joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dd670
Capabilities:
Execute anti-debugging instructions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
push edi
push dword [0x884c50]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov esi, dword [ecx + 4]
cmp esi, dword [ecx + 0xc]
jae 0x6dd6b3
mov dword [esi], str.LtGskAgent
mov dword [esi + 0xc], str.StTim
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
lea eax, [esi + 0x10]
mov dword [ecx + 4], eax
mov esi, dword [ebp + 0x10]
movss xmm0, dword [edi + 0x18]
ucomiss xmm0, dword [esi + 0x50]
lahf
test ah, 0x44
jnp 0x6dd78f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
movss xmm3, dword [eax + 0x5c]
mulss xmm3, dword [esi + 0x58]
movaps xmm2, xmmword [eax + 0x40]
movss xmm4, dword [ecx + 0x5c]
subps xmm2, xmmword [eax + 0x50]
mulss xmm4, dword [esi + 0x58]
movaps xmm0, xmm3
movaps xmm1, xmmword [ecx + 0x50]
subps xmm1, xmmword [ecx + 0x40]
shufps xmm0, xmm0, 0
mulps xmm2, xmm0
movaps xmm0, xmm4
shufps xmm0, xmm0, 0
mulps xmm1, xmm0
movss xmm0, dword [ecx + 0x9c]
mulss xmm0, xmm4
addps xmm2, xmm1
movss xmm1, dword [eax + 0x9c]
mulss xmm1, xmm3
mulss xmm0, dword [ecx + 0xa0]
mulss xmm1, dword [eax + 0xa0]
movaps xmmword [esp + 0x20], xmm2
addss xmm1, xmm0
movss xmm0, dword [edi + 0x2c]
comiss xmm0, dword [esi + 0xc]
movss dword [esp + 0x2c], xmm1
jbe 0x6dd78f
movaps xmm1, xmmword [edi + 0x20]
movaps xmm0, xmmword [esp + 0x20]
mulps xmm1, xmm0
shufps xmm0, xmm0, 0xff
movaps xmm2, xmm1
shufps xmm2, xmm1, 0xaa
addss xmm2, xmm0
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
addss xmm0, xmm1
addps xmm2, xmm0
movss xmm0, dword [edi + 0x2c]
subss xmm0, xmm2
movss dword [edi + 0x2c], xmm0
comiss xmm0, dword [esi + 0xc]
ja 0x6dd7e7
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [ecx + 4]
mov dword [esp + 0x18], eax
cmp eax, dword [ecx + 0xc]
jae 0x6dd7ce
mov dword [eax], str.StGsk
rdtsc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
add eax, 0xc
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
push dword [ebp + 0x14]
mov eax, dword [esi + 0x54]
mov ecx, edi
push 0
push esi
push dword [ebp + 0xc]
mov dword [edi + 0x18], eax
push dword [ebp + 8]
call fcn.006dd930
push dword [0x884c50]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 0xc]
jae 0x6dd816
mov dword [esi], 0x77f784
rdtsc
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0xc]
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x6dda14
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x6dda66
test al, 4
jne 0x6dda58
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x80
cmp ax, cx
je 0x6dda3b
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x80
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x6f4290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x6f429f
call fcn.0045c0c0
mov ecx, dword [esi + 0x1c]
pop esi
test ecx, ecx
jne fcn.0045c0c0
ret
Function at 0x6fcd90
Capabilities:
Get thread local storage value

Disassembly:
sub ecx, 8
jmp method.hkpCharacterProxy.virtual_0
push esi
mov esi, ecx
call fcn.006f8f90
mov eax, dword [esp + 8]
test al, 1
je 0x6fcde5
test al, 4
jne 0x6fcdd7
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xc0
cmp ax, cx
je 0x6fcdba
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xc0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6fd040
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
sub ecx, 1
js 0x6fd096
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
add eax, 0x1c
movss xmm3, dword [0x719730]
nop dword [eax]
movss xmm2, dword [eax]
movaps xmm1, xmmword [eax - 0xc]
movss dword [eax - 0x10], xmm2
mulps xmm1, xmmword [edx]
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
addss xmm0, xmm1
shufps xmm1, xmm1, 0xaa
addss xmm1, xmm0
mulss xmm1, xmm2
xorps xmm1, xmm3
movss dword [eax], xmm1
add eax, 0x30
sub ecx, 1
jns 0x6fd060
ret 0xc

Function at 0x6fdc60
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
push dword [esp + 0x10]
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi + 4], 0x1ffff
lea ecx, [edi + 0x1c]
mov dword [edi], vtable.hkaMirroredSkeleton.0
mov dword [edi + 0xc], esi
mov eax, dword [esi + 0xc]
mov dword [edi + 0x10], eax
call fcn.0046a7a0
mov esi, dword [esi + 0x1c]
mov dword [edi + 0x14], esi
push dword [0x884adc]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
push 0x10
mov ecx, dword [eax + 0x2c]
lea eax, [esi + esi]
push eax
push ecx
call fcn.004605d0
mov esi, dword [esp + 0x14]
add esp, 0xc
mov dword [esi + 8], eax
mov esi, dword [esi + 0x14]
push dword [0x884adc]
inc esi
call edi
push 0x10
shl esi, 4
push esi
push dword [eax + 0x2c]
call fcn.004605d0
mov edx, dword [esp + 0x14]
xor esi, esi
add esp, 0xc
mov dword [edx + 0x18], eax
cmp dword [edx + 0x14], esi
jle 0x6fdd09
movaps xmm0, xmmword [0x78cb00]
xor ecx, ecx
mov eax, dword [edx + 8]
mov word [eax + ecx*2], si
inc esi
shl ecx, 4
add ecx, dword [edx + 0x18]
movaps xmmword [ecx], xmm0
movsx ecx, si
cmp ecx, dword [edx + 0x14]
jl 0x6fdcf0
mov eax, dword [edx + 0x14]
movaps xmm0, xmmword [0x78cb00]
shl eax, 4
add eax, dword [edx + 0x18]
pop edi
pop esi
movaps xmmword [eax], xmm0
mov eax, edx
pop ecx
ret 4

Function at 0x6fdd30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 8]
mov dword [ebx], vtable.hkaMirroredSkeleton.0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push dword [eax + 0x2c]
call fcn.00460610
mov esi, dword [ebx + 0x18]
add esp, 8
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push dword [eax + 0x2c]
call fcn.00460610
add esp, 8
lea ecx, [ebx + 0x1c]
call fcn.0046a7e0
pop esi
mov dword [ebx], vtable.hkBaseObject.0
pop ebx
ret
Function at 0x6fec00
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006fdd30
mov eax, dword [esp + 8]
test al, 1
je 0x6fec52
test al, 4
jne 0x6fec47
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x2c
cmp ax, cx
je 0x6fec2a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x2c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6ff270
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x6ff282
call fcn.0045c160
cmp dword [esp + 8], 0
je 0x6ff2c0
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x30
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x30
mov word [eax + 4], cx
mov ecx, eax
push dword [esi + 0x28]
push dword [esp + 0xc]
call fcn.006ff590
mov dword [esi + 0x90], eax
pop esi
ret 4
mov dword [esi + 0x90], 0
pop esi
ret 4

Function at 0x6ff6e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006fedd0
mov eax, dword [esp + 8]
test al, 1
je 0x6ff735
test al, 4
jne 0x6ff727
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xa0
cmp ax, cx
je 0x6ff70a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xa0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6ff740
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006ff620
mov eax, dword [esp + 8]
test al, 1
je 0x6ff792
test al, 4
jne 0x6ff787
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x30
cmp ax, cx
je 0x6ff76a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x30
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4

Function at 0x6ffd30
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
call fcn.006ff930
mov eax, dword [esp + 8]
test al, 1
je 0x6ffd82
test al, 4
jne 0x6ffd77
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0x3c
cmp ax, cx
je 0x6ffd5a
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0x3c
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x700fd4
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], vtable.hkBaseObject.0
test al, 1
je 0x701026
test al, 4
jne 0x701018
movzx eax, word [esi + 4]
mov ecx, 0xffff
push edi
mov edi, 0xf0
cmp ax, cx
je 0x700ffb
mov edi, eax
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push esi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
ret 4
push 0xf0
push esi
call fcn.0045b780
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x704060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
push esi
mov esi, ecx
lea edx, [esi + 0x18]
push edi
mov edi, dword [edx]
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], edi
movaps xmm0, xmmword [eax]
movaps xmmword [esp + 0x10], xmm0
movaps xmm0, xmmword [eax + 0x10]
movaps xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [eax + 0x20]
movaps xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x10], edi
jne 0x7040a4
mov eax, dword [esi + 0xc]
jmp 0x7040a6
xor eax, eax
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x38]
mov ecx, dword [eax + 0x2c]
mov eax, dword [eax + 0xc]
cmp eax, dword [ecx + 0x1c]
je 0x7041eb
test edi, edi
je 0x7040f8
push dword [0x884adc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [edi + edi*2]
shl ecx, 4
add ecx, 0x7f
mov edi, dword [eax + 0xc]
and ecx, 0xffffff80
lea edx, [edi + ecx]
cmp ecx, dword [eax + 8]
jg 0x7040ec
cmp edx, dword [eax + 0x10]
ja 0x7040ec
mov dword [eax + 0xc], edx
jmp 0x7040fa
push ecx
mov ecx, eax
call fcn.0046a3c0
mov edi, eax
jmp 0x7040fa
xor edi, edi
mov eax, dword [esp + 8]
xor ecx, ecx
or eax, 0x80000000
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 0x1c], ecx
jle 0x70415a
mov edx, dword [ebp + 0xc]
add edx, 0x20
nop word [eax + eax]
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + ecx*4]
test eax, eax
js 0x70414b
movaps xmm0, xmmword [edx - 0x20]
lea eax, [eax + eax*2]
add eax, eax
movaps xmmword [edi + eax*8], xmm0
movaps xmm0, xmmword [edx - 0x10]
movaps xmmword [edi + eax*8 + 0x10], xmm0
movaps xmm0, xmmword [edx]
movaps xmmword [edi + eax*8 + 0x20], xmm0
mov eax, dword [esi + 0x38]
inc ecx
add edx, 0x30
mov eax, dword [eax + 0x2c]
cmp ecx, dword [eax + 0x1c]
jl 0x704120
push dword [ebp + 0x14]
movss xmm0, dword [ebp + 8]
lea eax, [esi + 0x18]
push dword [esi]
mov dword [esp + 0x48], edi
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
movss dword [esp], xmm0
call fcn.007043b0
mov eax, dword [esp + 0x1c]
add esp, 0x14
push dword [0x884adc]
lea esi, [eax + eax*2]
shl esi, 4
add esi, 0x7f
and esi, 0xffffff80
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [esi + 0xf]
and edx, 0xfffffff0
cmp esi, dword [eax + 8]
jg 0x7041b8
lea ecx, [edx + edi]
cmp ecx, dword [eax + 0xc]
jne 0x7041b8
cmp dword [eax + 0x14], edi
je 0x7041b8
mov dword [eax + 0xc], edi
jmp 0x7041c1
push edx
push edi
mov ecx, eax
call fcn.0046a590
mov eax, dword [esp + 0xc]
test eax, eax
js 0x704210
and eax, 0x3fffffff
mov ecx, 0x7d8954
lea eax, [eax + eax*2]
shl eax, 4
push eax
mov eax, dword [0x7d8954]
push edi
call dword [eax + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push dword [esi]
movss xmm0, dword [ebp + 8]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x18]
push edx
push eax
push ecx
movss dword [esp], xmm0
call fcn.007043b0
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x704e20
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push dword [0x884adc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x20
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x24]
mov edx, eax
xorps xmm0, xmm0
mov dword [esp + 0x10], edx
lea eax, [edx + 0x14]
lea edi, [edx + 8]
mov dword [esp + 0x18], eax
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm0
mov dword [edx + 4], 0x1ffff
mov dword [edx], vtable.hkbSymbolIdMap.0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], connect
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xffffffff
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
add ecx, ebx
and eax, 0x3fffffff
cmp eax, ecx
jge 0x704ebf
add eax, eax
cmp ecx, eax
push 4
cmovl ecx, eax
push ecx
push esi
push 0x7d8954
call fcn.00467b80
mov edx, dword [esp + 0x20]
add esp, 0x10
xor ebp, ebp
test ebx, ebx
jle 0x704f9e
lea ecx, [esi + 0x14]
nop dword [eax]
mov eax, dword [esp + 0x20]
push 0xffffffffffffffff
mov eax, dword [eax + ebp*4]
push eax
mov dword [esp + 0x1c], eax
call fcn.0046ab90
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x704f47
mov eax, dword [esi + 8]
mov ebx, dword [esi + 4]
and eax, 0x3fffffff
cmp ebx, eax
jne 0x704f09
push 4
push esi
push 0x7d8954
call fcn.00467c00
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea ecx, [eax + ecx*4]
test ecx, ecx
je 0x704f1a
call fcn.0045d8c0
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
push 0xffffffffffffffff
push dword [esp + 0x1c]
lea ecx, [eax + edx*4]
lea eax, [edx + 1]
mov dword [esi + 4], eax
call fcn.0045dae0
mov eax, dword [esi]
lea ecx, [esi + 0x14]
push ebx
mov eax, dword [eax + ebx*4]
and eax, 0xfffffffe
push eax
call fcn.0046abd0
mov eax, dword [edi + 8]
and eax, 0x3fffffff
cmp dword [edi + 4], eax
jne 0x704f64
push 4
push edi
push 0x7d8954
call fcn.00467c00
add esp, 0xc
mov ecx, dword [edi + 4]
mov eax, dword [edi]
push ebp
mov dword [eax + ecx*4], ebx
lea eax, [ebx + 1]
mov ecx, dword [esp + 0x1c]
inc dword [edi + 4]
push eax
push 0x7d8954
call fcn.0046ba50
inc ebp
lea ecx, [esi + 0x14]
cmp ebp, dword [esp + 0x24]
jl 0x704ed0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0xc
ret 8
Function at 0x704fb0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x884adc]
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [esp + 0x1c]
mov esi, dword [eax + 0xc]
lea ebx, [ebp*4 + 0x7f]
and ebx, 0xffffff80
lea ecx, [esi + ebx]
cmp ebx, dword [eax + 8]
jg 0x704fe8
cmp ecx, dword [eax + 0x10]
ja 0x704fe8
mov dword [eax + 0xc], ecx
jmp 0x704ff2
push ebx
mov ecx, eax
call fcn.0046a3c0
mov esi, eax
test ebp, ebp
jle 0x705011
mov edi, dword [esp + 0x18]
mov ecx, esi
sub edi, esi
mov edx, ebp
mov eax, dword [edi + ecx]
lea ecx, [ecx + 4]
and eax, 0xfffffffe
mov dword [ecx - 4], eax
sub edx, 1
jne 0x705000
mov ecx, dword [esp + 0x10]
push ebp
push esi
call fcn.00704e20
push dword [0x884adc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebx + 0xf]
and edx, 0xfffffff0
cmp ebx, dword [eax + 8]
jg 0x70504f
lea ecx, [edx + esi]
cmp ecx, dword [eax + 0xc]
jne 0x70504f
cmp dword [eax + 0x14], esi
je 0x70504f
mov dword [eax + 0xc], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push edx
push esi
mov ecx, eax
call fcn.0046a590
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x584b5e30
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x50297b78
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x6f096f6c
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x50dc1fe8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40c198
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040799b
mov dword [ebp - 0x14], eax
cmp dword [0x811e00], esi
jne 0x40c28b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c218
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c36b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c36b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c36b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x811e00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x811e04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x811e08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x811e10], eax
test eax, eax
je 0x40c288
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x811e0c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2b0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2a3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c2c5
push 4
pop eax
jmp 0x40c36d
cmp dword [ebp - 0x14], esi
je 0x40c2c5
push dword [0x811e00]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2aa
mov eax, dword [0x811e0c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c323
cmp dword [0x811e10], edi
je 0x40c323
push eax
call ebx
push dword [0x811e10]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c323
test eax, eax
je 0x40c323
call ecx
test eax, eax
je 0x40c318
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c318
test byte [ebp - 8], 1
jne 0x40c323
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c353
mov eax, dword [0x811e04]
cmp eax, edi
je 0x40c350
push eax
call ebx
test eax, eax
je 0x40c350
call eax
mov esi, eax
test esi, esi
je 0x40c350
mov eax, dword [0x811e08]
cmp eax, edi
je 0x40c350
push eax
call ebx
test eax, eax
je 0x40c350
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x811e00]
call ebx
test eax, eax
je 0x40c36b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c36d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b05
mov esp, ebp
pop ebp
ret
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x100451a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100451b5
pop dword [ebp - 8]
mov eax, 0x98975e9c
sub eax, 0x88930ce7
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2f240cae
sub dword [ebp - 0x18], 0xe0d1c763
mov dword [ebp - 0x14], 0xbad1b2fd
add dword [ebp - 0x14], 0x77619948
mov dword [ebp - 0x10], 0xb6e5ce9e
add dword [ebp - 0x10], 0x95667590
mov dword [ebp - 0xc], 0xf49f8ec
sub dword [ebp - 0xc], 0xf49f8ec
lea eax, [ebp - 0x18]
push eax
mov eax, 0x189666c4
sub eax, 0x88f65b8
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc11d3bd5
sub dword [ebp - 0x18], 0x4caad27f
mov dword [ebp - 0x14], 0x7d77ad75
add dword [ebp - 0x14], 0xc3f4b400
mov dword [ebp - 0x10], 0x1da56336
sub dword [ebp - 0x10], 0xba35f6ca
mov dword [ebp - 0xc], 0x1b2f6aa0
add dword [ebp - 0xc], 0xe4d09560
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x960bd75
sub eax, 0xf959bd35
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x66624
push 0
call eax
mov ecx, 0x6bb7811d
sub ecx, 0x6bb745ab
xor ebx, ebx
add ebx, eax
mov esi, 0x3e947cb4
sub esi, 0x2e8c30b4
add esi, dword [ebp - 8]
mov edi, 0x230b5993
sub edi, 0x933aa6c2
xor dword [ebp - 4], edx
mov edx, dword [esi]
mov dword [ebp - 4], 0x4500f482
add edx, edi
add dword [ebp - 4], eax
mov dword [ebx], edx
add dword [ebp - 4], 0x71785962
add ebx, 0xcd30dbad
add ebx, 0x32cf2457
add esi, 4
loop 0x100452d9
add eax, 0xe09b
mov ebx, eax
add eax, 0x2463d228
add eax, 0xdb9c2ddd
mov ecx, 0x5e56c869
sub ecx, 0x4e56c869
add ecx, dword [ebp - 8]
call ebx
leave
ret