joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487f90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x55000]
lea eax, [edi + 0x78660]
push dword [eax]
mov dword [eax], 0x6fa7a39c
push eax
push edi
or ebp, 0xffffffff
jmp 0x487fc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x487fc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x487fb8
mov eax, 1
add ebx, ebx
jne 0x487fdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x487fec
jne 0x48800b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48800b
dec eax
add ebx, ebx
jne 0x487ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x487fd0
add ebx, ebx
jne 0x488007
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48805d
xor ecx, ecx
sub eax, 3
jb 0x488023
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x488092
sar eax, 1
mov ebp, eax
jmp 0x48802e
add ebx, ebx
jne 0x48802e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x487ffc
inc ecx
add ebx, ebx
jne 0x48803c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x487ffc
add ebx, ebx
jne 0x488049
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48803e
jne 0x48805a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48803e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48807c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48806e
jmp 0x487fbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48807c
add edi, ecx
jmp 0x487fbe
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x1c9f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48809e
cmp byte [edi], 0x11
jne 0x48809e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4880a3
lea edi, [esi + 0x82000]
mov eax, dword [edi]
or eax, eax
je 0x488112
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x89824]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x89874]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4880d0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8987c]
or eax, eax
je 0x48810c
mov dword [ebx], eax
add ebx, 4
jmp 0x4880ed
call dword [esi + 0x89878]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x488143
cmp al, 0xef
ja 0x488136
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x488118
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x488125
mov ebp, dword [esi + 0x89880]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x488177
sub esp, 0xffffff80
jmp 0x431829
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x106b008], 0x8088405
inc edx
mov dword [ebx + 0x106b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d2ec
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d31d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d305
add dl, dl
jne 0x41d328
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d379
xor eax, eax
add dl, dl
jne 0x41d335
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d416
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d35a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d365
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d36f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d314
mov eax, 1
add dl, dl
jne 0x41d387
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d392
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d37e
sub eax, ebx
mov ebx, 1
jne 0x41d3c5
mov ecx, 1
add dl, dl
jne 0x41d3ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3b6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3a2
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d3dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3e7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3d3
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d437
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d314
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x104e9f2
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f553
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
jmp 0x41f572
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f5e4
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f5cd
test esi, esi
jbe 0x41f5e4
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f5bf
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f5e4
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f59c
jmp 0x41f5e4
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f5e4
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x104e9f9
ret
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x104fd6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x106d73c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x106d73c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x106c538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x104fd72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x67343db4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x90]
add eax, dword [ecx + 0x1c]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x90]
add eax, dword [ecx + 0x24]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x90]
cmp eax, dword [ecx + 0x18]
jae 0x67343f30
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x68]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0x160]
call fcn.67343a24
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x2b4]
jae 0x67343ef3
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x9c]
mov al, byte [eax + ecx]
mov byte [ebp - 0x3e], al
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x310]
jae 0x67343ecd
mov eax, dword [ebp - 0x30c]
add eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
jmp 0x67343e9c
mov eax, dword [ebp - 0x10c]
movzx ecx, byte [ebp - 0x3e]
add eax, ecx
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x9c]
add eax, 1
mov dword [ebp - 0x9c], eax
jmp 0x67343e4c
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x284]
jne 0x67343f22
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x274]
mov edx, dword [ebp - 0x270]
mov esi, dword [ebp - 0x68]
movzx edx, word [edx + esi*2]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x154], eax
jmp 0x67343f3a
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
jmp 0x67343de8
mov dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]

Function at 0x67343f4c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x104
call eax
sub esp, 0xc
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x28]
sub byte [ecx - 0x12b7b], cl
dec dword [ebx - 0x1ab7b]
invalid
mov dword [ebp - 0x38], eax
Function at 0x41117b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4111a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4111a1
xor al, al
jmp 0x4111b6
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x4168b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, 0xfff9bfe9
inc dword [ebx - 0x37b43]
inc dword [eax]
Function at 0x10002a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebx + 0x44], 0
je 0x10002bcf
cmp byte [ebx + 0x49], 0
je 0x10002bcf
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
jne 0x10002a80
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push edi
lea esi, [ebp - 0x20]
call fcn.10002660
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov edx, eax
cmp edi, 0x10
jae 0x10002a9c
lea edx, [ebp - 0x20]
mov eax, edx
add edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 4]
push edi
push edx
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x10002ad4
dec eax
je 0x10002ad8
sub eax, 2
lea ecx, [ebp - 0x20]
je 0x10002bb8
call fcn.10001660
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov edx, eax
cmp edi, 0x10
jae 0x10002ae8
lea edx, [ebp - 0x20]
mov esi, dword [ebp - 4]
sub esi, edx
je 0x10002b15
cmp edi, 0x10
jae 0x10002af7
lea eax, [ebp - 0x20]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.100050f3
add esp, 0x10
cmp esi, eax
jne 0x10002ba5
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
cmp byte [ebx + 0x49], 0
je 0x10002bb5
test esi, esi
jne 0x10002a90
mov ecx, dword [ebp - 0x10]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x10002bc5
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x10002bc5
cmp edi, esi
jae 0x10002b8e
push ecx
push esi
lea ecx, [ebp - 0x20]
call fcn.10002e90
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
test esi, esi
je 0x10002a90
mov ecx, eax
cmp edi, 0x10
jae 0x10002b6a
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], esi
jae 0x10002b85
lea eax, [ebp - 0x20]
mov byte [eax + esi], 0
jmp 0x10002a8a
test esi, esi
jne 0x10002b60
mov dword [ebp - 0x10], esi
cmp edi, 0x10
jae 0x10002b9d
lea eax, [ebp - 0x20]
mov byte [eax], 0
jmp 0x10002a8a
lea ecx, [ebp - 0x20]
call fcn.10001660
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.10001660
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.10003a2b
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10005df1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10019768]
jne 0x10005dfb
repz ret
jmp fcn.1000b56c
Function at 0x100101ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10019768]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10009af8
and dword [ebp - 0x14], 0
cmp dword [0x1001b1f0], 0
mov dword [ebp - 0x18], eax
jne 0x1001025f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10010307
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10010307
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001b1f0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001b1f4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001b1f8], eax
call edi
push eax
call esi
mov dword [0x1001b200], eax
test eax, eax
je 0x1001025f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001b1fc], eax
mov eax, dword [0x1001b1fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100102b8
cmp dword [0x1001b200], ecx
je 0x100102b8
push eax
call esi
push dword [0x1001b200]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100102b8
test ebx, ebx
je 0x100102b8
call edi
test eax, eax
je 0x100102af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100102af
test byte [ebp - 8], 1
jne 0x100102b8
or dword [ebp + 0x10], 0x200000
jmp 0x100102eb
mov eax, dword [0x1001b1f4]
cmp eax, dword [ebp - 0x18]
je 0x100102eb
push eax
call esi
test eax, eax
je 0x100102eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100102eb
mov eax, dword [0x1001b1f8]
cmp eax, dword [ebp - 0x18]
je 0x100102eb
push eax
call esi
test eax, eax
je 0x100102eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001b1f0]
call esi
test eax, eax
je 0x10010307
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10010309
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005df1
leave
ret
Function at 0x10012c20
Capabilities:
Parse pe header

Disassembly:
cmp edi, 0x40
jae 0x10012c28
xor eax, eax
ret
mov ecx, 0x5a4d
mov dword [edx + 0x10], eax
cmp word [eax], cx
jne 0x10012c25
mov ecx, dword [eax + 0x3c]
push esi
lea esi, [ecx + 0xf8]
cmp edi, esi
jb 0x10012c6c
add eax, ecx
mov dword [edx + 0x14], eax
cmp dword [eax], 0x4550
jne 0x10012c6c
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x10012c6c
test cl, 2
je 0x10012c6c
mov ecx, pe_nt_image_headers32
cmp word [eax + 0x14], cx
je 0x10012c70
xor eax, eax
pop esi
ret
push ebx
lea esi, [eax + 0xf8]
xor ebx, ebx
mov dword [edx + 0x18], esi
xor ecx, ecx
cmp bx, word [eax + 6]
jae 0x10012ca1
xor eax, eax
mov ebx, dword [eax + esi + 0x14]
add ebx, dword [eax + esi + 0x10]
cmp ebx, edi
ja 0x10012ca9
mov ebx, dword [edx + 0x14]
movzx ebx, word [ebx + 6]
inc ecx
add eax, 0x28
cmp ecx, ebx
jl 0x10012c86
pop ebx
mov eax, 1
pop esi
ret
pop ebx
xor eax, eax
pop esi
ret

Function at 0x10012fe0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
mov ecx, 0x65
mov word [ebp - 0x60], cx
mov ebx, 0x6c
mov ecx, ebx
mov word [ebp - 0x54], cx
push esi
mov edx, ebx
lea ecx, [ebp - 0x68]
xor eax, eax
push ecx
mov dword [ebp - 0x68], 0x65006b
mov dword [ebp - 0x64], 0x6e0072
mov word [ebp - 0x5e], dx
mov dword [ebp - 0x5c], 0x320033
mov dword [ebp - 0x58], 0x64002e
mov word [ebp - 0x52], dx
mov word [ebp - 0x50], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10013133
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x20]
push edx
push esi
mov dword [ebp - 0x20], 0x626f6c47
mov dword [ebp - 0x1c], 0x6c416c61
mov dword [ebp - 0x18], 0x636f6c
mov dword [ebp - 0x14], 0x626f6c47
mov dword [ebp - 0x10], 0x72466c61
mov word [ebp - 0xc], 0x6565
mov byte [ebp - 0xa], 0
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push esi
call edi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x10013132
test eax, eax
je 0x10013132
push 0x20
push 0x40
call ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x10013132
mov edx, dword [ebp - 4]
mov dword [eax + 0x18], edx
mov eax, dword [ecx]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x3c]
push edx
push esi
mov dword [eax + 0x1c], ecx
mov dword [ebp - 0x3c], 0x74726956
mov dword [ebp - 0x38], 0x416c6175
mov dword [ebp - 0x34], 0x636f6c6c
mov byte [ebp - 0x30], 0
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [edx + 0xc], eax
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x466c6175
mov dword [ebp - 0x24], 0x656572
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0x4c]
push eax
push esi
mov dword [ebp - 0x4c], 0x74726956
mov dword [ebp - 0x48], 0x506c6175
mov dword [ebp - 0x44], 0x65746f72
mov word [ebp - 0x40], 0x7463
mov byte [ebp - 0x3e], 0
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [edx + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100135e0
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018230
push 0x100136c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov byte [ebp - 0x19], 0
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x10013689
push str.RtlDecompressBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, esi
je 0x10013689
mov esi, dword [ebp + 0xc]
shl esi, 4
push esi
call fcn.10003ff5
add esp, 4
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
je 0x10013689
push esi
push 0
push edi
call fcn.10009820
add esp, 0xc
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push esi
push edi
push 2
call ebx
test eax, eax
je 0x10013685
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
push ecx
call fcn.10003fbb
add esp, 4
mov dword [esi], 0
jmp 0x10013689
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xffffffff
call fcn.100136a9
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x56238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x58b074
push ecx
mov edi, eax
call fcn.00576198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5623cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0057602e
push esi
call fcn.00575fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret