joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006d40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xa8
cmp eax, 0x40
jbe 0x10006d54
mov eax, 0x40
push ebp
xor edx, edx
push esi
push edi
test eax, eax
jbe 0x10006d7d
mov esi, dword [esp + 0xb8]
mov ecx, eax
mov edx, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp eax, 0x40
rep movsb byte es:[edi], byte [esi]
jae 0x10006d98
mov ecx, 0x40
lea edi, [esp + edx + 0xc]
sub ecx, edx
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xc4]
cmp esi, 0x40
jbe 0x10006da9
mov esi, 0x40
xor ecx, ecx
test esi, esi
jbe 0x10006dd2
mov edi, dword [esp + 0xc0]
lea eax, [esp + 0xc]
push ebx
sub edi, eax
mov bl, byte [esp + ecx + 0x10]
lea eax, [esp + ecx + 0x10]
mov dl, byte [edi + eax]
xor bl, dl
inc ecx
cmp ecx, esi
mov byte [eax], bl
jb 0x10006dbd
pop ebx
lea eax, [esp + 0x4c]
push eax
call fcn.100061d0
lea ecx, [esp + 0xc]
push 0x40
lea edx, [esp + 0x50]
push ecx
push edx
call fcn.10006200
lea esi, [esp + 0x54]
mov edi, 4
mov ebp, dword [esp + 0xc8]
lea ecx, [ebp + 1]
mov al, byte [esi]
mov edx, dword [esi]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 8
mov byte [ecx], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 1], al
mov byte [ecx + 2], dl
add esi, 4
add ecx, 4
dec edi
jne 0x10006e00
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0xa8
ret 0x14
Function at 0x10006e40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
sub esp, 0xfc
cmp edx, 0x40
jbe 0x10006e6d
mov ecx, dword [esp + 0x108]
lea eax, [esp + 4]
push eax
push edx
push ecx
call sym.iKeyAPI.dll_MD5_Hash
lea ecx, [esp + 4]
mov edx, 0x10
jmp 0x10006e74
mov ecx, dword [esp + 0x108]
push ebx
push ebp
xor eax, eax
push esi
test edx, edx
push edi
jbe 0x10006eb2
lea esi, [esp + 0x8c]
lea edi, [esp + 0xcc]
sub esi, ecx
sub edi, ecx
mov ebp, edx
mov dword [esp + 0x10], edx
mov al, byte [ecx]
mov bl, al
xor al, 0x5c
xor bl, 0x36
mov byte [edi + ecx], al
mov byte [esi + ecx], bl
inc ecx
dec ebp
jne 0x10006e96
cmp edx, 0x40
jae 0x10006ef1
mov eax, dword [esp + 0x10]
mov edx, 0x40
lea edi, [esp + eax + 0xcc]
sub edx, eax
lea esi, [esp + eax + 0x8c]
mov ecx, edx
mov eax, 0x5c5c5c5c
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, edx
mov eax, 0x36363636
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x24]
push eax
call fcn.100061d0
lea ecx, [esp + 0x8c]
push 0x40
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.10006200
mov eax, dword [esp + 0x120]
test eax, eax
je 0x10006f47
lea esi, [esp + 0x2c]
mov edi, 4
mov cl, byte [esi]
add esi, 4
mov byte [eax], cl
mov ecx, dword [esi - 4]
mov edx, ecx
inc eax
shr edx, 8
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
inc eax
dec edi
jne 0x10006f23
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.10006200
lea eax, [esp + 0x24]
mov ebp, dword [esp + 0x128]
push eax
push ebp
call fcn.100062b0
lea ecx, [esp + 0x24]
push ecx
call fcn.100061d0
lea edx, [esp + 0xcc]
push 0x40
lea eax, [esp + 0x28]
push edx
push eax
call fcn.10006200
mov eax, dword [esp + 0x124]
test eax, eax
je 0x10006fc9
lea esi, [esp + 0x2c]
mov edi, 4
mov cl, byte [esi]
add esi, 4
mov byte [eax], cl
mov ecx, dword [esi - 4]
mov edx, ecx
inc eax
shr edx, 8
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
inc eax
dec edi
jne 0x10006fa5
push 0x10
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.10006200
lea ecx, [esp + 0x24]
push ecx
push ebp
call fcn.100062b0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xfc
ret 0x1c
Function at 0x8ee9c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xf55a8f
jmp 0xf344bd
jmp 0xf3ef5a
push edx
mov edx, esp
add edx, 4
add edx, 4
jmp 0xf3efbc
push dword [ebp - 0xc]
push dword [esp]
mov eax, dword [esp]
add esp, 4
jmp 0xf3eef5
xchg dword [esp], edx
pop esp
jmp 0xf3efc5
jmp 0xf593ae
jmp 0xf3f9ee
cpuid
jmp 0xf3fa53
jmp 0xf5b39c
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ecx
mov dword [esp], 0xf5f0ab3
mov dword [esp], ecx
mov dword [esp], edx
jmp 0xf41142
jmp 0xf4b2f8
jmp 0xf41df5
rdtsc
jmp 0xf41ea2
jmp 0xf47493
jmp 0xf4248f
push ebx
push eax
push 0x1b9c833a
pop eax
mov dword [esp + 4], eax
pop eax
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0xf424f4
jmp 0xf46db7
jmp 0xf42b5d
cpuid
jmp 0xf42b64
jmp 0xf5bba9
push edx
push esi
push 0x3fdece2f
pop esi
mov dword [esp + 4], esi
mov esi, dword [esp]
add esp, 4
mov dword [esp], ecx
jmp 0xf43181
jmp 0xf41023
jmp 0xf43439
sub esp, 4
mov dword [esp], esi
push 0
pop esi
mov eax, esi
push dword [esp]
pop esi
add esp, 4
jmp 0xf434eb
jmp 0xf3f92f
jmp 0xf437fa
cpuid
jmp 0xf4384c
jmp 0xf433e7
jmp 0xf46d4d
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
jmp 0xf46db2
push ecx
mov dword [esp], esp
add dword [esp], 4
mov ebp, dword [esp]
jmp 0xf46d33
jmp 0xf4bc49
jmp 0xf46eb9
push esi
mov dword [esp], 0x7e64950b
mov dword [esp], eax
push edi
mov edi, 0
mov dword [esp + 4], edi
pop edi
pop eax
jmp 0xf46ed5
jmp 0xf4375b
push edx
push ebx
mov ebx, 0x137e0e8d
mov dword [esp + 4], ebx
pop ebx
mov dword [esp], edi
mov dword [esp], eax
pop dword [ebp - 0xc]
jmp 0xf475b9
jmp 0xf4928d
jmp 0xf49335
push ecx
mov dword [esp], edi
mov dword [esp], 0x63d7fe78
mov dword [esp], eax
mov dword [esp], edx
pop dword [ebp - 8]
jmp 0xf493aa
jmp 0xf3eea3
rdtsc
jmp 0xf4b408
jmp 0xf5e15a
jmp 0xf4bd75
push ecx
mov ecx, 0x14
add eax, 0x7fff6165
sub eax, ecx
sub eax, 0x7fff6165
pop ecx
xchg dword [esp], eax
mov esp, dword [esp]
jmp 0xf4bd89
push 0x5fa223db
mov dword [esp], eax
mov eax, esp
add eax, 4
jmp 0xf4bd57
jmp 0xf4feb8
jmp 0xf4ff68
pop ecx
mov dword [esp], ebx
jmp 0xf4ffd1
push esi
mov dword [esp], edx
push ecx
push 0x2bface86
pop ecx
mov dword [esp + 4], ecx
jmp 0xf4ff5f
jmp 0xf43053
jmp 0xf537f1
cpuid
jmp 0xf538ae
jmp 0xf41d8f
jmp 0xf55af6
push 0x1af04e43
mov dword [esp], edi
push edi
push 0x47df6a7e
pop edi
mov dword [esp + 4], edi
pop edi
mov dword [esp], ebp
jmp 0xf55bbb
jmp 0xf46c77
jmp 0xf59450
push dword [ebp - 8]
mov ebx, dword [esp]
push esi
mov dword [esp], 0x1750559
mov dword [esp], eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
jmp 0xf594d1
jmp 0xf3446b
push ebp
push 0
mov ebp, dword [esp]
add esp, 4
push ebp
mov eax, dword [esp]
add esp, 4
pop ebp
jmp 0xf5b4b2
jmp 0xf42a5f
push 0
push dword [esp]
mov eax, dword [esp]
add esp, 4
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0xf5bcd1
jmp 0xf5379b
jmp 0xf5e1b5
push ebp
mov dword [esp], ebx
push ebp
mov ebp, 0x54e77e96
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0xf5e264
jmp 0xf423da
Function at 0x4019b2
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x407270
call fcn.00402ca0
mov edi, 0x94
mov eax, edi
call fcn.00401730
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x409970], ecx
mov eax, dword [esi + 4]
mov dword [0x40997c], eax
mov edx, dword [esi + 8]
mov dword [0x409980], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x409974], esi
cmp ecx, 2
je 0x401a12
or esi, 0x8000
mov dword [0x409974], esi
shl eax, 8
add eax, edx
mov dword [0x409978], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401a4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a4d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401a65
cmp eax, 0x20b
je 0x401a52
mov dword [ebp - 0x1c], esi
jmp 0x401a79
cmp dword [ecx + 0x84], 0xe
jbe 0x401a4d
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401a73
cmp dword [ecx + 0x74], 0xe
jbe 0x401a4d
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00402c4c
pop ecx
test eax, eax
jne 0x401a8d
push 0x1c
call fcn.0040198e
pop ecx
call fcn.00402b43
test eax, eax
jne 0x401a9e
push 0x10
call fcn.0040198e
pop ecx
call fcn.004028dd
mov dword [ebp - 4], esi
call fcn.004026df
test eax, eax
jge 0x401ab7
push 0x1b
call fcn.00401969
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40a134], eax
call fcn.004025bd
mov dword [0x409914], eax
call fcn.0040251b
test eax, eax
jge 0x401add
push 8
call fcn.00401969
pop ecx
call fcn.004022e8
test eax, eax
jge 0x401aee
push 9
call fcn.00401969
pop ecx
push 1
call fcn.00401e0a
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401b04
push eax
call fcn.00401969
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040228b
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x401b25
movzx eax, word [ebp - 0x40]
jmp 0x401b28
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401090
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401b46
push edi
call fcn.00401f37
call fcn.00401f59
jmp 0x401b78
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00402cdb
ret
Function at 0x401b87
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x401bb5
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x401bbc
cmp ebx, dword [eax + 4]
jae 0x401bbc
xor eax, eax
jmp 0x401dac
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x401bcd
xor eax, eax
inc eax
jmp 0x401dab
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x401be3
cmp ecx, edx
jae 0x401d28
cmp dword [eax + 4], 0
je 0x401bec
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x401bd4
cmp dword [ebp + 8], 0
je 0x401c0e
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x401d28
cmp eax, esi
jae 0x401d28
mov eax, dword [0x409920]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x401c33
cmp dword [esi*4 + 0x409928], edi
je 0x401d2c
inc esi
cmp esi, eax
jl 0x401c21
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x401da8
cmp dword [ebp - 8], 0x1000000
jne 0x401da8
test byte [ebp - 0xc], 0xcc
je 0x401cb1
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x401da8
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401da8
cmp word [eax + 0x18], 0x10b
jne 0x401da8
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x401da8
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x401cb1
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x401cb1
test byte [ecx + 0x27], 0x80
jne 0x401d28
push 1
push 0x409968
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x401bc5
mov ecx, dword [0x409920]
test ecx, ecx
mov edx, ecx
jle 0x401ce5
lea eax, [ecx*4 + 0x409924]
cmp dword [eax], edi
je 0x401ce5
dec edx
sub eax, 4
test edx, edx
jg 0x401cd9
test edx, edx
jne 0x401d16
push 0xf
pop ebx
cmp ecx, ebx
jg 0x401cf2
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x401d0a
lea eax, [edx*4 + 0x409928]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x401cf8
cmp ecx, 0x10
jge 0x401d16
inc ecx
mov dword [0x409920], ecx
push 0
push 0x409968
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x401bc5
xor eax, eax
jmp 0x401dab
test esi, esi
jle 0x401bc5
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x409968
call ebx
test eax, eax
jne 0x401bc5
cmp dword [esi*4 + 0x409928], edi
je 0x401d82
mov eax, dword [0x409920]
lea esi, [eax - 1]
test esi, esi
jl 0x401d70
cmp dword [esi*4 + 0x409928], edi
je 0x401d6c
dec esi
jns 0x401d60
test esi, esi
jge 0x401d80
cmp eax, 0x10
jge 0x401d7b
inc eax
mov dword [0x409920], eax
lea esi, [eax - 1]
jmp 0x401d82
je 0x401d9a
xor ecx, ecx
test esi, esi
jl 0x401d9a
lea eax, [ecx*4 + 0x409928]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x401d88
push 0
push 0x409968
call ebx
jmp 0x401bc5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401e74
Capabilities:
Terminate process

Disassembly:
push 8
push 0x407298
call fcn.00402ca0
push 8
call fcn.00402e3f
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4099b0], esi
jne 0x401ea8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4099ac], esi
mov al, byte [ebp + 0x10]
mov byte [0x4099a8], al
cmp dword [ebp + 0xc], edi
jne 0x401ef2
cmp dword [0x40a128], edi
je 0x401ee2
mov eax, dword [0x40a124]
sub eax, 4
mov dword [0x40a124], eax
cmp eax, dword [0x40a128]
jb 0x401ee2
mov eax, dword [eax]
cmp eax, edi
je 0x401ec3
call eax
jmp 0x401ec3
push 0x409020
mov eax, 0x40901c
call fcn.00401df2
pop ecx
push 0x409028
mov eax, 0x409024
call fcn.00401df2
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x401f23
cmp dword [ebp + 0x10], edi
jne 0x401f31
mov dword [0x4099b0], esi
push dword [ebp + 8]
call fcn.00401db0
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x401f30
push 8
call fcn.00402d8a
pop ecx
ret
call fcn.00402cdb
ret

Function at 0x401f77
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4092c0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x409048]
je 0x401fac
inc eax
cmp eax, 0x13
jb 0x401f9d
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x409048]
jne 0x4020d2
mov eax, dword [0x40991c]
cmp eax, 1
je 0x4020aa
cmp eax, edx
jne 0x401fdc
cmp dword [0x409044], 1
je 0x4020aa
cmp ecx, 0xfc
je 0x4020d2
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402012
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00403060
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00403290
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x402046
mov eax, edi
push eax
call fcn.00403290
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x407690
push edi
call fcn.00403160
add esp, 0x10
push edi
call fcn.00403290
push dword [esi + 0x40904c]
mov ebx, eax
call fcn.00403290
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00401730
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00403060
push edi
push ebx
call fcn.00403070
push 0x407670
push ebx
call fcn.00403070
push dword [esi + 0x40904c]
push ebx
call fcn.00403070
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00402f62
add esp, 0x2c
jmp 0x4020d2
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x40904c]
push dword [esi]
call fcn.00403290
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040334c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x402f62
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x409c28], ebx
push esi
push edi
jne 0x402fe2
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40301d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40779c
push edi
call esi
test eax, eax
mov dword [0x409c28], eax
je 0x40301d
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x409c2c], eax
call esi
cmp dword [0x409970], 2
mov dword [0x409c30], eax
jne 0x402fe2
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x409c38], eax
je 0x402fe2
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x409c34], eax
mov eax, dword [0x409c34]
test eax, eax
je 0x403027
call eax
test eax, eax
je 0x40300e
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x409c38]
test eax, eax
je 0x40300e
test byte [ebp - 8], 1
jne 0x403027
cmp dword [0x40997c], 4
jb 0x403021
or byte [ebp + 0x12], 0x20
jmp 0x403046
xor eax, eax
jmp 0x403056
or byte [ebp + 0x12], 4
jmp 0x403046
mov eax, dword [0x409c2c]
test eax, eax
je 0x403046
call eax
mov ebx, eax
test ebx, ebx
je 0x403046
mov eax, dword [0x409c30]
test eax, eax
je 0x403046
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x409c28]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405f39
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00401730
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405fd4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x409970]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x405fd4
cmp eax, 1
je 0x405ff5
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x405fd4
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x405fa1
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x405fd0
xor eax, eax
inc eax
jmp 0x406014
cmp edi, eax
jae 0x405fd8
xor eax, eax
jmp 0x406014
cmp eax, esi
jae 0x405fdf
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x409970]
jmp 0x405ff8
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430e5b
Capabilities:
Encode data using add xor sub operations

Disassembly:
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
adc ecx, esp
mov eax, 0x3f3ad44d
aas
push edx
fnstcw word [edx + 0x2eb90412]
lodsb al, byte cs:[esi]
sbb byte [esi + 0x193fab49], al

Function at 0x430e63
Capabilities:
Encode data using add xor sub operations

Disassembly:
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
adc ecx, esp
mov eax, 0x3f3ad44d
aas
push edx
fnstcw word [edx + 0x2eb90412]
lodsb al, byte cs:[esi]
sbb byte [esi + 0x193fab49], al

Function at 0x479f67
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
mov byte [edx - 0x13ce06ee], ch
jae 0x479fae
jge 0x479f0e
mov ah, 0x54
popal
cmp dword [esi - 0x72], ecx
mov ss, esp
xchg edx, eax
popfd
push ecx
xchg ecx, eax
mov eax, dword [ecx]
pop esp
jle 0x479f7e
out 0x10, eax
jbe 0x479f25
int 0x18
mov ch, byte [esi + 0x5185254a]
xchg byte [esi], cl
jo 0x479fb4
cld
dec eax
jmp [ebx + 0x1f5eccd6]
pushal
cli
aad 0x34
js 0x479fbd
test eax, 0x58188a20
test byte [edx + 0x66], dh
aam 5
lahf
add al, 0x83
out dx, al
add eax, 0xee83049f
loope 0x479f82
pop eax
lahf
mov esi, 0xf1fc9bfb
cwde
add dword [ecx], esi
call 0x3bc2831a
test byte [edx + 0x7b90aff4], ah
and byte [edi + 0x1e6d3906], ch
in eax, dx
mov ss, word [ebx + 0x10]
dec eax
xchg esi, eax
test al, 0x42
movsd dword es:[edi], dword [esi]
mov esp, 0x80be4439
inc eax
cmpsb byte [esi], byte es:[edi]
inc esi
and eax, 0xb09ca7c3
jecxz 0x47a027
imul ebx, dword [esi + 0x3e], 0xffffffc7
xchg byte [edx - 0x92ff49b], ch
inc ecx
jmp 0x47a01d
inc esi
mov ds, word [ecx - 0x22]
jmp 0x47a088
dec esi
aad 0x58
retf
clc
or dword [ecx - 0x48300ab7], edi
cwde
sub bh, byte [esi]
fcomp qword [ebx]
fldcw word [edi - 0x7bf6b8b3]
dec edx
mov ah, 0x7d
invalid
Function at 0x4c5f51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cd390
cmp edx, dword [eax]
je 0x4c5f73
add eax, 8
inc ecx
cmp eax, 0x4cd420
jl 0x4c5f64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cd390]
jne 0x4c60a1
mov eax, dword [0x4d2dc0]
cmp eax, 1
je 0x4c607b
test eax, eax
jne 0x4c5fa4
cmp dword [0x4cd2bc], 1
je 0x4c607b
cmp edx, 0xfc
je 0x4c60a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c5fdb
lea eax, [ebp - 0x1a4]
push 0x4cb6b8
push eax
call fcn.004c6930
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c6dc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c601e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c6dc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cb6b4
push edi
call fcn.004c8c90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cb698
push eax
call fcn.004c6930
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c6940
lea eax, [ebp - 0xa0]
push 0x4cb694
push eax
call fcn.004c6940
push dword [esi + 0x4cd394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c6940
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cb66c
push eax
call fcn.004c8c04
add esp, 0x2c
pop edi
jmp 0x4c60a1
lea eax, [ebp + 8]
lea esi, [esi + 0x4cd394]
push 0
push eax
push dword [esi]
call fcn.004c6dc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret