joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b340
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x42b357
add esp, 0xfffffff0
call fcn.00402f98
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004111dc
mov dl, 1
mov eax, dword [0x40bbf0]
call fcn.00402d34
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, dword [0x40bbf0]
call fcn.00402d34
mov dword [ebx + 0x88], eax
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x40], 0x80000018
mov dword [ebx + 0x58], 0x1f4
mov dword [ebx + 0x5c], 0x32
mov dword [ebx + 0x60], 0x9c4
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, dword [0x412b18]
call fcn.00419990
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x42b4b0
mov eax, dword [0x462a90]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00419d28
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42cb20
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x462a90]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a190
test eax, eax
je 0x42b438
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040751c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040a1b8
test eax, eax
je 0x42b44c
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00403a5c
mov eax, dword [0x4629a8]
cmp byte [eax], 0
jne 0x42b47d
mov eax, ebx
call fcn.0042b594
mov byte [ebx + 0x3d], 1
mov byte [ebx + 0x3e], 1
mov byte [ebx + 0x3f], 1
mov byte [ebx + 0x7e], 1
xor eax, eax
mov dword [ebx + 0x80], eax
cmp byte [ebp - 1], 0
je 0x42b4a5
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b7e8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4636b0]
cmp dword [eax + 0x24], 0
je 0x42b878
cmp dword [ebx + 0x74], 0
jne 0x42b875
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x42b77c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x70]
cmp dword [eax + 8], 0
je 0x42b875
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x42b844
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x70]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x42b875
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x70]
call fcn.0040cd9c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x42b850
inc dword [ebx + 0x74]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x42c160
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x84], 0
je 0x42c195
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403914
jmp 0x42c19f
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004038c8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42cd90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x42cdc8
mov eax, esi
call fcn.00420884
test al, al
je 0x42cdc8
mov eax, dword [ebx + 0x64]
call fcn.004206ec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42cdc8
push 0
mov eax, dword [ebx + 0x64]
call fcn.004206ec
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x42d718
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, ecx
dec edx
test edx, edx
jl 0x42d744
inc edx
xor ecx, ecx
mov bl, byte [eax]
xor bl, byte [esi + ecx]
mov edi, dword [eax]
shr edi, 8
and ebx, 0xff
xor edi, dword [ebx*4 + 0x452830]
mov dword [eax], edi
inc ecx
dec edx
jne 0x42d727
pop edi
pop esi
pop ebx
ret

Function at 0x42d748
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov byte [esp], al
mov bl, 2
cmp dword [0x452818], 1
jne 0x42d779
cmp dword [0x45281c], 2
jne 0x42d779
cmp dword [0x452820], 3
jne 0x42d779
mov bl, 3
jmp 0x42d868
push 0x104
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x462b40]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
jle 0x42d85c
cmp byte [esp], 0
je 0x42d7d4
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
cmp eax, dword [0x45281c]
je 0x42d7d4
mov bl, 1
jmp 0x42d854
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
je 0x42d854
push 0
push 0
push 0
push 4
push edi
call sub.kernel32.dll_MapViewOfFile
mov ebp, eax
test ebp, ebp
je 0x42d84e
mov dword [esp + 4], 0xfff00fff
mov edx, ebp
lea eax, [esp + 4]
mov ecx, dword [0x452818]
call fcn.0042d718
mov eax, dword [0x452818]
mov edx, eax
add edx, 0x24
mov ecx, dword [0x45281c]
sub ecx, edx
push ecx
lea edx, [ebp + eax + 0x24]
lea eax, [esp + 8]
pop ecx
call fcn.0042d718
mov eax, dword [esp + 4]
not eax
cmp eax, dword [0x452820]
jne 0x42d848
xor ebx, ebx
push ebp
call sub.kernel32.dll_UnmapViewOfFile
push edi
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x42d868
call sub.kernel32.dll_GetLastError_1
cmp eax, 5
jne 0x42d868
mov bl, 4
mov eax, ebx
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42e07c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
xor eax, eax
cmp esi, eax
jle 0x42e09e
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
jle 0x42e098
xor ebx, ebx
sub eax, ebx
cmp esi, eax
jg 0x42e08d
pop esi
pop ebx
ret

Function at 0x430b97
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x430bdc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432bdc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov esi, 0x4625c4
mov edx, dword [esp + 0xc]
xor eax, eax
mov al, byte [esp + 8]
mov ebx, eax
add ebx, ebx
lea ebx, [ebx + ebx*2]
mov eax, dword [esi + ebx*8]
mov ecx, dword [esp]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esi + ebx*8 + 4]
mov edi, dword [esp]
mov eax, dword [edi + eax*4]
mov ebx, dword [esi + ebx*8 + 8]
mov edi, dword [esp]
mov ebx, dword [edi + ebx*4]
add edx, ebx
add ebx, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add eax, ecx
add ecx, eax
mov edi, eax
shr edi, 0x11
xor eax, edi
add ebx, eax
add eax, ebx
mov edi, ebx
shl edi, 9
xor ebx, edi
add edx, ebx
add ebx, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
mov edx, ecx
shl edx, 7
xor ecx, edx
add eax, ecx
mov edx, ebx
shr edx, 0xf
xor eax, edx
add ebx, eax
mov eax, ebx
shl eax, 0xb
xor ebx, eax
mov eax, dword [esp + 0x10]
xor eax, ebx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
add esi, 0xc
dec dword [esp + 0x14]
jne 0x432c0f
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x432d14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
dec ecx
test ecx, ecx
jl 0x432e11
inc ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov edx, dword [eax]
mov ecx, dword [esp + 4]
mov cl, byte [ecx]
xor byte [eax + edx + 4], cl
inc dword [eax]
cmp dword [eax], 0x100
jne 0x432d46
xor edx, edx
mov dword [eax], edx
mov edx, dword [eax + 0x104]
mov ecx, dword [esp + 4]
mov cl, byte [ecx]
xor byte [eax + edx + 0x108], cl
inc dword [eax + 0x104]
cmp dword [eax + 0x104], 8
jne 0x432e04
mov ecx, dword [eax + 0x114]
mov ebx, dword [eax + 0x110]
mov esi, dword [eax + 0x10c]
mov edx, dword [eax + 0x108]
mov edi, 4
add ecx, edx
add edx, ecx
mov ebp, ecx
shr ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shl ebp, 0xd
xor ebx, ebp
add esi, ebx
add ebx, esi
mov ebp, esi
shr ebp, 0x11
xor esi, ebp
add edx, esi
add esi, edx
mov ebp, edx
shl ebp, 9
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shr ebp, 3
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shl ebp, 7
xor ebx, ebp
add esi, ebx
add ebx, esi
mov ebp, edx
shr ebp, 0xf
xor esi, ebp
add edx, esi
add esi, edx
mov ebp, edx
shl ebp, 0xb
xor edx, ebp
dec edi
jne 0x432d89
mov dword [eax + 0x108], ecx
mov dword [eax + 0x10c], ebx
mov dword [eax + 0x110], esi
mov dword [eax + 0x114], edx
xor edx, edx
mov dword [eax + 0x104], edx
inc dword [esp + 4]
dec dword [esp]
jne 0x432d2c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x433208
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffea8
xor eax, eax
push ebp
push 0x4333a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
mov ecx, edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x680]
mov edx, 0x10
call fcn.0040728c
test eax, eax
jne 0x43326c
mov eax, dword [edi]
mov edx, dword [ebp + 8]
add edx, 0xfffffa9c
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax - 0x564]
mov eax, dword [ebp + 8]
add eax, 0xfffff984
mov ecx, 4
call fcn.00432d14
push 0x400
mov eax, dword [ebp + 8]
add eax, 0xfffffa9c
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, dword [ebp + 8]
mov dword [edx - 0x68c], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x68c]
dec esi
test esi, esi
jl 0x4332ad
inc esi
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x564]
mov al, byte [ebx]
call fcn.004028a0
mov byte [ebx], al
inc ebx
dec esi
jne 0x4332a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x68c]
mov eax, dword [ebp + 8]
lea edx, [eax - 0x564]
mov eax, dword [ebp + 8]
add eax, 0xfffff984
call fcn.00432d14
xor eax, eax
mov dword [edi], eax
mov ecx, edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x690]
mov edx, 0x10
call fcn.0040728c
test eax, eax
jne 0x433311
mov eax, dword [edi]
mov edx, dword [ebp + 8]
add edx, 0xfffffa9c
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax - 0x564]
mov eax, dword [ebp + 8]
add eax, 0xfffff984
mov ecx, 4
call fcn.00432d14
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x690]
lea eax, [ebp - 4]
mov ecx, 0x4333bc
call fcn.00403af8
mov eax, dword [ebp - 4]
mov ecx, edi
mov edx, 0x12
call fcn.0040728c
test eax, eax
je 0x433367
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x690]
lea eax, [ebp - 4]
mov ecx, 0x4333bc
call fcn.00403af8
mov eax, dword [ebp - 4]
mov ecx, edi
mov edx, 0x10
call fcn.0040728c
test eax, eax
jne 0x43338f
mov eax, dword [edi]
mov edx, dword [ebp + 8]
add edx, 0xfffffa9c
mov dword [edx], eax
mov eax, dword [ebp + 8]
lea edx, [eax - 0x564]
mov eax, dword [ebp + 8]
add eax, 0xfffff984
mov ecx, 4
call fcn.00432d14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4333ac
lea eax, [ebp - 4]
call fcn.00403830
ret
Function at 0x4333c4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff960
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x6a0], edx
mov dword [ebp - 0x680], edx
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x690]
call fcn.00403c60
lea eax, [ebp - 0x158]
mov edx, dword [0x4062b8]
call fcn.00403efc
lea edi, [ebp - 0x564]
xor eax, eax
push ebp
push 0x4335f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x67c]
call fcn.00432ccc
push 0x400
push edi
call sub.kernel32.dll_GetWindowsDirectoryA
mov dword [ebp - 0x68c], eax
mov esi, dword [ebp - 0x68c]
dec esi
test esi, esi
jl 0x43344b
inc esi
mov ebx, edi
mov al, byte [ebx]
call fcn.004028a0
mov byte [ebx], al
inc ebx
dec esi
jne 0x43343e
mov bl, byte [edi]
mov edx, edi
lea eax, [ebp - 0x67c]
mov ecx, dword [ebp - 0x68c]
call fcn.00432d14
lea edx, [ebp - 0x680]
mov eax, edi
call fcn.004076a4
call fcn.00432e78
cmp eax, 2
jne 0x433480
push ebp
call fcn.00432ea4
pop ecx
jmp 0x433487
push ebp
call fcn.00433208
pop ecx
mov eax, dword [ebp - 0x690]
mov al, byte [eax]
call fcn.004028a0
cmp bl, al
jae 0x4334a7
mov eax, dword [ebp - 0x690]
mov al, byte [eax]
call fcn.004028a0
mov ebx, eax
sub bl, 0x43
jb 0x4335a3
inc ebx
mov byte [ebp - 0x699], bl
mov bl, 0x43
lea eax, [ebp - 0x6a0]
mov edx, ebx
call fcn.004039d4
lea eax, [ebp - 0x6a0]
mov edx, 0x433618
call fcn.00403ab4
mov eax, dword [ebp - 0x6a0]
call fcn.00403c70
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x433596
mov eax, edi
xor ecx, ecx
mov edx, 0x400
call fcn.00402a88
xor eax, eax
mov al, bl
sub eax, 0x41
mov byte [edi], al
mov eax, ebx
sub al, 0x40
call fcn.00407458
mov dword [ebp - 0x698], eax
lea edx, [edi + 1]
lea eax, [ebp - 0x698]
mov ecx, 4
call fcn.004027e4
push 0
push 0
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [edi + 5]
push eax
push 0
push 0
lea eax, [ebp - 0x6a0]
mov edx, ebx
call fcn.004039d4
lea eax, [ebp - 0x6a0]
mov edx, 0x433618
call fcn.00403ab4
mov eax, dword [ebp - 0x6a0]
call fcn.00403c70
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea edx, [ebp - 0x698]
lea eax, [edi + 5]
mov ecx, 4
call fcn.004027e4
mov edx, edi
lea eax, [ebp - 0x67c]
mov ecx, 9
call fcn.00432d14
inc ebx
dec byte [ebp - 0x699]
jne 0x4334b9
lea edx, [ebp - 0x694]
lea eax, [ebp - 0x67c]
mov ecx, 4
call fcn.00432e18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433600
lea eax, [ebp - 0x6a0]
call fcn.00403830
lea eax, [ebp - 0x690]
call fcn.00403830
lea eax, [ebp - 0x680]
call fcn.00403830
lea eax, [ebp - 0x158]
mov edx, dword [0x4062b8]
call fcn.00403fc4
ret
Function at 0x4336b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc1c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x10], eax
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x4338be
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x463738], 1
mov byte [ebp - 1], 0
push 0x81
lea eax, [ebp - 0x3dd]
push eax
mov eax, dword [0x462b40]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x3dd]
call fcn.004076a4
lea edx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x10]
call fcn.0040741c
mov edx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x10]
call fcn.004038c8
lea edx, [ebp - 0x3e4]
mov eax, dword [ebp - 0x10]
call fcn.00407368
mov edx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x10]
call fcn.004038c8
mov eax, dword [ebp - 0x10]
call fcn.00403aac
mov edx, dword [ebp - 0x10]
cmp byte [edx + eax - 1], 0x5c
jne 0x43376f
mov eax, dword [ebp - 0x10]
call fcn.00403aac
mov edx, eax
lea eax, [ebp - 0x10]
mov ecx, 1
call fcn.00403cf0
lea eax, [ebp - 0x3e4]
mov ecx, 0x4338d8
mov edx, dword [ebp - 0x10]
call fcn.00403af8
mov edx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x15c]
call fcn.00404cde
mov edx, 1
lea eax, [ebp - 0x15c]
call fcn.004050f1
call fcn.004027cc
test eax, eax
jne 0x43389d
push edi
lea edx, [ebp - 0x35c]
mov ecx, 0x97
lea eax, [ebp - 0x15c]
call fcn.00404d80
call fcn.0040271c
lea eax, [ebp - 0x15c]
call fcn.00404de4
call fcn.0040271c
cmp dword [edi], 0x97
jl 0x43389d
mov ax, word [0x4637d8]
call fcn.0042d3b8
mov byte [ebp - 9], 0xff
mov byte [ebp - 0xa], 0xff
xor eax, eax
mov dword [edi], eax
lea esi, [ebp - 0x35c]
mov bl, byte [esi]
call fcn.0042d6a8
mov dl, byte [ebp - 9]
xor dl, bl
xor dl, byte [ebp - 0xa]
xor al, dl
mov byte [esi], al
mov byte [ebp - 9], bl
mov byte [ebp - 0xa], al
inc dword [edi]
inc esi
cmp dword [edi], 0x98
jne 0x433805
mov edx, 0x463740
lea eax, [ebp - 0x35c]
mov ecx, 0x97
call fcn.004027e4
lea eax, [ebp - 0x10]
call fcn.00403830
xor eax, eax
mov dword [edi], eax
mov ebx, 0x4637cd
lea eax, [ebp - 0x3e4]
mov dl, byte [ebx]
call fcn.004039d4
mov edx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x10]
call fcn.00403ab4
inc dword [edi]
inc ebx
cmp dword [edi], 0xa
jne 0x43384f
lea edx, [ebp - 0x3e4]
mov eax, 0x4338f4
call fcn.0043361c
mov edx, dword [ebp - 0x3e4]
mov eax, dword [ebp - 0x10]
call fcn.00403bbc
jne 0x43389d
mov byte [0x463738], 0
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4338c5
lea eax, [ebp - 0x3e4]
call fcn.00403830
lea eax, [ebp - 0x10]
call fcn.00403830
ret
Function at 0x180fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01806e52
and dword [ebp - 0x14], 0
cmp dword [0x185d558], 0
mov dword [ebp - 0x18], eax
jne 0x180fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x180fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x180fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x185d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x185d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x185d560], eax
call edi
push eax
call esi
mov dword [0x185d568], eax
test eax, eax
je 0x180fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x185d564], eax
mov eax, dword [0x185d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x180fc78
cmp dword [0x185d568], ecx
je 0x180fc78
push eax
call esi
push dword [0x185d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x180fc78
test ebx, ebx
je 0x180fc78
call edi
test eax, eax
je 0x180fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x180fc6f
test byte [ebp - 8], 1
jne 0x180fc78
or dword [ebp + 0x10], 0x200000
jmp 0x180fcab
mov eax, dword [0x185d55c]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x180fcab
mov eax, dword [0x185d560]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x185d558]
call esi
test eax, eax
je 0x180fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x180fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.018013cb
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x3e90787c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x1f9b5b9a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x41cf22fb
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
mov eax, section..text_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4fd33ecd
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x406e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406f48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406e6d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
cmp dword [ebp - 0x10], 0
jne 0x406e82
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x406f32
cmp dword [ebp - 0x10], 0x70000000
jb 0x406e90
call fcn.00405874
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x406e36
test eax, eax
jne 0x406f32
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x406ee0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x406f32
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x406eeb
dec esi
test esi, esi
je 0x406ef9
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x406eea
cmp dword [ebp - 0xc], 7
jne 0x406f04
test esi, esi
je 0x406f04
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x406f25
test esi, esi
je 0x406f25
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f4f
lea eax, [ebp - 0x14]
call fcn.00403198
ret

Function at 0x4078c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078e7
call fcn.004046eb
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x407912
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078ed
mov eax, ebx
pop edi
pop esi
pop ebx
ret