joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f7c1
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x437c10]
add word [0x437bf6], ax
push 0x1809ffff
call fcn.0040ffe3
add dword [0x437c0c], eax
movsx eax, byte [0x437bed]
movzx esi, word [esp + 0x1a]
push eax
push 0xd511ffff
call fcn.0040ffc6
or byte [0x437bee], 0xff
or word [0x437bf2], 0xffff
mov dword [0x437c2c], eax
add esp, 0x10
movzx eax, word [esp + 0xe]
add eax, 0xfffffffe
cmp eax, 0xa
ja case.default.0x41f828
push 0x1f
pop edi
jmp dword [eax*4 + 0x41fa73]
mov dword [0x437c08], 0xbc540001
add esi, 0x1e
inc byte [0x437bea]
add esi, edi
movsx eax, byte [0x437bec]
mov ecx, 0x7d89ffff
sub ecx, eax
movsx eax, word [0x437bfe]
push eax
push 0x5cc5ffff
mov dword [0x437c14], ecx
call fcn.00410092
mov dword [0x437c08], eax
pop ecx
movsx ax, byte [0x437be8]
dec eax
pop ecx
add word [0x437c04], ax
add esi, 0x1e
movsx eax, word [0x437bfe]
push 0x4cbdffff
push eax
call fcn.0040ff1a
mov word [0x437bfc], ax
xor al, al
pop ecx
add esi, edi
cmp byte [0x437bf1], al
pop ecx
jne 0x41f8b7
cmp byte [0x437bea], al
mov byte [0x437beb], al
je case.0x41f828.8
mov byte [0x437beb], 1
add esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
add byte [0x437bea], al
add dword [0x437c08], 0x2221ffff
push 0xa0edffff
push 0xf967ffff
add esi, 0x1e
call fcn.0040fede
add dword [0x437c18], eax
push dword [0x437c18]
push 0xa739ffff
call fcn.0040fede
add esp, 0x10
add word [0x437bfe], ax
push dword [0x437c0c]
or al, 0xff
sub al, byte [0x437bfa]
add esi, edi
add byte [0x437bf1], al
movsx eax, word [0x437bfc]
push eax
call fcn.004100bc
pop ecx
mov word [0x437c02], ax
pop ecx
add esi, 0x1e
call dword [sym.imp.USER32.dll_GetCapture]
add byte [0x437be9], al
movsx eax, word [0x437c02]
push eax
push 0x5205ffff
push 0xa9a7ffff
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x3ba7ffff
push 0x91afffff
mov word [0x437c04], ax
call fcn.00410016
add byte [0x437beb], al
pop ecx
pop ecx
mov al, byte [0x437bf8]
add esi, edi
mov byte [0x437bef], al
mov eax, dword [0x437c28]
imul eax, eax, 0xa5040000
mov dword [0x437c28], eax
mov al, byte [0x437bfc]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
add word [0x437bfc], ax
mov al, byte [esp + 0xc]
not al
and eax, 4
or al, 0x70
shr eax, 2
add esi, eax
movsx eax, word [0x437c00]
push eax
movsx eax, byte [0x437bea]
push eax
call fcn.0040ff4b
push dword [0x437c2c]
mov byte [0x437bf1], al
movsx eax, byte [0x437bec]
push eax
call fcn.0040ff1a
add esp, 0x10
add dword [0x437c2c], eax
mov eax, dword [0x437c28]
push 0xe8f9ffff
and eax, dword [0x437c10]
push 0x744fffff
add esi, edi
add dword [0x437c0c], eax
call fcn.0040fede
add dword [0x437c08], eax
inc dword [0x437c28]
pop ecx
pop ecx
mov al, byte [0x437c10]
sub dword [0x437c28], 0x8c0001
add al, byte [0x437c0c]
push 0x907bffff
mov byte [0x437bf0], al
movsx eax, byte [0x437bee]
push eax
call fcn.00410016
pop ecx
mov word [0x437bf2], ax
pop ecx
movzx ecx, word [esp + 0xc]
push 4
lea eax, [ecx - 0x7b1]
pop edi
cdq
imul ecx, ecx, 0x16d
idiv edi
pop edi
add esi, eax
lea eax, [ecx + esi - 0xaf8ca]
pop esi
ret
Function at 0x41fa9f
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x9437ffff
push 0xa16fffff
call fcn.0040ff4b
add word [0x437bfc], ax
pop ecx
movsx ax, byte [0x437bed]
imul eax, dword [0x437c10]
mov word [0x437c00], ax
pop ecx
lea eax, [ebp - 0x10]
mov word [0x437c04], 0xfffe
