joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x427120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0040ae90
add esp, 0xc
push str.IsWow64Process
push 0x41e9bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x104
lea edx, [ebp - 0x20c]
push edx
test eax, eax
jne 0x408788
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x40877f
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x408741
mov ecx, 0xc
mov esi, 0x422624
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x20c]
mov esi, ebx
mov edx, ecx
sub esi, edx
jmp 0x408770
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x408770
xor ecx, ecx
cmp ecx, eax
jmp 0x408889
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x210], eax
test eax, eax
jbe 0x408885
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4087a5
mov ecx, 8
mov esi, str._spooldrivers_
rep movsd dword es:[edi], dword [esi]
call fcn.00401880
test eax, eax
lea eax, [ebp - 0x20c]
je 0x4087fa
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4087d0
mov ecx, dword [str.x64_]
mov edx, dword [0x420e5c]
mov dword [eax], ecx
mov cx, word [0x420e60]
mov dword [eax + 4], edx
mov word [eax + 8], cx
jmp 0x40882f
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x408800
mov edx, dword [str.w32x86_]
mov ecx, dword [0x420e4c]
mov dword [eax], edx
mov edx, dword [0x420e50]
mov dword [eax + 4], ecx
mov ecx, dword [0x420e54]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
jmp 0x408840
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x408840
mov edx, dword [0x4209ec]
mov cx, word [0x4209f0]
mov dword [eax], edx
mov word [eax + 4], cx
lea eax, [ebp - 0x20c]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x408870
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x408870
mov eax, dword [ebp - 0x210]
xor edx, edx
cmp edx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0040ae4c
mov esp, ebp
pop ebp
ret

Function at 0x40ae4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427120]
jne 0x40ae56
repz ret
jmp fcn.0040dc58
Function at 0x41941d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040eb05
and dword [ebp - 4], 0
cmp dword [0x42abe8], 0
mov ebx, eax
jne 0x4194ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41957f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41957f
push eax
call fcn.0040ea93
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42abe8], eax
call esi
push eax
call fcn.0040ea93
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42abec], eax
call esi
push eax
call fcn.0040ea93
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42abf0], eax
call esi
push eax
call fcn.0040ea93
pop ecx
mov dword [0x42abf8], eax
test eax, eax
je 0x4194ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ea93
pop ecx
mov dword [0x42abf4], eax
mov eax, dword [0x42abf4]
cmp eax, ebx
je 0x419526
cmp dword [0x42abf8], ebx
je 0x419526
push eax
call fcn.0040eb0e
push dword [0x42abf8]
mov esi, eax
call fcn.0040eb0e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x419526
test edi, edi
je 0x419526
call esi
test eax, eax
je 0x41951d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41951d
test byte [ebp - 0xc], 1
jne 0x419526
or dword [ebp + 0x10], 0x200000
jmp 0x41955f
mov eax, dword [0x42abec]
cmp eax, ebx
je 0x41955f
push eax
call fcn.0040eb0e
pop ecx
test eax, eax
je 0x41955f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41955f
mov eax, dword [0x42abf0]
cmp eax, ebx
je 0x41955f
push eax
call fcn.0040eb0e
pop ecx
test eax, eax
je 0x41955f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42abe8]
call fcn.0040eb0e
pop ecx
test eax, eax
je 0x41957f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x419581
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8e3410
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x34e000]
push edi
jmp 0x8e342a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8e3431
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e3420
mov eax, 1
add ebx, ebx
jne 0x8e3443
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8e3454
jne 0x8e3473
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e3473
dec eax
add ebx, ebx
jne 0x8e3460
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8e3438
add ebx, ebx
jne 0x8e346f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8e34c5
xor ecx, ecx
sub eax, 3
jb 0x8e348b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8e34fa
sar eax, 1
mov ebp, eax
jmp 0x8e3496
add ebx, ebx
jne 0x8e3496
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e3464
inc ecx
add ebx, ebx
jne 0x8e34a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8e3464
add ebx, ebx
jne 0x8e34b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8e34a6
jne 0x8e34c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8e34a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8e34e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8e34d6
jmp 0x8e3426
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8e34e4
add edi, ecx
jmp 0x8e3426
pop esi
mov edi, esi
mov ecx, 0x4345
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8e3502
cmp byte [edi], 0x13
jne 0x8e3502
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8e3507
lea edi, [esi + 0x4e0000]
mov eax, dword [edi]
or eax, eax
je 0x8e357f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x542bfc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x542d3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8e3534
mov ecx, edi
jns 0x8e3563
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x542d40]
or eax, eax
je 0x8e3579
mov dword [ebx], eax
add ebx, 4
jmp 0x8e3551
call dword [esi + 0x542d50]
mov ebp, dword [esi + 0x542d44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8e35b3
sub esp, 0xffffff80
jmp 0x48b379
Function at 0x423ed4
Capabilities:
Encode data using xor

Disassembly:
cmp ch, byte [edx + 0x4d38caf]
fnstsw word [eax]
insb byte es:[edi], dx
xor ah, byte [esi - 0x2d]
je 0x423edd
mov byte [0x6ec36a1d], al
cmp byte [edx + 0x73e149a5], 0xc4
dec esp
jle 0x423f67
stosb byte es:[edi], al
or edx, dword [ecx - 0x57fe6141]
dec ecx
sbb byte [edx - 0x34f85a77], al
cmc
jp 0x423f3d
push ebp
dec eax
fistp word [edi - 0x34]
pushal
stosd dword es:[edi], eax
and eax, 0xea498e65
dec edx
jb 0x70120902
cmpsd dword [esi], dword es:[edi]
mov ebx, 0x89f1fa2f
iretd
mov ebx, ecx
invalid
sbb dword [edx - 0x90ff5d], 0xeac0741c
sub dword [esp + ecx + 0x56], ecx
push esi
xor eax, 0x51af7469
leave
outsd dx, dword [esi]
push ds
push ss
out dx, al
or ecx, edi
cdq
mov ebp, dword [ebx - 0x3490edb3]
add ecx, dword [ebp + 0x5bedecfd]
aas
jae 0x423fd3
xchg edi, eax
mov al, 0xa9
dec ebx
jle 0x423fbe
jg 0x423ff7
stosd dword es:[edi], eax
outsb dx, byte [esi]
aas
xchg dword [esp + edi*4 - 0x65], edi
pushfd
mov esi, 0x8129e6c6
loop 0x423f5a
cmp al, ch
enter 0x501c, 0x1f
push esp
or al, 0x18
push 0xfffffffffffffffe
cmp al, 0x58
inc edi
popal
push eax
mov byte [0xe30f4fc9], al
push 0x76
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
fmul qword [esp + edx*2]
stosd dword es:[edi], eax
pop ebp
cmp cl, byte [edi + 0x13]
outsb dx, byte [esi]
jmp [eax]
jb 0x423f70
enter 0x50de, 0x50
call [edx - 0x456682e]
xchg dword [esi], edi
xchg ebp, eax
and byte [ecx], ah
or byte [ecx - 0x4b], dl
sub esi, edi
aas
ficom dword [ecx - 0x51]
fisubr dword [ebx + 0x1d]
or eax, 0x428f57df
bswap ecx
mov bl, 0xd7
cmp al, 0x9c
retf

Function at 0x43b0d2
Capabilities:
Encode data using xor

Disassembly:
inc ebx
sal dword [ecx], cl
and dword [eax + 0x7e7275ec], ebx
adc eax, 0xcf6b3589
pop ebx
sbb eax, 0xdb057a
test eax, 0xc19ff8ad
retf 0xc44b
stosw word es:[edi], ax
sti
movsd dword es:[edi], dword [esi]
jmp 0x43b010
pop ecx
jne 0x43b07e
dec ebp
stosb byte es:[edi], al
push 0x583596df
sub dword [ebx + ebx], ebp
in eax, dx
test dword [eax - 0x26], eax
fdivr st(6), st(0)
mov byte [0x80f87e3b], al
mov esp, 0x495c8d5d
in eax, dx
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
push ds
lea eax, [eax - 0x2c707565]
lahf
sbb al, 0xed
stc
shufps xmm4, xmm1, 0x83
xor bh, ch
sbb eax, 0x3e5d2733
mov dword [0xb477040b], eax
out dx, al
loopne 0x43b0df
hlt
Function at 0x43e212
Capabilities:
Encode data using xor

Disassembly:
pop ds
push 0xffffffffffffffa9
cmovns ebx, ebx
cmc
loope 0x43e277
div cl
adc bh, 0x1b
and al, 0x2b
and al, 0x3b
add ecx, dword [ebp + 0x11]
retf 0xd9a7
pushal
das
adc ebx, dword [eax + 0x28]
call [ecx - 0x55]
sahf
fsubr dword [edi - 0x2e]
out 0xfe, eax
xchg ecx, eax
das
dec ebx
dec ecx
xchg ebx, eax
pop eax
mov dword [eax], 0x7cb55c7c
or ebx, dword [eax]
imul esi, dword [edx + 0x50], 0x46
jl 0x43e238
sbb byte [ebx + 0x74], ch
bound edx, qword [eax + 0x46]
push edx
mov bh, 0xaf
je 0x43e22b
add cl, dh
adc al, 0xf1
pop ebx
std
or dl, byte gs:[ebx + 0x395b0107]
popfd
pop ds
or dword [edi + edx*8 - 0x75], eax
pop edi
jae 0x43e2bd
mov cl, 0xa0
mov bl, 0xb0
fcmovb st(0), st(6)
cmp ebp, dword [edi + 0x27daf77e]
adc eax, 0x6b6ffbdf
jne 0x43e1f3
pop es
mov eax, dword [edi]
out dx, eax
xchg dword [esi + 0x1a], esp
inc esp
dec ebp
cdq
invalid
test dword [edi], 0xbcddd369
fstp xword [eax - 0x39]
xchg ebx, eax
popfd
xor esi, edi
and al, 0x6c
and eax, 0xd908de38
pop ds
jmp dword [edi + 0x6f]
test eax, edx
jmp [edx]

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bdac]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bdac], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x6572a0
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x4665d4
Capabilities:
Encode data using xor

Disassembly:
cdq
sbb byte [ebx], bl
mov al, 0x5d
mov al, byte [0x3d6729c9]
invalid

Function at 0x47c7fa
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xdf8950
adc dl, byte [edx - 0x29]
inc edx
adc al, 0x80
ficomp dword [eax - 0x12]
or eax, 0xca8ebdb
jbe 0x47c7bf
inc esi
or al, 0xd2
and ebp, dword [ebx + 0x7ee871dc]
loope 0x47c817
jno 0x47c7ac
jle 0x47c7a7
push eax
sbb al, 0x28
pop edi
push es
dec ecx
push ds
jg 0x47c7db
dec esi
loop 0x47c7fe
adc dh, cl
sbb eax, 0x7ee2fff7
aas
and eax, 0x7e441796
pop ds
xchg esi, eax
pop ss
inc esp
jle 0x47c7ff
sub eax, 0xad29f1e
xor dword [esi + ebp + 0x1b], ecx
jne 0x47c81a
sbb ebp, dword [ebp + 0x59]
xchg edx, eax
push cs
mov al, 0xe2
mov byte [0x134200a0], al
in eax, dx
push edi
dec ebx
push edx
xchg edx, eax
xchg edi, eax
mov es, ebp
insd dword es:[edi], dx
sar byte [edi], 1
lds ebp, [ebp - 0x30]
aas
mul byte [esi + 0x797a6518]
mov eax, 0x52121b30
cdq
cmpsb byte [esi], byte es:[edi]
sbb byte [ebp + 0x7a], ah
jns 0x47c7c2
xor byte [ebx], bl
adc dl, byte [edx - 0x67]
push ss
xchg dword [edx + 0x399fe4e8], ecx
or eax, dword gs:[0xa2061fb3]
or eax, dword [0xa2061fb3]
pop ds
push es
mov byte [0xa975c596], al
xchg esi, eax
lds esi, [ebp - 0x57]
mov bh, 0xa2
rcr dword [edx + esi*8], cl
std
ffree st(0)
out 0x23, al
jle 0x47c804
push cs
salc
sahf
sbb al, 0x5e
pop es
stosb byte es:[edi], al
popfd
iretd
Function at 0x513129
Capabilities:
Encode data using xor

Disassembly:
shr dword [ebx - 0x4d], 1
dec ebx
jb fcn.005130d6
stosd dword es:[edi], eax
sahf
dec ecx
push ebp
shl al, cl
inc edi
mov dl, 0x9f
ret

Function at 0x54b1b4
Capabilities:
Encode data using xor

Disassembly:
or esi, edx
insb byte es:[edi], dx
jno 0x54b20c
pop ebp
invalid
mov dword [edx - 0x522f3b65], esi
std
test al, 0x24
fucomp st(4)
lahf
nop
mov byte [0x35872917], al
add al, 0xd
mov esi, 0x30f56767
outsb dx, byte [esi]
and eax, esi
push esp
sub ch, ah
and ch, byte [edx + 0x3a32a51a]
out dx, al
pop es
inc ecx
aad 0xf7
mov ebp, 0x2a4a620d
inc esi
xor bh, byte [ebx + 0x10]
dec ebp
pop eax
adc byte [ebp + 0x58], cl
fadd qword [edx + 0x7337f2af]
ja 0x54b209
mov gs, word [ebx]
pop edx
imul ecx, dword [esi], 0xffffffd4
fist dword [eax]
dec edi
adc eax, 0x44b86965
arpl word [edx + 0x5a], bp
jge 0x54b1d9
mov esi, 0x871a0921
invalid
Function at 0x5c6214
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.00614ff4
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x5c629c
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.006121bb
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.005c6144
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x5c6397
shr edx, 2
je 0x5c6362
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x5c62f4
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x5c62e8
test edx, edx
je 0x5c63c3
jmp 0x5c63a4
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x5c63a4
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x5c6415
mov eax, 1
jmp 0x5c646a
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.005c1b94
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call fcn.00612667
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.006121bb
add esp, 0x864
ret
Function at 0x610ea4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call 0x65fc84
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x610f2c
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call 0x65ce4b
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.00610dd4
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x611027
shr edx, 2
je 0x610ff2
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x610f84
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x610f78
test edx, edx
je 0x611053
jmp 0x611034
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x611034
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x6110a5
mov eax, 1
jmp 0x6110fa
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.0060c824
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call 0x65d2f7
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call 0x65ce4b
add esp, 0x864
ret

Function at 0x63c8e8
Capabilities:
Encode data using xor

Disassembly:
dec esi
out dx, al
and bl, dl
invalid
sbb edx, eax
push ecx
salc
xor eax, 0x70b90c02
jnp 0x63c8c8
mov al, byte [0x75cc453b]
sub esi, dword [eax]
out dx, eax
dec esp
add esi, ecx
push edx
fisttp word [edx]
xchg esi, eax
mov esp, ebp
test byte [edx - 0x1900b5e6], dh
int1
dec ebx
xchg esp, eax
push eax
invalid
Function at 0x6456bb
Capabilities:
Encode data using xor

Disassembly:
mov gs, ecx
lcall 0xcf19, 0xdb387134
outsb dx, byte [esi]
xlatb
fmul qword [ebx - 0x7c3b5c90]
jle 0x645663
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x77272bd6
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x5e2e2d44
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219