joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467b50
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8960
call fcn.00488480
mov al, byte [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x896c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x8974]
cmp al, 0x41
je 0x467b77
cmp al, 0x61
jne 0x467bc8
cmp byte [ecx + 1], bl
jne 0x467bc8
cmp byte [edi], bl
jne 0x467bc8
cmp byte [esi], bl
jne 0x467bc8
cmp byte [edx], bl
jne 0x467bc8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x467ba9
cmp byte [ebp + 0xc2], bl
jne 0x467ba9
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x467ba9
xor esi, esi
cmp byte [esp + 0x897c], bl
je 0x467bbc
cmp esi, ebx
je 0x467bbc
mov dword [ebp + 0xa0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8960
ret
cmp al, bl
jne 0x467be9
cmp byte [edi], bl
jne 0x467be9
cmp byte [esi], bl
jne 0x467be9
cmp byte [edx], bl
jne 0x467be9
mov eax, ebp
call fcn.00467d40
pop esi
pop ebp
pop ebx
add esp, 0x8960
ret
push edx
push esi
push edi
push ecx
push ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x830], 0x49588a
mov byte [esp + 0x84c], bl
mov dword [esp + 0x850], ebx
mov dword [esp + 0x854], ebx
mov dword [esp + 0x858], ebx
mov dword [esp + 0x85c], ebx
mov dword [esp + 0x860], ebx
mov dword [esp + 0x864], ebx
mov dword [esp + 0x870], ebx
mov dword [esp + 0x874], ebx
call fcn.00468780
test eax, eax
je 0x467cfa
test byte [esp + 0x10], 2
mov al, byte [esp + 0x8978]
mov ecx, dword [esp + 0x8980]
mov edx, dword [esp + 0x8984]
mov byte [esp + 0x838], al
mov dword [esp + 0x848], ecx
mov dword [esp + 0x84c], edx
je 0x467d06
mov eax, dword [esp + 0x82c]
cmp eax, 0xffff
je 0x467cd3
push eax
call dword [sym.imp.USER32.dll_IsWindmw]
test eax, eax
je 0x467cfa
cmp byte [ebp + 0xc2], bl
jne 0x467ccc
mov eax, dword [esp + 0x82c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x467ccc
mov ecx, dword [esp + 0x82c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x467cfa
mov eax, dword [esp + 0x82c]
cmp dword [esp + 0x860], eax
je 0x467cec
lea esi, [esp + 0x10]
mov dword [esp + 0x860], eax
call fcn.00468bd0
push ebx
lea ecx, [esp + 0x14]
call fcn.00468c50
test eax, eax
jne 0x467d16
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8960
ret
lea edx, [esp + 0x10]
push edx
push 0x467db0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x840]
cmp byte [esp + 0x897c], bl
je 0x467d30
cmp eax, ebx
je 0x467d30
mov dword [ebp + 0xa0], eax
pop esi
pop ebp
pop ebx
add esp, 0x8960
ret
Function at 0x467f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8014
call fcn.00488480
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x467f50
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004668b0
mov eax, 0x4916f4
jmp 0x467f55
mov eax, 0x491918
mov ecx, dword [0x4a13a4]
mov edi, 1
push edi
push 0
push 0xffffffffffffffff
push eax
call fcn.004668b0
cmp dword [ebp + 0x14], 0
jne 0x467f78
mov dword [ebp + 0x14], 0x1f4
cmp dword [ebp + 0x18], edi
jge 0x467f84
mov dword [ebp + 0x18], 0x32
cmp dword [ebp + 0xc], edi
jge 0x467f8c
mov dword [ebp + 0xc], edi
test esi, esi
je 0x468128
mov ebx, dword [sym.imp.USER32.dll_SendMessageTi_aoutA]
lea eax, [esp + 0x1c]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x468128
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esp + 0x1c]
jg 0x468128
push 0x8000
mov ecx, esi
lea edi, [esp + 0x18]
call fcn.004653f0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x468128
mov edi, dword [ebp + 0xc]
dec edi
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
lea esp, [esp]
lea edx, [esp + 0xc]
push edx
push 0x7d0
push 2
push 0
push edi
push 0x403
push esi
call ebx
test eax, eax
je 0x46807b
mov eax, 0x7fff
cmp word [esp + 0xc], ax
ja 0x4680be
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x7d0
push 2
push edx
push edi
push 0x402
push esi
call ebx
test eax, eax
je 0x46807b
movzx eax, word [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0
inc eax
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4680b9
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x20]
call fcn.004674b0
test al, al
jne 0x4680db
cmp dword [ebp + 8], 0
jne 0x4680c4
push esi
call dword [sym.imp.USER32.dll_IsWindmw]
test eax, eax
je 0x468109
cmp dword [ebp + 0x14], 0
jl 0x4680a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x18]
add ecx, dword [ebp + 0x14]
sub ecx, eax
cmp ecx, 5
jle 0x4680f3
mov eax, dword [ebp + 0x18]
push 1
push eax
call fcn.00401340
add esp, 8
jmp 0x468000
mov byte [esp + 0x20], 0
cmp dword [ebp + 8], 0
je 0x468109
push 1
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004668b0
mov edi, eax
jmp 0x46810e
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
jmp 0x4680be
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
call fcn.004668b0
mov edi, 1
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push edx
call fcn.00465470
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bc60
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
mov eax, dword [esp + 0xd0]
mov eax, dword [eax]
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0x1c], eax
shr eax, 9
and eax, 1
mov dword [esp + 0x9c], eax
xor eax, 1
push ebx
mov ebx, dword [ecx]
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0xa8], eax
mov eax, 0xfffffffe
push ebp
xor edx, edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
push esi
push edi
mov edi, dword [ecx]
xor ebp, ebp
xor ecx, ecx
and eax, 1
mov esi, ebx
shl eax, 8
mov dword [esp + 0x44], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0xa4], edx
mov dword [esp + 0x64], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0xb8], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0xa0], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edx
mov dword [esp + 0x98], eax

Function at 0x46f290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
jmp 0x46f2b0
movzx eax, byte [edi]
movzx eax, byte [eax + 0x4968b0]
movzx edx, byte [eax + edi]
add eax, edi
lea ecx, [edx - 4]
cmp ecx, 0x64
ja 0x46f306
jmp 0x46f2d0
movzx ecx, byte [ecx + 0x46f3bc]
jmp dword [ecx*4 + 0x46f3ac]
movzx ecx, byte [eax]
cmp ecx, 0x5e
je 0x46f377
cmp ecx, 0x5f
jne 0x46f332
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 4]
shl ecx, 8
or ecx, edx
mov edx, 1
cmp ecx, 0x20
jge 0x46f32c
shl edx, cl
push ebp
or edx, ebx
push edx
jmp 0x46f379
cmp ecx, 0x58
je 0x46f377
cmp ecx, 0x5d
je 0x46f377
cmp ecx, 0x60
je 0x46f377
cmp ecx, 0x39
je 0x46f36b
cmp ecx, 0x3a
je 0x46f36b
cmp ecx, 0x42
je 0x46f36b
cmp ecx, 1
je 0x46f387
cmp ecx, 2
je 0x46f387
test byte [esi], 2
jne 0x46f364
cmp ecx, 0x1a
je 0x46f387
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp byte [eax + 1], 0xd
jne 0x46f364
test ebp, ebx
jne 0x46f364
jmp 0x46f387
push ebp
push ebx
push esi
push eax
call fcn.0046f290
add esp, 0x10
test eax, eax
je 0x46f364
movzx eax, byte [edi + 1]
movzx ecx, byte [edi + 2]
shl eax, 8
or eax, ecx
add edi, eax
cmp byte [edi], 0x54
je 0x46f2b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x46f6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
or edi, 0xffffffff
movzx edx, byte [ebp + 3]
lea eax, [ebp + 3]
lea ecx, [edx - 4]
cmp ecx, 0x64
ja case.0x46f6c9.6
movzx ecx, byte [ecx + 0x46f7b0]
jmp dword [ecx*4 + 0x46f7a0]
movzx ecx, byte [eax + 1]
mov edx, dword [esi]
xor edx, ecx
test dl, 1
je 0x46f6df
mov dword [esi], ecx
add eax, 2
jmp 0x46f70f
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
add eax, ecx
cmp byte [eax], 0x54
je case.0x46f6c9.89
movzx ecx, byte [eax]
movzx edx, byte [ecx + 0x4968b0]
add eax, edx
jmp 0x46f70f
movzx ecx, byte [edx + 0x4968b0]
add eax, ecx
movzx edx, byte [eax]
lea ecx, [edx - 4]
cmp ecx, 0x64
jbe 0x46f6c2
movzx ecx, byte [eax]
lea edx, [ecx - 0x1c]
cmp edx, 0x44
ja case.0x46f72c.30
movzx edx, byte [edx + 0x46f828]
jmp dword [edx*4 + 0x46f818]
xor edx, edx
cmp ecx, 0x58
sete dl
push edx
push esi
push eax
call fcn.0046f6a0
add esp, 0xc
test eax, eax
js case.0x46f72c.30
test edi, edi
jns 0x46f772
mov edi, eax
jmp 0x46f776
add eax, 2
test ebx, ebx
je case.0x46f72c.30
test edi, edi
jns 0x46f76e
test byte [esi], 1
movzx edi, byte [eax + 1]
je 0x46f776
or edi, 0x100
jmp 0x46f776
movzx eax, byte [eax + 1]
cmp edi, eax
jne case.0x46f72c.30
movzx ecx, byte [ebp + 1]
movzx edx, byte [ebp + 2]
shl ecx, 8
or ecx, edx
add ebp, ecx
cmp byte [ebp], 0x54
je 0x46f6b3
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x484a2a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x484a46
xor eax, eax
jmp 0x484abd
cmp word [ebx], si
je 0x484a5b
add eax, 2
cmp word [eax], si
rol byte [edx], 0x66
cmp dword [eax], esi
jne 0x484a4c
add eax, 2
cmp word [eax], si
jne 0x484a4b
push edi
mov edi, dword [0x8d108]
push esi
push esi
push esi
sub eax, ebx
push esi
sar eax, 1
inc eax
push eax
push ebx
push esi
push esi
mov dword [ebp - 0xc], eax
inc edi
mov dword [ebp + 0x78], eax
cmp eax, esi
je 0x484ab3
push eax
call fcn.0047e806
pop ecx
mov dword [ebp - 4], eax
cmp eax, esi
je 0x484ab3
push esi
push esi
push dword [ebp - 8]
push eax
push ebp
hlt
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esp
pop ebx
retf

Function at 0x485524
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49cdb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047c542
and dword [ebp - 0x14], 0
cmp dword [0x49f260], 0
mov dword [ebp - 0x18], eax
jne 0x4855d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48567f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48567f
mov esi, dword [fcn.004759f0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49f260], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49f264], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49f268], eax
call edi
push eax
call esi
mov dword [0x49f270], eax
test eax, eax
je 0x4855d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49f26c], eax
mov eax, dword [0x49f26c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004759f4]
cmp eax, ecx
je 0x485630
cmp dword [0x49f270], ecx
je 0x485630
push eax
call esi
push dword [0x49f270]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x485630
test ebx, ebx
je 0x485630
call edi
test eax, eax
je 0x485627
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x485627
test byte [ebp - 8], 1
jne 0x485630
or dword [ebp + 0x10], 0x200000
jmp 0x485663
mov eax, dword [0x49f264]
cmp eax, dword [ebp - 0x18]
je 0x485663
push eax
call esi
test eax, eax
je 0x485663
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x485663
mov eax, dword [0x49f268]
cmp eax, dword [ebp - 0x18]
je 0x485663
push eax
call esi
test eax, eax
je 0x485663
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49f260]
call esi
test eax, eax
je 0x48567f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x485681
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f404
leave
ret
Function at 0x40306c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x869088], 0x594
push edi
mov dword [ebp - 8], eax
jne 0x4030a2
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x449ef8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x449efc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.00403065
mov eax, dword [0x449f00]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x449f04]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x869088], 0xc
mov dword [ebp - 4], eax
jne 0x403130
push esi
lea eax, [ebp - 0x830]
push eax
push 0x4024f0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x869088]
cmp eax, 0xfa9
jne 0x40314c
mov dword [0x868624], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403159
mov dword [0x867fd4], esi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ebx
shr edx, cl
lea eax, [edi + ebx]
mov dword [ebp - 0x14], eax
mov dword [0x868620], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x869088], 0xc
jne 0x4031af
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
add edi, edx
add eax, dword [ebp - 0x24]
xor eax, edi
xor dword [ebp - 4], eax
sub ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
call fcn.0040305e
dec dword [ebp - 0x18]
jne 0x4030db
cmp dword [0x869088], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], ebx
jne 0x403206
push esi
push 0x402588
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x869088]
mov ecx, dword [0x867fd8]
sub esp, 0x400
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4032b3
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x869088], 0x959
jne 0x4032a5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
call fcn.0040306c
add edi, 8
dec ebx
jne 0x403238
pop edi
pop ebx
pop esi
leave
ret
Function at 0x404370
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4490c8]
jne 0x40437a
repz ret
jmp fcn.00406ade

Function at 0x4066ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043f1
and dword [ebp - 4], 0
cmp dword [0x44aa10], 0
mov ebx, eax
jne 0x4067b0
push 0x4019c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406861
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019bc
push edi
call esi
test eax, eax
je 0x406861
push eax
call fcn.0040437f
mov dword [esp], 0x4019ac
push edi
mov dword [0x44aa10], eax
call esi
push eax
call fcn.0040437f
mov dword [esp], 0x401998
push edi
mov dword [0x44aa14], eax
call esi
push eax
call fcn.0040437f
mov dword [esp], 0x40197c
push edi
mov dword [0x44aa18], eax
call esi
push eax
call fcn.0040437f
pop ecx
mov dword [0x44aa20], eax
test eax, eax
je 0x4067b0
push 0x401964
push edi
call esi
push eax
call fcn.0040437f
pop ecx
mov dword [0x44aa1c], eax
mov eax, dword [0x44aa1c]
cmp eax, ebx
je 0x406808
cmp dword [0x44aa20], ebx
je 0x406808
push eax
call fcn.004043fa
push dword [0x44aa20]
mov esi, eax
call fcn.004043fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406808
test edi, edi
je 0x406808
call esi
test eax, eax
je 0x4067ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4067ff
test byte [ebp - 0xc], 1
jne 0x406808
or dword [ebp + 0x10], 0x200000
jmp 0x406841
mov eax, dword [0x44aa14]
cmp eax, ebx
je 0x406841
push eax
call fcn.004043fa
pop ecx
test eax, eax
je 0x406841
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406841
mov eax, dword [0x44aa18]
cmp eax, ebx
je 0x406841
push eax
call fcn.004043fa
pop ecx
test eax, eax
je 0x406841
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44aa10]
call fcn.004043fa
pop ecx
test eax, eax
je 0x406861
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406863
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x868120]
mov ecx, dword [0x867074]
shr eax, 3
sub esp, 0x820
test eax, eax
jbe 0x4012f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x868120], 0x959
jne 0x4012d6
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push str.Yeda_defuhacurihe
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push 0
lea eax, [ebp - 0x820]
push eax
push 0
push str.Vekojadofoy_nari_xigajimasuha
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
push 0
push 0
push 0
push 0
push 0
push str.Joceterewi_dapubigemal
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov eax, dword [ebp - 4]
push eax
call fcn.00401020
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4480c8]
jne 0x40243a
repz ret
jmp fcn.004049fe

Function at 0x40462b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004024b1
and dword [ebp - 4], 0
cmp dword [0x449ab0], 0
mov ebx, eax
jne 0x4046dc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40478d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40478d
push eax
call fcn.0040243f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x449ab0], eax
call esi
push eax
call fcn.0040243f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x449ab4], eax
call esi
push eax
call fcn.0040243f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x449ab8], eax
call esi
push eax
call fcn.0040243f
pop ecx
mov dword [0x449ac0], eax
test eax, eax
je 0x4046dc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040243f
pop ecx
mov dword [0x449abc], eax
mov eax, dword [0x449abc]
cmp eax, ebx
je 0x404734
cmp dword [0x449ac0], ebx
je 0x404734
push eax
call fcn.004024ba
push dword [0x449ac0]
mov esi, eax
call fcn.004024ba
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404734
test edi, edi
je 0x404734
call esi
test eax, eax
je 0x40472b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40472b
test byte [ebp - 0xc], 1
jne 0x404734
or dword [ebp + 0x10], 0x200000
jmp 0x40476d
mov eax, dword [0x449ab4]
cmp eax, ebx
je 0x40476d
push eax
call fcn.004024ba
pop ecx
test eax, eax
je 0x40476d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40476d
mov eax, dword [0x449ab8]
cmp eax, ebx
je 0x40476d
push eax
call fcn.004024ba
pop ecx
test eax, eax
je 0x40476d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x449ab0]
call fcn.004024ba
pop ecx
test eax, eax
je 0x40478d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40478f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219