push eax
push 0x49
call fcn.0041448a
pop ecx
call eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
sub esp, 0x10
lea esi, [ebp - 0x10]
mov edi, esp
mov ecx, dword [0x437c2c]
movsd dword es:[edi], dword [esi]
movzx eax, ax
add dword [0x437c14], eax
movsx eax, byte [0x437beb]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ecx + eax - 0x46260001]
mov dword [0x437c2c], eax
movsd dword es:[edi], dword [esi]
call fcn.0041f7c1
movzx ecx, word [ebp - 8]
lea eax, [eax + eax*2]
add esp, 0x10
lea eax, [ecx + eax*8]
pop edi
movzx ecx, word [ebp - 6]
imul eax, eax, 0x3c
add eax, ecx
pop esi
movzx ecx, word [ebp - 4]
imul eax, eax, 0x3c
add eax, ecx
leave
ret
Function at 0x42452f
Capabilities:
Hash data with md5

Disassembly:
movsx eax, word [0x437c02]
or word [0x437bfc], 0xffff
push esi
push eax
mov esi, ecx
push 0x44f3ffff
call fcn.00410016
add word [0x437c04], ax
cmp dword [0x437c10], 0
push 8
push 0
setne al
mov byte [0x437bee], al
lea eax, [esi + 0x10]
push eax
call sub.MSVCRT.dll_memset
mov dword [esi], 0x67452301
mov eax, dword [0x437c2c]
dec eax
push 0x4cdbffff
add word [0x437bf6], ax
push 0x6103ffff
call fcn.0040fede
mov byte [0x437bed], al
mov byte [0x437bf0], 0xfe
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
movsx ax, byte [0x437bea]
push dword [0x437c2c]
add ax, word [0x437c02]
add word [0x437bfc], ax
push 0xec2dffff
call fcn.0040ffc6
movsx ecx, byte [0x437bea]
push ecx
push eax
mov dword [0x437c10], eax
call fcn.00410092
add dword [0x437c10], eax
mov dword [esi + 0xc], 0x10325476
movsx eax, word [0x437bf6]
push eax
push 0x5261ffff
call fcn.0040ff1a
add byte [0x437bf0], al
add esp, 0x34
pop esi
ret
Function at 0x424887
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movsx eax, word [0x437bf4]
push ebx
push esi
push edi
push eax
movsx eax, byte [0x437bee]
mov esi, ecx
push eax
call fcn.004100bc
add word [0x437c04], ax
mov al, byte [0x437c10]
dec al
pop ecx
mov byte [0x437bec], al
mov eax, dword [0x437c2c]
inc eax
pop ecx
mov word [0x437bfc], ax
mov ax, word [0x437c08]
sub word [0x437bf8], ax
lea edi, [esi + 0x10]
push 8
lea eax, [ebp - 8]
push edi
push eax
mov ecx, esi
call fcn.00425891
movsx eax, word [0x437bf6]
push 0xb7a1ffff
push eax
call fcn.00410016
pop ecx
mov word [0x437c04], ax
mov al, byte [0x437c24]
pop ecx
push eax
call dword [sym.imp.USER32.dll_IsCharLowerA]
push dword [0x437c2c]
mov byte [0x437bee], al
push 0x4e81ffff
call fcn.00410092
add dword [0x437c14], eax
mov eax, dword [edi]
pop ecx
pop ecx
shr eax, 3
push 0x38
and eax, 0x3f
pop ebx
cmp eax, ebx
jb 0x42493a
push 0x78
pop ebx
sub ebx, eax
movsx eax, word [0x437bfe]
push eax
movsx eax, byte [0x437be9]
push eax
call fcn.0040ff78
mov dword [0x437c1c], eax
movsx eax, word [0x437c02]
push eax
push eax
call fcn.004100bc
add esp, 0x10
mov ecx, esi
mov word [0x437bf2], ax
push ebx
push 0x4373e4
call fcn.0042460e
movsx eax, byte [0x437be8]
push eax
push dword [0x437c20]
call fcn.0040ff78
push dword [0x437c28]
mov dword [0x437c24], eax
push 0xea17ffff
call fcn.0041004e
add word [0x437c00], ax
or al, 0xff
sub al, byte [0x437beb]
add esp, 0x10
mov ecx, esi
add byte [0x437bf0], al
lea eax, [ebp - 8]
push 8
push eax
call fcn.0042460e
dec word [0x437bfc]
push 0xff5ffff
push 0x850dffff
call fcn.00410016
pop ecx
mov word [0x437bf8], ax
pop ecx
lea eax, [esi + 0x58]
push 0x10
push esi
push eax
mov ecx, esi
call fcn.00425891
xor ebx, ebx
push 8
push ebx
push edi
call sub.MSVCRT.dll_memset
xor eax, eax
cmp dword [0x437c0c], ebx
setne al
add word [0x437bf8], ax
movsx eax, word [0x437c04]
push eax
push eax
call fcn.00410092
add dword [0x437c20], eax
push 0x10
push ebx
push esi
call sub.MSVCRT.dll_memset
push 0x40
add esi, 0x18
push ebx
push esi
call sub.MSVCRT.dll_memset
or byte [0x437beb], 0xff
add esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add byte [0x437bf1], al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4261ab
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x437bea], al
xor eax, eax
cmp dword [0x437c18], eax
setne al
add word [0x437bf6], ax
mov eax, dword [esi + 4]
test eax, eax
je 0x4261da
push eax
call fcn.0042c504
pop ecx
and dword [esi + 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
add dword [0x437c14], eax
mov byte [0x437beb], 1
pop esi
ret
Function at 0x42973b
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movsx eax, byte [0x437beb]
push ebx
push esi
push 0x5f99ffff
push eax
call fcn.0040fede
mov esi, dword [ebp + 8]
pop ecx
mov dword [0x437c1c], eax
pop ecx
mov eax, dword [esi + 4]
mov ebx, dword [esi]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
add byte [0x437bea], al
movsx eax, byte [0x437bec]
push eax
push eax
call fcn.0041004e
push dword [0x437c2c]
mov dword [0x437c18], eax
movsx eax, word [0x437c04]
push eax
call fcn.0040ffe3
add dword [0x437c18], eax
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x437beb], al
xor eax, eax
cmp dword [ebp + 0x10], eax
mov dword [0x437c10], 1
mov dword [ebp - 4], eax
jle 0x42987b
push edi
inc bl
movzx eax, bl
mov dword [ebp - 8], eax
mov ebx, dword [esi + eax*4 + 8]
lea edi, [esi + eax*4 + 8]
mov dword [ebp - 0xc], ebx
movsx eax, byte [0x437bf1]
push eax
movsx eax, word [0x437bf8]
push eax
call fcn.00410092
add dword [0x437c18], eax
push dword [0x437c0c]
movsx eax, word [0x437bf2]
push eax
call fcn.0040fede
add bl, byte [ebp + 8]
add dword [0x437c2c], eax
or word [0x437bfe], 0xffff
push 0x37f3ffff
movzx eax, bl
mov ebx, dword [esi + eax*4 + 8]
mov dword [ebp + 8], eax
lea eax, [esi + eax*4 + 8]
mov dword [edi], ebx
mov dword [ebp - 0x10], eax
movsx eax, word [0x437bf6]
push eax
call fcn.004100bc
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov dword [0x437c24], eax
mov eax, dword [ebp - 0x10]
add bl, cl
add esp, 0x18
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, bl
add eax, edi
mov ebx, dword [ebp - 8]
mov cl, byte [esi + ecx*4 + 8]
xor byte [eax], cl
and byte [0x437bef], 0
inc edi
cmp edi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
jl 0x4297c7
xor eax, eax
pop edi
mov cl, byte [0x437c04]
and cl, byte [0x437be8]
cmp word [0x437bfc], ax
mov byte [0x437be9], cl
jne 0x4298a8
cmp word [0x437bf2], ax
jne 0x4298a8
and byte [0x437bef], 0
jmp 0x4298af
mov byte [0x437bef], 1
mov dword [esi], ebx
cmp word [0x437bfe], ax
setne al
mov byte [0x437bf0], al
movsx eax, byte [0x437bf1]
push eax
push dword [0x437c20]
call fcn.004100bc
add byte [0x437bed], al
mov eax, dword [ebp + 8]
pop ecx
mov dword [esi + 4], eax
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x42b573
Capabilities:
Terminate process

Disassembly:
mov eax, 0x42ed8d
call fcn.0042c5b0
sub esp, 0x64
push esi
push 0x66e1ffff
push 0x1249ffff
push 0x4c75ffff
call dword [sym.imp.KERNEL32.dll_MulDiv]
add word [0x437c00], ax
xor esi, esi
push 0x44
lea eax, [ebp - 0x70]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x8701ffff
push 0xdfe7ffff
mov dword [0x437c2c], 1
call fcn.0040ff1a
mov dword [0x437c2c], eax
mov dword [ebp - 0x70], 0x44
movsx eax, word [0x437c02]
push eax
push 0x5c01ffff
call fcn.0040ff78
push 0xbf83ffff
push 0x5959ffff
mov word [0x437bfa], ax
mov byte [0x437bea], 1
call fcn.0040fede
mov dword [0x437c20], eax
push 0x10
lea eax, [ebp - 0x2c]
push esi
push eax
call sub.MSVCRT.dll_memset
movsx eax, byte [0x437be8]
push 0x3043ffff
push eax
call fcn.0040ff4b
mov word [0x437c04], ax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0041f32a
add esp, 0x40
push 0x3735ffff
mov dword [ebp - 4], esi
push dword [0x437c24]
call fcn.0041004e
add word [0x437bfa], ax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
add word [0x437bf8], ax
call fcn.00401f57
mov al, byte [0x437bf4]
dec al
add byte [0x437bee], al
mov eax, dword [ebp - 0x18]
cmp eax, esi
jne 0x42b67c
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
push 0x3d
call fcn.0041448a
pop ecx
call eax
test eax, eax
je 0x42b72c
mov al, byte [0x437c08]
push 0x3a98
and al, byte [0x437c14]
push 0x59
mov word [0x437bf8], si
mov byte [0x437bed], al
call fcn.0041448a
pop ecx
call eax
movsx ax, byte [0x437beb]
push dword [0x437c2c]
add word [0x437bf2], ax
push 0xcdd7ffff
call fcn.0040ff1a
add byte [0x437bf0], al
pop ecx
pop ecx
call fcn.00401e55
test al, al
jne 0x42b706
push esi
push 0x43
call fcn.0041448a
pop ecx
call eax
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x437c10]
inc byte [0x437beb]
inc eax
add word [0x437bf4], ax
xor eax, eax
cmp word [0x437bfa], si
setne al
mov dword [0x437c28], eax
jmp 0x42b731
call fcn.00401e55
movsx eax, word [0x437c04]
push 0x24dfffff
push eax
call fcn.0040ff78
add dword [0x437c14], eax
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42c0fd
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x42ee53
call fcn.0042c5b0
push ecx
push ecx
and dword [ebp - 0x14], 0
push ebx
push esi
movsx eax, word [0x437bfe]
push 1
pop ebx
push eax
push 0x2dd9ffff
mov dword [ebp - 4], ebx
call fcn.0040fede
add byte [0x437bf1], al
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov byte [0x437bed], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esi, dword [ebp + 0x10]
movzx eax, ax
mov dword [0x437c2c], eax
mov al, byte [esi]
add al, 0x16
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042c5d0
mov ecx, esp
mov edx, esi
call fcn.004298e5
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
call fcn.0040f1db
lea eax, [ebp - 0x10]
lea ecx, [ebp + 0xc]
push eax
mov byte [ebp - 4], bl
call fcn.0042c4e1
mov ecx, eax
call fcn.0042c416
push 0x5123ffff
push 0x411fffff
mov byte [ebp - 4], 3
call fcn.004100bc
add byte [0x437bf1], al
and word [0x437c00], 0
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
inc dword [0x437c24]
pop ecx
test eax, eax
pop ecx
mov dword [esi], eax
je 0x42c1c5
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
test eax, eax
mov byte [ebp - 4], bl
je 0x42c1d5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
and byte [ebp - 4], 0
test eax, eax
je 0x42c1e6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret
Function at 0x10001090
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x10015858
push 0x1c
mov edi, ecx
call fcn.10002b86
mov esi, eax
add esp, 8
test esi, esi
je 0x100010bd
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
jmp 0x100010bf
xor esi, esi
test esi, esi
jne 0x100010c8
pop edi
xor al, al
pop esi
ret
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x100010d3
mov edi, dword [edi]
push eax
push edi
lea ecx, [esi + 4]
call fcn.10001120
push 0
push 0
push esi
push section..text
push 0
push 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov al, 1
pop esi
ret
Function at 0x10001ce0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10015004]
xor eax, ebp
mov dword [ebp - 4], eax
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
mov dword [ebp - 0xc], eax
cmp word [eax], cx
jne 0x10001ee1
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10001ee0
movzx eax, word [ebx + 0x14]
push esi
lea esi, [ebx + 0x18]
add esi, eax
xor eax, eax
push edi
xor edi, edi
cmp ax, word [ebx + 6]
jae 0x10001d5a
push str..text
push esi
call fcn.10006355
add esp, 8
test eax, eax
jne 0x10001d4e
test dword [esi + 0x24], 0x20000000
jne 0x10001d5a
movzx eax, word [ebx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jl 0x10001d33
mov edi, dword [esi + 0xc]
add edi, dword [ebp - 0xc]
mov eax, dword [0x10016260]
mov esi, dword [esi + 0x10]
cmp eax, 6
jne 0x10001e16
mov eax, dword [0x1001626c]
cmp eax, 1
jne 0x10001dd8
push 0xd
push esi
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x89044889
mov ecx, edi
mov dword [ebp - 0x10], 0x9090a301
mov dword [ebp - 0xc], 0x76ff9090
mov byte [ebp - 8], 0x20
call fcn.10001650
add esp, 8
cmp eax, 0xffffffff
je 0x10001ede
mov ecx, dword [eax + edi + 0x11]
mov dword [0x10016270], ecx
mov ecx, dword [eax + edi + 0x16]
add ecx, eax
lea eax, [edi + 0x1a]
pop edi
add eax, ecx
pop esi
mov dword [0x10016268], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002b42
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x10001ede
push 8
push esi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x568bff33
mov ecx, edi
mov dword [ebp - 0xc], 0xe8cb8b20
call fcn.10001650
add esp, 8
cmp eax, 0xffffffff
je 0x10001ede
mov ecx, dword [eax + edi + 8]
add ecx, eax
lea eax, [edi + 0xc]
jmp 0x10001ed7
cmp eax, 0xa
jne 0x10001ede
cmp dword [0x1001626c], 0
jne 0x10001ede
push 0xe
push esi
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0xfed4858b
mov ecx, edi
mov dword [ebp - 0x10], 0x708bffff
mov dword [ebp - 0xc], 0x8bd68b50
mov word [ebp - 8], 0xe8cb
mov dword [ebp - 0x24], 0x8bf8458b
mov dword [ebp - 0x20], 0x50408bce
mov dword [ebp - 0x1c], 0x4589d08b
mov word [ebp - 0x18], 0xe8f0
mov dword [ebp - 0x38], 0xff90858b
mov dword [ebp - 0x34], 0x708bffff
mov dword [ebp - 0x30], 0x8bd68b50
mov dword [ebp - 0x2c], 0xffff908d
mov word [ebp - 0x28], 0xe8ff
call fcn.10001650
add esp, 8
cmp eax, 0xffffffff
je 0x10001ea4
mov ecx, dword [eax + edi + 0xe]
add ecx, eax
lea eax, [edi + 0x12]
jmp 0x10001ed7
push 0xe
push esi
lea edx, [ebp - 0x24]
mov ecx, edi
call fcn.10001650
add esp, 8
cmp eax, 0xffffffff
jne 0x10001e99
push 0x12
push esi
lea edx, [ebp - 0x38]
mov ecx, edi
call fcn.10001650
add esp, 8
cmp eax, 0xffffffff
je 0x10001ede
mov ecx, dword [eax + edi + 0x12]
add ecx, eax
lea eax, [edi + 0x16]
add eax, ecx
mov dword [0x10016264], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002b42
mov esp, ebp
pop ebp
ret
Function at 0x10002950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x10002420
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push dword [ebp + 8]
push 0x10002390
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret

Function at 0x41e3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.041e378f
jae 0x41e370e
xor ecx, ecx
call fcn.041e378f
jae 0x41e373d
xor eax, eax
call fcn.041e378f
jae 0x41e374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.041e378f
adc al, al
jae 0x41e372f
jne 0x41e3779
stosb byte es:[edi], al
jmp 0x41e3711
call fcn.041e379b
sub ecx, ebx
jne 0x41e3756
call fcn.041e3799
jmp 0x41e3775
lodsb al, byte [esi]
shr eax, 1
je 0x41e3783
adc ecx, ecx
jmp 0x41e3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.041e3799
cmp eax, 0x7d00
jae 0x41e3772
cmp ah, 5
jae 0x41e3773
cmp eax, 0x7f
ja 0x41e3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41e3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x7b5d009d
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7c9650b5
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4596c3
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00459742
jae 0x4596cf
xor ecx, ecx
call fcn.00459742
jae 0x4596f9
xor eax, eax
call fcn.00459742
jae 0x45970a
mov al, 0x10
call fcn.00459742
adc al, al
jae 0x4596eb
jne 0x459737
stosb byte es:[edi], al
jmp 0x4596d0
call fcn.0045974e
dec ecx
loop 0x459716
mov eax, ebp
call fcn.0045974c
jmp 0x459738
lodsb al, byte [esi]
shr eax, 1
je 0x45975e
adc ecx, 2
mov ebp, eax
jmp 0x459738
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0045974c
cmp eax, 0x7d00
jae 0x459736
cmp eax, 0x500
jae 0x459737
cmp eax, 0x7f
ja 0x459738
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4596d0
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4887ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047f193
and dword [ebp - 4], 0
cmp dword [0x4f1e84], 0
mov ebx, eax
jne 0x4888b0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x488961
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x488961
push eax
call fcn.0047f121
mov dword [esp], 0x4b6358
push edi
mov dword [0x4f1e84], eax
call esi
push eax
call fcn.0047f121
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4f1e88], eax
call esi
push eax
call fcn.0047f121
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4f1e8c], eax
call esi
push eax
call fcn.0047f121
pop ecx
mov dword [0x4f1e94], eax
test eax, eax
je 0x4888b0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047f121
pop ecx
mov dword [0x4f1e90], eax
mov eax, dword [0x4f1e90]
cmp eax, ebx
je 0x488908
cmp dword [0x4f1e94], ebx
je 0x488908
push eax
call fcn.0047f19c
push dword [0x4f1e94]
mov esi, eax
call fcn.0047f19c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x488908
test edi, edi
je 0x488908
call esi
test eax, eax
je 0x4888ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4888ff
test byte [ebp - 0xc], 1
jne 0x488908
or dword [ebp + 0x10], 0x200000
jmp 0x488941
mov eax, dword [0x4f1e88]
cmp eax, ebx
je 0x488941
push eax
call fcn.0047f19c
pop ecx
test eax, eax
je 0x488941
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x488941
mov eax, dword [0x4f1e8c]
cmp eax, ebx
je 0x488941
push eax
call fcn.0047f19c
pop ecx
test eax, eax
je 0x488941
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f1e84]
call fcn.0047f19c
pop ecx
test eax, eax
je 0x488961
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x488963
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret