joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473d40
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x473d4f
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4a9cf0]
je 0x473d7a
mov esi, edi
call fcn.00474da0
test al, al
jne 0x473f12
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x473d94
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp edi, esi
jne 0x473da2
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x473db6
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4a7e02], 0
jne 0x473dd0
push esi
call fcn.00473ce0
add esp, 4
test eax, eax
jne 0x473f14
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x473e2d
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x473e2d
cmp dword [0x4a9cf0], ebx
je 0x473e14
call fcn.00474da0
test al, al
jne 0x473e14
mov eax, dword [0x4a9cf0]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x473e2d
cmp ebx, ebp
je 0x473e2d
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x14], 0
jmp 0x473e40
push edi
call ebx
push 1
push 0xa
mov dword [0x4a43a4], 0
call fcn.00401280
add esp, 8
mov dword [0x4a43a4], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x473e73
mov ebp, edi
jmp 0x473e84
cmp ebp, esi
je 0x473e88
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x473e88
test ebp, ebp
jne 0x473ec9
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x473e40
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e9d0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040e9d0
push esi
call fcn.00473ce0
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x473ee4
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4a9cf0]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x473efd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x473f12
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x474000
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x474010
mov eax, esi
call fcn.00451a70
jmp 0x47401d
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 4]
test eax, eax
js 0x474078
je 0x474078
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401280
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x474075
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x474075
push 1
push 0x8000012f
call fcn.00401280
add esp, 8
push esi
call ebx
test eax, eax
jne 0x474054
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x474250
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.0048f760
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x47427b
cmp cl, 0x61
jne 0x4742cc
cmp byte [edx + 1], bl
jne 0x4742cc
cmp byte [edi], bl
jne 0x4742cc
cmp byte [eax], bl
jne 0x4742cc
cmp byte [esi], bl
jne 0x4742cc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4742ad
cmp byte [ebp + 0xc6], bl
jne 0x4742ad
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4742ad
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x4742c0
cmp esi, ebx
je 0x4742c0
mov dword [ebp + 0xa0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x4742ed
cmp byte [edi], bl
jne 0x4742ed
cmp byte [eax], bl
jne 0x4742ed
cmp byte [esi], bl
jne 0x4742ed
mov eax, ebp
call fcn.00474440
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x496816
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.00474ee0
test eax, eax
je 0x4743fe
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov ecx, dword [esp + 0x8e80]
mov edx, dword [esp + 0x8e84]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ecx
mov dword [esp + 0xc48], edx
je 0x47440a
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x4743d6
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4743fe
cmp byte [ebp + 0xc6], bl
jne 0x4743cf
mov eax, dword [esp + 0x828]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4743cf
mov ecx, dword [esp + 0x828]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x4743fe
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x4743ef
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.00475320
push ebx
lea edx, [esp + 0x10]
push edx
call fcn.004753e0
test eax, eax
jne 0x47441a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea eax, [esp + 0xc]
push eax
push 0x4744b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x474434
cmp eax, ebx
je 0x474434
mov dword [ebp + 0xa0], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x474620
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.0048f760
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x474649
mov ecx, edi
call fcn.00412540
cmp dword [esp + 0x8038], 0
jne 0x47465e
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x474673
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x47467d
mov ebp, 1
test esi, esi
je 0x47484a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x47484a
cmp ebp, dword [esp + 0x20]
jg 0x47484a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.004717b0
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x474843
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x4746f0
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x474767
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x4747be
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x474767
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4747b9
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.00473bb0
test al, al
jne 0x4747e4
cmp dword [esp + 0x802c], 0
jne 0x4747c8
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x474817
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x47479e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4747fc
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.00401280
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x4746f0
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x474817
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.00472eb0
mov esi, eax
jmp 0x47481c
mov eax, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x496860
push eax
call fcn.00472eb0
jmp 0x4747be
mov ecx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x497ee0
push ecx
call fcn.00472eb0
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x497ee0
test edi, edi
jne 0x474858
mov eax, 0x498028
mov ecx, dword [0x4a4440]
cmp byte [ecx + 0xe4], 0
jne 0x474885
mov edx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.00472eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4aa0c0]
push 0x496816
push 0
push eax
call fcn.0042d5b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x475320
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x4753d7
mov eax, dword [esi]
test eax, eax
je 0x4753d7
push edi
test al, 1
jne 0x475349
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x475362
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x475362
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47537d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x4753b8
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x4753b8
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0044d720
add esp, 4
test eax, eax
jne 0x4753b8
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x4753d7
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x475a60
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.0048f760
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x475b0d
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x476190
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x496816
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x475b0d
mov ecx, dword [0x4a4440]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x475b0d
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x475b20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x475b3c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4a4440]
push eax
push esi
mov ecx, edi
call fcn.00475fd0
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x475b73
test eax, eax
jne 0x475b77
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00475c30
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x475bf6
test esi, esi
je 0x475bf6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401280
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x475bd5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x475bd5
push 1
push 0x8000012f
call fcn.00401280
add esp, 8
push esi
call edi
test eax, eax
jne 0x475bb0
mov edx, dword [0x4a4440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x475bee
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x475c10
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00475c30
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00475da0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x475da0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.0048f760
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x475f20
xor cl, cl
mov eax, edi
call fcn.00475f40
test eax, eax
jne 0x475dd5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4a4440]
push eax
push ebp
mov ecx, edi
call fcn.00475fd0
test eax, eax
je 0x475df8
xor eax, eax
mov dword [0x4a9ce8], eax
jmp 0x475dfd
mov eax, dword [0x4a9ce8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x496816
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x475e43
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x475e4b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4a9ce4]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x4760a0
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x475ef8
lea ecx, [esp + 0x10]
push ecx
push 0x474cf0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x475eb5
mov edx, dword [esp + 0xc48]
call fcn.00475770
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00473d40
mov edx, dword [esp + 0xc48]
call fcn.00475770
mov edx, dword [0x4a4440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x475f20
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4a9ce8]
cmp eax, ebx
je 0x475f20
cmp eax, 1
setg al
mov dword [0x4a9ce8], ebx
cmp al, bl
je 0x475f20
mov edx, ebp
call fcn.00475770
push ebx
mov ecx, edi
call fcn.00475da0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x48a074
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a3d90]
jne 0x48a07e
repz ret
jmp fcn.0048e9a7

