joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xed7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xed71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xed707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xed706a
add dl, dl
jne 0xed7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xed70dc
xor eax, eax
add dl, dl
jne 0xed7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xed717d
add dl, dl
jne 0xed70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xed70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xed70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xed70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xed70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xed7075
mov eax, 1
add dl, dl
jne 0xed70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xed70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xed70e1
sub eax, ebx
mov ebx, 1
jne 0xed7128
mov ecx, 1
add dl, dl
jne 0xed710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xed7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xed7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xed7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xed713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xed714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xed7136
cmp eax, 0x7d00
jae 0xed716d
cmp eax, 0x500
jb 0xed7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xed7075
cmp eax, 0x7f
ja 0xed7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xed7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xed719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xed7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41cd60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push 0x80000002
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41cdbb
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Speaker_Configuration
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
mov ecx, esi
push eax
call fcn.0041cdd0
pop esi
add esp, 0x10
ret

Function at 0x41cf80
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
mov esi, ecx
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41cfce
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push eax
push str.Speaker_Configuration
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41cfc3
mov edi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 8]
test eax, eax
je 0x41cfe9
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41cfe9
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0041d010
test edi, edi
pop edi
pop esi
je 0x41d005
mov edx, dword [0x42c1e8]
push 0
push 0
push edx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4077d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x44
push ebx
push esi
mov esi, dword [esp + 0x50]
push edi
cmp word [esi + 6], 0
push ebp
jbe 0x4078fa
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x78]
push eax
push ecx
push esi
call fcn.00407780
mov ebp, dword [esp + 0x68]
add esp, 0xc
push ebp
call fcn.00411d90
mov bl, byte [esp + 0x74]
add esp, 4
test bl, 0x20
je 0x407876
lea edi, [esp + 0x20]
xor eax, eax
mov ecx, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 0x18]
mov dword [esp + 0x2c], eax
mov ebx, dword [ecx + 0x1c]
mov dword [esp + 0x30], edx
mov eax, dword [ecx + 0x30]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x60]
mov dword [esp + 0x34], ebx
push ecx
mov dword [esp + 0x4c], eax
push edx
lea eax, [esp + 0x18]
xor ecx, ecx
mov cx, word [esi + 6]
push eax
mov eax, dword [esp + 0x80]
and eax, 0xffff
shl eax, 0x10
or eax, ecx
push eax
push ebp
call fcn.004aab50
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44
ret
mov edi, dword [esp + 0x74]
xor eax, eax
mov ax, word [esi + 6]
and edi, 0xffff
shl edi, 0x10
or eax, edi
push eax
call fcn.004ac870
mov dword [esp + 0x24], eax
add esp, 4
test bl, 8
movsx ecx, word [esp + 0x74]
mov dword [esp + 0x24], ecx
je 0x4078c5
lea eax, [esp + 0x60]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push ecx
push eax
push edx
push ebp
call fcn.004aac10
add esp, 0x14
jmp 0x4078e7
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x60]
lea edx, [esp + 0x10]
push ecx
mov ebx, dword [esp + 0x24]
push eax
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push ebx
push ebp
call fcn.004aaa70
add esp, 0x18
push 0
xor eax, eax
mov ax, word [esi + 6]
or eax, edi
push eax
call fcn.004acd20
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x40cda0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [esp + 0x28]
mov eax, dword [edi + 6]
test eax, eax
je 0x40cdd2
lea ecx, [esp + 0xc]
mov ebx, dword [sym.imp.GDI32.dll_GetObjectA]
push ecx
push 0x18
push eax
call ebx
test eax, eax
je 0x40cdd8
mov esi, dword [esp + 0x14]
imul esi, dword [esp + 0x18]
jmp 0x40cdd8
mov ebx, dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [edi + 0xa]
test eax, eax
je 0x40cdf8
lea ecx, [esp + 0xc]
push ecx
push 0x18
push eax
call ebx
test eax, eax
je 0x40cdf8
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x18]
add esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x40ec90
Capabilities:
Read clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x40eca7
xor eax, eax
pop esi
ret
cmp esi, 2
pop esi
ret
Function at 0x40f0c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
push esi
mov si, word [esp + 0x34]
push edi
movsx eax, si
shl eax, 6
push ebp
mov edx, dword [0x508488]
mov dword [esp + 0x10], eax
movzx eax, si
shl eax, 0x10
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [edx + ecx + 0x10]
xor ecx, ecx
mov edx, dword [eax]
mov cx, word [edx + 0xe]
or ecx, dword [esp + 0x14]
push ecx
call fcn.004ac870
add esp, 4
test eax, eax
jne 0x40f111
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov ecx, dword [eax]
test ecx, ecx
je 0x40f22b
cmp dword [ecx + 2], 0
jne 0x40f22b
test byte [ecx + 1], 0x80
je 0x40f22b
mov edi, dword [ecx + 6]
inc edi
push edi
push eax
lea eax, [esp + 0x20]
push 0
push 0x200
push eax
mov ebx, 1
call fcn.004dae20
lea eax, [esp + 0x2c]
add esp, 0x14
push eax
call fcn.004db820
add esp, 4
cmp edi, ebx
jbe 0x40f187
inc ebx
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.004db880
add esp, 8
mov ebp, eax
test byte [eax], 1
je 0x40f183
push ebp
push esi
call fcn.0040f390
mov word [ebp + 2], ax
add esp, 8
cmp edi, ebx
ja 0x40f15f
mov ebp, dword [esp + 0x40]
push ebp
call fcn.004db820
add esp, 4
mov ebx, 1
push ebp
call fcn.004dae10
add esp, 4
mov edi, eax
cmp edi, ebx
jbe 0x40f1e4
inc ebx
push ebx
push ebp
call fcn.004db880
add esp, 8
mov esi, eax
test esi, esi
je 0x40f1e4
movsx eax, word [esi + 4]
inc eax
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004db880
add esp, 8
test eax, eax
je 0x40f1da
mov ax, word [eax + 2]
mov word [esi + 4], ax
jmp 0x40f1e0
mov word [esi + 4], 0
cmp edi, ebx
ja 0x40f1a8
push ebp
call fcn.004db850
lea eax, [esp + 0x1c]
add esp, 4
push eax
call fcn.004db850
mov ecx, dword [esp + 0x14]
add esp, 4
mov eax, dword [0x508488]
push 0
mov edx, dword [eax + ecx + 0x10]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 0xe]
or ecx, dword [esp + 0x18]
push ecx
call fcn.004acd20
add esp, 8
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov ecx, dword [esp + 0x10]
push 0
mov eax, dword [0x508488]
mov edx, dword [eax + ecx + 0x10]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 0xe]
or ecx, dword [esp + 0x18]
push ecx
call fcn.004acd20
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x412150
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
mov esi, dword [esp + 8]
mov ax, word [esi + 2]
lea edx, [eax*4 + 4]
xor eax, eax
mov ecx, edx
dec edx
test ecx, ecx
je 0x412186
mov ecx, eax
inc esi
shl ecx, 0x18
shr eax, 8
or ecx, eax
xor eax, eax
mov al, byte [esi - 1]
xor ecx, eax
mov eax, ecx
mov ecx, edx
dec edx
test ecx, ecx
jne 0x41216b
pop esi
ret
Function at 0x412230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
xor esi, esi
call fcn.004a44a0
cmp eax, 8
mov edi, eax
jl 0x412274
xor eax, eax
mov ax, word [0x50e1e8]
shl eax, 0x10
mov al, 1
push eax
call fcn.0049dc60
add esp, 4
test eax, eax
je 0x412274
push 0x24
xor eax, eax
mov ax, word [0x50e1e8]
shl eax, 0x10
mov al, 1
push eax
call fcn.0049a210
add esp, 8
mov esi, eax
test esi, esi
jne 0x4122e2
mov eax, 0x100
cmp edi, 8
jge 0x412287
mov eax, 0x10
push 0x108
mov ecx, dword [0x50e328]
movzx eax, ax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4122e2
push eax
mov eax, dword [0x50e328]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4122e2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4122db
add eax, 0x14
xor ecx, ecx
mov cx, word [eax + 2]
shl ecx, 2
add ecx, 5
dec ecx
push ecx
push eax
call fcn.00488d50
add esp, 8
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
ret
Function at 0x417180
Capabilities:
Capture screenshot

Disassembly:
sub esp, 4
mov dword [esp], 0
push ebx
push esi
push edi
push ebp
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x41728f
mov esi, dword [esp + 0x18]
push 0
mov eax, dword [esp + 0x20]
push esi
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov ebx, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test ebx, ebx
je 0x41728f
push 0
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call ebp
mov edi, eax
test edi, edi
je 0x417288
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
inc eax
push eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x10], eax
test eax, eax
je 0x417281
push 0
call ebp
mov ebp, eax
test ebp, ebp
je 0x417281
push ebx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
push 0x2000000
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x2ffffff
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
cmp dword [esp + 0x20], 1
sbb eax, eax
mov ecx, dword [esi + 8]
and eax, 0x990018
mov edx, dword [esi + 4]
add eax, 0x330008
push eax
push 0
push 0
push ebp
push ecx
push edx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4192a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4192cc
cmp dword [esp + 0xc], 1
mov ecx, 0
adc ecx, 0xffffffff
and ecx, 5
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x41f110
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
lea ecx, [esp + 6]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push ecx
push esi
call fcn.00424e90
mov cx, word [esp + 0x1e]
add esp, 0xc
cmp word [esp + 0x10], cx
je 0x41f1c5
mov eax, dword [0x50e324]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41f1c5
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x12]
push eax
push ecx
push esi
call fcn.00424be0
add esp, 0xc
mov edi, eax
test edi, edi
je 0x41f1bf
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
call ebx
push eax
call fcn.004c7680
add esp, 4
movzx esi, ax
push edi
call fcn.00489000
add esp, 4
add esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call ebp
push 2
push esi
push edi
call fcn.00488da0
add esp, 0xc
test eax, eax
je 0x41f1b0
push edi
call ebx
push esi
push eax
call fcn.004c75b0
add esp, 8
push edi
call ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x41f4e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, dword [esp + 0xa4]
push edi
mov ebx, dword [esp + 0x94]
push ebp
push esi
push ebx
call fcn.00424a10
mov dword [esp + 0x18], eax
add esp, 8
push esi
push ebx
call fcn.004249d0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xb0]
add esp, 8
lea eax, [ecx + eax + 0x10]
mov ecx, dword [esp + 0xa4]
push edx
mov dword [esp + 0x18], eax
push ecx
mov eax, dword [ebx + 0x56]
push eax
call fcn.00469f70
add esp, 0xc
add eax, 0x10
mov ebp, dword [ebx + 0x56]
mov dword [esp + 0x18], eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebx + 0x56], eax
test eax, eax
je 0x41f6bb
mov eax, dword [esp + 0x14]
push 0
mov ecx, dword [esp + 0x1c]
push 1
push 1
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x41f6b4
push eax
mov ecx, dword [ebx + 0x56]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dx, word [ebx + 0x86]
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], eax
push ecx
mov ax, word [esi + 6]
push edx
push eax
call fcn.004d5760
lea ecx, [esp + 0x30]
lea eax, [esp + 0x4c]
add esp, 0xc
mov edx, dword [ebx + 0x56]
push ecx
push edx
push eax
call fcn.004698f0
lea edi, [esp + 0x68]
add esp, 0xc
mov esi, eax
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x5c]
lea edi, [esp + 0x78]
mov ecx, 7
push 0xff0062
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
mov eax, dword [ebx + 0x56]
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
movsx ecx, word [esp + 0xa8]
mov eax, dword [esp + 0xa4]
push ecx
mov edx, dword [esp + 0x14]
push eax
push edx
mov ecx, dword [ebx + 0x56]
push 0
push ecx
call dword [sym.imp.GDI32.dll_TextOutA]
mov esi, dword [esp + 0xa0]
push 0x2000000
sub esi, dword [esp + 0x14]
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x2ffffff
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x990066
push 0
push 0
mov eax, dword [ebx + 0x56]
mov ecx, dword [esp + 0x20]
push eax
mov edx, dword [esp + 0x28]
push ecx
mov eax, dword [esp + 0xb0]
push edx
push esi
push eax
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 0x78]
mov eax, dword [ebx + 0x56]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
call fcn.004698f0
lea ecx, [esp + 0x30]
add esp, 0xc
push ecx
call fcn.004698c0
mov ecx, dword [esp + 0x24]
add esp, 4
mov edx, dword [ebx + 0x56]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebx + 0x56]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, 1
mov dword [ebx + 0x56], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
mov dword [ebx + 0x56], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
Function at 0x437630
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00461b20
mov si, word [esp + 0x24]
test si, si
jne 0x43765d
mov edi, dword [esp + 0x28]
push edi
call fcn.0047c460
add esp, 4
test eax, eax
je 0x437666
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.0047c770
mov edi, dword [esp + 0x28]
call fcn.004112a0
test edi, edi
je 0x437679
push 0
call fcn.00437740
add esp, 4
cmp si, 2
je 0x437691
cmp si, 3
je 0x437691
call fcn.004ac6c0
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov eax, dword [0x50e324]
xor edi, edi
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4376c1
call ebx
mov edi, eax
test edi, edi
jne 0x43770d
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x437703
lea eax, [esp + 0x10]
push 0
mov ecx, dword [esp + 0x10]
push 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], 2
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call ebx
test eax, eax
jne 0x437731
test edi, edi
je 0x437712
cmp edi, 0x78
jne 0x437731
cmp si, 3
push 0
jne 0x437729
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x462f50
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x38
mov ecx, dword [0x50e328]
lea eax, [esp + 0x10]
push esi
push eax
push str.APW_COVER
push ecx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
jne 0x462fc9
xor esi, esi
mov eax, dword [0x50e328]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
push 0x7f00
mov dword [esp + 0x28], eax
push esi
mov dword [esp + 0x20], 0x462e60
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
push ecx
mov dword [esp + 0x3c], str.APW_COVER
mov dword [esp + 0x38], esi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x462fc9
xor eax, eax
pop esi
add esp, 0x38
ret
lea eax, [esp + 4]
mov ecx, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
mov ecx, dword [0x50e328]
mov eax, dword [esp + 0x14]
push ecx
sub eax, dword [esp + 0x10]
push 0
push 0
inc eax
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
sub eax, dword [esp + 0x18]
inc eax
push eax
push ecx
push edx
push 0x80000000
push 0x5050cc
push str.APW_COVER
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 8
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop esi
add esp, 0x38
ret
Function at 0x464140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x830
push ebx
push esi
push edi
push ebp
xor ebp, ebp
cmp dword [esp + 0x85c], ebp
je 0x46415c
mov eax, 0xffffff
jmp 0x464163
mov ebp, 0xffffff
xor eax, eax
cmp dword [esp + 0x854], 0
mov dword [esp + 0x14], ebp
je 0x464189
lea ecx, [eax - 0xffffff]
cmp ecx, 1
sbb edx, edx
and dx, 0xff
mov bx, dx
xor bl, 0xff
jmp 0x464193
mov dx, word [esp + 0x18]
mov bx, word [esp + 0x18]
mov cx, word [esp + 0x850]
lea edi, [esp + 0x440]
shl cx, 2
mov esi, dword [esp + 0x844]
mov word [esp + 0x12], cx
mov ecx, dword [esp + 0x12]
and ecx, 0xffff
mov dword [esp + 0x18], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x84c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x860], 0
je 0x464295
lea esi, [esp + 0x440]
lea edi, [esp + 0x40]
cmp dword [esp + 0x854], 0
je 0x464250
cmp word [esp + 0x850], 0
je 0x4642bd
mov ax, word [esp + 0x850]
mov word [esp + 0x14], ax
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 1]
mov cl, byte [esi + 2]
shl eax, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [esi]
shl ecx, 0x10
mov word [edi], dx
or eax, ecx
cmp eax, ebp
je 0x464241
mov word [edi], bx
add edi, 2
add esi, 4
dec word [esp + 0x14]
jne 0x46421f
jmp 0x4642bd
cmp word [esp + 0x850], 0
je 0x4642bd
mov bx, word [esp + 0x850]
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 1]
mov dl, byte [esi + 2]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
or ecx, edx
cmp ecx, ebp
jne 0x464283
mov dword [edi], eax
jmp 0x464289
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add edi, 4
add esi, 4
dec bx
jne 0x464263
jmp 0x4642bd
cmp dword [esp + 0x854], 0
je 0x4642ae
mov word [esp + 0x40], dx
mov word [esp + 0x23e], bx
jmp 0x4642bd
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], eax
mov dword [esp + 0x43c], ecx
cmp dword [esp + 0x854], 0
je 0x4642d8
mov cx, word [esp + 0x850]
lea eax, [ecx*2 + 0x28]
jmp 0x4642e1
mov ax, word [esp + 0x12]
add ax, 0x28
lea esi, [esp + 0x18]
mov edi, dword [esp + 0x848]
movzx eax, ax
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x830
ret