joyce8/EMBER2024-capa huggingface dataset:
Function at 0x575cf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5affb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.005a4272
xor eax, eax
mov dword [esi + 0x10], 0x60726c
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi], method.CDC.virtual_0
mov byte [esp + 0x10], cl
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ecx], eax
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
push edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00575df0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x575d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5affdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CDC.virtual_0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
push eax
call fcn.00576a30
lea ecx, [esi + 0x10]
mov dword [esp + 8], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x14], 2
call fcn.005a4ec0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.005a43a7
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x57eaf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x57eb3c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x57eb3c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x57eb26
push eax
call ebp
test ax, ax
jl 0x57eb34
inc esi
add edi, 4
cmp esi, 6
jb 0x57eb18
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.0057e7f0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x582640
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x5826a0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x5826a0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x5826a0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x5826a0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x5826b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x59edec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x59ee0e
cmp dword [edi + 0x3c], 0
jne 0x59ee0e
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005a7ad7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0059ee3b
pop edi
pop esi
pop ebx
ret 8

Function at 0x5a04e9
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5a0521
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0059e3d7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0059e3af
jmp 0x5a052d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5a1bd7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5a1c19
call fcn.005a7ad7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5a1c19
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5a1c10
xor eax, eax
jmp 0x5a1c21
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005a1c27
pop edi
pop esi
pop ebx
ret 4

Function at 0x5a8007
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5a8035
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a8053
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005a7f6d
jmp 0x5a8053
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5a8053
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005a7f6d
test edi, edi
mov eax, edi
jne 0x5a803d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401170
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40212d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.FactoryGame.exe
lea ecx, [ebp - 0x40]
call fcn.004012d0
push str._EpicPortal
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004012d0
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
push 5
cmova ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0xf
push 0
cmova eax, dword [ebp - 0x40]
push ecx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x401212
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401208
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40124a
push ecx
push edx
call fcn.00401419
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x40125a
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401250
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401250
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401419
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004013db
mov esp, ebp
pop ebp
ret

Function at 0x401c7b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401cba
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401cba
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401cba
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401cba
cmp dword [ecx + 0x74], 0xe
jbe 0x401cba
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100069ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x10043770]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0xc
mov eax, 0x100341c1
call fcn.100108ec
xor esi, esi
mov dword [ebp - 0x10], esi
push 0x20019
push 0x100355b0
push 0x80000002
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.10005767
test eax, eax
je 0x10006a21
lea ecx, [ebp - 0x10]
call fcn.10005750
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.1000f60a
add ebp, 0x244
leave
ret
push 0x206
lea eax, [ebp + 0x3a]
push esi
push eax
mov word [ebp + 0x38], si
call fcn.1000f590
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x100355a0
push dword [ebp - 0x10]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea ecx, [ebp - 0x10]
je 0x10006a77
call fcn.10005750
lea ecx, [ebp - 0x10]
call fcn.10005750
mov eax, esi
jmp 0x100069fe
call fcn.10005750
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.10006768
push esi
push 0x100354e0
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.10005d41
push eax
push esi
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.1000679f
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x10006ab3
lea eax, [ebp + 0x20]
push eax
call fcn.10010ed9
cmp eax, 7
pop ecx
push esi
lea ecx, [ebp + 0x1c]
push ebx
jb 0x10006ad7
call fcn.10005f8e
push esi
push ebx
lea ecx, [ebp]
call fcn.10005f8e
mov esi, ebx
jmp 0x10006a6b
call fcn.10005f8e
push esi
push ebx
lea ecx, [ebp]
call fcn.10005f8e
jmp 0x10006a6b
Function at 0x10006ba9
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x42c
lea ebp, [esp - 4]
mov eax, dword [0x10043770]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push 8
mov eax, 0x1003422e
call fcn.100108ec
mov eax, dword [ebp + 0x438]
push 7
xor esi, esi
test byte [0x1004489c], 1
mov dword [ebp - 0x14], eax
pop ebx
mov edi, 0x10044880
jne 0x10006c09
or dword [0x1004489c], 1
push esi
mov ecx, edi
mov dword [0x10044898], ebx
call fcn.10005c57
push 0x10034b08
call fcn.1001102d
pop ecx
cmp dword [0x10044894], esi
je 0x10006c43
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
push esi
push edi
call fcn.100065e3
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.1000f60a
add ebp, 0x430
leave
ret
push esi
lea ecx, [ebp]
mov dword [ebp + 0x18], ebx
call fcn.10005c57
mov ebx, 0x206
push ebx
lea eax, [ebp + 0x226]
push esi
push eax
mov dword [ebp - 4], esi
mov word [ebp + 0x224], si
call fcn.1000f590
add esp, 0xc
call fcn.10005472
test eax, eax
je 0x10006cc5
call fcn.100069ad
test eax, eax
je 0x10006cc5
call int.100054e3
test eax, eax
lea eax, [ebp + 0x224]
push eax
push esi
push esi
je 0x10006cce
push 0x8020
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x10006d79
push 0x10035638
lea eax, [ebp + 0x224]
push 0x104
push eax
call fcn.1000f64b
add esp, 0xc
jmp 0x10006cdd
lea eax, [ebp + 0x224]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jl 0x10006d79
push ebx
lea eax, [ebp + 0x1e]
push esi
push eax
mov word [ebp + 0x1c], si
call fcn.1000f590
push 0x10035618
lea eax, [ebp + 0x224]
push eax
push 0x100355fc
lea eax, [ebp + 0x1c]
push 0x104
push eax
call fcn.1000f7e1
add esp, 0x20
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.1000674b
lea eax, [ebp + 0x1c]
push eax
call fcn.10005572
test eax, eax
pop ecx
jne 0x10006d47
lea eax, [ebp + 0x1c]
push eax
call fcn.10006ae8
test eax, eax
pop ecx
jne 0x10006d47
lea ecx, [ebp]
call fcn.10006570
push 0xffffffffffffffff
push esi
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.100065e3
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
push esi
lea eax, [ebp]
push eax
call fcn.100065e3
xor edi, edi
inc edi
push esi
push 1
lea ecx, [ebp]
call fcn.10005f8e
mov eax, edi
jmp 0x10006c20
xor edi, edi
jmp 0x10006d67
Function at 0x10007030
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push esi
push 0x10035870
call fcn.10006d7d
xor edi, edi
add esp, 0xc
cmp esi, edi
je 0x1000712d
push esi
call fcn.1000f3c0
test eax, eax
pop ecx
je 0x1000712d
cmp ebx, edi
jne 0x1000707b
push 0x10035834
call fcn.10006d7d
pop ecx
push 0xfffffffffffffffe
pop eax
jmp 0x1000713b
push esi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
call fcn.10005472
test eax, eax
je 0x100070b1
mov esi, dword [ebp + 0x10]
cmp esi, edi
jbe 0x100070b1
lea eax, [esi + esi]
push eax
push edi
push ebx
call fcn.1000f590
add esp, 0xc
push dword [ebp + 0x14]
push edi
push esi
push ebx
push dword [ebp + 8]
push edi
call fcn.10033f24
jmp 0x100070eb
push ebx
call fcn.1000f3c0
test eax, eax
pop ecx
je 0x10007068
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call fcn.10005558
test eax, eax
pop ecx
je 0x100070dd
push 0x100357f0
call fcn.10006d7d
pop ecx
push 0xfffffffffffffffb
jmp 0x10007075
push dword [ebp + 0x14]
push edi
push ebx
push dword [ebp + 8]
push edi
call fcn.10033f1e
cmp eax, edi
je 0x10007101
push 0x100357a8
call fcn.10006d7d
pop ecx
push 0xfffffffffffffffc
jmp 0x10007075
push ebx
call fcn.10005558
test eax, eax
pop ecx
jne 0x1000711e
push 0x1003576c
call fcn.10006d7d
pop ecx
push 0xfffffffffffffffa
jmp 0x10007075
push 0x10035748
call fcn.10006d7d
xor eax, eax
inc eax
jmp 0x1000713a
push 0x10035714
call fcn.10006d7d
or eax, 0xffffffff
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10007665
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100076cd
cmp dword [ebp + 0x10], 1
je 0x100076a6
cmp dword [ebp + 0x10], 2
je 0x100076a6
push 0xd
pop eax
jmp 0x100076cd
test edi, edi
mov eax, dword [ebp - 4]
je 0x100076c7
test eax, eax
je 0x100076c3
test al, 1
jne 0x100076a1
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x100076c7
jmp 0x100076a1
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x100078a9
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10007915
push dword [esi + 0x28]
push 0x10035da8
call fcn.10006d7d
pop ecx
pop ecx
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [esi + 0x30]
call fcn.100098e8
push 0xbb8
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000790d
push ebx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x28]
push 0x10035d40
call fcn.10006d7d
pop ecx
pop ecx
push dword [esi + 0x20]
call edi
mov dword [esi + 0x20], ebx
lea ecx, [esi + 0x30]
call fcn.100094da
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x1000792a
push eax
call edi
mov dword [esi + 0x2c], ebx
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x10007963
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10007963
push dword [esi + 0x28]
push 0x10035ce8
call fcn.10006d7d
pop ecx
pop ecx
push ebx
push 0xffffffffffffffeb
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x28], ebx
cmp dword [esi + 0x24], ebx
je 0x10007978
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10007978
mov dword [esi + 0x24], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebx
ret
Function at 0x10009ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x10043770]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x10009bd8
push ebx
push 0x200
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.1000f590
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call ebx
push eax
call fcn.1000f8e0
pop ecx
call ebx
push eax
lea eax, [ebp - 0x54]
push 0x10036c00
push eax
call fcn.10009598
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, 0x7f00
push ebx
push edi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x80], 0x100b
mov dword [ebp - 0x7c], 0x10009ab7
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], eax
call dword [sym.imp.USER32.dll_LoadIconW]
push ebx
push edi
mov dword [ebp - 0x6c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x64], 6
mov dword [ebp - 0x60], edi
call dword [sym.imp.USER32.dll_RegisterClassW]
push edi
push dword [ebp - 0x58]
mov word [esi + 8], ax
mov eax, dword [ebp - 0x70]
push edi
push 0xfffffffffffffffd
push 1
push 1
push edi
push edi
push 0x2000000
mov dword [esi + 0xc], eax
push 0x10036bdc
lea eax, [ebp - 0x54]
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [esi + 4], eax
pop ebx
je 0x10009bd8
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp + 0x1ac]
xor eax, eax
cmp dword [esi + 4], edi
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.1000f60a
add ebp, 0x1b0
leave
ret
Function at 0x1000ef3a
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xfe
xor al, 0x1e
mov ebx, dword [ebp - 0x2dce0354]
sub dword [esi - 0x6f], esp
inc eax
dec ecx
xchg edi, eax
invalid
mov dh, 0x56
jae 0x1000ee70
xchg ebx, eax
insb byte es:[edi], dx
hlt
aam 0x89
xchg ebx, eax
jne 0x1000ef03
movsb byte es:[edi], byte [esi]
jge 0x1000eea1
dec esp
xchg edx, eax
mov dl, byte [edx + 0x1d]
or byte [esp + esi*2], 2
mov edx, eax
jne 0x1000ef30
mov dl, 0x5f
xchg esi, eax
invalid
fld dword [edi + 0x5e]
xor eax, 0xc8e03bae
adc bl, byte [ecx]
dec esi
das
dec ecx
aad 0x52
push ss
invalid
lea ebp, [edi + 0x3e]
mov dword [0xe8900f4e], eax
jne 0x1000ef75
stc
bound esi, qword [eax]
wait
stc
cli
fidiv word [0xa837fa0e]
in eax, dx
xchg edi, eax
and dword fs:[ebx + 0x4c], edx
push ecx
dec edx
add ebp, eax
dec eax
jnp 0x1000eeeb
push cs
adc al, 0x6b
cmp byte [edx], cl
loopne 0x1000ef73
sar dword [eax - 0x75], cl
int3
sbb eax, dword [eax + 0xc]
pushal
or al, 0x60
paddb mm1, qword [esi + 0x4d]
leave
inc edi
jle 0x1000efe4
and dl, byte [ecx + 0x6f802db7]
das
mov ch, 0x30
pop ds
invalid
mov edi, 0xba6d1e3b
push ebp
lodsb al, byte [esi]
int 0x52
jg 0x1000ef23
mov al, byte [0x91e14d79]
cwde
jae 0x1000ef51
sub ch, ah
xor ah, 0x24
jne 0x1000ef39
mov byte fs:[0x13a1e314], al
in eax, dx
sbb dh, cl
leave
dec edx
and eax, 0x8150c32d
out 0x5e, al
sti
jge 0x1000efd3
mov edx, 0xf8cc9dad
mov bl, ch
daa
invalid
xor al, 0x63
stc
pushal
test byte [esi], ah
add dword [edx + 0x7cf44ce5], ebp
cdq
inc ebp
push esi
add dword [ebx + 0x3d], 0x6d
and al, 0x2c
pop ebp
sub eax, 0xe36f7368
and ch, ah
xor edi, ebx
mov dh, 0xc9
xchg ecx, eax
sub cl, bl
in eax, 0x4c
hlt
push 0x20e36f73
in eax, 0x31
fbstp tbyte [esi - 0x26d76e37]
or ebp, dword [ecx - 0x28]
jno 0x1000ef8c
inc edi
mov cs, word [esi]
in eax, dx
test eax, 0xb81ca161
dec eax
xchg ebp, eax
add edx, dword [eax]
call fcn.1000f541
int3
Function at 0x1001001d
Capabilities:
Encode data using xor

Disassembly:
push 0xc
push 0x10040788
call fcn.10014b80
mov esi, dword [ebp + 8]
test esi, esi
je 0x10010017
cmp dword [0x10046840], 3
jne 0x1000ffee
push 4
call int.100193f5
pop ecx
and dword [ebp - 4], 0
push esi
call fcn.10019511
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000ffce
push esi
push eax
call fcn.1001953c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
call fcn.1000ffe5
cmp dword [ebp - 0x1c], 0
jne 0x10010017
push dword [ebp + 8]
jmp 0x1000ffef
push esi
push 0
push dword [0x10044f4c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x1000ffc3
mov dword [0x62534086], eax
fidiv dword [edx - 0x2c]
adc ebp, ebx
and dword [edi + 0x7d], edx
pop esi
pop ss
ror byte [ecx], 1
in eax, dx
lodsd eax, dword [esi]
in eax, dx
invalid
aam 0x13
jmp 0x1001002d
dec ebx
pop ds
adc eax, 0x28ddaed7
invalid
sahf
jge 0x10010017
mov al, 0xe5
add ebp, edi
xchg edi, eax
mov edi, 0x8f6adf7c
jl 0x10010008
push 0xffffffffffffff8f
xor al, 0xfa
js 0x1001001f
jo 0x10010027
xor dword [ebx - 0x3b], 0xffffffd1
out 0x9f, eax
xor edi, dword [edi + 0x66]
mov dx, 0x5a58
mov edx, 0xd97a3b28
movsd dword es:[edi], dword [esi]
inc eax
imul byte [edx - 0x7c5a272]
in al, dx
fnstenv [ebx - 0x2e]
mov dword [0x8d8d3583], eax
push cs
sal dl, cl
arpl word [eax - 0x63feb5ce], sp
popfd
mov eax, 0x346251a5
and al, byte [ecx - 0x4e2e2e43]
stc
inc esp
jne 0x100100c4
pop edi
cmp byte [edx - 0x46363637], cl
loope 0x10010018
mov eax, dword [0x46933b21]
cwde
xor eax, 0x4c06162c
push 0x3dd7615c
ljmp 0xc662
push ecx
invalid
jle 0x100100ab
and eax, 0xc2e2fe01
inc edx
shl dword [ecx - 0x10], 1
mov dh, 0xfc
hlt
Function at 0x6dc78f
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.006dc80e
jae 0x6dc79b
xor ecx, ecx
call fcn.006dc80e
jae 0x6dc7c5
xor eax, eax
call fcn.006dc80e
jae 0x6dc7d6
mov al, 0x10
call fcn.006dc80e
adc al, al
jae 0x6dc7b7
jne 0x6dc803
stosb byte es:[edi], al
jmp 0x6dc79c
call fcn.006dc81a
dec ecx
loop 0x6dc7e2
mov eax, ebp
call fcn.006dc818
jmp 0x6dc804
lodsb al, byte [esi]
shr eax, 1
je 0x6dc82a
adc ecx, 2
mov ebp, eax
jmp 0x6dc804
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.006dc818
cmp eax, 0x7d00
jae 0x6dc802
cmp eax, 0x500
jae 0x6dc803
cmp eax, 0x7f
ja 0x6dc804
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6dc79c
pop ebp
ret 8

Function at 0x710c82
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
or ebx, ecx
push 0x294e940e
pop ecx
call fcn.00710cb9
sub ebx, ebx
and ebx, ecx
xor dword [esi], eax
or ecx, ecx
and ecx, ecx
inc esi
push 0x5b47d29c
pop ebx
cmp esi, edx
jne fcn.00710c82
or ecx, ebx
or ecx, ebx
mov ebx, 0x6ae9801c
ret