joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a537
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45a561
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0x7e90
push 1
call fcn.0045a5e4
add esp, 0x10
jmp 0x45a5e0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45a5d2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x45a5bf
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45a5bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x45a5d0
push 0x6db
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x45a5e0
push 0x3f1e
push 0
call fcn.0045e929
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x45fc6f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45fd26
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x45fcb3
push 0x7e7b
push 1
call fcn.0045fd38
pop ecx
pop ecx
jmp 0x45fd24
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x45fcfd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45fcfb
push 0
push 0
push 0x4709
push 0xb41
call fcn.0046a5e1
add esp, 0x10
jmp 0x45fd24
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x45fd24
push 0x6db
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x45fd34
push 0x7b9e
push 0
call fcn.0045af7c
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x460db8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x460e33
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x460e1a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x460e09
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x2c59
call fcn.0045aa43
add esp, 0x14
jmp 0x460e18
push 0x22ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x460e2e
push 0x3d78
push 0
push 0x656f
call fcn.0046b535
add esp, 0xc
jmp 0x460ec1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x460e75
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0x233b
push 0
push dword [ebp - 0x24]
call fcn.0046101d
add esp, 0xc
jmp 0x460ec1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x460eaa
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x460ec1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x461797
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4617fd
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4617ea
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4617de
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
call fcn.00466a26
pop ecx
pop ecx
jmp 0x4617e8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x4617fb
push 0xd13
push 1
push 0
call fcn.0045a61b
add esp, 0xc
jmp 0x461816
push 0x1d36
push 0
push 0x65cf
push 0x14cc
call fcn.0045c5c5
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x463246
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46331a
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x463299
push 0x74d0
push 0x64e0
push 1
push 0x707b
push 0xa51
push 0x6221
call fcn.0046332f
add esp, 0x18
jmp 0x463318
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4632cc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4632ca
push 0
push 0x247a
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x463318
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x1c
jmp 0x4632ee
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jl 0x463318
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x46330c
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x463316
jmp 0x4632e3
jmp 0x4632e3
jmp 0x46332b
push 1
push 0x2383
push 0
call fcn.0045ed76
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4638f1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x463944
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0x12de
push dword [ebp - 8]
push 0x320c
push 0x7e7d
push 0x59b7
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x7e18
push 0x6d77
push 0x566c
push 1
call fcn.004639c0
add esp, 0x28
jmp 0x4639bc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4639a2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x463987
push 0x22ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x4639a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0xf
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4639bc
push 1
push 0x28b0
push 1
push 1
push 0x725f
push 0
call fcn.004661a2
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x464560
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x46460e
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4645d1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4645c5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4645cf
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x464609
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x37ec
push 0x2489
push 0x6740
push 0x671
push 0x63ab
push dword [ebp - 0x28]
push 1
push 0x7331
push 0x10a8
push 0
call fcn.00463d64
add esp, 0x28
jmp 0x4646b9
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x464668
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x46464a
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x464666
mov byte [ebp - 1], 0
push 0x428f
push 0x26af
push 0
lea eax, [ebp - 1]
push eax
call fcn.0046926c
add esp, 0x10
jmp 0x4646b9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x46469d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x46469b
push 0x507e
push 0
push 1
call fcn.004576df
add esp, 0xc
jmp 0x4646b9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4646b9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret
Function at 0x4667ec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46681d
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x4742
push 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push 1
call fcn.004668d5
add esp, 0x10
jmp 0x4668d1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x46685f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 1
call fcn.004659ea
pop ecx
pop ecx
jmp 0x4668d1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4668bd
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
shl eax, 1
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [eax + 0x24], ecx
jmp 0x4668d1
push 0xfaf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret

Function at 0x466a96
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x466b4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x466b2c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x466b0e
mov byte [ebp - 1], 0
push 0x18d8
push 0x105c
push 0
push 1
push 0x266c
push 0x4818
lea eax, [ebp - 1]
push eax
push 1
push 1
call fcn.00462baf
add esp, 0x24
jmp 0x466b2a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x466b2a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x466b4a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 1
push 1
push dword [ebp - 0x28]
push 1
push 1
push 0x40b9
call fcn.004638f1
add esp, 0x18
jmp 0x466b54
push 0
call fcn.00462632
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46a60f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x46a6ac
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46a657
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
call fcn.0046a747
pop ecx
pop ecx
jmp 0x46a6a7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x46a69d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x46a69b
push 0x7f69
push 0x782c
push 0
push 0
push 1
call fcn.0045a537
add esp, 0x14
jmp 0x46a6a7
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x46a743
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x46a729
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x46a71c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 1
mov eax, dword [ebp - 0x50]
mov dword [eax], 1
jmp 0x46a727
push 0x22a8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x46a743
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0
push dword [ebp - 0x58]
push 0x7d49
push 1
call fcn.004582e0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4abb56
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b17c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0049e4fb
mov dword [ebp - 0x14], eax
cmp dword [0xaaa05c], esi
jne 0x4abc49
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4abbd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4abd29
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4abd29
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4abd29
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaaa05c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaaa060], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaaa064], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaaa06c], eax
test eax, eax
je 0x4abc46
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaaa068], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4abc6e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4abc61
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4abc83
push 4
pop eax
jmp 0x4abd2b
cmp dword [ebp - 0x14], esi
je 0x4abc83
push dword [0xaaa05c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4abc68
mov eax, dword [0xaaa068]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4abce1
cmp dword [0xaaa06c], edi
je 0x4abce1
push eax
call ebx
push dword [0xaaa06c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4abce1
test eax, eax
je 0x4abce1
call ecx
test eax, eax
je 0x4abcd6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4abcd6
test byte [ebp - 8], 1
jne 0x4abce1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4abd11
mov eax, dword [0xaaa060]
cmp eax, edi
je 0x4abd0e
push eax
call ebx
test eax, eax
je 0x4abd0e
call eax
mov esi, eax
test esi, esi
je 0x4abd0e
mov eax, dword [0xaaa064]
cmp eax, edi
je 0x4abd0e
push eax
call ebx
test eax, eax
je 0x4abd0e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaaa05c]
call ebx
test eax, eax
je 0x4abd29
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4abd2b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049b4db
mov esp, ebp
pop ebp
ret
Function at 0x4010b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push ecx
push 1
pop eax
cpuid
test ecx, 0x40000000
setne al
test al, al
je 0x4010cd
rdrand eax
rdrand edx
pop ecx
pop ebx
ret
push 7
pop eax
xor ecx, ecx
cpuid
test ebx, 0x40000
setne al
test al, al
je 0x4010ea
rdseed eax
rdseed edx
pop ecx
pop ebx
ret
rdtsc
mov ecx, eax
ror ecx, 0xd
rdtsc
mov edx, eax
rol edx, 0xd
mov eax, ecx
pop ecx
pop ebx
ret

Function at 0x401228
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
nop
xor dword [ecx], 0x47063fc8
not dword [ecx]
nop
add ecx, 4
dec edx
jne 0x401234
pop edx
pop ecx
pop ebp
ret 8

Function at 0x4012cc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x104]
xor al, al
stosb byte es:[edi], al
mov ecx, 0x2a
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3e
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3f
stosb byte es:[edi], al
mov ecx, 0xa
mov al, 0x34
stosb byte es:[edi], al
inc al
loop 0x401302
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
xor al, al
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
xor al, al
stosb byte es:[edi], al
inc al
loop 0x401323
mov dl, al
mov ecx, 6
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
mov al, dl
stosb byte es:[edi], al
inc al
loop 0x40133a
mov ecx, 0x85
mov al, 0xff
rep stosb byte es:[edi], al
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, edi
mov al, byte [edi]
add edi, 4
test al, al
jne 0x40134f
lea ebx, [edi - 4]
mov eax, 0x3d
sub ebx, esi
je 0x4013e1
cmp al, byte [esi + ebx - 1]
sete dl
jne 0x401371
mov byte [esi + ebx - 1], ah
cmp al, byte [esi + ebx - 2]
sete al
jne 0x40137e
mov byte [esi + ebx - 2], ah
add al, dl
mov edi, dword [ebp + 0xc]
shr ebx, 2
lea edx, [ebx + ebx*2]
sub edx, eax
push edx
mov dword [ebp - 4], ebx
mov ecx, dword [esi]
movzx edx, cl
movzx ebx, ch
push edi
lea edi, [ebp - 0x104]
mov al, byte [edx + edi]
mov ah, byte [ebx + edi]
shr ecx, 0x10
add esi, 4
movzx edx, cl
movzx ecx, ch
mov bl, byte [edx + edi]
mov bh, byte [ecx + edi]
pop edi
mov dl, ah
mov dh, bl
shl al, 2
shr bl, 2
shl dh, 6
shl ah, 4
shr dl, 4
or bh, dh
or al, dl
or ah, bl
mov byte [edi], al
mov byte [edi + 2], bh
mov byte [edi + 1], ah
dec dword [ebp - 4]
lea edi, [edi + 3]
jne 0x40138f
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4013ec
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x44]
mov eax, 0x44434241
stosd dword es:[edi], eax
mov eax, 0x48474645
stosd dword es:[edi], eax
mov eax, 0x4c4b4a49
stosd dword es:[edi], eax
mov eax, 0x504f4e4d
stosd dword es:[edi], eax
mov eax, 0x54535251
stosd dword es:[edi], eax
mov eax, 0x58575655
stosd dword es:[edi], eax
mov eax, 0x62615a59
stosd dword es:[edi], eax
mov eax, 0x66656463
stosd dword es:[edi], eax
mov eax, 0x6a696867
stosd dword es:[edi], eax
mov eax, 0x6e6d6c6b
stosd dword es:[edi], eax
mov eax, 0x7271706f
stosd dword es:[edi], eax
mov eax, 0x76757473
stosd dword es:[edi], eax
mov eax, 0x7a797877
stosd dword es:[edi], eax
mov eax, 0x33323130
stosd dword es:[edi], eax
mov eax, 0x37363534
stosd dword es:[edi], eax
mov eax, 0x2f2b3938
stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0x40146e
jmp 0x4014c9
mov al, byte [esi]
mov dl, byte [esi + 1]
mov bl, byte [esi + 2]
mov ah, al
mov dh, dl
mov bh, bl
and ah, 3
and dh, 0xf
and bh, 0x3f
shr al, 2
shr dl, 4
shr bl, 6
shl ah, 4
shl dh, 2
or ah, dl
or bl, dh
movzx edx, al
movzx ecx, ah
push esi
lea esi, [ebp - 0x44]
mov al, byte [edx + esi]
mov ah, byte [ecx + esi]
movzx edx, bl
movzx ecx, bh
mov bl, byte [edx + esi]
mov bh, byte [ecx + esi]
pop esi
and eax, 0xffff
shl ebx, 0x10
add esi, 3
or eax, ebx
stosd dword es:[edi], eax
sub dword [ebp - 4], 3
jns 0x401466
cmp dword [ebp - 4], 0
je 0x4014db
add edi, dword [ebp - 4]
mov byte [edi], 0x3d
inc edi
inc dword [ebp - 4]
jne 0x4014d2
mov eax, edi
mov word [eax], 0
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc