joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493124
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49312c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49331e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x493334
mov eax, esi
call fcn.00490eb4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040431c
lea ecx, [ebp - 0x10]
mov edx, 0x493348
mov eax, esi
call fcn.00490eb4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040431c
lea ecx, [ebp - 0x14]
mov edx, 0x493360
mov eax, esi
call fcn.00490eb4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040431c
lea ecx, [ebp - 0x18]
mov edx, 0x49337c
mov eax, esi
call fcn.00490eb4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040431c
lea ecx, [ebp - 0x1c]
mov edx, 0x493398
mov eax, esi
call fcn.00490eb4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040431c
lea ecx, [ebp - 0x24]
mov edx, 0x4933b0
mov eax, esi
call fcn.00490eb4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040897c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408ec4
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4933c8
mov eax, esi
call fcn.00490eb4
mov eax, dword [ebp - 0x28]
call fcn.0047c6d0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4933d8
mov eax, esi
call fcn.00490eb4
mov eax, dword [ebp - 0x2c]
call fcn.0047c6d0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4933f0
mov eax, esi
call fcn.00490eb4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408ec4
inc eax
je 0x4932c1
lea ecx, [ebp - 0x34]
mov edx, 0x4933f0
mov eax, esi
call fcn.00490eb4
mov eax, dword [ebp - 0x34]
call fcn.00408e88
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a538
fstp qword [ebp - 0x3c]
wait
call fcn.0040a8fc
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4932dc
lea ecx, [ebp - 0x40]
mov edx, 0x4933f0
mov eax, esi
call fcn.00490eb4
mov eax, dword [ebp - 0x40]
call fcn.0047c6d0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x493400
mov eax, esi
call fcn.00490eb4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.0040431c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493325
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004042ec
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004042ec
ret
Function at 0x49f584
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x49f5de
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0049f574
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0047b33c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0047af3c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f5e5
lea eax, [ebp - 4]
call fcn.004042c8
ret

Function at 0x4a237c
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x4a238e
add esp, 0xfffffff0
call fcn.00403718
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0049fb2c
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004a0c8c
mov eax, dword [ebp - 4]
mov dword [eax + 0x9c], 0x7530
mov eax, dword [ebp - 4]
call fcn.004a13f8
add eax, 0x50
mov edx, 0x4a2448
call fcn.0040431c
mov eax, dword [ebp - 4]
call fcn.004a13f8
add eax, 0x70
mov edx, 0x4a24a8
call fcn.0040431c
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x111]
or al, byte [0x4a2504]
mov edx, dword [ebp - 4]
mov byte [edx + 0x111], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x111]
or al, byte [0x4a2508]
mov edx, dword [ebp - 4]
mov byte [edx + 0x111], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x104], 1
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4a2437
call fcn.00403770
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a5940
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a5ba0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a59a3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a5408
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d09c
cmp al, 1
jne 0x4a59a3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a5720
test al, al
je 0x4a5b2f
cmp dword [ebp - 8], 0
jge 0x4a59c1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a5408
mov eax, dword [ebp - 0x210]
call fcn.00404588
cmp ebx, eax
jge 0x4a5a0b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a5408
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4cfe68]
and eax, 0xff
bt dword [edx], eax
jae 0x4a5a0b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a5a1f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a591c
cmp ebx, dword [ebp - 8]
je 0x4a5b21
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a5a4b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004035b0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4cf2d0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a5b0e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004035b0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4cf2d0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00454be8
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004035b0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4cf2d0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00454be8
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5b15
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a5b82
cmp dword [ebp - 8], 0
jge 0x4a5b3a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a5408
mov eax, dword [ebp - 0x218]
call fcn.00404588
cmp eax, dword [ebp - 8]
jg 0x4a5b74
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a5408
mov eax, dword [ebp - 0x21c]
call fcn.00404588
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a591c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5ba7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004042ec
ret
Function at 0x4b51f8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
cmp eax, 5
jb 0x4b523d
cmp dword [ebp - 0x8c], 0
jbe 0x4b5234
mov byte [0x4cf354], 8
jmp 0x4b52b1
mov byte [0x4cf354], 7
jmp 0x4b52b1
cmp eax, 3
jbe 0x4b52b1
cmp dword [ebp - 0x84], 2
jne 0x4b5254
mov byte [0x4cf354], 1
jmp 0x4b52b1
and dword [ebp - 0x88], 0xffff
mov eax, dword [ebp - 0x8c]
cmp eax, 0x5a
jb 0x4b5272
mov byte [0x4cf354], 6
jmp 0x4b52b1
cmp eax, 0xa
jb 0x4b5295
cmp dword [ebp - 0x88], 0x8ae
jb 0x4b528c
mov byte [0x4cf354], 5
jmp 0x4b52b1
mov byte [0x4cf354], 4
jmp 0x4b52b1
cmp dword [ebp - 0x88], 0x3e8
jb 0x4b52aa
mov byte [0x4cf354], 3
jmp 0x4b52b1
mov byte [0x4cf354], 2
mov esp, ebp
pop ebp
ret

