joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x29000]
push edi
jmp 0x435e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435e80
mov eax, 1
add ebx, ebx
jne 0x435ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435e98
jne 0x435eb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435e98
xor ecx, ecx
sub eax, 3
jb 0x435ec8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x435f3a
mov ebp, eax
add ebx, ebx
jne 0x435ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x435ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x435f04
inc ecx
add ebx, ebx
jne 0x435ef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x435ee5
jne 0x435f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435ee5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x435f24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x435f15
jmp 0x435e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x435f24
add edi, ecx
jmp 0x435e86
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x435f42
cmp byte [edi], 9
jne 0x435f42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x435f47
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x435fbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4d570]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4d650]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x435f74
mov ecx, edi
jns 0x435fa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4d658]
or eax, eax
je 0x435fb9
mov dword [ebx], eax
add ebx, 4
jmp 0x435f91
call dword [esi + 0x4d654]
mov ebp, dword [esi + 0x4d65c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x435ff3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x656305
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
pushal
mov word [esp + 0x15], bp
push word [esp + 0x1e]
jmp 0x65630b
lea esp, [esp + 2]
jmp 0x6562ef
jo 0x656321
mov word [esp + 0x11], ax
lea esp, [esp + 2]
jmp 0x656353
mov word [esp + 0x11], ax
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
push dx
mov word [esp], bx
Function at 0x656d7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x553
lea ecx, [esi + esi]
setns dl
xchg dword [esp], edi
dec ch
jmp 0x656e04
mov cl, 0x91
mov cl, byte [esp]
bt ecx, ebx
call 0x656dde

Function at 0x844730
Capabilities:
Parse pe header

Disassembly:
push edx
push word [esp]
mov dword [esp + 4], esp
mov dword [esp], ebp
push esi
push ebp
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 4], edx
mov dword [esp], ebx
push bx
jmp 0x844649
push dword [esp + 4]
mov byte [esp], dh
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
jmp 0x844676

Function at 0x8506ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0085076e
jae 0x8506fb
xor ecx, ecx
call fcn.0085076e
jae 0x850725
xor eax, eax
call fcn.0085076e
jae 0x850736
mov al, 0x10
call fcn.0085076e
adc al, al
jae 0x850717
jne 0x850763
stosb byte es:[edi], al
jmp 0x8506fc
call fcn.0085077a
dec ecx
loop 0x850742
mov eax, ebp
call fcn.00850778
jmp 0x850764
lodsb al, byte [esi]
shr eax, 1
je 0x85078a
adc ecx, 2
mov ebp, eax
jmp 0x850764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00850778
cmp eax, 0x7d00
jae 0x850762
cmp eax, 0x500
jae 0x850763
cmp eax, 0x7f
ja 0x850764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8506fc
pop ebp
ret 8
Function at 0x402143
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
je 0x4022f7
cmp dword [ebp + 0xc], 0
je 0x4022f7
xor ebx, ebx
push ebx
push ebx
push 0x40104c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x4022f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401064
push esi
call edi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4022f7
push 0x401080
push esi
call edi
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4022f7
push 0x4010a0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x4022f7
push 0x4010b4
push esi
call edi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4022f7
push 0x4010c8
push esi
call edi
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4022f7
push 0x4010d8
push esi
call edi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4022f7
push 0x4010ec
push esi
call edi
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4022f7
xor esi, esi
lea eax, [ebp - 4]
and dword [ebp - 4], esi
push esi
push esi
push 0x401100
push eax
mov dword [ebp - 0xc], esi
call dword [ebp - 0x14]
test eax, eax
jne 0x4022e5
push eax
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x401110
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x4022e5
push eax
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push 0x401134
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x4022e5
mov ecx, dword [ebp - 0x10]
call fcn.00402ad6
mov ecx, dword [ebp - 0x14]
mov edi, eax
call fcn.00402ad6
mov esi, eax
test edi, edi
je 0x4022d6
test esi, esi
je 0x4022e2
xor ebx, ebx
lea eax, [ebp - 8]
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 8], ebx
push esi
push eax
push dword [ebp - 4]
call dword [ebp - 0x1c]
test eax, eax
jne 0x4022cb
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x4022cb
push ebx
push dword [ebp - 0x10]
push edi
push dword [ebp - 8]
call dword [ebp - 0x2c]
test eax, eax
jne 0x4022cb
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 1
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
cmp dword [ebp - 8], ebx
je 0x4022d6
push dword [ebp - 8]
call dword [ebp - 0x30]
test esi, esi
je 0x4022e2
push esi
call dword [sym.imp.ucrtbase_clr0400.dll_free]
pop ecx
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x4022f3
push 0
push dword [ebp - 4]
call dword [ebp - 0x34]
mov eax, esi
jmp 0x4022f9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402302
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x401150
mov ebx, edx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x40116c
push edi
call esi
push 0x40118c
push edi
mov dword [ebp - 0xc], eax
call esi
xor esi, esi
mov edi, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
test eax, eax
je 0x402354
test edi, edi
je 0x402354
lea ecx, [ebp - 8]
push ecx
call eax
mov dword [ebp - 4], eax
push esi
push 0x80
push 3
push esi
push esi
push 0xc0000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, 0xffffffff
je 0x402472
cmp dword [ebp - 4], 0
je 0x402385
push dword [ebp - 8]
call edi
xor edi, edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x402472
push edi
push eax
push edi
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
je 0x402472
xor eax, eax
push eax
push eax
push eax
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x4023e1
test ebx, ebx
je 0x4023d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40247e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402472
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
and dword [ebp - 4], 0
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00402143
test eax, eax
je 0x402472
mov eax, dword [ebp - 4]
xor edx, edx
mov edi, dword [eax]
or edi, 0xc0000000
cmp word [esi], dx
jne 0x402448
mov ecx, pe_overlay
cmp word [esi + 2], cx
jne 0x402448
cmp word [esi + 4], dx
je 0x40244b
push 0x10
lea eax, [esi + 0xc]
push 0x401430
push eax
call sub.VCRUNTIME140_CLR0400.dll_memcmp
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 8], edi
jmp 0x40244b
mov dword [esi + 4], edi
push 1
push eax
call fcn.004050eb
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x402472
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402472
xor eax, eax
inc eax
jmp 0x402480
test ebx, ebx
je 0x40247e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402d12
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x406014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x408], edx
test edi, edi
je 0x402d80
push esi
mov esi, edi
cmp edi, 0x400
jbe 0x402d46
mov esi, 0x400
push ebx
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call dword [sym.imp.ucrtbase_clr0400.dll_fread]
add esp, 0x10
cmp eax, esi
jne 0x402d92
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push esi
push 1
push eax
call dword [sym.imp.ucrtbase_clr0400.dll_fwrite]
add esp, 0x10
cmp eax, esi
jne 0x402d9e
sub edi, esi
jne 0x402d37
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004050da
mov esp, ebp
pop ebp
ret 4
call fcn.00402bd4
push 0x44f
jmp 0x402da8
call fcn.00402bd4
push 0x452
call fcn.00402dae
int3
Function at 0x4038fa
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
jne 0x403919
mov edi, dword [ebp + 8]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov al, 1
jmp 0x4039a5
mov eax, dword [0x406508]
push ebx
xor ebx, ebx
test eax, eax
jne 0x403946
push 0xf0000000
push 1
push 0x401700
push ebx
push 0x406508
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x403975
mov eax, dword [0x406508]
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403975
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x403979
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor al, al
jmp 0x4039a4
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x10
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x403999
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403e8e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov ecx, 0x20000
push edi
mov dword [ebp - 8], ebx
call fcn.00402ad6
push ebx
mov esi, eax
push 2
push 1
push esi
mov dword [ebp - 0xc], esi
mov edi, esi
call dword [sym.imp.ucrtbase_clr0400.dll_fread]
add esp, 0x10
cmp eax, 2
jne 0x403ffc
movzx eax, word [esi]
mov ecx, pe_overlay
cmp ax, cx
jne 0x403f01
push 0x10
pop ecx
call fcn.00402ad6
push dword [ebp - 8]
mov ebx, eax
push 2
push 1
lea ecx, [ebx + 4]
mov byte [ebx], 0
push ecx
call dword [sym.imp.ucrtbase_clr0400.dll_fread]
add esp, 0x10
cmp eax, 2
je 0x403feb
jmp 0x403ffc
xor edx, edx
mov dword [ebp - 4], edx
test ax, ax
je 0x403f3d
cmp edx, ecx
je 0x403f7b
push ebx
push 2
inc edx
add edi, 2
push 1
push edi
mov dword [ebp - 4], edx
call dword [sym.imp.ucrtbase_clr0400.dll_fread]
add esp, 0x10
cmp eax, 2
jne 0x403ffc
mov edx, dword [ebp - 4]
xor eax, eax
mov ecx, pe_overlay
cmp word [edi], ax
jne 0x403f0b
mov ebx, dword [0x406528]
mov dword [ebp - 8], 0x406528
test ebx, ebx
je 0x403fa1
xor edx, edx
mov ecx, esi
lea eax, [ebx + 0xe]
mov di, word [eax]
cmp di, word [ecx]
jne 0x403f85
test di, di
je 0x403f77
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x403f85
add eax, 4
add ecx, 4
test di, di
jne 0x403f55
mov eax, edx
jmp 0x403f8a
push 0x456
jmp 0x404006
sbb eax, eax
or eax, 1
test eax, eax
je 0x403f9a
lea edi, [ebx + 4]
mov ebx, dword [edi]
mov dword [ebp - 8], edi
test ebx, ebx
jne 0x403f50
mov edx, dword [ebp - 4]
test ebx, ebx
jne 0x403feb
lea ecx, [edx*2 + 0x10]
call fcn.00402ad6
mov esi, dword [ebp - 4]
mov ebx, eax
mov edi, dword [0x4064fc]
mov word [ebx + 0xc], si
lea eax, [ebx + 0xe]
add esi, esi
mov byte [ebx], 1
push esi
push dword [ebp - 0xc]
mov dword [ebx + 8], edi
push eax
call sub.VCRUNTIME140_CLR0400.dll_memcpy
lea eax, [esi + 2]
add esp, 0xc
mov esi, dword [ebp - 0xc]
add eax, edi
mov dword [0x4064fc], eax
xor eax, eax
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
push esi
call dword [sym.imp.ucrtbase_clr0400.dll_free]
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00402bd4
push 0x44f
call fcn.00402dae
int3
Function at 0x404d81
Capabilities:
Extract resource via kernel32 functions
Resolve path using msvcrt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x406014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp byte [0x406560], 0
push edi
jne 0x404e3f
call dword [sym.imp.ucrtbase_clr0400.dll___p__wpgmptr]
push esi
push esi
mov edi, 0x100
lea ecx, [ebp - 0x20c]
push edi
push ecx
push edi
lea ecx, [ebp - 0x40c]