Function at 0x48c9f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a3d90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00487012
and dword [ebp - 0x14], 0
cmp dword [0x4a6514], 0
mov dword [ebp - 0x18], eax
jne 0x48caa7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48cb4f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48cb4f
mov esi, dword [fcn.00482b80]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a6514], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a6518], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a651c], eax
call edi
push eax
call esi
mov dword [0x4a6524], eax
test eax, eax
je 0x48caa7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a6520], eax
mov eax, dword [0x4a6520]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00482b84]
cmp eax, ecx
je 0x48cb00
cmp dword [0x4a6524], ecx
je 0x48cb00
push eax
call esi
push dword [0x4a6524]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48cb00
test ebx, ebx
je 0x48cb00
call edi
test eax, eax
je 0x48caf7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48caf7
test byte [ebp - 8], 1
jne 0x48cb00
or dword [ebp + 0x10], 0x200000
jmp 0x48cb33
mov eax, dword [0x4a6518]
cmp eax, dword [ebp - 0x18]
je 0x48cb33
push eax
call esi
test eax, eax
je 0x48cb33
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48cb33
mov eax, dword [0x4a651c]
cmp eax, dword [ebp - 0x18]
je 0x48cb33
push eax
call esi
test eax, eax
je 0x48cb33
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a6514]
call esi
test eax, eax
je 0x48cb4f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48cb51
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a074
leave
ret
Function at 0x5e95ff
Capabilities:
Encode data using xor

Disassembly:
mov byte [eax - 0x3da6812], dh
jno 0x5e9611
aas
out 0x70, eax
sbb byte [eax + 0x6aeeb925], 0x78
bound edi, qword [ebx + 0xd]
mov al, byte [edi - 0xa]
xchg edi, eax
push ds
xor bh, al
xchg edi, eax
and eax, 0x25aba6b9
mov ecx, 0xbe8f00ee
out dx, al
xchg edi, eax
jbe 0x5e95d1
add byte [edi + 0x7697eebe], cl
mov ecx, 0x70fd8801
xor byte [edi - 0x78], 0xfe
add dword [eax + 0x778070fd], ecx
mov dh, bh
stc
sub ebx, dword [edi]
mov ecx, 0xb97697ee
ja 0x5e95ca
jnp 0x5e95ea
mov esi, 0x57010d97
jae 0x5e95c6
pop ecx
mov ebx, 0xd7b90960
xlatb

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x403680
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x140c
call fcn.0040e970
mov eax, dword [0x2b8bc04]
mov ecx, dword [0x2b8bb78]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403791
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b8bc04], 0x959
jne 0x403777
push 0
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0x402db8
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea ecx, [esp + 0x420]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea edx, [esp + 0xc1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402dfc
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0x402e04
push 0x402e38
call esi
push 0
push 0x402e94
push 0x402eac
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004034c0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4036c4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140c
ret
Function at 0x4061fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431aac]
jne 0x406205
repz ret
jmp fcn.0040b07c

Function at 0x40bfdb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004089d8
and dword [ebp - 4], 0
cmp dword [0x4350b0], 0
mov ebx, eax
jne 0x40c08c
push 0x401c2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c13d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c20
push edi
call esi
test eax, eax
je 0x40c13d
push eax
call fcn.00408966
mov dword [esp], 0x401c10
push edi
mov dword [0x4350b0], eax
call esi
push eax
call fcn.00408966
mov dword [esp], 0x401bfc
push edi
mov dword [0x4350b4], eax
call esi
push eax
call fcn.00408966
mov dword [esp], 0x401be0
push edi
mov dword [0x4350b8], eax
call esi
push eax
call fcn.00408966
pop ecx
mov dword [0x4350c0], eax
test eax, eax
je 0x40c08c
push 0x401bc8
push edi
call esi
push eax
call fcn.00408966
pop ecx
mov dword [0x4350bc], eax
mov eax, dword [0x4350bc]
cmp eax, ebx
je 0x40c0e4
cmp dword [0x4350c0], ebx
je 0x40c0e4
push eax
call fcn.004089e1
push dword [0x4350c0]
mov esi, eax
call fcn.004089e1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c0e4
test edi, edi
je 0x40c0e4
call esi
test eax, eax
je 0x40c0db
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c0db
test byte [ebp - 0xc], 1
jne 0x40c0e4
or dword [ebp + 0x10], 0x200000
jmp 0x40c11d
mov eax, dword [0x4350b4]
cmp eax, ebx
je 0x40c11d
push eax
call fcn.004089e1
pop ecx
test eax, eax
je 0x40c11d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c11d
mov eax, dword [0x4350b8]
cmp eax, ebx
je 0x40c11d
push eax
call fcn.004089e1
pop ecx
test eax, eax
je 0x40c11d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4350b0]
call fcn.004089e1
pop ecx
test eax, eax
je 0x40c13d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c13f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret