]
mov dword [0x128dad8], eax
movzx eax, byte [0x128e720]
test al, al
jne 0x413c71
xor eax, eax
jmp 0x413d89
mov edx, dword [0x128db14]
mov ebx, dword [edx + 4]
mov dword [0x128db14], ebx
mov ebx, dword [0x128db20]
mov dword [edx + 4], ebx
mov dword [0x128db20], edx
mov edx, dword [0x128db20]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413d71
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402110
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x128df40]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413ced
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x413cfa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00458570
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x128df40]
test edx, edx
jne 0x413d26
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413d47
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00458570
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00458570
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00458570
nop
lea eax, [0x128db1c]
mov dword [esp], eax
call fcn.00409150
nop
lea eax, [0x128db18]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402290
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00458600
lea esi, [0x128e720]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413c71
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413dd3
lea edx, [0x12331f4]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x413d7b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004585f0
mov ecx, 5
call fcn.004585f0
lea eax, str.queuefinalizer_during_GCr
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00431490
nop
call fcn.00457160
jmp fcn.00413bd0
Function at 0x41b990
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41bbbe
sub esp, 0x20
mov eax, dword [esp + 0x24]
test eax, 3
jne 0x41bba7
mov edx, dword [esp + 0x30]
mov ebx, dword [edx + 0x2c]
test byte [ebx], al
nop
movzx ebp, byte [0x128da77]
mov ecx, dword [esp + 0x38]
mov esi, ecx
shr ecx, 3
mov dword [esp + 0x1c], ecx
mov edi, esi
and esi, 7
mov ecx, esi
mov eax, 1
shl eax, cl
mov esi, dword [esp + 0x1c]
mov ecx, eax
lea eax, [ebx + esi]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x41bab8
mov ebp, dword [0x128e58c]
test ebp, ebp
jle 0x41ba1c
cmp dword [edx + 0x58], edi
ja 0x41ba1c
mov ebp, dword [edx + 0x28]
test byte [ebp], al
movzx ebp, byte [ebp + esi]
nop
xchg ebp, eax
test cl, al
xchg ebp, eax
je 0x41bb2e
movzx ebx, byte [esi + ebx]
test cl, bl
jne 0x41bab4
nop
mov dword [esp], eax
mov byte [esp + 4], cl
call fcn.00402260
mov eax, dword [0x126db9c]
test byte [eax], al
nop
nop
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
nop
mov ebx, edx
shr edx, 0x16
mov edx, dword [eax + edx*4]
test byte [edx], al
mov ebp, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx esi, byte [edx + ebx + 0x21840]
lea edx, [edx + ebx + 0x21840]
shr ebp, 0xd
and ebp, 7
mov eax, ecx
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
test bl, al
xchg esi, eax
jne 0x41ba8f
mov dword [esp], edx
mov byte [esp + 4], bl
call fcn.00402260
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + 0x3a]
test dl, 1
je 0x41bae9
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebx, 0
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], ebx
add esp, 0x20
ret
add esp, 0x20
ret
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], cl
mov dword [esp + 0x14], edi
call fcn.00413560
movzx eax, byte [esp + 0x18]
test al, al
jne 0x41bb20
mov edx, dword [esp + 0x34]
mov ebx, dword [edx]
test ebx, ebx
je 0x41bb0c
mov eax, dword [ebx + 0xc]
cmp eax, 0x1fc
je 0x41bb0c
jae 0x41bb24
mov ecx, dword [esp + 0x24]
mov dword [ebx + eax*4 + 0x10], ecx
inc dword [ebx + 0xc]
jmp 0x41bb1c
mov dword [esp], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00421dd0
add esp, 0x20
ret
add esp, 0x20
ret
mov ecx, 0x1fc
call fcn.004585f0
lea eax, [0xcb13e0]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.0041bbd0
lea eax, [0xcb121e]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041bbd0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0xcb6afa]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00431490
lea eax, [0xcc1d4c]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00431490
nop
call fcn.00457160
jmp fcn.0041b990
Function at 0x425100
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42521c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x425195
cmp cl, 2
je 0x42513d
cmp cl, 3
jne 0x425205
mov byte [eax + 8], 1
jmp 0x425201
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00429960
nop
lea eax, [0x12720b8]
mov dword [esp], eax
call fcn.00408f50
nop
mov eax, dword [0x1272084]
sub eax, dword [0x1272068]
mov dword [0x1272084], eax
mov eax, dword [0x1272074]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x1272074], ecx
nop
lea eax, [0x12720b8]
mov dword [esp], eax
call fcn.00409150
jmp 0x425201
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413bd0
nop
lea eax, [0x12720b8]
mov dword [esp], eax
call fcn.00408f50
nop
mov eax, dword [0x127205c]
sub eax, dword [0x1272040]
mov dword [0x127205c], eax
mov eax, dword [0x127204c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x127204c], ecx
nop
nop
lea eax, [0x12720b8]
mov dword [esp], eax
call fcn.00409150
add esp, 0x14
ret
lea eax, [0xcb4c2d]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00431490
nop
call fcn.00457160
jmp fcn.00425100
Function at 0x458420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x128e500]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x456beb
je 0x456c3e
cmp ebx, 0x20
jbe 0x456c44
cmp ebx, 0x40
jbe 0x456c8a
jmp 0x456d2b
test ebx, ebx
je 0x456c34
add eax, 0x10
test ax, 0xff0
je 0x456c20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xf9f680]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xf9f780]
jmp 0x456c08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x456c08
pxor xmm1, xmmword [0x128e510]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x128e510]
pxor xmm2, xmmword [0x128e520]
pxor xmm3, xmmword [0x128e530]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x128e510]
pxor xmm2, xmmword [0x128e520]
pxor xmm3, xmmword [0x128e530]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x456d8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x128da76], 0
je 0x45843a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x456bb0
jmp fcn.00407890
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00431219

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401550
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000c
call fcn.00408cf0
mov eax, dword [0x41207c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10008]
push eax
push 0
push 0
mov esi, ecx
mov ecx, dword [0x413d60]
push 0x8004
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x401689
push 0x4102a0
push esi
call fcn.00402ac7
mov esi, eax
add esp, 8
test esi, esi
je 0x40167c
push edi
push esi
push 0x10000
lea edx, [ebp - 0x10004]
push 1
push edx
call fcn.004031c0
add esp, 0x10
test eax, eax
je 0x401602
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea esp, [esp]
mov ecx, dword [ebp - 0x10008]
push 0
push eax
lea eax, [ebp - 0x10004]
push eax
push ecx
call edi
test eax, eax
je 0x401654
push esi
push 0x10000
lea edx, [ebp - 0x10004]
push 1
push edx
call fcn.004031c0
add esp, 0x10
test eax, eax
jne 0x4015d0
push esi
call fcn.00402f02
mov ecx, dword [ebp - 0x10008]
add esp, 4
push 0
lea eax, [ebp - 0x1000c]
push eax
push ebx
push 2
push ecx
mov dword [ebp - 0x1000c], 0x14
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40166a
mov edx, dword [ebp - 0x10008]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402813
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10008]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
call fcn.00402f02
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402813
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10008]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00402813
mov esp, ebp
pop ebp
ret

Function at 0x401760
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x40177b
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.0040272b
push esi
mov edi, eax
push 0
push edi
call fcn.00406240
add esp, 0x10
push edi
push esi
xor esi, esi
push esi
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x4017b1
push edi
call fcn.004031dd
add esp, 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x4102a8
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4017e2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
push edi
call fcn.004031dd
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402813
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41207c]
jne 0x40281d
repz ret
jmp fcn.00403ae1

Function at 0x40ad63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41207c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004069af
and dword [ebp - 0x14], 0
cmp dword [0x413d30], 0
mov dword [ebp - 0x18], eax
jne 0x40ae16
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40aebe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40aebe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413d30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413d34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413d38], eax
call edi
push eax
call esi
mov dword [0x413d40], eax
test eax, eax
je 0x40ae16
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413d3c], eax
mov eax, dword [0x413d3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ae6f
cmp dword [0x413d40], ecx
je 0x40ae6f
push eax
call esi
push dword [0x413d40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ae6f
test ebx, ebx
je 0x40ae6f
call edi
test eax, eax
je 0x40ae66
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ae66
test byte [ebp - 8], 1
jne 0x40ae6f
or dword [ebp + 0x10], 0x200000
jmp 0x40aea2
mov eax, dword [0x413d34]
cmp eax, dword [ebp - 0x18]
je 0x40aea2
push eax
call esi
test eax, eax
je 0x40aea2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40aea2
mov eax, dword [0x413d38]
cmp eax, dword [ebp - 0x18]
je 0x40aea2
push eax
call esi
test eax, eax
je 0x40aea2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413d30]
call esi
test eax, eax
je 0x40aebe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40aec0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402813
leave
ret
Function at 0x4e1140
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
test edx, edx
jne 0x4e114e
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
cmp esi, 8
jb 0x4e120b
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
sub edi, 1
jne 0x4e1164
pop edi
test esi, esi
je 0x4e122a
nop
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55ac50]
sub esi, 1
jne 0x4e1210
not eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e6a68
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x53ffbc
push 0x53ffb4
push str.FlsAlloc
push 0
call fcn.004e69e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e6a9a
push dword [ebp + 8]
mov ecx, esi
call fcn.004e3074
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4e6adc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x53ffcc
push 0x53ffc4
push str.FlsGetValue
push 2
call fcn.004e69e8
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x4e6b0d
mov ecx, esi
call fcn.004e3074
call esi
jmp 0x4e6b13
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x4e6b16
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x53ffd4
push 0x53ffcc
push str.FlsSetValue
push 3
call fcn.004e69e8
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x4e6b4a
mov ecx, esi
call fcn.004e3074
call esi
jmp 0x4e6b50
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1cc157fa
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x79806de5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219