push ecx
push 3
lea ecx, [ebp - 0xc]
push ecx
push dword [eax]
call dword [sym.imp.ucrtbase_clr0400.dll__wsplitpath_s]
push esi
push esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x614]
push 0x104
push eax
call dword [sym.imp.ucrtbase_clr0400.dll__wmakepath_s]
push 0xffffffffffffffff
push 0x401760
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.ucrtbase_clr0400.dll_wcsncat_s]
add esp, 0x4c
test eax, eax
je 0x404e18
mov edi, esi
mov dword [0x406554], edi
jmp 0x404e36
sub esp, 0x18
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x614]
call fcn.004031ae
test eax, eax
js 0x404e0e
mov edi, dword [0x406554]
mov byte [0x406560], 1
jmp 0x404e45
mov edi, dword [0x406554]
movzx eax, word [0x406564]
push eax
mov eax, ebx
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x404e91
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, eax
test edx, edx
je 0x404e91
and ebx, 0xf
je 0x404e85
movzx eax, word [edx]
lea edx, [edx + eax*2]
add edx, 2
sub ebx, 1
jne 0x404e77
movzx esi, word [edx]
lea ecx, [edx + 2]
neg esi
sbb esi, esi
and esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004050da
mov esp, ebp
pop ebp
ret
Function at 0x40e990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x454928], 0
mov eax, 0xffff8e1d
movsd xmm0, qword [0x449a40]
mov dword [ebp - 4], 0x4e5b3671
movsd qword [ebp - 0x10], xmm0
movsd xmm0, qword [0x449a58]
mov word [ebp - 8], ax
mov eax, 0x2f7f
movsd qword [ebp - 0x18], xmm0
mov word [ebp - 4], ax
jne 0x40e9dc
call fcn.0040d8e0
mov dword [0x454928], eax
dec dword [ebp - 8]
movsx eax, word [ebp - 8]
push esi
push edi
push 3
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push 0x415d
addsd xmm0, qword [ebp - 0x10]
subsd xmm0, qword [ebp - 0x10]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 4], xmm0
movsd xmm0, qword [ebp - 0x10]
subsd xmm0, qword [0x447a60]
movsd qword [ebp - 0x10], xmm0
call fcn.0040e120
movss xmm0, dword [0x452314]
add esp, 8
movss xmm1, dword [0x44a300]
mov esi, eax
subss xmm1, xmm0
movss xmm0, dword [0x452494]
subss xmm1, xmm0
movsd xmm0, qword [0x452300]
addsd xmm0, qword [0x452228]
cvtps2pd xmm1, xmm1
subsd xmm0, qword [0x4495c8]
ucomisd xmm1, xmm0
movsd xmm0, qword [0x452228]
movsd xmm1, qword [0x447a60]
addsd xmm0, xmm1
lahf
movsd qword [0x452228], xmm0
movss xmm0, dword [0x452314]
addss xmm0, dword [0x447a58]
movss dword [0x452314], xmm0
test ah, 0x44
jp 0x40eaca
movsd xmm0, qword [ebp - 0x10]
addsd xmm0, xmm1
movsd qword [ebp - 0x10], xmm0
movss xmm0, dword [0x452058]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [ebp - 0x10]
mulsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
movss dword [0x452058], xmm0
push esi
push dword [ebp + 8]
call fcn.0043047c
push esi
push 3
mov edi, eax
call fcn.0040e550
add esp, 0x10
test edi, edi
jne 0x40ebb0
movss xmm0, dword [0x452334]
subss xmm0, dword [0x447a58]
movss dword [0x452334], xmm0
movss xmm0, dword [ebp - 4]
addss xmm0, dword [0x449420]
subss xmm0, dword [0x452334]
movsd xmm1, qword [ebp - 0x18]
subsd xmm1, qword [0x4498d8]
cvtps2pd xmm2, xmm0
movss xmm0, dword [ebp - 4]
comisd xmm1, xmm2
subss xmm0, dword [0x447a58]
movss dword [ebp - 4], xmm0
jb 0x40eb4a
movsd xmm0, qword [ebp - 0x18]
cvttsd2si eax, xmm0
mov word [ebp - 8], ax
push 0x3e8
call dword [0x453f94]
mov eax, dword [0x452298]
add eax, 0x4462bd8f
push 3
push 0x415d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [0x452270], xmm0
dec dword [0x452298]
call fcn.0040e120
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0043047c
push esi
push 3
mov edi, eax
call fcn.0040e550
movzx eax, word [0x452378]
add esp, 0x18
imul eax, eax, 0xd04d2d7
mov word [0x452378], ax
test edi, edi
je 0x40ec0c
mov eax, dword [0x452364]
sub eax, 0x51dcc993
cmp eax, 0xfcdaea5a
jne 0x40ebe2
movsd xmm1, qword [ebp - 0x18]
movss xmm0, dword [0x45221c]
subss xmm0, dword [0x4493c4]
cvtps2pd xmm0, xmm0
subsd xmm1, xmm0
movsd qword [ebp - 0x18], xmm1
push edi
push 1
push 4
push 0x454928
call fcn.004305ea
movzx eax, word [0x4522a0]
add eax, 0x40971159
push edi
mov word [0x4522a0], ax
call fcn.00430151
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411b40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movsd xmm0, qword [0x447b38]
mov eax, 0x48ee
push dword [0x45466c]
mov word [ebp - 4], ax
movsd qword [ebp - 0xc], xmm0
call fcn.0040b2a0
add esp, 4
push 1
call fcn.0042ff22
int3
Function at 0x423a10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movsd xmm0, qword [0x449b60]
mov eax, 0xffffd06f
mov dword [ebp - 4], 0x34e050c1
mov word [ebp - 8], ax
movsd qword [ebp - 0x10], xmm0
mov eax, dword [ebp - 4]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
movd xmm1, eax
movsx eax, word [ebp - 8]
add eax, 0x790085ff
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [0x4520d0]
subsd xmm1, xmm0
cvttsd2si eax, xmm1
movsd xmm1, qword [0x447a60]
mov dword [ebp - 4], eax
movsd xmm0, qword [0x4520d0]
addsd xmm0, xmm1
movsd qword [0x4520d0], xmm0
inc dword [ebp - 8]
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
movzx eax, word [0x452098]
imul eax, eax, 0x3bbc2d54
mov word [0x452098], ax
mov dword [ecx + 0x14], 0x10325476
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov eax, dword [0x4523a4]
sub ecx, eax
mov eax, dword [ebp - 4]
inc dword [0x4523a4]
add eax, 0x56b1310c
dec dword [ebp - 4]
cmp eax, ecx
jne 0x423b1d
movsd xmm0, qword [0x4522f0]
addsd xmm0, xmm1
movsd qword [0x4522f0], xmm0
dec dword [ebp - 8]
movsd xmm0, qword [0x4522f0]
movsx eax, word [ebp - 8]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm1, xmm0
addsd xmm1, qword [ebp - 0x10]
mulsd xmm1, qword [ebp - 0x10]
movsd qword [ebp - 0x10], xmm1
mov esp, ebp
pop ebp
ret
Function at 0x439efa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4530d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00431d81
mov dword [ebp - 0x14], eax
cmp dword [0x4556a8], esi
jne 0x439fed
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x439f7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43a0cd
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43a0cd
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43a0cd
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4556a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4556ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4556b0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4556b8], eax
test eax, eax
je 0x439fea
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4556b4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43a012
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43a005
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43a027
push 4
pop eax
jmp 0x43a0cf
cmp dword [ebp - 0x14], esi
je 0x43a027
push dword [0x4556a8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43a00c
mov eax, dword [0x4556b4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43a085
cmp dword [0x4556b8], edi
je 0x43a085
push eax
call ebx
push dword [0x4556b8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43a085
test eax, eax
je 0x43a085
call ecx
test eax, eax
je 0x43a07a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43a07a
test byte [ebp - 8], 1
jne 0x43a085
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43a0b5
mov eax, dword [0x4556ac]
cmp eax, edi
je 0x43a0b2
push eax
call ebx
test eax, eax
je 0x43a0b2
call eax
mov esi, eax
test esi, esi
je 0x43a0b2
mov eax, dword [0x4556b0]
cmp eax, edi
je 0x43a0b2
push eax
call ebx
test eax, eax
je 0x43a0b2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4556a8]
call ebx
test eax, eax
je 0x43a0cd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43a0cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430d4b
mov esp, ebp
pop ebp
ret