joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457af0
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b0014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi]
push str.CProcessKiller::KillProcess
push str._s_Started_for___s_
push 0
push 5
call fcn.004569b0
add esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esi]
call fcn.00457cc0
mov edi, eax
test edi, edi
jne 0x457b66
push dword [esi]
push str.CProcessKiller::KillProcess
push str._s_Could_not_find_the_process_or_get_a_handle_of_it___s_
push eax
push 5
call fcn.004569b0
add esp, 0x14
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d27f
mov esp, ebp
pop ebp
ret 0xc
push ebx
push edi
push dword [esi]
push str.CProcessKiller::KillProcess
push str._s_Found_the_process___s___Handle__0x_x_
push 0
push 5
call fcn.004569b0
push str.CProcessKiller::KillProcess
push str._s_Starting_loop
push 0
push 5
call fcn.004569b0
add esp, 0x28
xor ebx, ebx
push dword [esi]
inc ebx
push ebx
push str.CProcessKiller::KillProcess
push str._s_Loop_iteration___d___Process___s_
push 0
push 5
call fcn.004569b0
add esp, 0x18
push dword [ebp - 8]
push 0x458380
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [esi]
push str.CProcessKiller::KillProcess
push str._s_Waiting_for_process_to_signal___s_
push 0
push 5
call fcn.004569b0
add esp, 0x14
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi]
push str.CProcessKiller::KillProcess
test eax, eax
je 0x457c23
push str._s_Timeout_while_waiting_for_the_process___s_
push 0
push 5
call fcn.004569b0
add esp, 0x14
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x457c3b
push dword [esi]
push str.CProcessKiller::KillProcess
push str._s_Terminate_Process_failed_for_the_process___s_
push eax
push 5
call fcn.004569b0
jmp 0x457c38
push str._s_Finished_waiting_for_the_process___s_
push 0
push 5
call fcn.004569b0
mov dword [ebp - 0xc], 1
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 5
jge 0x457c6f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push dword [ebp + 0xc]
push eax
push dword [esi]
call fcn.00457cc0
mov edi, eax
test edi, edi
jne 0x457b95
jmp 0x457c87
push dword [esi]
push str.CProcessKiller::KillProcess
push str._s_Breaking_the_loop___s_
push 0
push 5
call fcn.004569b0
add esp, 0x14
push dword [esi]
push ebx
push str.CProcessKiller::KillProcess
push str._s_Ended_the_loop_after___d__iterations__Process___s_
push 0
push 5
call fcn.004569b0
mov ecx, dword [ebp - 4]
add esp, 0x18
cmp dword [ebp - 0xc], 1
sete al
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0045d27f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4583f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489038
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b0014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
push 0
mov dword [ebp - 4], 0
xor bl, bl
push 0
mov byte [ebp - 4], 1
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4584c4
inc eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d2c8
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
push dword [ebp - 0x18]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4584b7
test esi, esi
jne 0x45848c
xor ecx, ecx
push ecx
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.0042da10
jmp 0x4584b5
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458491
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.0042da10
jmp 0x4584b5
mov bl, 1
test esi, esi
je 0x4584c4
push esi
call fcn.0045d290
add esp, 4
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4584e6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b3d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489509
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 0
push eax
push str.iexplore.exe
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
mov dword [esi], 0
call fcn.0040f7b0
mov ecx, eax
test ecx, ecx
jne 0x45b452
push 0x80004005
call fcn.0041ffd0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 1
test ebx, ebx
je 0x45b4e1
push ebx
call fcn.0045d2c8
add esp, 4
mov edi, eax
push edi
push ebx
push dword [ebp - 0x14]
push str.iexplore.exe
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45b4d8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x49835c
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45b4d8
cmp dword [ebp - 0x18], 0
je 0x45b4d8
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0xfeef04bd
jne 0x45b4d8
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push esi
call fcn.0042e840
add esp, 0x18
push edi
call fcn.0045d290
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d27f
mov esp, ebp
pop ebp
ret
Function at 0x45bbf0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4895e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
call fcn.0045ba20
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x45bc7d
push 0x49f868
mov ecx, edi
call fcn.0042c3c0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45bd7f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x45bd7f
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push 0x49f868
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov esi, eax
call fcn.0042c3c0
mov byte [ebp - 4], 1
test esi, esi
je 0x45bd2f
push esi
call fcn.0045d2c8
add esp, 4
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45bd26
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x49835c
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45bd26
cmp dword [ebp - 0x20], 0
je 0x45bd26
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0xfeef04bd
jne 0x45bd26
movzx esi, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x18]
push str._d._d._d._d
push eax
call fcn.0042e840
add esp, 0x18
push ebx
call fcn.0045d290
add esp, 4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0042d8d0
add eax, 0x10
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov dword [edi], eax
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45bd60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x45bd7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d27f
mov esp, ebp
pop ebp
ret
Function at 0x45c4b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4895e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
call fcn.0045c2e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x45c53d
push 0x49f868
mov ecx, edi
call fcn.0042c3c0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x14]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45c63f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x45c63f
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push 0x49f868
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov esi, eax
call fcn.0042c3c0
mov byte [ebp - 4], 1
test esi, esi
je 0x45c5ef
push esi
call fcn.0045d2c8
add esp, 4
mov ebx, eax
push ebx
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45c5e6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x49835c
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45c5e6
cmp dword [ebp - 0x20], 0
je 0x45c5e6
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0xfeef04bd
jne 0x45c5e6
movzx esi, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x18]
push str._d._d._d._d
push eax
call fcn.0042e840
add esp, 0x18
push ebx
call fcn.0045d290
add esp, 4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0042d8d0
add eax, 0x10
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
or esi, 0xffffffff
mov dword [edi], eax
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45c620
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x45c63f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d27f
mov esp, ebp
pop ebp
ret
Function at 0x45c7b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488a08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr eax, 8
movzx eax, al
movzx ebx, cl
mov dword [ebp - 0x18], eax
cmp ecx, 0x80000000
jae 0x45c80a
mov edi, ecx
shr edi, 0x10
cmp ebx, 6
jb 0x45c81d
cmp eax, 2
jb 0x45c81d
mov ecx, esi
call fcn.0045caf0
jmp 0x45c888
call fcn.0040f7b0
mov ecx, eax
test ecx, ecx
jne 0x45c832
push 0x80004005
call fcn.0041ffd0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push ebx
push str._d._d___d_
push eax
call fcn.0042e840
mov edi, dword [ebp - 0x14]
add esp, 0x14
add edi, 0xfffffff0
mov ecx, edi
call fcn.0042d8d0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45c888
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d27f
mov esp, ebp
pop ebp
ret

Function at 0x476726
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004765a5

Function at 0x4785c6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00478286
Function at 0x43b664
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
and edi, eax
call fcn.0043b69b
or eax, eax
add eax, 1
and eax, edi
xor dword [edx], esi
dec eax
sub edi, 0xa5d1a5ce
inc eax
add edx, 1
mov eax, edi
or eax, eax
and eax, edi
cmp edx, ecx
jne fcn.0043b664
or edi, edi
ret
Function at 0x10001020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10010570]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push str.CreateEventW
push 0x1000f82c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov al, byte [eax]
cmp al, 0xe8
je 0x1000110c
cmp al, 0xe9
je 0x1000110c
cmp al, 0xeb
je 0x1000110c
mov eax, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov al, byte [eax]
cmp al, 0xe8
je 0x1000110c
cmp al, 0xe9
je 0x1000110c
cmp al, 0xeb
je 0x1000110c
mov ecx, dword [ebp + 8]
push 0
mov dword [0x10011cfc], ecx
call esi
cmp byte [eax + 0xe367], 0x8b
lea esi, [eax + 0xe367]
jne 0x1000110c
cmp byte [esi + 1], 0xf8
jne 0x1000110c
push ebx
mov ebx, section..text
lea edx, [ebp - 0x14]
sub ebx, esi
push edx
sub ebx, 5
push 0x1000f840
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0x10], 0x506c6175
mov dword [ebp - 0xc], 0x65746f72
mov word [ebp - 8], 0x7463
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
push 5
push esi
call eax
test eax, eax
je 0x1000110b
mov dl, byte [ebp - 0x16]
mov al, byte [ebp - 0x15]
mov byte [esi], 0xe8
mov byte [esi + 1], bl
mov byte [esi + 2], bh
mov byte [esi + 3], dl
mov byte [esi + 4], al
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10008beb
mov esp, ebp
pop ebp
ret 4

Function at 0x10008beb
Capabilities:
Terminate process

Disassembly:
mov eax, eax
pushfd
jge 0x10008bd8
jl 0x10008bd8
fistp qword [edx + 0x3a78e851]
add byte [eax], al
inc esp
idiv bh
call [edx + 0x3a6ce855]
push ebp
call fcn.10007a19
call ebx
invalid
mov eax, eax
popfd
jl 0x1000759a
xchg bl, bl
xchg cl, cl
jge 0x1000759a
pushal
mov eax, 0x1406814
add dword [eax], edx
call fcn.10007a19
cmp byte [esi], 0
add byte [ecx - 0x382071f1], al
invalid
mov eax, eax
xchg dword [esp], ecx
jns 0x100081b6
js 0x100081b6
mov al, byte [0x89ec4d89]
dec ebp
invalid
mov eax, eax
xchg dword [esp], ecx
jno 0x10003f8a
nop
jo 0x10003f8a
invalid
mov eax, eax
ret
mov eax, eax
add ecx, dword [ecx]
jb 0x10004b75
mov ecx, ecx
jae 0x10004b75
adc edi, dword [ebx]
or eax, 0x10010570
jne 0x10008bf5
repz ret
jmp fcn.10008e77
Function at 0x1000c9da
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10010570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10008f7d
and dword [ebp - 0x14], 0
cmp dword [0x10011ce4], 0
mov dword [ebp - 0x18], eax
jne 0x1000ca8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000cb35
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000cb35
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10011ce4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10011ce8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10011cec], eax
call edi
push eax
call esi
mov dword [0x10011cf4], eax
test eax, eax
je 0x1000ca8d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10011cf0], eax
mov eax, dword [0x10011cf0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000cae6
cmp dword [0x10011cf4], ecx
je 0x1000cae6
push eax
call esi
push dword [0x10011cf4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000cae6
test ebx, ebx
je 0x1000cae6
call edi
test eax, eax
je 0x1000cadd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000cadd
test byte [ebp - 8], 1
jne 0x1000cae6
or dword [ebp + 0x10], 0x200000
jmp 0x1000cb19
mov eax, dword [0x10011ce8]
cmp eax, dword [ebp - 0x18]
je 0x1000cb19
push eax
call esi
test eax, eax
je 0x1000cb19
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000cb19
mov eax, dword [0x10011cec]
cmp eax, dword [ebp - 0x18]
je 0x1000cb19
push eax
call esi
test eax, eax
je 0x1000cb19
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10011ce4]
call esi
test eax, eax
je 0x1000cb35
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000cb37
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008beb
leave
ret
Function at 0x405538
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4054bd
cld
nop
jmp 0x4054d0
call 0x4057ef
jmp 0x4054e6
jmp 0x4054f6
pushal
nop
mov ebp, esp
jmp 0x405509
xor edx, edx
jmp 0x40551a
mov edx, dword fs:[edx + 0x30]
jmp 0x405529
mov edx, dword [edx + 0xc]
jmp 0x405536
mov edx, dword [edx + 0x14]
nop
jmp 0x405545
cwde
inc eax
inc ecx
cdq
cwde
daa
cwde
wait
clc
aaa
inc eax
cld
wait
clc
xchg ebx, eax
xchg ebx, eax
das
cmc
xchg ebx, eax
cdq
inc edx
wait
cwde
lahf
clc
dec edx
dec edx
xchg ebx, eax
cdq
cwde
stc
dec ecx
cmc
cld
lahf
das
nop
dec ecx
clc
dec ebx
stc
inc ecx
dec ebx
das
aas
dec ecx
lahf
cwde
xchg ecx, eax
inc eax
xchg edx, eax
salc
inc ecx
cmc
clc
aaa
dec eax
dec edx
aas
inc eax
das
xchg ecx, eax
das
inc ecx
daa
dec ecx
xchg ebx, eax
das
cmc
inc ecx
aas
das
cwde
inc edx
aaa
cmc
nop
std
cdq
lahf
std
cld
inc edx
aaa
stc
clc
xchg edx, eax
dec eax
aaa
xchg edx, eax
dec ecx
dec eax
inc ecx
lahf
salc
wait
cdq
xchg edx, eax
inc ebx
cld
dec eax
clc
aas
wait
inc ebx
dec ecx
inc ecx
inc edx
std
daa
aaa
dec ebx
dec ebx
inc edx
nop
dec ecx
dec edx
inc ebx
cmc
dec ebx
xchg ebx, eax
dec ecx
lahf
xchg edx, eax
cld
cld
inc ebx
cdq
wait
stc
inc eax
salc
das
aaa
daa
xchg ebx, eax
dec edx
inc ecx
inc ebx
stc
xchg ecx, eax
lahf
clc
cmc
xchg edx, eax
cmc
inc ecx
salc
daa
stc
std
cdq
cdq
xchg ecx, eax
inc edx
xchg edx, eax
dec ecx
cwde
dec edx
inc edx
lahf
inc ecx
wait
stc
aaa
dec edx
lahf
xchg ebx, eax
cwde
xchg ebx, eax
wait
dec ecx
cld
aaa
clc
std
cld
lahf
inc ebx
inc eax
jmp 0x4054ac

Function at 0x407ef0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
ret 0xa430
movsb byte es:[edi], byte [esi]
push ss
inc esi
mov bl, 0xc1
xor byte [eax + 0x7859e90e], cl
invalid
push ebp
jne 0x407ea6
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov esi, dword [eax + 0x14]
and eax, 0x6a10458b
add dword [ecx - 0x5c], edx
dec ebp
or al, 0x52
mov edx, dword [ebp + 8]
sahf
push ecx
push edx
push cs
add byte [esi + 0x1cc48300], al
pop ebp
inc eax
nop
fidivr word [edx]
nop
stosd dword es:[edi], eax
nop
call dword [eax - 0x1374aa70]
sub esp, 0x14
cmp dword [ebp + 0x10], 0x4f
jl 0x407ea4
mov dword [ebp + 0x1d], 0x982e4e
fld qword [ebp + 0x22]
fcomp qword [ecx + 0x7e70c230]
xor dl, al
jo 0x407f8a
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
lahf
sub byte [edi - 0x21], dl
cmp ecx, dword [ecx + 0x31acfca5]
neg byte [esi]
add eax, 0xe9afb86
fnstsw word [edi]
or cl, bl
jp 0x407f08
jmp 0x1424638
add ch, bl
pop ebp
hlt
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xa
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xd8
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x42
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x7c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x36
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa4
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x73
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xdd
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x94
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x16
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x4c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9c
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x9f
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x21
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb3
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xfb
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x7b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc5
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xd9
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa4
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf4
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2e
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x5b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xbb
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xee
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x43
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2b
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret