joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453828
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45383a
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a880
mov eax, dword [0x45dafc]
mov dword [eax + 4], ebx
mov dword [eax], 0x453bcc
mov eax, dword [0x45db08]
mov dword [eax + 4], ebx
mov dword [eax], 0x453bd8
mov eax, ebx
call fcn.00453be4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44f08c
push eax
push 0
push 0
mov eax, dword [0x45dc4c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41e540]
call fcn.0041fa60
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41e540]
call fcn.0041fa60
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41e540]
call fcn.0041fa60
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045405c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453f2c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453f2c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453f2c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453977
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x453d10
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453ebb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x453e9c
mov dl, 1
mov eax, dword [0x412a54]
call fcn.004039d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404814
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x453e8b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00445490
test al, al
je 0x453e7e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x453ecc
lea eax, [ebp - 0x254]
call fcn.00409544
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x453e7e
xor eax, eax
push ebp
push 0x453e77
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x453f04
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x453e60
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x453e60
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453e7e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x453d81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041672c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453ec2
lea eax, [ebp - 0x260]
call fcn.00404814
ret

Function at 0x454834
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x462c94]
cmp byte [eax + 0xad], 0
jne 0x4548a5
cmp dword [0x462cb0], 0
jne 0x454866
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4547f0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x462cb0], eax
cmp dword [0x462cac], 0
jne 0x454881
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x462cac], eax
cmp dword [0x462cb4], 0
jne 0x4548a5
push esp
push 0
push 0
push 0x454794
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x462cb4], eax
pop edx
ret
Function at 0x454aa8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x454abf
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a880
mov eax, dword [0x45dc38]
cmp word [eax + 2], 0
jne 0x454ae7
mov eax, dword [0x45dc38]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00456798
mov eax, dword [0x45dcdc]
cmp word [eax + 2], 0
jne 0x454b01
mov eax, dword [0x45dcdc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004569a4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.004039d0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41ed1c]
call fcn.00424be8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x454cb8
mov eax, dword [0x45db60]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424fbc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x457068
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45db60]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce9c
test eax, eax
je 0x454c08
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408efc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ced0
test eax, eax
je 0x454c1c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov byte [ebx + 0xd4], 0
push ebx
push 0x456224
call fcn.0041b9fc
mov dword [ebx + 0xc8], eax
mov eax, dword [0x45da6c]
cmp byte [eax], 0
jne 0x454c6d
mov eax, ebx
call fcn.00454dfc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045724c
mov eax, ebx
call fcn.00457db0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454cad
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45507c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45511b
cmp dword [ebx + 0x94], 0
jne 0x455115
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x455004
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x455115
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4550db
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x455115
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004149d4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4550ea
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455334
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x462c94]
cmp dword [eax + 0x30], 0
je 0x455491
test bl, bl
jne 0x4553e2
cmp dword [esi + 0x9c], 0
jne 0x4553d7
mov eax, esi
call fcn.00457c2c
push eax
push 0x455260
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4553a8
mov eax, dword [0x462c94]
call fcn.0045830c
test al, al
je 0x4553a8
mov eax, dword [0x462cb8]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x4553a8
push 0
mov eax, dword [0x462cb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x455392
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4553d7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004149d4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4553b7
inc dword [esi + 0x9c]
jmp 0x455491
cmp dword [esi + 0x9c], 0
jle 0x455491
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x455491
cmp dword [esi + 0x44], 0
je 0x45543d
mov eax, dword [0x462c94]
call fcn.0045830c
test al, al
je 0x45543d
mov eax, dword [0x462cb8]
call fcn.004056d0
mov edi, eax
cmp edi, 0
jl 0x45543d
push 5
mov eax, dword [0x462cb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x455427
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45546c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004149d4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45544c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x462cb8
mov ecx, 1
mov edx, dword [0x455240]
call fcn.00405884
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x455f78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x455fe2
mov eax, ebx
call fcn.0045830c
test al, al
jne 0x455fe2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404904
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x455fcf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x455fef
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
jmp 0x455fef
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x457430
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45749e
mov eax, esi
call fcn.00440174
test al, al
je 0x45749e
mov eax, dword [ebx + 0x84]
call fcn.0043fe00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45749e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x457492
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043fe00
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00437c80
jmp 0x45749e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045726c
pop esi
pop ebx
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x3e888046
sub eax, 0x3e4863e0
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xb5aa707d
add dword [ebp - 0x2c], 0x98a7d4ce
mov dword [ebp - 0x28], 0x7fc99507
add dword [ebp - 0x28], 0xb269b73e
mov dword [ebp - 0x24], 0x393ab6b0
add dword [ebp - 0x24], 0x13118d7e
mov dword [ebp - 0x20], 0x7a0297c2
add dword [ebp - 0x20], 0x85fd683e
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x88b5726
sub dword [ebp - 0x2c], 0x9418edd0
mov dword [ebp - 0x28], 0x4d8b47d3
sub dword [ebp - 0x28], 0xc1ee65e
mov dword [ebp - 0x24], 0x95850e3a
add dword [ebp - 0x24], 0xcdea5e32
mov dword [ebp - 0x20], 0xd7beaf77
add dword [ebp - 0x20], 0x28415089
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xd248adf4
sub eax, 0xd2087dc8
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39d62
push 0
call eax
mov ecx, 0x4942c835
add ecx, 0xb6bd8d37
xor ebx, ebx
add ebx, eax
mov edx, 0x407000
add edx, dword [ebp - 0x1c]
mov edi, 0x68eed307
add edi, 0x32dfcd0d
sub dword [ebp - 0x14], 0x98734f39
mov esi, dword [edx]
sub dword [ebp - 8], ecx
xor esi, edi
mov dword [ebx], esi
add dword [ebp - 4], 0xb3502ab1
add ebx, 0x606a7d9c
add ebx, 0x9f958268
add edx, 4
loop 0x401d7f
add eax, 0x14883
mov ebx, eax
add eax, 0xd3ca0931
add eax, 0x2c35f6d4
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4da880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x49b015
lea edi, [esi - 0x9a015]
push edi
or ebp, 0xffffffff
jmp 0x4da8a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4da8a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da898
mov eax, 1
add ebx, ebx
jne 0x4da8bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4da8cc
jne 0x4da8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da8eb
dec eax
add ebx, ebx
jne 0x4da8d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4da8b0
add ebx, ebx
jne 0x4da8e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4da93d
xor ecx, ecx
sub eax, 3
jb 0x4da903
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4da972
sar eax, 1
mov ebp, eax
jmp 0x4da90e
add ebx, ebx
jne 0x4da90e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da8dc
inc ecx
add ebx, ebx
jne 0x4da91c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da8dc
add ebx, ebx
jne 0x4da929
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4da91e
jne 0x4da93a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4da91e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4da95c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4da94e
jmp 0x4da89e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4da95c
add edi, ecx
jmp 0x4da89e
pop esi
mov edi, esi
mov ecx, 0x3021
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4da97a
cmp byte [edi], 6
jne 0x4da97a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4da97f
lea edi, [esi + 0xd8000]
mov eax, dword [edi]
or eax, eax
je 0x4da9ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xda000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xda03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4da9ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xda040]
or eax, eax
je 0x4da9e8
mov dword [ebx], eax
add ebx, 4
jmp 0x4da9c9
call dword [esi + 0xda050]
mov ebp, dword [esi + 0xda044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xdaa49]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4daa3a
sub esp, 0xffffff80
jmp 0x4014e0
Function at 0x40d21d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a511
mov dword [ebp - 0x14], eax
cmp dword [0x458fe4], esi
jne 0x40d310
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d3f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d3f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x458fe4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x458fe8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x458fec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x458ff4], eax
test eax, eax
je 0x40d30d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x458ff0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d335
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d328
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d34a
push 4
pop eax
jmp 0x40d3f2
cmp dword [ebp - 0x14], esi
je 0x40d34a
push dword [0x458fe4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d32f
mov eax, dword [0x458ff0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d3a8
cmp dword [0x458ff4], edi
je 0x40d3a8
push eax
call ebx
push dword [0x458ff4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d3a8
test eax, eax
je 0x40d3a8
call ecx
test eax, eax
je 0x40d39d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d39d
test byte [ebp - 8], 1
jne 0x40d3a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d3d8
mov eax, dword [0x458fe8]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
call eax
mov esi, eax
test esi, esi
je 0x40d3d5
mov eax, dword [0x458fec]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x458fe4]
call ebx
test eax, eax
je 0x40d3f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d3f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045d8
mov esp, ebp
pop ebp
ret
Function at 0x2e022fb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2e022fc3
pop dword [ebp - 0x10]
mov eax, 0xd74a44a5
sub eax, 0xa94814e2
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x657d82d9
add dword [ebp - 0x20], 0xe8d4c272
mov dword [ebp - 0x1c], 0xb6339691
sub dword [ebp - 0x1c], 0x84004a4c
mov dword [ebp - 0x18], 0xaf149ba9
sub dword [ebp - 0x18], 0x62c8577b
mov dword [ebp - 0x14], 0x27509474
sub dword [ebp - 0x14], 0x27509474
lea eax, [ebp - 0x20]
push eax
mov eax, 0x57cd0404
sub eax, 0x29c9e33c
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x81fa4f31
sub dword [ebp - 0x20], 0xd87e5db
mov dword [ebp - 0x1c], 0xa368241e
sub dword [ebp - 0x1c], 0x61fbc2a9
mov dword [ebp - 0x18], 0x81f9258c
add dword [ebp - 0x18], 0xe17646e0
mov dword [ebp - 0x14], 0x95800789
sub dword [ebp - 0x14], 0x95800789
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3f22c
push 0
call eax
mov ecx, 0x9f9ec3ad
sub ecx, 0x9f9e834b
mov edi, eax
mov edx, 0x9a834e7c
sub edx, 0x6c7de07c
add edx, dword [ebp - 0x10]
mov esi, 0x151bfafb
add esi, 0x6a676f8b
sub dword [ebp - 4], edx
mov ebx, dword [edx]
add dword [ebp - 4], edi
sub ebx, esi
xor dword [ebp - 0xc], eax
mov dword [edi], ebx
xor dword [ebp - 8], 0x83ee4df9
add edi, 4
add edx, 4
loop 0x2e0230e0
add eax, 0x1b612af9
add eax, 0xe49fc962
xor ebx, ebx
add ebx, eax
add eax, 0x4d0148e5
sub eax, 0x4d0148e0
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a8f6
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a8f6
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4030ca
pop dword [ebp - 0x2c]
mov eax, 0x4030ca
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xfe436deb
add dword [ebp - 0x3c], 0x500ed760
mov dword [ebp - 0x38], 0xe3a79ce5
sub dword [ebp - 0x38], 0xb17450a0
mov dword [ebp - 0x34], 0x6b8e1a58
add dword [ebp - 0x34], 0xe0be29d6
mov dword [ebp - 0x30], 0x7603a7e2
add dword [ebp - 0x30], 0x89fc581e
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x455b71c2
add eax, 0xbae50f42
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x32c58653
sub dword [ebp - 0x3c], 0xbe531cfd
mov dword [ebp - 0x38], 0x9ee0607a
add dword [ebp - 0x38], 0xa28c00fb
mov dword [ebp - 0x34], 0xb0a5ae92
sub dword [ebp - 0x34], 0x4d364226
mov dword [ebp - 0x30], 0xd6b1a118
add dword [ebp - 0x30], 0x294e5ee8
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x35298
push 0
call eax
mov ecx, 0x5ae449da
sub ecx, 0x5ae40927
mov esi, eax
mov edx, 0x63db38c6
sub edx, 0x639634c6
add edx, dword [ebp - 0x2c]
mov edi, 0x64781934
sub edi, 0xbf7758f4
xor dword [ebp - 0x14], ebx
mov ebx, dword [edx]
sub dword [ebp - 0x1c], 0xc49efe46
xor ebx, edi
xor dword [ebp - 0x10], ecx
mov dword [esi], ebx
sub dword [ebp - 4], eax
add esi, 0x7ea16928
sub esi, 0x7ea16924
add edx, 0x1120786c
sub edx, 0x11207868
loop 0x4031e2
add eax, 0x653ee86b
sub eax, 0x653df2cc
xor ebx, ebx
add ebx, eax
add eax, 0x36607904
sub eax, 0x366078ff
mov ecx, 0x11b0ab2
add ecx, 0xff24f54e
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret