joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444547
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x473020]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x44458b
cmp word [edx], bx
jne 0x44458b
or byte [edi + eax + 0x28], 4
jmp 0x444590
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4446e4
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4446c4
cmp ax, word [ebp - 0x10]
je 0x4445c9
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4446b9
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4445ef
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4445df
push ecx
pop eax
push 4
jmp 0x4445e4
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4446b3
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4446aa
cmp dword [ebp - 0x18], 0
je 0x4446aa
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x473020]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x444676
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x44463a
mov word [esi], ax
jmp 0x44466e
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x473020]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x473020]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x473020]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4446b9
cmp word [ebp - 4], ax
jne 0x44468b
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x44468b
mov word [esi], ax
add esi, 2
jmp 0x4446b9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0043a617
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4446b6
jmp 0x4446ad
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4445a9
jmp 0x4446e4
mov ecx, dword [ecx*4 + 0x473020]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4446db
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4446e4
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4496b6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00449358
Function at 0x6d3c4990
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
mov dword [esp], eax
call fcn.6d3e4e30
mov eax, dword [edi + 0x1c]
movzx edx, si
lea ecx, [edx + edx*2]
lea esi, [eax + ecx*8]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x6d3c4ae0
shl edx, 6
add eax, edx
mov edx, dword [eax]
mov dword [ebx], edx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov edx, dword [eax + 8]
mov dword [ebx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov edx, dword [eax + 0x10]
mov dword [ebx + 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [ebx + 0x14], edx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x18], edx
mov edx, dword [eax + 0x1c]
mov dword [ebx + 0x1c], edx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x20], edx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x24], edx
mov edx, dword [eax + 0x28]
mov dword [ebx + 0x28], edx
mov edx, dword [eax + 0x2c]
mov dword [ebx + 0x2c], edx
mov edx, dword [eax + 0x30]
mov dword [ebx + 0x30], edx
mov edx, dword [eax + 0x34]
mov dword [ebx + 0x34], edx
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x38], edx
mov eax, dword [eax + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x44], eax
movzx edx, byte [esi + 4]
mov ecx, edx
and ecx, 3
jne 0x6d3c4aa0
movzx ecx, byte [esi + 7]
mov edx, 8
shr cl, 7
shl edx, cl
mov ecx, edx
xor edx, edx
sar ecx, 3
div ecx
xor edx, edx
mov dword [ebx + 0x44], eax
movzx ecx, byte [esi + 4]
shr cl, 2
and ecx, 7
div ecx
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov esi, dword [ebp - 0x1c]
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], edx
movzx eax, word [esi + 0x30]
mov dword [ebx + 0x50], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
mov dword [esp], eax
call fcn.6d3e4e50
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp cl, 2
jne 0x6d3c4a6b
movzx ecx, byte [esi + 6]
shr dl, 2
and edx, 7
shr cl, 7
movzx edi, cl
movzx ecx, byte [esi + 7]
and ecx, 0x7f
add ecx, ecx
or ecx, edi
lea edi, [ecx + 0x16]
add ecx, 0x10
imul edi, edx
xor edx, edx
div edi
imul eax, ecx
add eax, eax
mov dword [ebx + 0x44], eax
jmp 0x6d3c4a6b
mov ecx, 0x10
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x6d3c4a29
Function at 0x6d3c6fd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
test eax, eax
je 0x6d3c6ff0
pop ebp
movzx edx, dx
jmp fcn.6d3c4990
mov eax, 1
pop ebp
ret
Function at 0x6d3c8ad0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x6d3e9044]
push ebp
mov ebp, esp
push ebx
cmp eax, 0x9bf
ja 0x6d3c8b1b
mov ecx, dword [eax + section..bss]
lea edx, [eax + 4]
mov dword [0x6d3e9044], edx
mov edx, ecx
mov ebx, dword [ebp - 4]
leave
shr edx, 0xb
xor edx, ecx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
cmp eax, 0x9c0
jne 0x6d3c8c57
mov ebx, dword [section..bss]
xor edx, edx
nop
and ebx, 0x80000000
mov ecx, ebx
mov ebx, dword [edx*4 + 0x6d3fb004]
mov eax, ebx
and eax, 0x7fffffff
or eax, ecx
mov ecx, eax
and eax, 1
shr ecx, 1
xor ecx, dword [edx*4 + 0x6d3fb634]
neg eax
and eax, 0x9908b0df
xor ecx, eax
mov dword [edx*4 + section..bss], ecx
add edx, 1
cmp edx, 0xe3
jne 0x6d3c8b30
movdqa xmm5, xmmword [0x6d3ec460]
mov eax, 0x6d3fb38c
movdqa xmm4, xmmword [0x6d3ec470]
movdqa xmm3, xmmword [0x6d3ec480]
nop
movdqa xmm1, xmmword [eax + 4]
add eax, 0x10
movdqu xmm0, xmmword [eax - 0x10]
pand xmm1, xmm5
pand xmm0, xmm4
por xmm1, xmm0
movdqa xmm2, xmm1
pand xmm1, xmm3
movdqa xmm0, xmm1
psrld xmm2, 1
pxor xmm2, xmmword [eax - 0x39c]
pslld xmm0, 3
paddd xmm0, xmm1
pslld xmm0, 9
paddd xmm0, xmm1
pslld xmm0, 5
paddd xmm0, xmm1
pslld xmm0, 2
psubd xmm0, xmm1
pslld xmm0, 3
psubd xmm0, xmm1
movdqa xmm6, xmm0
pslld xmm6, 4
paddd xmm0, xmm6
pslld xmm0, 5
psubd xmm0, xmm1
pxor xmm2, xmm0
movups xmmword [eax - 0x10], xmm2
cmp eax, 0x6d3fb9bc
jne 0x6d3c8b90
mov ecx, dword [section..bss]
mov eax, dword [0x6d3fb9bc]
mov edx, ecx
and edx, 0x7fffffff
and eax, 0x80000000
or eax, edx
mov edx, eax
and eax, 1
shr edx, 1
xor edx, dword [0x6d3fb630]
neg eax
and eax, 0x9908b0df
xor eax, edx
mov edx, 4
mov dword [0x6d3fb9bc], eax
jmp 0x6d3c8ae9
xor eax, eax
xor edx, edx
lea esi, [esi]
nop
imul eax, eax, 0x7ff8a3ed
add eax, 0x2aa01d31
mov ecx, eax
rol ecx, 0x10
xor ecx, 0x31415926
mov dword [edx*4 + section..bss], ecx
add edx, 1
cmp edx, 0x270
jne 0x6d3c8c60
jmp 0x6d3c8b26
Function at 0x6d3e4ea0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movd xmm0, dword [ebp + 0x10]
mov dword [esp], 0xc
movd xmm1, dword [ebp + 0xc]
punpckldq xmm1, xmm0
movq qword [ebp - 0x10], xmm1
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x6d3e4f0d
mov edx, dword [ebp + 8]
movq xmm1, qword [ebp - 0x10]
movq qword [eax + 4], xmm1
mov dword [eax], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x6d3e3d30
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
leave
ret
Function at 0x6d3e82d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x6d3fbb00]
test eax, eax
je 0x6d3e8388
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x6d3e8310
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x6d3e82fc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x6d3e83bd
mov dword [esp + 4], 0x6d3fad58
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x6d3fbb00], eax
test eax, eax
jne 0x6d3e82ed
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x6d3e82fe
Function at 0x10001640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1003e014]
xor eax, esp
mov dword [esp + 0x10], eax
sub dword [ebp + 0xc], 1
push edi
jne 0x100016b7
call fcn.10008330
call fcn.100011e0
mov ecx, dword [0x1003fe34]
mov byte [esp + 8], 0xe9
mov eax, dword [ecx + 4]
mov dword [0x1003fe3c], eax
mov eax, 0x1000eb60
mov edi, dword [ecx]
sub eax, edi
sub eax, 5
mov dword [esp + 9], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 8]
mov dword [edi], eax
mov al, byte [esp + 0xc]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x14]
mov eax, 1
pop edi
xor ecx, esp
call fcn.1001021d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000a240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x1003e014]
xor eax, esp
mov dword [esp + 0x48], eax
cmp byte [0x1003fe38], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x1000a2c9
push str.__module.
push edi
push str.Unauthorized_registration_attempt_of__
lea ecx, [esp + 0x18]
call fcn.100017a0
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.1000a650
add esp, 4
lea ecx, [esp + 0x40]
mov edx, eax
call fcn.1000a700
add esp, 4
lea ecx, [esp + 0x24]
call fcn.100016d0
lea ecx, [esp + 0xc]
call fcn.100016d0
push 0x10
push str.Module_loading_failed
lea ecx, [esp + 0x44]
call fcn.10003ea0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x22d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, dword [0x1003fe40]
mov esi, dword [ebx]
cmp esi, ebx
je 0x1000a2e8
lea ecx, [esi + 8]
push edi
call fcn.1000a430
test eax, eax
jns 0x1000a315
mov esi, dword [esi]
cmp esi, ebx
jne 0x1000a2d5
push edi
push ebx
call fcn.1000a930
cmp byte [edi + 0x48], 0
je 0x1000a2fa
call fcn.10009a60
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
mov byte [0x1003fe38], 0
call fcn.1001021d
mov esp, ebp
pop ebp
ret 4
push edi
lea ecx, [esi + 8]
call fcn.1000a430
test eax, eax
jle 0x1000a331
push edi
push esi
call fcn.1000a930
cmp byte [edi + 0x48], 0
jne 0x1000a2f5
jmp 0x1000a2fa
push str.__found._Make_sure_you_are_running_just_one_version_of_this_module__check_Modules_directory_.
push edi
push str.Duplicated_module__
lea ecx, [esp + 0x18]
call fcn.100017a0
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.1000a650
add esp, 4
lea ecx, [esp + 0x28]
mov edx, eax
call fcn.1000a700
add esp, 4
lea ecx, [esp + 0x3c]
call fcn.100016d0
lea ecx, [esp + 0xc]
call fcn.100016d0
push 0x10
push str.Module_loading_failed
lea ecx, [esp + 0x2c]
jmp 0x1000a2b0
Function at 0x1000f581
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1000f55d
pop esi
leave
ret 8

Function at 0x1002104f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033180
push 0x10033178
push str.FlsAlloc
push 0x1e
call fcn.10020f19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10021083
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002f144]
call esi
jmp 0x10021089
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100210cd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10033190
push 0x10033188
push str.FlsGetValue
push 0x20
call fcn.10020f19
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10021104
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002f144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10024a3b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10024ad8
push ebx
push esi
call fcn.10024a04
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002379b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10024a85
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10024ad7
push edi
push eax
call fcn.1001ed32
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10024aa5
call fcn.1001ecf8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10024ad6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002379b
add esp, 0x20
test eax, eax
jne 0x10024ac4
push edi
call fcn.1001ecf8
jmp 0x10024acc
push ebx
call fcn.1001ecf8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1002c600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002c62d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002c62d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b65e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
or edx, ecx
or ecx, ecx
sub ecx, ecx
call fcn.0043b693
add ecx, edx
mov edx, edx
dec ecx
xor dword [edi], eax
add edx, 1
sub edx, 1
inc edi
or edx, ecx
cmp edi, esi
jne fcn.0043b65e
mov edx, 0x739f008a
ret
Function at 0x48edd4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9b30]
jne 0x48edde
repz ret
jmp fcn.00493887

Function at 0x491a11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048bfb2
and dword [ebp - 0x14], 0
cmp dword [0x4acb0c], 0
mov dword [ebp - 0x18], eax
jne 0x491ac4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x491b6c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x491b6c
mov esi, dword [fcn.00487fe0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acb0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acb10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acb14], eax
call edi
push eax
call esi
mov dword [0x4acb1c], eax
test eax, eax
je 0x491ac4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acb18], eax
mov eax, dword [0x4acb18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00487fe4]
cmp eax, ecx
je 0x491b1d
cmp dword [0x4acb1c], ecx
je 0x491b1d
push eax
call esi
push dword [0x4acb1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x491b1d
test ebx, ebx
je 0x491b1d
call edi
test eax, eax
je 0x491b14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x491b14
test byte [ebp - 8], 1
jne 0x491b1d
or dword [ebp + 0x10], 0x200000
jmp 0x491b50
mov eax, dword [0x4acb10]
cmp eax, dword [ebp - 0x18]
je 0x491b50
push eax
call esi
test eax, eax
je 0x491b50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491b50
mov eax, dword [0x4acb14]
cmp eax, dword [ebp - 0x18]
je 0x491b50
push eax
call esi
test eax, eax
je 0x491b50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acb0c]
call esi
test eax, eax
je 0x491b6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x491b6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048edd4
leave
ret

Function at 0x484ce6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x484a08
sub edi, edi
call fcn.00484d22
and edi, edi
and edi, edi
add ebx, 0x799bbcce
xor dword [esi], ecx
mov edi, 0x737c4a9f
sub edi, 0x1759ca7d
sub edi, ebx
add esi, 2
mov edi, ebx
mov edi, 0xbfd33886
cmp esi, eax
jl fcn.00484ce6
inc ebx
ret
Function at 0x510a76
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005108f5

Function at 0x51382b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005134eb

Function at 0x51e82c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x40f140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f16d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f16d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4738bf
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4735cc
mov edx, 0x5fbcff72
call fcn.00473903
sub esp, 4
mov dword [esp], 0xeeb06619
pop edx
xor dword [ecx], edi
and edx, ebx
sub ebx, edx
add ecx, 2
and edx, ebx
and ebx, edx
cmp ecx, esi
jl fcn.004738bf
sub edx, 1
add edx, 0x2bac9fa4
sub esp, 4
mov dword [esp], edx
pop ebx
ret

Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret