joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5d50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x7c6ee4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], 0xffffffff
push 1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
lea esi, [edi + 0x182b0]
mov dword [esp + 0x28], 0xffffffff
push esi
call fcn.004b3bb0
push 2
push esi
mov ecx, edi
mov ebx, eax
call fcn.004b3bb0
push 3
push esi
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.004b3bb0
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x18]
mov dword [esp + 0x14], eax
mov ecx, edi
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b5df6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4b5dc3
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov ecx, edi
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4b5e36
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4b5de3
jmp 0x4b5e5c
xor dl, dl
nop dword [eax + eax]
movzx eax, dl
mov cl, byte [eax + edi]
xor cl, byte [eax + ebx]
cmp cl, 0xff
jne 0x4b5e17
inc dl
cmp dl, 0x10
jb 0x4b5e00
jmp 0x4b5dd4
cmp dl, 0x10
jae 0x4b5dd4
pop edi
pop esi
pop ebp
mov eax, 0xe029
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0050b38b
add esp, 0x1c
ret 4
xor dl, dl
nop dword [eax + eax]
movzx eax, dl
mov cl, byte [eax + edi]
xor cl, byte [eax + ebx]
cmp cl, 0xaa
jne 0x4b5e57
inc dl
cmp dl, 0x10
jb 0x4b5e40
jmp 0x4b5e5c
cmp dl, 0x10
jb 0x4b5e1c
mov eax, ebp
sub ebx, ebp
mov edx, 0x10
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x4b5e65
xor dl, dl
movzx ecx, dl
mov al, byte [ecx + ebp]
cmp al, byte [ecx + ebp + 8]
jne 0x4b5e8a
inc dl
cmp dl, 8
jb 0x4b5e75
jmp 0x4b5e94
mov eax, 0xe02a
cmp dl, 8
jb 0x4b5e99
mov eax, 0x9000
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0050b38b
add esp, 0x1c
ret 4
Function at 0x4bd378
Capabilities:
Encode data using xor

Disassembly:
int3
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526179
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edx
add byte [ecx], ah
add byte [eax], al
add byte [eax - 0x7d], dl
in al, dx
cmp al, 0x53
push esi
push edi
mov eax, dword [0x7c6ee4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push ebp
mov ebp, 0x1e50140a
pushfd
shl bp, 0x96
call fcn.0080ef4e
push edx
in al, 0x33
jg 0x4bd378
pop ecx
adc esp, ebx
sub cl, 0x13
popal
sbb dword [edi - 0xd], edi
scasd eax, dword es:[edi]
aaa
pop ss
jg 0x4bd368
ret

Function at 0x4bd72d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5261b2
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x7c6ee4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
call fcn.008cbe29
invalid
Function at 0x4cc420
Capabilities:
Check for peb ntglobalflag flag
Get number of processors
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax + 8], 0x59
je 0x4cc435
mov dword [esp + 4], eax
jmp dword [0x5316b4]
mov dword [esp + 4], ecx
mov ecx, dword [ecx + 0x18]
jmp fcn.004d29e0
Function at 0x4e9363
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
cmp dword [esp + 8], 0
jne case.default.0x4e9338
mov eax, dword [esp + 0xc]
cmp eax, 0x1f
ja case.default.0x4e9338
jmp dword [eax*4 + 0x4e9460]
mov ecx, dword [esp + 4]
jmp fcn.004cc450
mov ecx, dword [esp + 4]
jmp fcn.004cc510
mov ecx, dword [esp + 4]
jmp fcn.004888a0
mov ecx, dword [esp + 4]
jmp fcn.004cc5d0
mov ecx, dword [esp + 4]
jmp fcn.004d0ab0
mov ecx, dword [esp + 4]
jmp fcn.004cccf0
mov ecx, dword [esp + 4]
jmp fcn.004ceba0
mov ecx, dword [esp + 4]
jmp fcn.004cf640
mov ecx, dword [esp + 4]
jmp fcn.004cfaf0
mov ecx, dword [esp + 4]
jmp fcn.004cfda0
mov ecx, dword [esp + 4]
jmp fcn.004d0010
mov ecx, dword [esp + 4]
jmp fcn.004d0240
mov ecx, dword [esp + 4]
jmp fcn.004d0480
mov ecx, dword [esp + 4]
jmp fcn.004d06b0
mov ecx, dword [esp + 4]
jmp fcn.004d08f0
mov ecx, dword [esp + 4]
jmp fcn.004cde00
mov ecx, dword [esp + 4]
jmp fcn.004cdfc0
mov ecx, dword [esp + 4]
jmp fcn.004ce170
mov ecx, dword [esp + 4]
jmp fcn.004ce2e0
mov ecx, dword [esp + 4]
jmp fcn.004ce430
mov ecx, dword [esp + 4]
jmp fcn.004ce5a0
mov ecx, dword [esp + 4]
jmp fcn.004ce6f0
mov ecx, dword [esp + 4]
jmp fcn.004ce860
mov ecx, dword [esp + 4]
jmp fcn.004ce9b0
mov ecx, dword [esp + 4]
jmp fcn.004ceac0
mov ecx, dword [esp + 4]
jmp fcn.004cef60
mov ecx, dword [esp + 4]
jmp fcn.004cf070
mov ecx, dword [esp + 4]
jmp fcn.004cf150
mov ecx, dword [esp + 4]
jmp fcn.004cf260
mov ecx, dword [esp + 4]
jmp fcn.004cf340
mov ecx, dword [esp + 4]
jmp fcn.004cf450
mov ecx, dword [esp + 4]
jmp fcn.004cf530
ret

Function at 0x4e936c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [esp + 8], 0
jne case.default.0x4e9338
mov eax, dword [esp + 0xc]
cmp eax, 0x1f
ja case.default.0x4e9338
jmp dword [eax*4 + 0x4e9460]
mov ecx, dword [esp + 4]
jmp fcn.004cc450
mov ecx, dword [esp + 4]
jmp fcn.004cc510
mov ecx, dword [esp + 4]
jmp fcn.004888a0
mov ecx, dword [esp + 4]
jmp fcn.004cc5d0
mov ecx, dword [esp + 4]
jmp fcn.004d0ab0
mov ecx, dword [esp + 4]
jmp fcn.004cccf0
mov ecx, dword [esp + 4]
jmp fcn.004ceba0
mov ecx, dword [esp + 4]
jmp fcn.004cf640
mov ecx, dword [esp + 4]
jmp fcn.004cfaf0
mov ecx, dword [esp + 4]
jmp fcn.004cfda0
mov ecx, dword [esp + 4]
jmp fcn.004d0010
mov ecx, dword [esp + 4]
jmp fcn.004d0240
mov ecx, dword [esp + 4]
jmp fcn.004d0480
mov ecx, dword [esp + 4]
jmp fcn.004d06b0
mov ecx, dword [esp + 4]
jmp fcn.004d08f0
mov ecx, dword [esp + 4]
jmp fcn.004cde00
mov ecx, dword [esp + 4]
jmp fcn.004cdfc0
mov ecx, dword [esp + 4]
jmp fcn.004ce170
mov ecx, dword [esp + 4]
jmp fcn.004ce2e0
mov ecx, dword [esp + 4]
jmp fcn.004ce430
mov ecx, dword [esp + 4]
jmp fcn.004ce5a0
mov ecx, dword [esp + 4]
jmp fcn.004ce6f0
mov ecx, dword [esp + 4]
jmp fcn.004ce860
mov ecx, dword [esp + 4]
jmp fcn.004ce9b0
mov ecx, dword [esp + 4]
jmp fcn.004ceac0
mov ecx, dword [esp + 4]
jmp fcn.004cef60
mov ecx, dword [esp + 4]
jmp fcn.004cf070
mov ecx, dword [esp + 4]
jmp fcn.004cf150
mov ecx, dword [esp + 4]
jmp fcn.004cf260
mov ecx, dword [esp + 4]
jmp fcn.004cf340
mov ecx, dword [esp + 4]
jmp fcn.004cf450
mov ecx, dword [esp + 4]
jmp fcn.004cf530
ret
Function at 0x4f28f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov edx, eax
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, eax
shr esi, 5
mov ebp, dword [ebp + 0x10]
inc esi
push edi
mov dword [esp + 0x10], ebp
mov ebx, dword [ebp + 0x38]
xor ebx, eax
cmp eax, esi
jb 0x4f293b
mov edi, dword [esp + 0x24]
nop dword [eax + eax]
movzx ecx, byte [edi + edx - 1]
mov eax, ebx
shl eax, 5
sub edx, esi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp edx, esi
jae 0x4f2920
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x18], edx
lea ecx, [edx - 1]
and ecx, ebx
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [esp + 0x14], eax
test edi, edi
je 0x4f29d8
nop dword [eax]
movzx eax, byte [edi + 7]
cmp ebp, eax
jne 0x4f29cd
mov ecx, dword [esp + 0x24]
lea edx, [edi + 0x10]
mov esi, ebp
sub esi, 4
jb 0x4f2987
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4f2990
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4f2976
cmp esi, 0xfffffffc
je 0x4f2a56
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4f29cd
cmp esi, 0xfffffffd
je 0x4f2a56
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4f29cd
cmp esi, 0xfffffffe
je 0x4f2a56
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4f29cd
cmp esi, 0xffffffff
je 0x4f2a56
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4f2a56
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f2960
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
cmp dword [edi + 0x1c], edx
jl 0x4f2a09
cmp edx, 0x3fffffff
jg 0x4f2a09
lea eax, [edx + edx]
push eax
push dword [esp + 0x24]
call fcn.004f2e70
mov ecx, dword [edi + 0x20]
add esp, 8
mov eax, dword [edi + 0x18]
dec ecx
and ecx, ebx
lea eax, [eax + ecx*4]
mov dword [esp + 0x14], eax
lea eax, [ebp + 0x11]
push eax
push 4
push dword [esp + 0x28]
call fcn.004ef5b0
mov esi, eax
mov dword [esi + 8], ebx
lea ecx, [esi + 0x10]
mov ebx, dword [esp + 0x34]
push ebx
push dword [esp + 0x34]
mov byte [esi + 6], 0
push ecx
mov byte [esi + ebx + 0x10], 0
call fcn.0050c59e
mov ecx, dword [esp + 0x2c]
add esp, 0x18
mov byte [esi + 7], bl
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword [ecx], esi
inc dword [edi + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
mov al, byte [edi + 5]
xor al, 3
mov cl, byte [ecx + 0x3c]
xor cl, 3
test al, cl
jne 0x4f2a6c
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4f2b70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
xor eax, dword [esp + 0x10]
push edi
mov edi, esi
shr edi, 5
inc edi
cmp esi, edi
jb 0x4f2bac
push ebx
mov ebx, dword [esp + 0x10]
nop dword [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x4f2b90
pop ebx
pop edi
pop esi
ret
Function at 0x4f2bb0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 6], 0
jne 0x4f2bf8
mov edx, dword [edi + 8]
push ebx
push esi
mov esi, dword [edi + 0xc]
mov ebx, esi
shr ebx, 5
xor edx, esi
inc ebx
cmp esi, ebx
jb 0x4f2beb
nop
movzx ecx, byte [edi + esi + 0xf]
mov eax, edx
shl eax, 5
sub esi, ebx
add ecx, eax
mov eax, edx
shr eax, 2
add ecx, eax
xor edx, ecx
cmp esi, ebx
jae 0x4f2bd0
pop esi
pop ebx
mov dword [edi + 8], edx
mov eax, edx
mov byte [edi + 6], 1
pop edi
ret
mov eax, dword [edi + 8]
pop edi
ret

Function at 0x4f4d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push esi
push edi
call dword [0x531810]
mov ecx, dword [esp + 0x18]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
mov dh, byte [eax]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
movzx eax, byte [ecx]
test byte [eax + 0x788cb1], 8
je 0x4f4d6e
nop word [eax + eax]
movzx eax, byte [ecx + 1]
inc ecx
test byte [eax + 0x788cb1], 8
jne 0x4f4d60
mov dl, byte [ecx]
cmp dl, 0x2d
jne 0x4f4d80
inc ecx
mov dword [esp + 8], 1
jmp 0x4f4d8f
lea eax, [ecx + 1]
mov dword [esp + 8], esi
cmp dl, 0x2b
cmovne eax, ecx
mov ecx, eax
cmp byte [ecx], 0x30
jne 0x4f4ecd
mov al, byte [ecx + 1]
cmp al, 0x78
je 0x4f4da7
cmp al, 0x58
jne 0x4f4ecd
movsd xmm2, qword [0x786d48]
add ecx, 2
mov dl, byte [ecx]
mov dword [esp + 0x18], ecx
cmp dl, dh
jne 0x4f4dce
cmp dword [esp + 0x10], 0
jne 0x4f4e24
mov dword [esp + 0x10], 1
inc ecx
jmp 0x4f4db2
movzx eax, dl
test byte [eax + 0x788cb1], 0x10
je 0x4f4e24
test edi, edi
jne 0x4f4de9
cmp dl, 0x30
jne 0x4f4de9
inc dword [esp + 0xc]
jmp 0x4f4e19
inc edi
cmp edi, 0x1e
jg 0x4f4e18
movsx eax, dl
test byte [eax + 0x788cb1], 2
je 0x4f4e00
add eax, 0xffffffd0
jmp 0x4f4e06
or eax, 0x20
sub eax, 0x57
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x4f4e19
inc esi
cmp dword [esp + 0x10], 0
je 0x4f4e21
dec esi
inc ecx
jmp 0x4f4db2
mov eax, dword [esp + 0xc]
add eax, edi
je 0x4f4ecd
mov eax, dword [esp + 0x1c]
lea edi, [esi*4]
mov dword [eax], ecx
mov al, byte [ecx]
cmp al, 0x70
je 0x4f4e47
cmp al, 0x50
jne 0x4f4ea7
mov al, byte [ecx + 1]
inc ecx
xor esi, esi
cmp al, 0x2d
jne 0x4f4e5b
mov dword [esp + 0xc], 1
jmp 0x4f4e66
cmp al, 0x2b
mov dword [esp + 0xc], esi
cmovne ecx, dword [esp + 0x18]
movzx eax, byte [ecx + 1]
lea edx, [ecx + 1]
test byte [eax + 0x788cb1], 2
je 0x4f4ecd
mov al, byte [edx]
movsx eax, al
lea esi, [esi + esi*4]
inc edx
lea esi, [esi - 0x18]
lea esi, [eax + esi*2]
movzx eax, byte [edx]
test byte [eax + 0x788cb1], 2
mov al, byte [edx]
jne 0x4f4e78
mov eax, esi
neg eax
cmp dword [esp + 0xc], 0
cmove eax, esi
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
cmp dword [esp + 8], 0
je 0x4f4eb5
xorps xmm1, xmmword [0x786d50]
push edi
sub esp, 8
movsd qword [esp], xmm1
call dword [0x53184c]
add esp, 0xc
pop edi
pop esi
add esp, 0xc
ret
fldz
pop edi
pop esi
add esp, 0xc
ret
Function at 0x8ad998
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
bswap ebx
mov esi, dword [esp + 0x28]
rcl al, cl
bswap esi
rol esi, 2
mov bl, 0xf9
lahf
not esi
inc esi
rdtsc
not esi
jmp 0xa252b9
xor ebx, edx
cmp cl, 0x13
add edi, edx
jmp 0xa76869
add esi, ecx
sbb edx, edi
movzx edx, si
mov ebp, esp
mov dh, 0x7e
sub esp, 0xc0
inc bl
mov ebx, esi
sub edi, ebx
xchg edi, edx
mov eax, 0
sub ebx, eax
sar edi, 0x12
shr dl, cl
bts dx, dx
lea edi, [0x879739]
add edx, ebp
cmc
sub esi, 4
cwd
xor dl, 0x25
mov edx, dword [esi]
clc
xor edx, ebx
not edx
xor edx, 0x41fa7bd8
cmc
jmp 0x909018
push eax
mov ax, si
push edx
rdtsc
pushfd
bts dx, ax
push ebp
movzx ebp, ax
lahf
rol ax, 0xae
push esi
push edi
cmc
btr edi, 7
push ecx
push ebx
mov ecx, 0
jmp 0x83353d
inc edx
jmp 0x84642b
rol edx, 1
jmp 0x8bcd84
inc esi
jmp 0x87970f
jmp edi

Function at 0xc4d969
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, edx
cmp cl, 0x13
add edi, edx
jmp 0xb41df8
inc edx
jmp 0xad5674
jmp edi
rol edx, 1
jmp 0xb2b308
add esi, ecx
sbb edx, edi
movzx edx, si
mov ebp, esp
mov dh, 0x7e
sub esp, 0xc0
inc bl
mov ebx, esi
sub edi, ebx
xchg edi, edx
mov eax, 0
sub ebx, eax
sar edi, 0x12
shr dl, cl
bts dx, dx
lea edi, [0xc20c19]
add edx, ebp
cmc
sub esi, 4
cwd
xor dl, 0x25
mov edx, dword [esi]
clc
xor edx, ebx
not edx
xor edx, 0x41fa7bd8
cmc
jmp 0xbc5554
push eax
mov ax, si
push edx
rdtsc
pushfd
bts dx, ax
push ebp
movzx ebp, ax
lahf
rol ax, 0xae
push esi
push edi
cmc
btr edi, 7
push ecx
push ebx
mov ecx, 0
jmp 0xcb586b
inc esi
jmp 0xc20bef
push ecx
bswap ebx
mov esi, dword [esp + 0x28]
rcl al, cl
bswap esi
rol esi, 2
mov bl, 0xf9
lahf
not esi
inc esi
rdtsc
not esi
jmp 0xc95a8e
Function at 0x10001000
Capabilities:
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x10005139
sub esp, 0x9e8
jmp 0x10005146
mov dword [ebp - 0x74], 0xda80f407
pushfd
add dword [ebp - 0x74], 0x257f0bfb
popfd
push dword [ebp + 8]
pop eax
push eax
jmp 0x1000515e
call fcn.10010926
jmp 0x10005168
add esp, 4
jmp 0x10005177
mov dword [ebp - 4], eax
jmp 0x10005182
mov dword [ebp - 0x78], 0xe399b956
pushfd
add dword [ebp - 0x78], 0x1c6646aa
popfd
jmp 0x100051b4
push dword [ebp - 0x78]
pop ecx
push edx
mov edx, ecx
add edx, 1
mov ecx, edx
pop edx
mov dword [ebp - 0x78], ecx
jmp 0x100051b4
cmp dword [ebp - 0x78], 0x64
jmp 0x100051c0
jae fcn.100051e5
jmp 0x100051cb
push dword [ebp - 0x78]
pop edx
mov byte [ebp + edx - 0x70], 0
jmp 0x100051e0
jmp 0x1000519e

Function at 0x10010944
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1001094e
repz ret
jmp fcn.10010ba1

Function at 0x10015d78
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10010d19
and dword [ebp - 4], 0
cmp dword [0x10038788], 0
mov ebx, eax
jne 0x10015e29
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10015eda
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10015eda
push eax
call fcn.10010ca7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10038788], eax
call esi
push eax
call fcn.10010ca7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003878c], eax
call esi
push eax
call fcn.10010ca7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10038790], eax
call esi
push eax
call fcn.10010ca7
pop ecx
mov dword [0x10038798], eax
test eax, eax
je 0x10015e29
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10010ca7
pop ecx
mov dword [0x10038794], eax
mov eax, dword [0x10038794]
cmp eax, ebx
je 0x10015e81
cmp dword [0x10038798], ebx
je 0x10015e81
push eax
call fcn.10010d22
push dword [0x10038798]
mov esi, eax
call fcn.10010d22
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10015e81
test edi, edi
je 0x10015e81
call esi
test eax, eax
je 0x10015e78
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10015e78
test byte [ebp - 0xc], 1
jne 0x10015e81
or dword [ebp + 0x10], 0x200000
jmp 0x10015eba
mov eax, dword [0x1003878c]
cmp eax, ebx
je 0x10015eba
push eax
call fcn.10010d22
pop ecx
test eax, eax
je 0x10015eba
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10015eba
mov eax, dword [0x10038790]
cmp eax, ebx
je 0x10015eba
push eax
call fcn.10010d22
pop ecx
test eax, eax
je 0x10015eba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10038788]
call fcn.10010d22
pop ecx
test eax, eax
je 0x10015eda
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10015edc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x990058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009901a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x99007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99006a
add dl, dl
jne 0x990089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9900dc
xor eax, eax
add dl, dl
jne 0x990096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99017d
add dl, dl
jne 0x9900a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9900b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9900bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9900c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9900d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x990075
mov eax, 1
add dl, dl
jne 0x9900ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9900f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9900e1
sub eax, ebx
mov ebx, 1
jne 0x990128
mov ecx, 1
add dl, dl
jne 0x99010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x990119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x990105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x990075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x99013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x990136
cmp eax, 0x7d00
jae 0x99016d
cmp eax, 0x500
jb 0x990168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x990075
cmp eax, 0x7f
ja 0x990170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x990075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x99019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x990075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x1000048
mov edi, 0x24060383
xor edx, edi
push edx
mov ecx, 0x17647d54
mov esi, 0x38b2781e
xor esi, ecx
pop eax
xor esi, eax
mov ebx, 0x20008010
mov ecx, 0x40024040
xor ebx, ecx
push 0x1e2208a
mov edi, 0xe20082
pop edx
xor edi, edx
xor ebx, edi
xor esi, ebx
mov edi, 0x189edc20
mov ebx, 0x18de0da0
xor ebx, edi
mov edi, ebx
dec edi
mov edx, dword [edi + 1]
mov esi, edx
push 0x70c11a3f
mov ecx, 0xc6c85d2
pop eax
xor ecx, eax
push ecx
push 0x3d84d8dc
mov edi, 0x73109bd7
pop eax
xor edi, eax
pop ebx
xor edi, ebx
mov ecx, edi
add esp, 0xfffffffc
mov dword [esp], ecx
mov edi, 0x50084111
mov ecx, 0xd0182c
xor edi, ecx
push 0x5e5e82f1
mov esi, 0x3cbf072a
pop eax
xor esi, eax
xor esi, edi
pop edx
xor esi, edx
mov ecx, 0x7cfad7f0
mov edi, 0x7c1f056f
xor edi, ecx
mov ecx, 0x2e5632bc
mov edx, 0x2eb3e023
xor edx, ecx
xor edx, edi
xor edx, esi
and edx, 0xffffffff
je 0x403f97
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x7c6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x7c638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x7ef074
push ecx
mov edi, eax
call fcn.007da198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7c63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.007da02e
push esi
call fcn.007d9fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret