joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4766c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00475de0
add esp, 0xc
jo 0x4766dc
jno 0x4766dc
call 0x66f7d491
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
jne 0x47672b
je 0x47672b
call 0x8b33b4b9
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov dl, byte [ebp - 0xa]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 5]
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x13]
dec dl
dec cl
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 5], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 4]
dec dl
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0xd]
mov byte [ebp - 4], al
mov al, byte [ebp - 8]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 3]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0x11]
mov byte [ebp - 8], al
mov al, byte [ebp - 0xc]
dec dl
dec cl
mov byte [ebp - 3], dl
mov dl, byte [ebp - 7]
dec al
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
dec dl
dec cl
dec al
mov byte [ebp - 7], dl
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xb], al
dec byte [ebp - 6]
jb 0x4767bb
jae 0x4767bb
sbb al, 0xe8
loopne 0x476834
call fcn.0047dea0
add byte [eax], al
test eax, eax
jne 0x4767cb
pop esi
mov esp, ebp
pop ebp
ret 4
jl 0x4767d0
jge 0x4767d0
call 0x5233b561
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0047ba60
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00475de0
add esp, 0xc
test esi, esi
jne 0x4767f9
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
jb 0x4767fe
jae 0x4767fe
call 0x22a45058
add byte [eax], al
push esi
call fcn.00478a60
add esp, 4
jo 0x47680c
jno 0x47680c
call 0x504fad9b
mov eax, dword [ebp + 8]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
je 0x476837
pop esi
xor eax, eax
pop ebp
ret
Function at 0x4786c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x11
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00475de0
add esp, 0xc
jne 0x4786dc
je 0x4786dc
call 0x76f8ed90
mov al, 0x66
mov cl, 0x76
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x7a
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x6d
mov byte [ebp - 9], cl
mov byte [ebp - 8], al
mov byte [ebp - 7], 0x46
mov byte [ebp - 6], 0x79
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
jne 0x478724
je 0x478724
call 0x8b33dcb2
dec ebp
int1
mov dl, byte [ebp - 0x14]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0xa]
dec dl
mov byte [ebp - 0x14], dl
mov dl, byte [ebp - 5]
dec cl
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x13]
dec dl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 5], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0x12]
dec dl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 8]
dec cl
dec al
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x11]
dec dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xc]
mov byte [ebp - 8], dl
mov dl, byte [ebp - 7]
dec cl
dec al
mov byte [ebp - 0x11], cl
mov cl, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0xb]
mov byte [ebp - 7], dl
mov dl, byte [ebp - 6]
dec cl
dec al
dec dl
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xb], al
mov byte [ebp - 6], dl
jne 0x4787a9
je 0x4787a9
jmp 0x478792
call fcn.0047dea0
test eax, eax
jne 0x4787be
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x18
jns 0x4787c3
js 0x4787c3
call 0x5233d554
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0047ba60
push 0x11
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.00475de0
add esp, 0xc
test esi, esi
jne 0x4787ef
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x18
jb 0x4787f4
jae 0x4787f4
jmp 0x47884b
push esi
call fcn.00478a60
add esp, 4
jb 0x478802
jae 0x478802
or dword [ebx + 0x4d8b1c45], ecx
sbb byte [ebx - 0x74afebab], cl
inc ebp
adc byte [ecx - 0x75], dl
dec ebp
or al, 0x52
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
adc al, 0x89
or eax, 0x46d308
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp], edx
mov edx, dword [eax + 8]
mov dword [esp + 4], ecx
mov ecx, dword [eax + 0xc]
mov dword [esp + 8], edx
mov edx, dword [eax + 0x10]
lea eax, [esp]
push eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.0047b1f0
add esp, 0x14
ret
Function at 0x5142ad
Capabilities:
Authenticate hmac

Disassembly:
mov cl, 0x8c
sub dl, byte [ecx]
jl 0x51431a
cld
lodsb al, byte [esi]
in al, dx
sbb dword [edi - 0x41], eax
shr dword [ebx + 0x74], 0xd6
mov dword [0x157c221c], eax
xchg edi, eax
mov edx, 0x6fc57e3f
salc
sti
rcl byte [eax - 0xcdb3bcc], 0xd8
mov ch, 0xf3
and dh, byte [ecx + 6]
inc eax
xor dword [esi + ecx*2 - 0x330ce9b6], esp
or eax, 0xa18e6e10
push 0xffffffffffffffe0
das
in al, dx
int3
ficom dword [ebx + 0x1ef12dc6]
jmp dword [0xe60ccab2]
insd dword es:[edi], dx
sbb byte [eax + 0x17b7ec62], ch
aad 0xfe
pop ecx
sbb ebx, dword [0x885cc286]
jmp 0x514335
invalid
xchg dl, al
pop esp
mov bl, ch
adc eax, 0xc5ae46c8
jo 0x51430d
popfd
pop ecx
mov al, byte [0xdea8019b]
add ah, byte [ebp - 0x1a94ea3c]
push ds
invalid
adc eax, 0xf01ee56b
jbe 0x514330
lahf
cmp bh, dl
js 0x5142dd
mov ch, 0x6d
push 0x5c
mov dh, 0x5b
wait
pushfd
pop eax
clc
loop 0x5142e7
xchg esp, eax
or esp, 0xffffff9d
test eax, 0x77a502e2
push 0x36
sub cl, byte [edi - 0x67]
xchg esp, eax
xor eax, 0xbcbfc21c
mov eax, 0xa9690b6d
insd dword es:[edi], dx
aaa
mov al, byte [0xafe92e56]
or eax, 0xef1eab6f
imul ecx, dword [edx + ebx*8 + 0xc], 0x10
adc dword [ecx - 0x245d47e], edx
mov ch, 0xcf
mov ebx, 0xaff8385c
cwde
inc ecx
inc edx
and dword [ebp + edi + 0x7f027d7f], ecx
xchg byte [ebp - 0x4b9f8931], bl
pop ss
jge 0x51440c
jge 0x51438a
jg 0x514310
popfd
iretd
mov dl, 0xb8
or esi, 0xffffff99
dec ecx
invalid
test eax, 0xded18aef
sbb eax, 0xa338e071
jae 0x5143f4
insb byte es:[edi], dx
xchg dword [ecx], ecx
jno 0x514450
pushfd
jl 0x514386
xor esi, ebx
xchg ebx, eax
cli
das
popal
stosd dword es:[edi], eax
ljmp 0x17b4
pop ss
mov eax, 0x854f9cf8
sub dword gs:[eax], ebx
cmp al, dl
push ebx
or dl, al
add dword [esi - 0x75], ebx
pop esp
inc ecx
sub byte [eax], cl
pop edx
mov ebx, 0x2c21f9d0
add al, 0x28
daa
stc
and dword [esp + eax], ebp
sub byte [edi], ah
mov edi, 0x4f60bd50
jae 0x5143ed
cwde
mov cl, 0xc0
sbb dword [edx - 0x2b], eax
mov eax, dword [0x19c18c3a]
jle 0x514474
jo 0x5143d2
push ds
popfd
shr byte [edi], 0x19
salc
cmp eax, dword [edx - 0x2301222b]
scasd eax, dword es:[edi]
push eax
rcl dword [edx + 0x48], cl
aad 0x12
or dword [edi + 0x58], 0xffffffe7
mov eax, 0xed426915
push ds
cmpsd dword [esi], dword es:[edi]
test eax, 0x1c5a8c15
aam 0x2b
sbb al, 0xa3
xchg ecx, eax
sbb byte [ebp + esi*8 + 0x70], 0x9b
or al, byte [ecx - 0xb]
jmp [edx - 0x3b681d96]
invalid
Function at 0x64a48b
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ecx], 0x6114d4bc
out dx, eax
daa
sbb dh, byte [ebx + ecx*2 - 0x67]
push edx
popal
pushal
mov dword [edx + 0x30dd64e3], eax
push ds
ret
das
paddsb mm3, qword [ebx - 0xd08f936]
and dword [eax - 4], edx
push es
xchg ebx, eax
inc edx
cmp ch, dl
pushfd
xor eax, 0x885a5d6a
xchg ebx, eax
jo 0x64a497
sar dword [edx + 0x72], cl
mov dl, 0x65
cdq
jg 0x64a4b5
in al, dx
loop 0x64a4d6
in eax, 0x4d
stosb byte es:[edi], al
scasb al, byte es:[edi]
test dword [ebx], ebp
push ds
push ebp
sub eax, 0xa0aea2cc
jae 0x64a472
mov al, byte [0x69acfc76]
imul edx, dword [esp + esi], 0x40
invalid
mov ecx, 0xd41408e2
cmp byte [ebp + 0x1b], dl
lodsd eax, dword [esi]
jecxz 0x64a52d
jl 0x64a55c
iretd
hlt
adc cl, byte [ecx - 0x45b319a4]
adc byte [esi], bh
imul eax, dword [edi + 0xd], 0x25a13cd
or cl, byte [edi - 0x56058971]
jae 0x64a509
invalid
test eax, 0x372b8c98
mov ch, byte [esi + ebp*2 + 0x2f]
aaa
xchg edi, eax
mov al, 0xdd
lea edx, [eax + ecx*4]
imul eax, dword [eax + ebp*2], 0xc1f2a87
push cs
movsb byte es:[edi], byte gs:[esi]
xchg ebx, eax
jb 0x64a528
pushal
in al, dx
invalid
adc ebx, eax
ror dword [edi + ebx - 0x3c], 0xc2
lodsb al, byte [esi]
rcr al, cl
cmp dh, byte [edx]
cmpsd dword [esi], dword es:[edi]
sbb al, 0xb9
idiv dl
add ecx, dword [edi]
pop ebp
or dl, byte [edx]
leave
or eax, 0xd3acc8cc
fidivr dword [eax - 0x2341d776]
je 0x64a50a
mov al, byte [0x44e00555]
hlt

Function at 0x95f763
Capabilities:
Encode data using xor

Disassembly:
clc
mov ah, 0x7d
and esi, dword [edi - 0x64dd907e]
adc dword [edx - 0x565fecb7], 0x551c4d48
pushal
push ss
jae 0x95f7a6
dec ebp
fld qword [edx + ecx*8 + 0x3b07c87c]
and al, 0xca
mov eax, 0x7d0b9ebe
invalid
jo 0x95f733
adc byte [eax + 0x72], cl
jns 0x95f7be
pop es
mul ch
iretd
sbb esp, dword [eax + 0x6c19879e]
out 0xf1, eax
sbb byte [edx - 0x2db13238], dh
xchg ebx, eax
das
sbb ebx, ebx
sbb ch, ah
push 0x6ca2a4cf
dec esp
xchg dword [ebx + 0x75f6183a], ebp
xor eax, 0x35de6743
mov byte [0xab874c6c], al
cmp bl, byte [eax]
div byte [ebp + 0x35]
inc ebx
fidiv word [di]
mov ebp, dword [0x6b203b44]
add al, byte [esi + 0x637358aa]
inc esp
fnstenv [ebx]
xchg ebp, eax
and byte [eax], ah
sti
sbb eax, 0x2ea63650
fcom dword [ecx]
xor edx, dword [ebp + 0x1dfb2020]
push eax
cmpsb byte ss:[esi], byte es:[edi]
fcom dword cs:[ecx]
jb 0x95f7da
cmp ch, al
lea eax, [edi - 0x727ebd8b]
fidiv dword [esi]
test al, 0xb9
iretd
Function at 0x416298
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423990]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040edbe
mov dword [ebp - 0x14], eax
cmp dword [0x425ab0], edi
jne 0x416389
push 0x800
push edi
push 0x41f554
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x416316
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x416469
push 0x41f554
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x416469
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416469
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x425ab0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x425ab4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x425ab8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x425ac0], eax
test eax, eax
je 0x416386
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x425abc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4163ae
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4163a1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4163c3
push 4
pop eax
jmp 0x41646b
cmp dword [ebp - 0x14], edi
je 0x4163c3
push dword [0x425ab0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4163a8
mov eax, dword [0x425abc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x416421
cmp dword [0x425ac0], esi
je 0x416421
push eax
call ebx
push dword [0x425ac0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416421
test eax, eax
je 0x416421
call ecx
test eax, eax
je 0x416416
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x416416
test byte [ebp - 8], 1
jne 0x416421
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x416451
mov eax, dword [0x425ab4]
cmp eax, esi
je 0x41644e
push eax
call ebx
test eax, eax
je 0x41644e
call eax
mov edi, eax
test edi, edi
je 0x41644e
mov eax, dword [0x425ab8]
cmp eax, esi
je 0x41644e
push eax
call ebx
test eax, eax
je 0x41644e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x425ab0]
call ebx
test eax, eax
je 0x416469
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41646b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406e20
leave
ret
Function at 0x401260
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x4012fd
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
jmp 0x401290
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
add ecx, 1
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 1
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 1
mov byte [ecx], al
add ecx, 1
add esi, 3
sub edx, 1
jne 0x401290
pop ebx
test edi, edi
jle 0x401365
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
add ecx, 1
shl al, 4
cmp edi, 1
jle 0x401327
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
add ecx, 1
cmp edi, 2
jge 0x40134c
mov al, 0x3d
mov byte [ecx], al
add ecx, 1
mov byte [ecx], al
add ecx, 1
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x4014b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4014c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x401504
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401500
lea ebx, [ebx]
cmp esi, eax
jae 0x401504
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4014f0
cmp esi, eax
jb 0x40150a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4061e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x487378
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push edi
mov eax, dword [0x504a70]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push eax
call edi
push eax
call fcn.00459534
push eax
lea ecx, [esp + 0x30]
call fcn.0045e40f
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0
mov edx, dword [esi + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x1c]
push edx
push eax
call edi
push eax
call fcn.00459534
mov ecx, eax
call fcn.0045e1dc
cmp dword [esi + 0x130], 0
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
jne 0x406301
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x12c]
call fcn.0045e37c
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
lea edi, [esi + 0x13c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.0045e5b4
test edi, edi
je 0x4062bb
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x130]
push edi
push eax
call fcn.0045e639
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0xc]
push 0xcc0020
push edx
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x144], eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [esi + 0x130]
push ecx
push 0
push 0
push eax
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
sub ecx, dword [esp + 0xc]
lea edx, [esi + 0x12c]
test edx, edx
je 0x40631e
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push eax
push ecx
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
push 0
push 0
push edx
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0045e463
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x44
ret 4
Function at 0x40b590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x4896bd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x504a70]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGPUDlg.0
lea eax, [esi + 0xbc8]
push eax
mov dword [esp + 0x18], 0x24
call fcn.004057b0
lea ecx, [esi + 0xbc0]
mov byte [esp + 0x14], 0x23
mov dword [ecx], vtable.CMenu.0
call fcn.00463638
lea ecx, [esi + 0xb50]
mov byte [esp + 0x14], 0x22
call fcn.0045f6d7
lea ecx, [esi + 0xb48]
mov byte [esp + 0x14], 0x21
mov dword [ecx], vtable.CBitmap.0
call fcn.004015a0
lea ecx, [esi + 0xaf4]
mov byte [esp + 0x14], 0x20
call fcn.0045d6be
lea ecx, [esi + 0xaa0]
mov byte [esp + 0x14], 0x1f
call fcn.0045d6be
lea ecx, [esi + 0xa4c]
mov byte [esp + 0x14], 0x1e
call fcn.0045d6be
lea ecx, [esi + 0x9f8]
mov byte [esp + 0x14], 0x1d
call fcn.0045d6be
lea ecx, [esi + 0x9a4]
mov byte [esp + 0x14], 0x1c
call fcn.0045d6be
lea ecx, [esi + 0x950]
mov byte [esp + 0x14], 0x1b
call fcn.0045d6be
lea ecx, [esi + 0x8fc]
mov byte [esp + 0x14], 0x1a
call fcn.0045d6be
lea ecx, [esi + 0x8a8]
mov byte [esp + 0x14], 0x19
call fcn.0045d6be
lea ecx, [esi + 0x854]
mov byte [esp + 0x14], 0x18
call fcn.0045d6be
mov byte [esp + 0x14], 0x17
lea ecx, [esi + 0x800]
call fcn.0045d6be
lea ecx, [esi + 0x7ac]
mov byte [esp + 0x14], 0x16
call fcn.0045d6be
lea ecx, [esi + 0x758]
mov byte [esp + 0x14], 0x15
call fcn.0045d6be
lea ecx, [esi + 0x704]
mov byte [esp + 0x14], 0x14
call fcn.0045d6be
lea ecx, [esi + 0x6b0]
mov byte [esp + 0x14], 0x13
call fcn.0045d6be
lea ecx, [esi + 0x65c]
mov byte [esp + 0x14], 0x12
call fcn.0045d6be
lea ecx, [esi + 0x608]
mov byte [esp + 0x14], 0x11
call fcn.0045d6be
lea ecx, [esi + 0x5b4]
mov byte [esp + 0x14], 0x10
call fcn.0045d6be
lea ecx, [esi + 0x560]
mov byte [esp + 0x14], 0xf
call fcn.0045d6be
lea ecx, [esi + 0x50c]
mov byte [esp + 0x14], 0xe
call fcn.0045d6be
lea ecx, [esi + 0x4b8]
mov byte [esp + 0x14], 0xd
call fcn.0045d6be
lea ecx, [esi + 0x464]
mov byte [esp + 0x14], 0xc
call fcn.0045d6be
lea ecx, [esi + 0x410]
mov byte [esp + 0x14], 0xb
call fcn.0045d6be
lea ecx, [esi + 0x3bc]
mov byte [esp + 0x14], 0xa
call fcn.0045d6be
lea ecx, [esi + 0x368]
mov byte [esp + 0x14], 9
call fcn.0045d6be
lea ecx, [esi + 0x314]
mov byte [esp + 0x14], 8
call fcn.0045d6be
lea ecx, [esi + 0x2c0]
mov byte [esp + 0x14], 7
call fcn.0045d6be
lea ecx, [esi + 0x26c]
mov byte [esp + 0x14], 6
call fcn.0045d6be
lea ecx, [esi + 0x218]
mov byte [esp + 0x14], 5
call fcn.0045d6be
lea ecx, [esi + 0x1c4]
mov byte [esp + 0x14], 4
call fcn.0045d6be
lea ecx, [esi + 0x170]
mov byte [esp + 0x14], 3
call fcn.0045d6be
lea ecx, [esi + 0x11c]
mov byte [esp + 0x14], 2
call fcn.0045d6be
lea ecx, [esi + 0xc8]
mov byte [esp + 0x14], 1
call fcn.0045d6be
lea ecx, [esi + 0x74]
mov byte [esp + 0x14], 0
call fcn.0045d6be
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0045cce3
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x40d3a0
Capabilities:
Access peb ldr_data
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x48869b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x504a70]
xor eax, esp
mov dword [esp + 0x144], eax
push ebp
push esi
mov eax, dword [0x504a70]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x164]
xor eax, eax
mov dword [esp + 0xc], 0
push 0x11c
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
push eax
call fcn.0046ac40
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0x11c
call esi
test eax, eax
jne 0x40d45e
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], 0x114
call esi
test eax, eax
jne 0x40d45e
push 0x4f1164
mov ecx, ebp
call fcn.00403e00
jmp 0x40d5c6
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x40d482
lea ecx, [esp + 0x10]
push ecx
call eax
jmp 0x40d48d
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
call fcn.0045e8af
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d4a7
push 0x80004005
call fcn.00401440
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x15c], 0
cmp dword [esp + 0x38], 6
jne 0x40d4f3
cmp dword [esp + 0x3c], 0
jne 0x40d58c
cmp byte [esp + 0x14e], 1
lea ecx, [esp + 0xc]
jne 0x40d4e9
push str.Vista
jmp 0x40d4ee
push str.Longhorn
call fcn.00403ee0
mov esi, 5
cmp dword [esp + 0x38], esi
jne 0x40d575
cmp dword [esp + 0x3c], 2
jne 0x40d545
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40d518
push str.2003R2
jmp 0x40d536
cmp byte [esp + 0x14e], 1
jne 0x40d531
cmp word [esp + 0x10], 9
jne 0x40d531
push str.XP64
jmp 0x40d536
push str.2003
lea ecx, [esp + 0x10]
call fcn.00403ee0
cmp dword [esp + 0x38], esi
jne 0x40d575
cmp dword [esp + 0x3c], 1
jne 0x40d560
push 0x4f2c44
lea ecx, [esp + 0x10]
call fcn.00403ee0
cmp dword [esp + 0x38], esi
jne 0x40d575
cmp dword [esp + 0x3c], 0
jne 0x40d58c
push 0x4f2c4c
lea ecx, [esp + 0x10]
call fcn.00403ee0
cmp dword [esp + 0x38], 4
ja 0x40d58c
push 2
push 0x4f2c54
lea ecx, [esp + 0x14]
call fcn.00404b60
mov esi, dword [esp + 0xc]
add esi, 0xfffffff0
push esi
call fcn.00404c60
add eax, 0x10
add esp, 4
mov dword [ebp], eax
mov dword [esp + 0x15c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d5c6
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, ebp
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0046875c
add esp, 0x154
ret