Function at 0x4c02d0
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404778
mov eax, dword [ebp - 8]
call fcn.00404778
xor eax, eax
push ebp
push 0x4c036c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c0343
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404788
push eax
mov eax, dword [ebp - 4]
call fcn.00404788
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00409274
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c0351
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0373
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042ec
ret
Function at 0x4c6748
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x130], ebx
mov ebx, ecx
test ebx, ebx
js 0x4c6774
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4c676d
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010f4]
call fcn.00404f74
xor eax, eax
push ebp
push 0x4c687c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c6837
push 0xff
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x4c6823
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x120]
mov ecx, pe_nt_image_headers32
call fcn.00404538
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + ecx*4]
call fcn.004088d4
test eax, eax
jne 0x4c681b
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x4c67de
push 2
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c67b7
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6883
lea eax, [ebp - 0x138]
call fcn.004042c8
lea eax, [ebp - 0x130]
call fcn.004042c8
lea eax, [ebp - 0x128]
call fcn.004042c8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010f4]
call fcn.00404e34
ret

Function at 0x4c9974
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x21
mov eax, dword [0x4cfba4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040973c
mov esp, ebp
pop ebp
ret

Function at 0x4c99b8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404778
xor eax, eax
push ebp
push 0x4c9a23
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x23]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402db4
mov dword [ebp - 0x1f], 3
mov eax, dword [ebp - 4]
call fcn.00404788
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x13], 0x10
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9a2a
lea eax, [ebp - 4]
call fcn.004042c8
ret
Function at 0x4c9af0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4c9c0f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c9bea
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [ebp - 0xc]
call fcn.004027c4
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c9b5b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov eax, dword [ebp - 4]
call fcn.004027e4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7a
jne 0x4c9bd7
mov eax, dword [ebp - 0xc]
call fcn.004027c4
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
je 0x4c9bcf
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004044c0
mov edx, dword [ebp - 0x14]
mov eax, 0x4c9c28
call fcn.004048cc
dec eax
jne 0x4c9bcf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov eax, dword [ebp - 4]
call fcn.004027e4
cmp dword [ebp - 0x10], 0x103
jne 0x4c9b63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9bf9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9c16
lea eax, [ebp - 0x14]
call fcn.004042c8
ret
Function at 0x4cb194
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb269
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4cb274
call sub.kernel32.dll_OutputDebugStringA
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
test edx, edx
je 0x4cb1c9
sub edx, 0xfffffff8
mov ecx, 0x4cb29c
call fcn.00405f8c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x4cb1f5
cmp dword [ebp - 8], 0
je 0x4cb1f5
mov ecx, 0xc1
mov edx, 0x4cb2b4
mov eax, 0x4cb300
call fcn.00404224
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00476e34
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.00405f48
mov ecx, eax
mov edx, 0x4cb314
pop eax
call fcn.0040e26c
test al, al
jne 0x4cb236
mov ecx, 0x4cb32c
mov dl, 1
mov eax, dword [0x407a10]
call fcn.0040c698
call fcn.00403c44
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb270
lea eax, [ebp - 0x14]
call fcn.00405f48
lea eax, [ebp - 0x10]
call fcn.00405f48
lea eax, [ebp - 0xc]
call fcn.00405f48
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x538a2e72
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x641a7a4b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x418120
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x17e
jmp 0x4326ec
pushal
fbstp tbyte [ebp + 0x7b]
jne 0x41811c
cmpsb byte [esi], byte es:[edi]
je 0x41809f
xor al, 0x46
outsd dx, dword [esi]
dec ecx
mov ebp, 0x2fd90c53
and eax, dword [edi]
push 0xffffffffffffffc9
cli
push es
or edx, dword [ebx + 0xa]
sbb eax, 0x2197bc48
fisubr dword [esi]
and ch, byte [bx + di - 0x28]
mov esi, 0xce42f823
xor byte [ebx + 0x74], bl
jns 0x4180b7
invalid
jmp fcn.0040a267
call int.0043b184
lds esi, [ebx + ebp*8 - 0xc]
lahf
jl 0x4180a1
mov ebp, 0xebf4eb78
sbb byte [edi - 0x609b4290], 0x78
movsb byte es:[edi], byte [esi]
call 0x6d2cf594
js 0x4180d1
hlt
insb byte es:[edi], dx
lahf
jl 0x4180e3
insb byte es:[edi], dx
lahf
je 0x4180a2
js 0x41809d
jo 0x41809f
lahf
fcomi st(4)
cmpsb byte [esi], byte es:[edi]
invalid
lds esi, [edi + ebx*4 + 0x78]
jmp 0x41819a
movsb byte es:[edi], byte [esi]
sub bl, 0x68
jmp 0x4180ff
mov edx, 0xeb78caaf
je 0x4180f4
clc
movsb byte es:[edi], byte [esi]
js 0x41813f
invalid
mov ebp, 0xd464c978
or cl, 0xf0
aam 0xf4
movsb byte es:[edi], byte [esi]
push 0x70a478bd
mov byte [0xeb70a4fc], al
leave
aam 0x80
leave
invalid
mov ebp, 0xa270a478
cld
movsb byte es:[edi], byte [esi]
jo 0x41818e
je 0x418149
clc
jmp 0x418190
jmp 0x4180d8
call fcn.0042e1e9
jmp 0x431d8f

Function at 0x439c8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
jmp 0x432cd9
cmp dword [ebp + 8], 0
jmp 0x438064
push ebx
jmp 0x4015ba
mov ebp, esp
jmp 0x436f3d
push esi
jmp 0x4088fb
mov edi, dword [ebp + 8]
jmp 0x436ece
push edx
jmp 0x4372c0
jmp 0x430e7e
add esp, 0xfffffef4
jmp 0x40d6a9
push edi
jmp 0x41a9fe
je fcn.00407c82
jmp 0x42ba08
push ebp
jmp 0x41945e

Function at 0x43ea50
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xaa951bda
pop esp
jp 0x43e9f6
lodsd eax, dword [esi]
sub al, 0xd5
adc ch, 0xd2
sub dword [edi - 0x13], ebx
Function at 0x44a600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00465520
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
add ecx, 0x28
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx], vtable.Poco::XML::LexicalHandler.0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x38]
mov dword [eax], vtable.Poco::XML::WhitespaceFilter.5.0
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 4], vtable.Poco::XML::WhitespaceFilter.4.0
mov edx, dword [ebp - 0x38]
mov dword [edx + 8], vtable.Poco::XML::WhitespaceFilter.3.0
mov eax, dword [ebp - 0x38]
mov dword [eax + 0xc], vtable.Poco::XML::WhitespaceFilter.2.0
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x10], vtable.Poco::XML::WhitespaceFilter.1.0
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x28], vtable.Poco::XML::WhitespaceFilter.0
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x38]
add ecx, 0x30
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0x19]
mov dword [ebp - 0x18], edx
push 0
push 0
mov ecx, dword [ebp - 0x34]
call fcn.00402c20
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x4c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x44a6d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f707d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [eax], vtable.Poco::XML::WhitespaceFilter.5.0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], vtable.Poco::XML::WhitespaceFilter.4.0
mov edx, dword [ebp - 0x24]
mov dword [edx + 8], vtable.Poco::XML::WhitespaceFilter.3.0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc], vtable.Poco::XML::WhitespaceFilter.2.0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x10], vtable.Poco::XML::WhitespaceFilter.1.0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x28], vtable.Poco::XML::WhitespaceFilter.0
mov dword [ebp - 4], 1
push 0
push 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00402c20
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.00465430
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
call fcn.004655f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48f7bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x530964]
jne 0x48f7c5
repz ret
jmp fcn.0049622d

Function at 0x4a0497
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00497fee
and dword [ebp - 4], 0
cmp dword [0x534ad0], 0
mov ebx, eax
jne 0x4a0548
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a05f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x50f194
push edi
call esi
test eax, eax
je 0x4a05f9
push eax
call fcn.00497f7c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x534ad0], eax
call esi
push eax
call fcn.00497f7c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x534ad4], eax
call esi
push eax
call fcn.00497f7c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x534ad8], eax
call esi
push eax
call fcn.00497f7c
pop ecx
mov dword [0x534ae0], eax
test eax, eax
je 0x4a0548
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00497f7c
pop ecx
mov dword [0x534adc], eax
mov eax, dword [0x534adc]
cmp eax, ebx
je 0x4a05a0
cmp dword [0x534ae0], ebx
je 0x4a05a0
push eax
call fcn.00497ff8
push dword [0x534ae0]
mov esi, eax
call fcn.00497ff8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4a05a0
test edi, edi
je 0x4a05a0
call esi
test eax, eax
je 0x4a0597
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a0597
test byte [ebp - 0xc], 1
jne 0x4a05a0
or dword [ebp + 0x10], 0x200000
jmp 0x4a05d9
mov eax, dword [0x534ad4]
cmp eax, ebx
je 0x4a05d9
push eax
call fcn.00497ff8
pop ecx
test eax, eax
je 0x4a05d9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4a05d9
mov eax, dword [0x534ad8]
cmp eax, ebx
je 0x4a05d9
push eax
call fcn.00497ff8
pop ecx
test eax, eax
je 0x4a05d9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x534ad0]
call fcn.00497ff8
pop ecx
test eax, eax
je 0x4a05f9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a05fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret