joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072f80
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
lea esp, [esp - 8]
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
and edi, 0xfffffffe
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
jle 0x100730c5
movdqa xmm5, xmmword [0x102cc3a0]
mov dword [esp + 4], edi
mov dword [esp], ebx
nop dword [eax + eax]
nop dword [eax]
nop
mov ebx, dword [esp + 0x1c]
mov edi, dword [ebx + eax*4]
mov ebx, dword [ebx + eax*4 + 4]
add eax, 2
movq xmm7, qword [edi + ecx - 6]
pshufd xmm1, xmm7, 1
movdqa xmm6, xmm7
pshufb xmm6, xmm5
pshufb xmm1, xmm5
cvtdq2ps xmm3, xmm6
cvtdq2ps xmm2, xmm1
movups xmm6, xmmword [edx]
movups xmm7, xmmword [edx + 0x10]
mulps xmm3, xmm6
mulps xmm2, xmm7
movups xmm6, xmmword [edx + 0x48]
addps xmm3, xmm2
movq xmm4, qword [ebx + ecx - 6]
movdqa xmm0, xmm4
pshufd xmm4, xmm4, 1
pshufb xmm0, xmm5
pshufb xmm4, xmm5
cvtdq2ps xmm1, xmm0
cvtdq2ps xmm0, xmm4
movups xmm4, xmmword [edx + 0x38]
mulps xmm0, xmm6
mulps xmm1, xmm4
movups xmm4, xmmword [edx + 0x58]
addps xmm1, xmm0
movd xmm2, dword [edi + ecx + 2]
pshufb xmm2, xmm5
movd xmm0, dword [ebx + ecx + 2]
cvtdq2ps xmm6, xmm2
pshufb xmm0, xmm5
movups xmm2, xmmword [edx + 0x20]
cvtdq2ps xmm7, xmm0
mulps xmm6, xmm2
mulps xmm7, xmm4
addps xmm3, xmm6
addps xmm1, xmm7
movzx edi, word [edi + ecx + 6]
movzx ebx, word [ebx + ecx + 6]
movsd xmm4, qword [edx + 0x30]
movd xmm0, edi
pshufb xmm0, xmm5
movd xmm2, ebx
pshufb xmm2, xmm5
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
mulps xmm0, xmm4
movsd xmm6, qword [edx + 0x68]
add edx, 0x70
mulps xmm2, xmm6
addps xmm3, xmm0
movaps xmm4, xmm3
addps xmm1, xmm2
movlhps xmm4, xmm1
shufps xmm3, xmm1, 0xee
addps xmm4, xmm3
pshufd xmm0, xmm4, 8
pshufd xmm3, xmm4, 0xd
addps xmm0, xmm3
movlps qword [esi], xmm0
add esi, 8
cmp eax, dword [esp + 4]
jl 0x10072fc0
mov ebx, dword [esp]
cmp eax, dword [esp + 0x18]
jge 0x10073162
mov edi, dword [esp + 0x1c]
movups xmm4, xmmword [edx]
movups xmm5, xmmword [edx + 0x10]
mov eax, dword [edi + eax*4]
movq xmm2, qword [eax + ecx - 6]
pshufd xmm3, xmm2, 1
movdqa xmm1, xmm2
pshufb xmm1, xmmword [0x102cc3a0]
pshufb xmm3, xmmword [0x102cc3a0]
cvtdq2ps xmm0, xmm1
cvtdq2ps xmm6, xmm3
movups xmm1, xmmword [edx + 0x20]
mulps xmm0, xmm4
mulps xmm6, xmm5
movd xmm7, dword [eax + ecx + 2]
addps xmm0, xmm6
pshufb xmm7, xmmword [0x102cc3a0]
movzx ecx, word [eax + ecx + 6]
cvtdq2ps xmm2, xmm7
movd xmm3, ecx
pshufb xmm3, xmmword [0x102cc3a0]
mulps xmm2, xmm1
cvtdq2ps xmm5, xmm3
addps xmm0, xmm2
movsd xmm4, qword [edx + 0x30]
mulps xmm5, xmm4
addps xmm0, xmm5
movaps xmm6, xmm0
shufps xmm6, xmm0, 0x4e
addps xmm6, xmm0
movaps xmm0, xmm6
shufps xmm0, xmm6, 1
addss xmm6, xmm0
movss dword [esi], xmm6
lea esp, [esp + 8]
pop edi
pop esi
ret
Function at 0x1008ae00
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x14
xor edx, edx
mov eax, dword [0x102f8be4]
lea ecx, [esp]
xor eax, esp
mov dword [ecx + 0x10], eax
mov dword [ecx], edx
push edx
push edx
push ecx
call fcn.10270b90
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], 0
xor ecx, esp
mov eax, dword [esp]
cmp ecx, dword [0x102f8be4]
jne 0x1008ae3c
add esp, 0x14
ret
call fcn.1025d860
nop dword [eax + eax]
nop dword [eax]
nop dword [eax + eax]
nop dword [eax]
nop
Function at 0x1008b260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102f49e0]
jmp dword [eax*4 + 0x102f8c14]

Function at 0x1008b2a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102f49e0]
jmp dword [eax*4 + 0x102f8c2c]

Function at 0x1008b320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102f49e0]
jmp dword [eax*4 + 0x102f8c5c]

Function at 0x1008b360
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x102f49e0]
jmp dword [eax*4 + 0x102f8c74]

Function at 0x1008b3a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x102f49e0]
jmp dword [eax*4 + 0x102f8c8c]

Function at 0x1008b440
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x102f49e0]
jmp dword [eax*4 + 0x102f8cec]
Function at 0x100b4000
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
cmp dword [esp + 0x10], 0
je 0x100b412c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100b412c
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x100b4121
cmp dword [esp + 0x14], 4
jl 0x100b4118
mov esi, dword [esp + 0x10]
and esi, 0xf
je 0x100b404e
test esi, 3
jne 0x100b4118
neg esi
add esi, 0x10
shr esi, 2
mov edx, esi
add edx, 4
cmp edx, dword [esp + 0x14]
jg 0x100b4118
mov edi, ebx
mov ecx, 0x80000000
sub edi, esi
and edi, 3
neg edi
add edi, ebx
test esi, esi
jbe 0x100b4092
mov eax, dword [esp + 0x10]
xor edx, edx
nop word [eax + eax]
cmp ecx, dword [eax + edx*4]
cmovl ecx, dword [eax + edx*4]
lea edx, [edx + 1]
cmp edx, esi
jb 0x100b4080
mov eax, dword [esp + 0x18]
movd xmm0, ecx
pshufd xmm0, xmm0, 0
mov edx, dword [esp + 0x10]
nop
movdqa xmm1, xmmword [edx + esi*4]
add esi, 4
movdqa xmm2, xmm1
pxor xmm1, xmm0
pcmpgtd xmm2, xmm0
cmp esi, edi
pand xmm2, xmm1
pxor xmm0, xmm2
jb 0x100b40a0
pshufd xmm1, xmm0, 0xe
movdqa xmm2, xmm0
pcmpgtd xmm2, xmm1
pxor xmm0, xmm1
pand xmm2, xmm0
pxor xmm2, xmm1
pshufd xmm0, xmm2, 0x39
movdqa xmm3, xmm2
pcmpgtd xmm3, xmm0
pxor xmm2, xmm0
pand xmm3, xmm2
pxor xmm3, xmm0
movd edx, xmm3
cmp edi, dword [esp + 0x14]
jae 0x100b410e
mov ecx, dword [esp + 0x10]
cmp edx, dword [ecx + edi*4]
cmovl edx, dword [ecx + edi*4]
lea edi, [edi + 1]
cmp edi, ebx
jb 0x100b4100
mov dword [eax], edx
xor eax, eax
pop ebx
pop edi
pop esi
ret 0xc
mov edx, 0x80000000
xor edi, edi
jmp 0x100b40f6
mov eax, 0xfffffffa
pop ebx
pop edi
pop esi
ret 0xc
mov eax, 0xfffffff8
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x10106b50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025faa0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x10106b99
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102f254c], 0
jne 0x10106bb0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x10106bfd
mov eax, dword [esi]
test eax, eax
je 0x10106b82
cmp dword [esi + 4], 0
je 0x10106b82
push eax
call fcn.101a4fd0
add esp, 4
push dword [esi + 4]
call fcn.101a4fd0
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x10106bee
push eax
call fcn.101a4fd0
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10106c35
push eax
call fcn.101a4fd0
jmp 0x10106c32
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.101a4fd0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.101a4fd0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.101a4fd0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.101a4fd0
add esp, 4
push 8
call fcn.101a4fd0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10106c70
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.101a4fd0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101a1930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102615ee
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.101a3000
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.101a2fe0
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101a63f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026181d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102f8be4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov ecx, esi
call sym.AIDE.dll_public:_void___thiscall_AIDE::AIDEDimension::constructor_void_
lea ebx, [esi + 8]
mov dword [ebp - 4], 0
mov ecx, ebx
call sym.AIDE.dll_public:_void___thiscall_AIDE::AIDEDimension::constructor_void_
mov eax, dword [edi + 0x14]
mov dword [esi], eax
mov eax, dword [edi + 0x30]
mov edi, dword [edi + 0x2c]
mov esi, dword [ebp - 0x10]
lea ecx, [edi + eax]
mov edx, dword [esi + 0x18]
sub edx, eax
cmp ecx, dword [esi + 0x18]
mov eax, dword [ebp + 8]
mov ecx, esi
cmova edi, edx
mov dword [ebx], 0
mov dword [eax + 4], edi
mov ecx, dword [ecx + 0x30]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x102063a0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x102063b1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x10236040
push 0x100
push 0
push 0x102fbb38
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
nop word [eax + eax]
mov byte [eax + 0x102fbc38], al
inc eax
cmp eax, 0x100
jl 0x10236060
push esi
push edi
push 0x100
push 0xff
push 0x102fbd38
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0xfe317780
mov edx, 0xfc403180
mov esi, 0xf6b26d80
mov edi, 0xf8a3b8c0
xor eax, eax
nop dword [eax]
mov dword [eax + 0x102fbe38], edi
add edi, 0x166e9
mov dword [eax + 0x102fe838], esi
add esi, 0x1c5a2
mov dword [eax + 0x10301238], edx
add edx, 0xb6d2
mov dword [eax + 0x10303c38], ecx
add eax, 4
add ecx, 0x581a
cmp eax, 0x29e0
jle 0x102360a0
xorps xmm0, xmm0
mov dword [0x10305148], 0
pop edi
movups xmmword [0x10305128], xmm0
mov dword [0x10302748], 0
movups xmmword [0x10305138], xmm0
mov dword [0x102ffd48], 0
movups xmmword [0x10302728], xmm0
mov dword [0x102fd348], 0
movups xmmword [0x10302738], xmm0
pop esi
movups xmmword [0x102ffd28], xmm0
movups xmmword [0x102ffd38], xmm0
movups xmmword [0x102fd328], xmm0
movups xmmword [0x102fd338], xmm0
ret
Function at 0x1021a3d0
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x1021a3e1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1025d420
movss xmm5, dword [0x102d91f4]
movss xmm4, dword [0x102d91fc]
movss xmm6, dword [0x102d91f0]
movss xmm7, dword [0x102d91e8]
movss xmm3, dword [0x102926c8]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102e4250]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x10306650], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102d91f8]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102d91e0]
add eax, edx
mov dword [esi*4 + 0x10306e50], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102d91ec]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102d91e4]
add eax, ecx
mov dword [esi*4 + 0x10306a50], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10307250], eax
mulss xmm0, dword [0x102d9204]
mov dword [esi*4 + 0x10307a50], edx
mov dword [esi*4 + 0x10307650], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10307e50], eax
mulss xmm0, dword [0x102d9208]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
movaps xmm0, xmm2
mov dword [esi*4 + 0x10308250], eax
mulss xmm0, dword [0x102d920c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101a4fd0
mov dword [esi*4 + 0x10308650], eax
mulss xmm2, dword [0x102d9200]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.101a4fd0
mov dword [esi*4 + 0x10308a50], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1025d450
pop esi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x74117455
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x48035864
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x43df10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 2
imul ecx, eax, 0x9ea
movsx edx, word [ecx + 0x490dc0]
add edx, 0xef22751
xor edx, 0x7c33c6b0
mov dword [ebp - 4], edx
mov eax, 2
imul ecx, eax, 0x9ea
mov dx, word [ecx + 0x490dc0]
sub dx, 1
mov eax, 2
imul ecx, eax, 0x9ea
mov word [ecx + 0x490dc0], dx
cmp dword [ebp - 4], 0x30120009
je 0x43df8e
mov edx, 4
imul eax, edx, 0x1e97
mov ecx, dword [eax + 0x4952f8]
and ecx, 0xdb537751
mov edx, 4
imul eax, edx, 0x1e97
mov dword [eax + 0x4952f8], ecx
mov ecx, dword [0x490528]
push ecx
call fcn.004161a0
add esp, 4
mov edx, 4
imul eax, edx, 0x619
mov ecx, 4
imul edx, ecx, 0x12c2
mov eax, dword [eax + 0x4952f8]
mov dword [edx + 0x4952f8], eax
mov ecx, 4
imul edx, ecx, 0x619
mov eax, dword [edx + 0x4952f8]
sub eax, 1
mov ecx, 4
imul edx, ecx, 0x619
mov dword [edx + 0x4952f8], eax
push 1
call fcn.004666f0
mov eax, 2
imul ecx, eax, 0x1fdb
mov edx, 4
imul eax, edx, 0xb61
mov edx, 0x44f99203
sub edx, dword [eax + 0x4952f8]
and edx, 0xb59222a8
movsx eax, word [ecx + 0x490dc0]
add eax, edx
mov ecx, 2
imul edx, ecx, 0x1fdb
mov word [edx + 0x490dc0], ax
mov eax, 4
imul ecx, eax, 0xb61
mov edx, dword [ecx + 0x4952f8]
add edx, 1
mov eax, 4
imul ecx, eax, 0xb61
mov dword [ecx + 0x4952f8], edx
mov esp, ebp
pop ebp
ret
Function at 0x46dd95
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48faf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00467e6c
mov dword [ebp - 0x14], eax
cmp dword [0x49e90c], esi
jne 0x46de88
push 0x800
push esi
push 0x485250
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46de15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46df68
push esi
push esi
push 0x485250
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46df68
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46df68
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49e90c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49e910], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49e914], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49e91c], eax
test eax, eax
je 0x46de85
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49e918], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46dead
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46dea0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46dec2
push 4
pop eax
jmp 0x46df6a
cmp dword [ebp - 0x14], esi
je 0x46dec2
push dword [0x49e90c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46dea7
mov eax, dword [0x49e918]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46df20
cmp dword [0x49e91c], edi
je 0x46df20
push eax
call ebx
push dword [0x49e91c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46df20
test eax, eax
je 0x46df20
call ecx
test eax, eax
je 0x46df15
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46df15
test byte [ebp - 8], 1
jne 0x46df20
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46df50
mov eax, dword [0x49e910]
cmp eax, edi
je 0x46df4d
push eax
call ebx
test eax, eax
je 0x46df4d
call eax
mov esi, eax
test esi, esi
je 0x46df4d
mov eax, dword [0x49e914]
cmp eax, edi
je 0x46df4d
push eax
call ebx
test eax, eax
je 0x46df4d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49e90c]
call ebx
test eax, eax
je 0x46df68
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46df6a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046dbe7
mov esp, ebp
pop ebp
ret
Function at 0x100010e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c0d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov al, 0x45
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x28], al
mov al, 0x6c
xor ebx, ebx
push 0x10058dd0
push 0x10058dc0
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x1c], eax
mov al, 0x65
mov cl, 0x73
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x35], al
mov byte [ebp - 0x31], al
mov byte [ebp - 0x34], cl
mov byte [ebp - 0x33], cl
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
push eax
push ecx
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x50
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x32], 0x48
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x70
mov byte [ebp - 0x2e], bl
call esi
push eax
call edi
lea edx, [ebp - 0x14]
push 0x1000def0
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x63
call fcn.100025ea
mov eax, dword [ebp + 8]
push eax
push 0
call dword [ebp - 0x18]
push eax
call dword [ebp - 0x1c]
mov eax, 0x100011c9
ret
Function at 0x100012a0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c0f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
push 0x1000def0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x30
call fcn.100025ea
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10058dec
push 0x10058dc0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10058e04
push 0x10058dc0
mov ebx, eax
call esi
push eax
call edi
mov cl, 0x73
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x2c], cl
mov byte [ebp - 0x2b], cl
lea ecx, [ebp - 0x34]
mov al, 0x65
push ecx
push 0x10058dc0
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x50
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], al
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x70
mov byte [ebp - 0x26], 0
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x10001368
mov eax, 0x100013bb
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x24], edi
cmp dword [edi], 0x4550
je 0x1000137e
mov eax, 0x100013bb
ret
mov edx, dword [edi + 0x50]
mov eax, dword [edi + 0x34]
push 4
push 0x2000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
jne 0x100013d1
mov ecx, dword [edi + 0x50]
push 4
push 0x2000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x100013ce
mov eax, 0x100013bb
ret
mov esi, dword [ebp - 0x14]
push 0x14
push 0
call dword [ebp - 0x1c]
push eax
call ebx
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov edx, dword [edi + 0x50]
mov dword [ebp - 0x1c], ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [edi + 0x54]
push 4
push 0x1000
push eax
push esi
call dword [ebp - 0x20]
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x14]
push edi
mov edx, dword [ecx + 0x3c]
push ecx
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], esi
call fcn.100014a0
mov ecx, dword [edi + 0x34]
mov eax, esi
add esp, 0xc
sub eax, ecx
je 0x1000145b
push eax
push ebx
call fcn.10001760
add esp, 8
push ebx
call fcn.10001850
push ebx
call fcn.10001610
mov eax, dword [ebx]
add esp, 8
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10001483
push 0
push 1
add eax, esi
push esi
call eax
mov dword [ebx + 0x10], 1
mov eax, 0x10001489
ret