joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040eb78
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x433680], eax
call fcn.00410fe0
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401112
pop ecx
mov esi, ebp
call fcn.0040e6c7
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e6cd
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401112
add esp, 0xc
inc esi
call fcn.0040e6c7
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040121d
call fcn.00401285
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401135
pop ecx
pop ecx
mov esi, eax
call fcn.0040128b
mov edx, ebp
test ebx, ebx
jle 0x401093
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x401088
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a2
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010ae
mov edx, dword [esi]
mov ecx, dword [0x432990]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426274
push 0x426278
push dword [0x432994]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d65
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x404305
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.00410fe0
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x404478
jg 0x404334
test esi, esi
jb 0x404478
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x404478
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404396
push edi
call fcn.00404887
pop ecx
test eax, eax
je 0x40438d
push ebx
push esi
push edi
push ebp
call fcn.00410fe0
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40447d
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.00410fe0
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x404478
jg 0x4043bf
cmp ebp, ebx
jb 0x404478
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043d4
jl 0x4043ce
cmp ebp, ecx
jae 0x4043d4
mov esi, ebp
mov ecx, eax
jmp 0x4043d8
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.00410fe0
add esp, 0x10
cmp edx, ebx
jl 0x404478
jg 0x4043fe
cmp eax, ebx
jb 0x404478
push 0x10015
call fcn.00410fe0
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404478
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175dd
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404471
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40446d
cmp byte [esi], 0x50
jne 0x40446c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40446c
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404484
dec esi
cmp esi, ebx
jae 0x40442d
push ebx
call fcn.00410fe0
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a170
push ebx
call fcn.00410fe0
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404887
add esp, 0x14
test eax, eax
je 0x4044c4
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.00410fe0
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40447d
Function at 0x410fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x410fef
pop dword [ebp - 0x50]
mov eax, 0xf4cb88d0
add eax, 0xb75871f
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x261d015c
add dword [ebp - 0x60], 0x283543ef
mov dword [ebp - 0x5c], 0x4ffdaff3
sub dword [ebp - 0x5c], 0x1dca63ae
mov dword [ebp - 0x58], 0x461883b7
sub dword [ebp - 0x58], 0xf9cc3f89
mov dword [ebp - 0x54], 0xd00b4b90
add dword [ebp - 0x54], 0x2ff4b470
lea eax, [ebp - 0x60]
push eax
mov eax, 0x33fd11e2
sub eax, 0x33bab18e
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa8109ddd
add dword [ebp - 0x60], 0xcc61cb79
mov dword [ebp - 0x5c], 0xba8c8f26
add dword [ebp - 0x5c], 0x86dfd24f
mov dword [ebp - 0x58], 0x471519e0
sub dword [ebp - 0x58], 0xe3a5ad74
mov dword [ebp - 0x54], 0xcf3b6e41
sub dword [ebp - 0x54], 0xcf3b6e41
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x41322
push 0
call eax
mov ecx, 0x39613873
add ecx, 0xc69f167c
xor ebx, ebx
add ebx, eax
mov edx, 0x43ea00
add edx, dword [ebp - 0x50]
mov edi, 0x2945d604
sub edi, 0x1a15211e
mov dword [ebp - 0x28], 0xb2b8d7b2
mov esi, dword [edx]
sub dword [ebp - 0x1c], edx
xor esi, edi
add dword [ebp - 0x4c], edi
mov dword [ebx], esi
xor dword [ebp - 0x1c], 0x10e4c051
add ebx, 0xbf4d7bd6
sub ebx, 0xbf4d7bd2
add edx, 0x4d0184f7
sub edx, 0x4d0184f3
loop 0x411108
add eax, 0x11ae93d9
sub eax, 0x11ad654a
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0xc14c6719
sub eax, 0xc10c4ab3
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd09b3871
sub dword [ebp - 0x18], 0x8248f326
mov dword [ebp - 0x14], 0xd8bf063f
sub dword [ebp - 0x14], 0xa68bb9fa
mov dword [ebp - 0x10], 0xb9508db9
add dword [ebp - 0x10], 0x92fbb675
mov dword [ebp - 0xc], 0xc455fd81
add dword [ebp - 0xc], 0x3baa027f
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc41bc6b4
add eax, 0x3c2469a0
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc11382ad
add dword [ebp - 0x18], 0xb35ee6a9
mov dword [ebp - 0x14], 0x27968f84
sub dword [ebp - 0x14], 0xe62a2e0f
mov dword [ebp - 0x10], 0x8f046d82
sub dword [ebp - 0x10], 0x2b950116
mov dword [ebp - 0xc], 0x263e75e8
sub dword [ebp - 0xc], 0x263e75e8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x916ae04c
add eax, 0x6ed54fe0
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37072
push 0
call eax
mov ecx, 0x4a30
xor esi, esi
add esi, eax
mov edi, 0xad2dcacb
add edi, 0x5312a535
add edi, dword [ebp - 8]
mov ebx, 0x601ad3cf
xor dword [ebp - 4], ecx
mov edx, dword [edi]
sub dword [ebp - 4], 0xc2016b95
xor edx, ebx
mov dword [esi], edx
sub dword [ebp - 4], eax
add esi, 0x5068500c
sub esi, 0x50685008
add edi, 0x21b09199
add edi, 0xde4f6e6b
loop 0x401d7e
add eax, 0x11b93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435030]
jne 0x40107a
repz ret
jmp fcn.00401ac1

Function at 0x409195
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bf5
and dword [ebp - 4], 0
cmp dword [0x437794], 0
mov ebx, eax
jne 0x409246
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092f7
push eax
call fcn.00404b83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437794], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437798], eax
call esi
push eax
call fcn.00404b83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43779c], eax
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x4377a4], eax
test eax, eax
je 0x409246
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b83
pop ecx
mov dword [0x4377a0], eax
mov eax, dword [0x4377a0]
cmp eax, ebx
je 0x40929e
cmp dword [0x4377a4], ebx
je 0x40929e
push eax
call fcn.00404bfe
push dword [0x4377a4]
mov esi, eax
call fcn.00404bfe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40929e
test edi, edi
je 0x40929e
call esi
test eax, eax
je 0x409295
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409295
test byte [ebp - 0xc], 1
jne 0x40929e
or dword [ebp + 0x10], 0x200000
jmp 0x4092d7
mov eax, dword [0x437798]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4092d7
mov eax, dword [0x43779c]
cmp eax, ebx
je 0x4092d7
push eax
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437794]
call fcn.00404bfe
pop ecx
test eax, eax
je 0x4092f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b010
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x2c1501c]
sub esp, 0x1c
push ebx
mov ebx, dword [0x2c14e68]
push esi
mov esi, dword [0x435f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b040
push str.toxoporeh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c1501c]
mov dword [0x4378f4], esi
cmp eax, 0x114e
jne 0x40b06e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
lea eax, [esp + 0xc]
push eax
push str.liyezejozonoduhu
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c1501c]
cmp eax, 0x2f
jne 0x40b08b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
call fcn.0040af50
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x404cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movss xmm0, dword [0x45834c]
movss dword [0x462504], xmm0
mov eax, dword [0x463ee4]
push eax
call fcn.00413f50
add esp, 4
push 1
call fcn.00427b80
pop ebp
ret

Function at 0x40e5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
je 0x40e5f4
movss xmm0, dword [0x462358]
cvtss2sd xmm0, xmm0
movsd xmm1, qword [0x462230]
addsd xmm1, xmm0
movsx ecx, word [0x4622ac]
cvtsi2sd xmm0, ecx
addsd xmm0, xmm1
cvttsd2si edx, xmm0
mov word [0x4622ac], dx
movsd xmm0, qword [0x462230]
subsd xmm0, qword [0x457c00]
movsd qword [0x462230], xmm0
xor eax, eax
je 0x40e62e
movsx ecx, word [0x462094]
mov edx, 0xbada5f08
sub edx, ecx
cvtsi2ss xmm0, edx
movss xmm1, dword [0x46231c]
addss xmm1, xmm0
movss dword [0x46231c], xmm1
mov ax, word [0x462094]
add ax, 1
mov word [0x462094], ax
movsd xmm0, qword [0x462590]
subsd xmm0, qword [0x457c00]
movsd qword [0x462590], xmm0
movss xmm0, dword [0x46229c]
cvtss2sd xmm0, xmm0
addsd xmm0, qword [0x4622c8]
subsd xmm0, qword [0x462590]
mov ecx, dword [0x46218c]
cvtsi2sd xmm1, ecx
mulsd xmm1, xmm0
cvttsd2si edx, xmm1
mov dword [0x46218c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [0x4623ec]
sub ecx, 1
mov dword [0x4623ec], ecx
mov edx, dword [0x4623ec]
mov dword [0x462160], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x40e6b8
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
je 0x40e79f
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
xor ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp - 4]
shl ecx, 0x1f
or eax, ecx
mov dword [ebp - 4], eax
mov dx, word [0x462074]
sub dx, 1
mov word [0x462074], dx
movsx eax, word [0x462074]
sub eax, dword [0x462528]
add eax, 0x5a8cba71
cvtsi2ss xmm0, eax
movss xmm1, dword [0x46211c]
subss xmm1, xmm0
movss dword [0x46211c], xmm1
mov ecx, dword [0x462528]
add ecx, 1
mov dword [0x462528], ecx
mov edx, 1
shl edx, 0
mov eax, 1
imul ecx, eax, 0
movzx eax, byte [ebp + ecx - 4]
movzx ecx, byte [ebp + edx - 4]
add ecx, eax
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 4], cl
mov eax, 1
imul ecx, eax, 0
mov edx, 1
shl edx, 0
movzx eax, byte [ebp + edx - 4]
movzx ecx, byte [ebp + ecx - 4]
add ecx, eax
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 4], cl
movsx ecx, word [0x462424]
cvtsi2sd xmm0, ecx
addsd xmm0, qword [0x462408]
cvttsd2si edx, xmm0
mov word [0x462424], dx
jmp 0x40e6af
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41f4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movsx eax, word [0x462468]
cvtsi2sd xmm0, eax
subsd xmm0, qword [0x4622d0]
cvttsd2si ecx, xmm0
mov word [0x462468], cx
movsd xmm0, qword [0x4622d0]
addsd xmm0, qword [0x457c00]
movsd qword [0x4622d0], xmm0
cmp dword [0x4646f4], 0
jne 0x41f50f
call fcn.0041fc70
mov dword [0x4646f4], eax
push 3
push 0x2b98
call fcn.0041f610
add esp, 8
mov dword [ebp - 8], eax
mov dword [0x4620d4], 0x17037af0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00428417
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
push 3
call fcn.00415140
add esp, 8
mov dword [0x462528], 0x5f223b6f
cmp dword [ebp - 4], 0
jne 0x41f5a6
push 0x3e8
call dword [0x464504]
push 3
push 0x2b98
call fcn.0041f610
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [0x462020]
mov dword [0x46238c], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00428417
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
push 3
call fcn.00415140
add esp, 8
cmp dword [ebp - 4], 0
je 0x41f5cd
mov eax, dword [ebp - 4]
push eax
push 1
push 4
push 0x4646f4
call fcn.004285ca
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.004280ec
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41fb10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 0x3b5f
mov word [0x4624fc], ax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0
movss xmm0, dword [0x462068]
cvtss2sd xmm0, xmm0
movsd xmm1, qword [0x462278]
subsd xmm1, xmm0
movss xmm0, dword [0x46253c]
cvtss2sd xmm0, xmm0
addsd xmm1, xmm0
movss xmm0, dword [0x462138]
cvtss2sd xmm0, xmm0
mulsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
movss dword [0x462138], xmm0
movss xmm0, dword [0x46253c]
addss xmm0, dword [0x457bf8]
movss dword [0x46253c], xmm0
movss xmm0, dword [0x462068]
addss xmm0, dword [0x457bf8]
movss dword [0x462068], xmm0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 8], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 8], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 8], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx + 8], 0x10325476
mov ecx, 0xb9973a6e
sub ecx, dword [0x4624a4]
cmp ecx, 0xa257d868
jge 0x41fc43
mov edx, dword [0x46218c]
cvtsi2sd xmm0, edx
addsd xmm0, qword [0x4624b0]
cvttsd2si eax, xmm0
mov word [0x462170], ax
mov ecx, dword [0x46218c]
add ecx, 1
mov dword [0x46218c], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43ba02
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4631b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042df1c
mov dword [ebp - 0x14], eax
cmp dword [0x465470], esi
jne 0x43baf5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43ba82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43bbd5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43bbd5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43bbd5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x465470], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x465474], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x465478], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465480], eax
test eax, eax
je 0x43baf2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46547c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43bb1a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43bb0d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43bb2f
push 4
pop eax
jmp 0x43bbd7
cmp dword [ebp - 0x14], esi
je 0x43bb2f
push dword [0x465470]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43bb14
mov eax, dword [0x46547c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43bb8d
cmp dword [0x465480], edi
je 0x43bb8d
push eax
call ebx
push dword [0x465480]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43bb8d
test eax, eax
je 0x43bb8d
call ecx
test eax, eax
je 0x43bb82
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43bb82
test byte [ebp - 8], 1
jne 0x43bb8d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43bbbd
mov eax, dword [0x465474]
cmp eax, edi
je 0x43bbba
push eax
call ebx
test eax, eax
je 0x43bbba
call eax
mov esi, eax
test esi, esi
je 0x43bbba
mov eax, dword [0x465478]
cmp eax, edi
je 0x43bbba
push eax
call ebx
test eax, eax
je 0x43bbba
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x465470]
call ebx
test eax, eax
je 0x43bbd5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43bbd7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c92d
mov esp, ebp
pop ebp
ret
Function at 0x10002915
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10002924
pop dword [ebp - 0x40]
mov eax, 0x659df2e2
sub eax, 0x559dc9be
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x39d4b
push 0
mov eax, 0x5fb2f3e8
add eax, 0xb04dfcec
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4a93
mov esi, eax
mov edx, 0x1001c400
add edx, dword [ebp - 0x40]
mov edi, 0xbace3c39
mov ebx, dword [edx]
add dword [ebp - 0xc], edx
xor ebx, edi
xor dword [ebp - 0x38], 0xd90089f
mov dword [esi], ebx
add dword [ebp - 0x1c], 0xc981d083
add esi, 4
add edx, 0xf63423aa
sub edx, 0xf63423a6
loop 0x10002971
add eax, 0x3b7b2ec5
sub eax, 0x3b7a11a6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe2634c54
add ecx, 0x2d9cb3ac
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x429552a9
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x505742b6
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219