joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451150
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x484db8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x9e
push eax
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xa2]
push eax
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xb8], ebx
call fcn.0043e970
add esp, 0xc
lea eax, [ebp - 0xb4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0xb4]
push eax
push dword [ebx]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
add dword [ebp - 0xb4], 0xa
sub dword [ebp - 0xac], 0xa
push 0x50
lea eax, [ebp - 0xa4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0xa4], 0
je 0x451347
push edi
push 0x4767e0
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0xfffffffffffffff0
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
call esi
push 0xffffffffffffffec
push dword [ebp - 0xbc]
mov edi, eax
call esi
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0xac]
push 0xffffffffffffffff
push dword [ebx]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0xb4]
sub eax, ecx
push eax
push edx
shr edi, 0x10
push ecx
and edi, 0xff7faffc
or edi, 0x50000000
push edi
lea eax, [ebp - 0xa4]
push eax
push str.STATIC
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x451346
mov eax, dword [ebp - 0xb8]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x31
push dword [eax]
call esi
push 1
push eax
push 0x30
push ebx
mov dword [ebp - 0xc8], eax
call esi
push 0x453390
push 0xfffffffffffffffc
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [ebp - 0xb8]
mov esi, dword [sym.imp.USER32.dll_SetPropW]
push str.PROP_STAT_PSKIN
push ebx
mov edi, eax
call esi
push edi
push str.PROP_STAT_OLDPROC
push ebx
call esi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], ecx
test esi, esi
je 0x451316
push dword [ebp - 0xc8]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0xa4]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
push 2
push ecx
push eax
push dword [ebp - 0xb0]
push dword [ebp - 0xb4]
push dword [ebp - 0xbc]
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [eax + 0x14c]
push ebx
call fcn.00450db0
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e8f7
mov esp, ebp
pop ebp
ret
Function at 0x459320
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46948e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x484db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov dword [ebx + 0x7c], edi
mov dword [ebx + 0x80], 0
push 0x4c
push 0
push ebx
mov dword [ebp - 4], 0
call fcn.0043e970
push 0x30
lea esi, [ebx + 0x4c]
push 0
push esi
call fcn.0043e970
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebx + 0x54], 1
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x64], 0x64
mov dword [ebx + 0x68], 0x64
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x34], 0x4000
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 1
mov dword [ebx + 0x48], eax
call fcn.0045d810
mov dword [ebx + 0x58], eax
add esp, 0x1c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45a8e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x45a8ec
pop ebp
ret
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00459740

Function at 0x45baa0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469808
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x484db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
or esi, 0xffffffff
mov dword [ebp - 4], 0
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, esi
je 0x45bb59
push edi
push edi
push edi
push 2
push edi
mov esi, ebx
push ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x45bb59
push 0
push 0
push 0
push 4
mov edi, eax
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
test eax, eax
je 0x45bb59
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ebx
call fcn.0045b840
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp + 0xb], 1
test eax, eax
je 0x45bb5d
push ebx
call eax
jmp 0x45bb5d
mov byte [ebp + 0xb], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x45bb6e
test ebx, ebx
je 0x45bb6e
push edi
call ebx
cmp esi, 0xffffffff
je 0x45bb7a
test ebx, ebx
je 0x45bb7a
push esi
call ebx
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x30], eax
movzx eax, cx
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x45d581
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x45d57a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
push ebx
call fcn.0045bd40
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x45d5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x45d5d3
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.0045d7c0
movzx ebx, word [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x4765a0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x45d622
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x45d60a
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.0045d710
add esp, 8
mov dword [edi], eax
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 0x10]
mov ebx, eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x45d6af
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x45d6af
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x45d6a8
push dword [ebp - 4]
push dword [ebp + 0x10]
push ebx
call fcn.0043ecc0
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push esi
mov dword [ebp + 0x10], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x45d6a1
push eax
push dword [ebp + 0x10]
call fcn.0045d760
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45f3a8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x7863513
call fcn.0045f542
add esp, 0x10
mov dword [ebp - 8], eax
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, 0xffffffff
je 0x45f504
push edi
mov edi, dword [ebp + 0x18]
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call fcn.0045f513
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push eax
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x45f4fc
push esi
push esi
push esi
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x45f4f0
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], ecx
cmp esi, esi
jl 0x45f4cd
jg 0x45f46b
cmp ecx, esi
jbe 0x45f4cd
mov eax, dword [ebp + 0x10]
cdq
mov ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], edx
mov edi, esi
mov eax, esi
jmp 0x45f480
mov ecx, dword [ebp - 0xc]
push edx
push ecx
push eax
push edi
call fcn.0045f770
mov ecx, dword [ebp - 8]
movzx eax, byte [eax + ecx]
push eax
movzx eax, byte [edi + ebx]
push eax
cmp dword [ebp + 0x14], esi
je 0x45f4a2
call fcn.0045f38b
jmp 0x45f4a7
call fcn.0045f378
mov edx, dword [ebp - 0x14]
mov byte [edi + ebx], al
mov eax, dword [ebp - 0x10]
add edi, 1
adc eax, esi
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x45f480
mov ecx, dword [ebp - 0x18]
jg 0x45f4ca
cmp edi, ecx
jb 0x45f47d
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x45f4e6
mov eax, dword [edi + 4]
test eax, eax
je 0x45f4e6
push dword [edi + 8]
push esi
push ecx
push ebx
call eax
add esp, 0x10
mov dword [edi + 0xc], eax
xor esi, esi
push ebx
inc esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push dword [ebp - 8]
call fcn.0043ebe5
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x45f542
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0xc]
call fcn.0043e61d
mov esi, eax
xor eax, eax
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], eax
jle 0x45f581
push ebx
mov ebx, dword [ebp + 8]
sub ebx, esi
lea ecx, [eax + esi]
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov al, byte [edx + eax]
xor al, byte [ebx + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jl 0x45f562
pop ebx
mov eax, esi
pop esi
leave
ret
Function at 0x40d660
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
push edi
lea edi, [esi + eax]
cmp esi, edi
jae 0x40d696
mov al, byte [esi]
push eax
call fcn.0041c410
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x40d678
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x41d480
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41d4a8
cmp dword [esi + 0x78], 0
je 0x41d4a8
push 2
push 3
push esi
call fcn.0041ca60
push dword [ebp + 0xc]
call fcn.0041cee0
add esp, 0x10
jmp 0x41d4b7
push dword [ebp + 0xc]
call fcn.0041cee0
add esp, 4
test esi, esi
je 0x41d4c8
cmp dword [esi + 0x78], 0
je 0x41d4c8
push 3
push esi
call fcn.0041caa0
add esp, 8
pop esi
pop ebp
ret
Function at 0x444030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
xor bl, bl
test edx, edx
je 0x444057
push esi
mov esi, dword [ebp + 0xc]
sub esi, eax
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x444046
pop esi
mov al, bl
shr al, 4
or bl, al
movzx eax, bl
mov ecx, eax
shr ecx, 2
or ecx, eax
mov eax, ecx
shr eax, 1
or eax, ecx
and eax, 1
pop ebx
pop ebp
ret

Function at 0x470350
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47037d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47037d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x48b91c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx di, bl
pushfd
mov edi, 0x406b28
push 0xfef32176
mov byte [esp], bh
mov edi, dword [edi + 0xf5e3b]
pushfd
call fcn.004d0c62
arpl word [eax - 0x1b55da9c], bx
sbb ch, dl
adc edx, 0xefb61cf3
mov bh, 0xc4
movsd dword es:[edi], dword [esi]
cmp al, 0x15
mov ah, 0x24
invalid

Function at 0x4a9d60
Capabilities:
Encode data using xor

Disassembly:
call fcn.004db2a4
pushfd
pushal
lea eax, [eax + 1]
pushfd
jmp 0x4ca2af
call 0x4ad89c
stosb byte es:[edi], al
in eax, dx
mov edx, 0xcd60d59
fcomp qword [ebx]
cld
or al, 0xdc
sbb edi, esp
xor ch, byte [edi]
and byte [esi], 0x63
or edx, dword [eax + edi*4]
mov ecx, 0xed0e5182
mov byte [0xa6c93a89], al
dec ebp
push ds
in eax, 0x42
mov esp, 0x44da8960
bound ebp, qword [esi]
pop eax
lahf
jle 0x4ca2ba
xor ecx, ebx
lodsb al, byte [esi]
cli
imul esp, ebx, 0x2e
and byte [eax - 0x7f64441c], cl
jb 0x4ca358
push eax
outsb dx, byte [esi]
jle 0x4ca36f
iretd
jmp 0x4ca342
scasd eax, dword es:[edi]
retf
push ss
sbb al, 0xd9
and byte [eax + 0x66], al
mov bh, 0x6b
xchg ebx, eax
xchg esp, eax
hlt
pop ss
sub eax, 0x54443a3d
sub dword [ecx - 0x1d6dd6d1], edx
xchg dword [ecx - 0x63a64455], ecx
sti
sbb eax, esp
mov ecx, 0x45dc07f7
scasd eax, dword es:[edi]
or edi, dword [esi - 0x43]
mov dl, 0xa
push edx
sub byte fs:[esi + 0x6a], dl
jo 0x4ca40a
shr byte [eax], 0x68
jo 0x4ca33d
xchg esi, eax
ljmp 0x8918
sub bl, byte [ebx]
in al, dx
sbb dword [ebx + eax*2 - 0x71], 0x4b
adc al, 0xb3
mov byte [edi], cl
mov esp, dword [edi - 0x44]
fcmovb st(0), st(3)
cwde
inc edi
sbb dword gs:[edi + 0x5f], ecx
adc al, 0x42
push edx
and eax, ebp
and al, 0
inc edi
inc edi
mov dword [0xae157557], eax
mov edi, edx
inc ecx
in al, dx
dec esi
test byte [edi + edx - 0x523080c5], dl
fstp xword [edx]
scasb al, byte es:[edi]
invalid

Function at 0x4b8a74
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
call fcn.004e57fb
stosb byte es:[edi], al
jb 0x4b8adb
rol byte ds:[ebx], cl
mov ah, 0x33
idiv dword [eax + 0x44d5203c]
xor eax, esp
invalid
ffree st(2)
xchg dword [esi - 0x16], eax
or dword [ebp - 0x708cb2d3], esi
iretd

Function at 0x4c02ff
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [eax + 0x9d3d8]
call fcn.004ddfc6
jmp 0x4a0e51
Function at 0x4e4ef0
Capabilities:
Encode data using xor

Disassembly:
pushfd
jmp 0x4b1252
pushfd
mov ebx, dword [ebx + 0x301fb]
call fcn.004c95e8
pop ds
out dx, eax
fsubr dword [edi + 0x27]
cmp byte [ebp + 0x83f8337], dl
fbstp tbyte [esi + edi*2]
div dword [ecx - 0x2f]
push ebp
cmp bl, cl
scasb al, byte es:[edi]
and eax, 0x5b8b7da9
or byte [edx], 0x96
enter 0xffffffffffffeea9, 0x18
jp 0x4b1284
fstp xword [esi - 0x13]
in eax, dx
stosb byte es:[edi], al
mov eax, 0xd649ad7b
dec ebx
push ecx
xor al, byte [edx + 0x16]
pop ss
pop ebp
loopne 0x4b128c
invalid
push dword [esp]
xchg dword [esp + 0x34], ebx
push 0x69fa9e76
pushfd
mov dword [esp + 0x38], ebx
mov byte [esp + 0x20], bh
not bl
setns bl
mov byte [esp + 0x1c], 0x9e
mov ebx, 0x45d777
jmp 0x4991b1

Function at 0x4f338a
Capabilities:
Encode data using xor

Disassembly:
push ebp
call fcn.004c46bc
popfd
pop ss
fcomp dword [eax - 0x1b]
invalid
pushal
lea ebx, [ebx + 1]
pushfd
jmp 0x49c287
mov ebx, dword [esp + 0x14]
jmp 0x4be623

Function at 0x4f912a
Capabilities:
Packed with generic packer

Disassembly:
pop eax
jmp 0x4a35ef
or esp, dword [eax + esi*2]
mov ch, 0x65
fstp qword [ebp - 0x1b]
xor al, 0x3f
invalid
mov eax, dword [eax + 0xbdf4e]
call fcn.00499452
nop eax
scasd eax, dword es:[edi]
or ebp, dword [edi + 0x7b0c4b84]
push 0xba2a8827
jecxz 0x4a0e10
pop ds
invalid
push 0x64a2d753
mov byte [esp], cl
xchg dword [esp + 4], eax
jmp 0x4e99b5
xchg dword [esp], eax
pushfd
mov eax, 0x4171b7
pushal
jmp 0x4a0e5c
mov dword [esp + 0x38], edi
pushfd
push 0xfcffc10c
pop edi
call fcn.0049c5dc
nop
jmp 0x48ec2f
Function at 0x401c30
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x24d3354], 0x400
push edi
jne 0x401c7c
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004041a1
push esi
call fcn.00404828
push esi
push esi
call fcn.00404673
push esi
call fcn.004048de
add esp, 0x14
xor edi, edi
cmp edi, 0x16c76
jge 0x401c8e
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x401cb4
inc edi
cmp edi, 0x3003f
jl 0x401c7e
mov eax, dword [0x4b5b6c]
mov dword [0x24d3354], eax
call fcn.0040192c
mov edi, 0x3078f
cmp dword [0x24d3354], 0x51f
jne 0x401ce0
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x401cc8
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x4027b3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4aed8d
call fcn.004aec10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00403489
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.004048ed
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x4027fb
call fcn.0040323d
mov dword [ebx], eax
call fcn.00402ffc
mov ecx, eax
call fcn.004011a5
mov eax, ebx
jmp 0x4027fd
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404f75
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b499c]
jne 0x404f7f
repz ret
jmp fcn.0040b6ac
Function at 0x40fa1e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b499c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040721b
and dword [ebp - 0x14], 0
cmp dword [0x4c0c4c], 0
mov dword [ebp - 0x18], eax
jne 0x40fad1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40fb79
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40fb79
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c0c4c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c0c50], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c0c54], eax
call edi
push eax
call esi
mov dword [0x4c0c5c], eax
test eax, eax
je 0x40fad1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c0c58], eax
mov eax, dword [0x4c0c58]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40fb2a
cmp dword [0x4c0c5c], ecx
je 0x40fb2a
push eax
call esi
push dword [0x4c0c5c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40fb2a
test ebx, ebx
je 0x40fb2a
call edi
test eax, eax
je 0x40fb21
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40fb21
test byte [ebp - 8], 1
jne 0x40fb2a
or dword [ebp + 0x10], 0x200000
jmp 0x40fb5d
mov eax, dword [0x4c0c50]
cmp eax, dword [ebp - 0x18]
je 0x40fb5d
push eax
call esi
test eax, eax
je 0x40fb5d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40fb5d
mov eax, dword [0x4c0c54]
cmp eax, dword [ebp - 0x18]
je 0x40fb5d
push eax
call esi
test eax, eax
je 0x40fb5d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c0c4c]
call esi
test eax, eax
je 0x40fb79
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40fb7b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404f75
leave
ret