joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd12539
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
bsf di, bp
mov bx, 0xbadd
jmp 0xd1257b
bsf ebx, esi
xchg ebp, ecx
pop dword [esp]
mov word [esp], bx
inc edx
jmp 0xd12591
adc ah, 0xb6
pop word [esp + 7]
shl edx, cl
lea esi, [edx + ebx]
rdtsc
mov di, word [esp + 6]
jmp 0xd12565
bts bx, bp
setg cl
mov byte [esp + 1], ah
sub esp, 0x1a
xchg dword [esp + 7], eax
std
jmp 0xd125d4
mov ax, 0x6344
lea ecx, [eax + edi]
cpuid
mov ah, byte [esp + 1]
sub esp, 0x11
pop eax
jmp 0xd125ed
mov word [esp + 1], sp
cpuid
lea esp, [esp + 0x1e]
mov ecx, 0xccc5a09f
mov dx, 0x2956
setle ah
jmp 0xd125bb
bswap ebx
mov ebx, dword [esp + 0xc]
dec bh
pop word [esp + 8]
push word [esp + 1]
lea eax, [ebp*4]
jmp 0xd126a0
lea ecx, [ebx - 0xfa]
clc
xchg di, ax
xchg bx, ax
neg si
cld
jmp 0xd1261a
pop dword [esp + 6]
mov dword [esp + 2], edx
xchg dx, bp
push word [esp]
not di
lea esi, [esi*4]
jmp 0xd12630

Function at 0xd1286c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, bl
neg edx
lea ebp, [esi*4]
not esi
lea ebx, [eax + esi]
jmp 0xd128c5
stc
pop si
bswap esi
pop cx
neg si
xchg bl, cl
jmp 0xd128af

Function at 0xd12f1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 2]
mov ax, 0xb1d5
rdtsc
mov word [esp + 1], di
jmp 0xd12f67
lea esp, [esp + 5]
neg si
bts edx, ebp
jmp 0xd12f09
push dword [esp + 4]
rcr edi, 1
mov bh, byte [esp]
bswap edi
mov edi, ebx
mov edx, esp
jmp 0xd12f4a
Function at 0x100111a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1008a080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x2f63839c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0x83fad826
je 0x10011217
jmp 0x100111d9
mov eax, dword [ebp - 0x20]
sub eax, 0x2f63839c
je 0x100111f1
jmp 0x100111ec
jmp 0x1001126a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push eax
mov edx, esp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x83fad826
jmp 0x1001126a
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10011270
add esp, 8
mov ah, al
mov al, ah
xor al, 0xff
and al, 1
mov dl, 1
xor dl, 1
and ah, dl
mov cl, 1
xor cl, 1
and cl, 0xff
and dl, 1
or al, ah
or cl, dl
xor al, cl
and al, 1
movzx eax, al
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c310
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
jmp 0x100111c3

Function at 0x1002132a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10021369
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10021369
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10021369
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10021369
cmp dword [ecx + 0x74], 0xe
jbe 0x10021369
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10023cf4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10023d91
push ebx
push esi
call fcn.10023cbd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10023c51
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10023d3e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10023d90
push edi
push eax
call fcn.100225f2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10023d5e
call fcn.10022640
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10023d8f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10023c51
add esp, 0x20
test eax, eax
jne 0x10023d7d
push edi
call fcn.10022640
jmp 0x10023d85
push ebx
call fcn.10022640
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10023ffe
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c800
push 0x1002c7f8
push str.FlsAlloc
push 0x1f
call fcn.10023f1a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10024032
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002a154]
call esi
jmp 0x10024038
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002407c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c810
push 0x1002c808
push str.FlsGetValue
push 0x21
call fcn.10023f1a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100240b3
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002a154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100240bb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1002c818
push 0x1002c810
push str.FlsSetValue
push 0x22
call fcn.10023f1a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100240f5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002a154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10029600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002962d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002962d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4011d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x138
mov eax, dword [0x433174]
xor eax, esp
mov dword [esp + 0x134], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0xc], eax
mov ecx, 0x430012
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401218
test dl, dl
je 0x401214
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401218
add eax, 2
add ecx, 2
test dl, dl
jne 0x4011f8
xor eax, eax
jmp 0x40121d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4012a6
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4012a6
push 0x128
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00406320
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40129f
mov edi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.0040dc53
add esp, 8
test eax, eax
jne 0x401290
mov edx, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x10], eax
call edi
test eax, eax
jne 0x4012be
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401266
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x134]
xor ecx, esp
call fcn.004062e1
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004062e1
mov esp, ebp
pop ebp
ret 4
Function at 0x401d70
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x28
push ebp
push esi
push edi
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.00401f30
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebp
jne 0x401ec5
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
je 0x401de6
push ecx
push ebp
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
push 0x201eb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401ddf
lea eax, [ebp + 5]
pop edi
pop esi
pop ebp
add esp, 0x28
ret 8
push esi
call edi
xor eax, eax
jmp 0x401dee
cmp eax, ebp
jne 0x401ec5
cmp dword [esp + 0x10], ebp
je 0x401ec5
lea edx, [esp + 0x18]
push edx
push str.SeDebugPrivilege
push ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x401e2a
mov eax, dword [esp + 0x10]
push eax
call edi
mov eax, 2
pop edi
pop esi
pop ebp
add esp, 0x28
ret 8
mov ecx, dword [esp + 0x10]
push ebx
push 1
push 1
push ebp
push 0x2000000
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x401e59
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, 3
pop edi
pop esi
pop ebp
add esp, 0x28
ret 8
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ebx]
push 4
push ecx
push 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov ecx, dword [esp + 0x1c]
push ebp
xor eax, eax
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
push 0x10
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x34], eax
mov eax, dword [ebx]
push ebp
push eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 0x10]
mov esi, eax
dec esi
neg esi
sbb esi, esi
push ecx
and esi, 4
call edi
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x28
ret 8
Function at 0x401f30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x238
mov eax, dword [0x433174]
xor eax, esp
mov dword [esp + 0x234], eax
cmp dword [edi + 0x14], 0
mov eax, dword [esp + 0x23c]
mov dword [esp + 4], eax
jne 0x401f71
mov eax, 1
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004062e1
add esp, 0x238
ret 4
push ebp
mov ebp, dword [ecx]
cmp ebp, 0xffffffff
jne 0x401f96
mov eax, 6
pop ebp
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004062e1
add esp, 0x238
ret 4
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x401fb1
mov eax, 7
jmp 0x402040
push 0x22c
lea edx, [esp + 0x14]
push 0
push edx
call fcn.00406320
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401fea
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 8
jmp 0x402040
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, edi
call fcn.00402220
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.00407ea7
add esp, 8
test eax, eax
jne 0x402024
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call ebx
test eax, eax
je 0x402024
cmp dword [esp + 0xc], ebp
je 0x402059
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401ff1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 9
pop ebx
mov ecx, dword [esp + 0x23c]
pop esi
pop ebp
xor ecx, esp
call fcn.004062e1
add esp, 0x238
ret 4
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push esi
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40203f
Function at 0x4020e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
push esi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x402104
lea eax, [edi + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8
push 1
push edi
lea eax, [esp + 0x78]
push eax
mov ebx, 0x30
mov dword [esp + 0x7c], 0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x402128
mov ebx, 0x430
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00406320
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x28], str.winsta0default
mov eax, 8
jne 0x40216a
xor esi, esi
jmp 0x402177
cmp dword [esi + 0x18], eax
jb 0x402174
mov esi, dword [esi + 4]
jmp 0x402177
add esi, 4
cmp dword [ebp + 0x14], 0
jne 0x402181
xor eax, eax
jmp 0x40218e
cmp dword [ebp + 0x18], eax
jb 0x40218b
mov eax, dword [ebp + 4]
jmp 0x40218e
lea eax, [ebp + 4]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x24]
push ecx
push 0
push edx
push ebx
push 0
push 0
push 0
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, 1
mov eax, dword [esp + 0x70]
je 0x4021d1
test eax, eax
je 0x4021c3
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, 0xd
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8
test eax, eax
je 0x4021dc
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [esp + 0x74]
test eax, eax
je 0x4021ea
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4021fb
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402206
push eax
call esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret 8
Function at 0x402300
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4210
call fcn.004062f0
mov eax, dword [0x433174]
xor eax, esp
mov dword [esp + 0x420c], eax
mov eax, str._CLIENT_SERVICE_
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402320
push ebp
push esi
push edi
sub eax, edx
mov ebp, eax
push str._CLIENT_SERVICE_
lea eax, [esp + 0x21c]
push 0x42d330
push eax
lea esi, [esp + ebp + 0x224]
call fcn.0040612f
mov edx, dword [esp + 0x4230]
lea ecx, [esp + 0x4234]
push ecx
mov edi, 0x3ffd
push edx
sub edi, ebp
push edi
push esi
call fcn.00406112
add esp, 0x1c
test eax, eax
jge 0x402373
mov eax, edi
add esi, eax
lea eax, [esp + 0x218]
cmp esi, eax
jbe 0x4023a0
movsx ecx, byte [esi - 1]
push ecx
call fcn.0040604c
add esp, 4
test eax, eax
je 0x4023a0
dec esi
lea edx, [esp + 0x218]
mov byte [esi], 0
cmp esi, edx
ja 0x402380
mov byte [esi], 0xd
inc esi
mov byte [esi], 0xa
mov byte [esi + 1], 0
mov esi, dword [esp + 0x4220]
cmp dword [esi], 0
jle 0x4023c5
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esi], 1
jle 0x402486
push 0x103
lea ecx, [esp + 0x99]
push 0
push ecx
mov byte [esp + 0xa0], 0
call fcn.00406320
lea edx, [esp + 0x18]
push edx
call fcn.00404a13
lea eax, [esp + 0x1c]
push eax
call fcn.004049ec
mov esi, eax
push esi
push str._m_d
lea ecx, [esp + 0x1b4]
push 0x80
push ecx
call fcn.00405f49
lea edx, [esp + 0x1bc]
push edx
lea eax, [esp + 0xbc]
push str.c:initechclient_service_logIniClientSvc__s.log
push eax
call fcn.0040612f
push esi
push str.__H:_M:_S_
lea ecx, [esp + 0x4c]
push 0x80
push ecx
call fcn.00405f49
add esp, 0x40
lea edx, [esp + 0x94]
push 0x42d2e4
push edx
call fcn.00404dc1
mov esi, eax
add esp, 8
test esi, esi
je 0x402486
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x18]
push ecx
push str._s__s
push esi
call fcn.00404b57
push esi
call fcn.00404adb
add esp, 0x14
mov ecx, dword [esp + 0x4218]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004062e1
add esp, 0x4210
ret

Function at 0x402a00
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
jne 0x402a3d
mov ecx, dword [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x402a3d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
pop ecx
ret 8

Function at 0x402ab0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push edi
lea esi, [ecx + 0x1c]
mov edi, 2
mov ecx, dword [esi + 0x50]
lea eax, [esp + 0xc]
push eax
push 0
push esi
push ecx
push 0
push 0
call ebx
mov dword [esi], eax
add esi, 0x54
sub edi, 1
jne 0x402ac2
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4062e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433174]
jne 0x4062eb
repz ret
jmp fcn.0040e567
Function at 0x40af8e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and esi, eax
test dword [edi + 0x30fffffc], ebx
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
invalid
invalid
invalid

Function at 0x428c11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040cff5
and dword [ebp - 4], 0
cmp dword [0x434cd8], 0
mov ebx, eax
jne 0x428cc2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x428d73
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42feac
push edi
call esi
test eax, eax
je 0x428d73
push eax
call fcn.0040cf83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434cd8], eax
call esi
push eax
call fcn.0040cf83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x434cdc], eax
call esi
push eax
call fcn.0040cf83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x434ce0], eax
call esi
push eax
call fcn.0040cf83
pop ecx
mov dword [0x434ce8], eax
test eax, eax
je 0x428cc2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040cf83
pop ecx
mov dword [0x434ce4], eax
mov eax, dword [0x434ce4]
cmp eax, ebx
je 0x428d1a
cmp dword [0x434ce8], ebx
je 0x428d1a
push eax
call fcn.0040cffe
push dword [0x434ce8]
mov esi, eax
call fcn.0040cffe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x428d1a
test edi, edi
je 0x428d1a
call esi
test eax, eax
je 0x428d11
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x428d11
test byte [ebp - 0xc], 1
jne 0x428d1a
or dword [ebp + 0x10], 0x200000
jmp 0x428d53
mov eax, dword [0x434cdc]
cmp eax, ebx
je 0x428d53
push eax
call fcn.0040cffe
pop ecx
test eax, eax
je 0x428d53
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x428d53
mov eax, dword [0x434ce0]
cmp eax, ebx
je 0x428d53
push eax
call fcn.0040cffe
pop ecx
test eax, eax
je 0x428d53
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x434cd8]
call fcn.0040cffe
pop ecx
test eax, eax
je 0x428d73
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x428d75
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa95058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a951a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9506a
add dl, dl
jne 0xa95089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa950dc
xor eax, eax
add dl, dl
jne 0xa95096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9517d
add dl, dl
jne 0xa950a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa950d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa95075
mov eax, 1
add dl, dl
jne 0xa950ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa950e1
sub eax, ebx
mov ebx, 1
jne 0xa95128
mov ecx, 1
add dl, dl
jne 0xa9510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa95119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa95105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa95075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa95136
cmp eax, 0x7d00
jae 0xa9516d
cmp eax, 0x500
jb 0xa95168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa95075
cmp eax, 0x7f
ja 0xa95170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa95075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa95075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x406604
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406628
xor eax, eax
test eax, eax
je 0x40663a
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40663a
xor ecx, ecx
jmp 0x40663d
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406729
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a16f4], 0
push esi
jne 0x406760
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40673a
mov dword [ecx*4 + 0x7a16f0], eax
inc ecx
cmp ecx, 0x100
jl 0x406735
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406791
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a16f0]
xor eax, esi
inc ecx
dec edx
jne 0x406773
pop edi
not eax
pop esi
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x17431ed3
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
mov ecx, 0x46971a25
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219