joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ecfb
Capabilities:
Get file version info

Disassembly:
push ebp
push edi
push ebx
push esi
mov ebp, esp
sub esp, 0x10
push ebp
add dword [esp], 0xfffffffc
push dword [ebp + 0x14]
call sub.VERSION.dll_GetFileVersionInfoSizeA
or eax, eax
jne 0x40ed1a
jmp 0x40edab
push eax
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
pop eax
push ebx
push eax
push 0
push dword [ebp + 0x14]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 8], 0x5c
push ebp
add dword [esp], 0xfffffff0
push ebp
add dword [esp], 0xfffffff4
push ebp
add dword [esp], 0xfffffff8
push ebx
call sub.VERSION.dll_VerQueryValueA
or eax, eax
jne 0x40ed57
jmp 0x40edab
mov esi, dword [ebp - 0xc]
mov eax, dword [esi + 8]
mov edx, eax
and edx, 0xffff
shr eax, 0x10
mov ecx, eax
mov eax, dword [esi + 0xc]
mov edi, eax
and edi, 0xffff
shr eax, 0x10
cmp dword [ebp + 0x18], 0
je 0x40ed92
push edi
push eax
push edx
push ecx
push 0x40edcd
push dword [ebp + 0x18]
call sub.USER32.dll_wsprintfA
add esp, 0x18
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push eax
push edx
push ebx
call sub.KERNEL32.dll_GlobalFree
pop edx
pop eax
mov esp, ebp
pop esi
pop ebx
pop edi
pop ebp
ret 8
push 0x40edd9
push dword [ebp + 0x18]
call fcn.00401bb4
push 0xd
call sub.KERNEL32.dll_SetLastError
xor edx, edx
xor eax, eax
dec eax
mov esp, ebp
pop esi
pop ebx
pop edi
pop ebp
ret 8

Function at 0x40f1c9
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 2
push 0
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [0x41def0], eax
push 0
call sub.KERNEL32.dll_SetLastError
push 0
push 0
push 0
push 4
push dword [0x41def0]
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x41def4], eax
call sub.KERNEL32.dll_GetLastError
or eax, eax
je 0x40f227
push dword [0x41def0]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp + 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffffff
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4

Function at 0x40f22d
Capabilities:
Parse pe header

Disassembly:
push ebp
push edi
mov ebp, esp
sub esp, 8
mov eax, dword [0x41def4]
cmp word [eax], 0x5a4d
je 0x40f25b
push 0
push 0
push 0x422e1a
push dword [ebp + 0xc]
call sub.USER32.dll_MessageBoxA
xor eax, eax
dec eax
mov esp, ebp
pop edi
pop ebp
ret 0xc
mov eax, dword [0x41def4]
mov edi, dword [eax + 0x3c]
add edi, dword [0x41def4]
cmp dword [edi], 0x4550
je 0x40f28c
push 0
push 0
push 0x422e38
push dword [ebp + 0xc]
call sub.USER32.dll_MessageBoxA
xor eax, eax
dec eax
mov esp, ebp
pop edi
pop ebp
ret 0xc
mov eax, dword [edi + 0x58]
cmp dword [ebp + 0x10], 0
jne 0x40f2a4
push edi
call fcn.0040f444
xor eax, eax
mov esp, ebp
pop edi
pop ebp
ret 0xc
push dword [ebp + 0x14]
push edi
call fcn.0040f309
xor eax, eax
mov esp, ebp
pop edi
pop ebp
ret 0xc
Function at 0x40f4f1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push 0x104
push ebp
add dword [esp], 0xfffffefc
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push ebp
add dword [esp], 0xfffffefc
call sub.SHLWAPI.dll_PathRemoveFileSpecA
push ebp
add dword [esp], 0xfffffdf0
push ebp
add dword [esp], 0xfffffdec
push 0
push 0x4001f
push 0
push 0
push 0
push 0x41aa38
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x40f552
xor eax, eax
dec eax
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x210], 2
je 0x40f588
push ebp
add dword [esp], 0xfffffefc
call sub.KERNEL32.dll_lstrlen
inc eax
push eax
push ebp
add dword [esp], 0xfffffefc
push 1
push 0
push 0
push dword [ebp - 0x214]
call sub.ADVAPI32.dll_RegSetValueExA
jmp 0x40f60f
mov dword [ebp - 0x20c], 0x104
push ebp
add dword [esp], 0xfffffdf4
push ebp
add dword [esp], 0xfffffdf8
push 0
push 0
push 0x422e53
push dword [ebp - 0x214]
call sub.ADVAPI32.dll_RegQueryValueExA
push ebp
add dword [esp], 0xfffffefc
push ebp
add dword [esp], 0xfffffdf8
call sub.KERNEL32.dll_lstrcmpi
test eax, eax
je 0x40f60f
push 4
push 0x422e54
push 0x40f620
push 0
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x40f60f
push ebp
add dword [esp], 0xfffffefc
call sub.KERNEL32.dll_lstrlen
inc eax
push eax
push ebp
add dword [esp], 0xfffffefc
push 1
push 0
push 0
push dword [ebp - 0x214]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 0x214]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40f66b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebp
add dword [esp], 0xffffffc0
push 0x20006
push 0
push 0x41aa83
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x40f694
mov esp, ebp
pop ebp
ret
push 4
push 0x41e350
push 4
push 0
push 0x41ab20
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
push 0x41a49c
call fcn.00401b1b
inc eax
push eax
push 0x41a49c
push 1
push 0
push 0x41ab28
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
push 0x41a4e8
call fcn.00401b1b
inc eax
push eax
push 0x41a4e8
push 1
push 0
push 0x41ab34
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
cmp dword [0x41a6f8], 1
jne 0x40f737
push ebp
add dword [esp], 0xffffffd4
push dword [0x41a668]
call sub.USER32.dll_GetWindowPlacement
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
push 0x10
push ebp
add dword [esp], 0xfffffff0
push 3
push 0
push 0x41aae9
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
cmp dword [0x41a6fc], 1
jne 0x40f76c
push 0xfffffffffffffff0
push dword [0x41a678]
call sub.USER32.dll_GetWindowLongA
mov dword [ebp - 0x7c], eax
push 4
push ebp
add dword [esp], 0xffffff84
push 4
push 0
push 0x41ab0c
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
cmp dword [0x41a700], 1
jne 0x40f812
push 0
push 0
push 0x1200
push dword [0x41a680]
call sub.USER32.dll_SendMessageA
mov edi, eax
shl eax, 2
mov dword [ebp - 0x74], eax
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x78], eax
mov esi, eax
push esi
push edi
push 0x1211
push dword [0x41a680]
call sub.USER32.dll_SendMessageA
push dword [ebp - 0x74]
push esi
push 3
push 0
push 0x41aaf2
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
mov dword [ebp - 0x70], 1
xor ebx, ebx
jmp 0x40f7f1
push ebp
add dword [esp], 0xffffff90
push ebx
push 0x1203
push dword [0x41a680]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp - 0x6c]
mov dword [esi + ebx*4], eax
inc ebx
cmp ebx, edi
jl 0x40f7d4
push dword [ebp - 0x74]
push esi
push 3
push 0
push 0x41aaf9
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 0x78]
call sub.KERNEL32.dll_GlobalFree
cmp dword [0x41a704], 1
jne 0x40f877
push ebp
add dword [esp], 0xffffffc4
push dword [0x41a674]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
push eax
push ebp
add dword [esp], 0xffffffc4
push dword [0x41a668]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x3c]
sub dword [ebp - 0x34], eax
pop eax
mov edx, 0x64
mul edx
xor edx, edx
div dword [ebp - 0x34]
inc eax
mov dword [0x41a6d4], eax
push 4
push 0x41a6d4
push 4
push 0
push 0x41ab04
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
push 0x41e694
call fcn.00401b1b
inc eax
push eax
push 0x41e694
push 1
push 0
push 0x41ab40
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 0x40]
call sub.ADVAPI32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x40fe73
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push dword [ebp + 8]
push 0x422e6a
push ebp
add dword [esp], 0xfffffefc
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov dword [ebp - 0x148], 0x44
push ebp
add dword [esp], 0xfffffeb8
call sub.KERNEL32.dll_GetStartupInfoA
push ebp
add dword [esp], 0xfffffea8
push ebp
add dword [esp], 0xfffffeb8
push 0
push 0
push 0
push 1
push 0
push 0
push ebp
add dword [esp], 0xfffffefc
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x40fef8
push dword [ebp - 0x158]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x154]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov esp, ebp
pop ebp
ret 4
xor eax, eax
dec eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4142be
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4142cd
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x41c220]
test eax, eax
je 0x4142db
call fcn.00414264
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x4143dd
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x41fc45]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x41fc45]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x41fc45]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x41fc45]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x41fc45]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x41fc45]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x41fc45]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x41fc45]
xor eax, ecx
inc esi
dec edi
jne 0x4142f5
pop edi
test edx, edx
je 0x4143ff
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x41fc45]
xor eax, ecx
inc esi
dec edx
jne 0x4143e1
pop ebx
pop esi
not eax
ret 0xc
Function at 0x40529a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48fd3c]
jne 0x4052a4
repz ret
jmp fcn.00409092

Function at 0x40bb2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406cf4
and dword [ebp - 4], 0
cmp dword [0x491650], 0
mov ebx, eax
jne 0x40bbdd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bc8e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40bc8e
push eax
call fcn.00406c82
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x491650], eax
call esi
push eax
call fcn.00406c82
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x491654], eax
call esi
push eax
call fcn.00406c82
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x491658], eax
call esi
push eax
call fcn.00406c82
pop ecx
mov dword [0x491660], eax
test eax, eax
je 0x40bbdd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406c82
pop ecx
mov dword [0x49165c], eax
mov eax, dword [0x49165c]
cmp eax, ebx
je 0x40bc35
cmp dword [0x491660], ebx
je 0x40bc35
push eax
call fcn.00406cfd
push dword [0x491660]
mov esi, eax
call fcn.00406cfd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bc35
test edi, edi
je 0x40bc35
call esi
test eax, eax
je 0x40bc2c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bc2c
test byte [ebp - 0xc], 1
jne 0x40bc35
or dword [ebp + 0x10], 0x200000
jmp 0x40bc6e
mov eax, dword [0x491654]
cmp eax, ebx
je 0x40bc6e
push eax
call fcn.00406cfd
pop ecx
test eax, eax
je 0x40bc6e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bc6e
mov eax, dword [0x491658]
cmp eax, ebx
je 0x40bc6e
push eax
call fcn.00406cfd
pop ecx
test eax, eax
je 0x40bc6e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x491650]
call fcn.00406cfd
pop ecx
test eax, eax
je 0x40bc8e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bc90
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add edi, 0xc1
bswap ebx
or eax, 0x12
rcl edi, 0x62
dec edx
imul ebx
sub ebx, 0x8e
imul esi
neg ebx
neg esi
add edi, 0x8d
bswap esi
not edx
sbb ebx, 5
dec edx
imul edx
imul eax
sbb ebx, 0x36
rcl edi, 0xb3
neg edx
or edx, 0xdb
neg edx
rol edx, 0x5b
sbb ebx, 0x83
rcr ebx, 0xc5
imul eax
imul edx
inc edi
rcl esi, 0xf7
neg eax
ror eax, 0x2b
dec edi
imul esi
add edx, 0x99
sbb edi, 0x44
bswap ebx
mov edx, 0x8a
or esi, 0x2e
inc ebx
neg esi
mov esi, 0x50
and esi, 0x93
neg edi
dec edi
add ebx, 0x49
not esi
inc ebx
rcr ebx, 0x6c
bswap edi
ror eax, 0x3d
xor ecx, ecx
xor edi, edi
bswap eax
rcl edi, 0x71
imul edi
sbb edi, 0x9f
sbb eax, 0x3f
or esi, 0xa2
mov edi, 0xad
not edi
rol edi, 0xea
bswap ebx
or edi, 0x32
bswap eax
ror edi, 0x78
rol esi, 0x9a
inc esi
mov edi, 8
rcr edx, 0x46
bswap esi
rcl edx, 0x23
rol eax, 0xdb
not ebx
or esi, 0x90
sbb ebx, 0xac
dec eax
or ebx, 0xf2
inc esi
neg ebx
bswap ebx
inc ebx
rol edi, 0x4f
dec eax
dec edx
or ebx, 0x7f
bswap eax
mov edx, 0xaa
not ebx
dec eax
bswap edi
rcl ebx, 0xac
rcr ebx, 7
rcr ebx, 0x73
neg ebx
neg esi
mov edx, 0x5e
rol eax, 0xec
or eax, 0xe5
bswap ebx
imul edx
rcl eax, 0x40
not eax
mov ecx, dword [ebp + 0xc]
dec eax
sbb edx, 0x60
sbb edi, 0xd5
rcr esi, 0xdd
sbb edx, 0x6d
neg esi
not edx
imul edx
inc esi
inc esi
neg edi
neg edi
rcl edx, 0xa0
imul esi
add ebx, 0x8e
mov ebx, 1
bswap ebx
imul eax
rol esi, 0x8f
ror ebx, 0xeb
bswap esi
imul eax
sbb esi, 0x4e
or ebx, 0x2b
inc edx
sbb edx, 0x7b
dec eax
rcr ebx, 0xb3
bswap edx
imul esi
neg edx
dec edx
neg esi
dec edi
dec esi
dec esi
ror ebx, 0xd5
sub esi, 0xc1
neg edx
neg esi
inc edx
inc esi
imul edi
imul ebx
ror edx, 0x86
not esi
add edi, 0xdc
ror eax, 0xeb
bswap esi
imul edx
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, ebx
xor ebx, esi
not byte [edi]
xor eax, eax
xor esi, eax
xor ebx, eax
xor ebx, eax
mov ebx, esi
mov ebx, esi
mov eax, esi
mov eax, eax
mov esi, ebx
add byte [edi], 0x48
xor ebx, ebx
xor ebx, eax
xor esi, esi
xor eax, esi
xor eax, esi
mov esi, ebx
xor ebx, eax
xor esi, eax
mov esi, ebx
sub byte [edi], 0x97
mov esi, esi
xor eax, eax
mov esi, esi
xor esi, ebx
xor esi, ebx
xor esi, esi
xor esi, ebx
mov eax, esi
mov esi, ebx
imul byte [edi]
inc edi
loop 0x4103bc
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4018d0
Capabilities:
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [0x848520], 0x400
push esi
push edi
jne 0x401907
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea esi, [ebp - 0x24]
call fcn.004019e0
mov ecx, esi
call fcn.00401a00
mov edi, dword [ebp - 4]
xor esi, esi
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x2afe65
jle 0x401926
cmp edi, 0x78e90b55
jne 0x40192f
inc esi
cmp esi, 0x1c03
jl 0x401910
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
mov edi, edi
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp esi, 0x206d47
jg 0x40195d
inc esi
cmp esi, 0x4f6a4
jl 0x401940
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x40197c
cmp ebx, 0x785074d5
jne 0x401985
inc esi
cmp esi, 0x11915
jl 0x401968
mov eax, dword [0x42939c]
mov ecx, dword [0x429370]
mov dword [0x848520], eax
mov dword [0x848524], ecx
call fcn.00401620
mov esi, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, 0x3078f
pop ebx
lea esp, [esp]
cmp dword [0x848520], 0x51f
jne 0x4019c2
lea edx, [ebp - 0x2c]
push edx
call esi
sub edi, 1
jne 0x4019b0
mov eax, dword [0x847474]
mov dword [0x847ab4], eax
call eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4044ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428218]
jne 0x4044b5
repz ret
jmp fcn.0040909c
Function at 0x40a80f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004057f5
and dword [ebp - 4], 0
cmp dword [0x42a1e8], 0
mov ebx, eax
jne 0x40a8c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a971
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a971
push eax
call fcn.00405783
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42a1e8], eax
call esi
push eax
call fcn.00405783
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42a1ec], eax
call esi
push eax
call fcn.00405783
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42a1f0], eax
call esi
push eax
call fcn.00405783
pop ecx
mov dword [0x42a1f8], eax
test eax, eax
je 0x40a8c0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405783
pop ecx
mov dword [0x42a1f4], eax
mov eax, dword [0x42a1f4]
cmp eax, ebx
je 0x40a918
cmp dword [0x42a1f8], ebx
je 0x40a918
push eax
call fcn.004057fe
push dword [0x42a1f8]
mov esi, eax
call fcn.004057fe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a918
test edi, edi
je 0x40a918
call esi
test eax, eax
je 0x40a90f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a90f
test byte [ebp - 0xc], 1
jne 0x40a918
or dword [ebp + 0x10], 0x200000
jmp 0x40a951
mov eax, dword [0x42a1ec]
cmp eax, ebx
je 0x40a951
push eax
call fcn.004057fe
pop ecx
test eax, eax
je 0x40a951
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a951
mov eax, dword [0x42a1f0]
cmp eax, ebx
je 0x40a951
push eax
call fcn.004057fe
pop ecx
test eax, eax
je 0x40a951
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42a1e8]
call fcn.004057fe
pop ecx
test eax, eax
je 0x40a971
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a973
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x66c23dd4
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x6e0f5f9c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x533c3fb9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x60f200a
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x412a05
Capabilities:
Encode data using xor

Disassembly:
pop ebx
pslld mm4, qword [edx - 0x396845ee]
xor byte [edi], dh
cmpsb byte [esi], byte es:[edi]
push esp
cli
xor byte [esi + 0x56ecf67e], 0xf0
dec edi
adc eax, 0xa7668770
pop esi
fldenv [ebx + 0x48]
mov dh, 0xe6
loopne 0x412a8b
xchg esi, eax
mov ah, 0xc6
jmp 0x48288dfc
out 0x77, al
push 5
sar byte [ebx - 0x2a], cl
push edx
add eax, 0x52d67bd2
in eax, 0xdf
mov bl, 0xef
mov byte [0x49b64cb6], al
jae 0x412a67
jno 0x412ad8
push 0x5eaccba7
xor dh, 0x32
mov dword [esi], esp
cmpsb byte [esi], byte es:[edi]
daa
and eax, 0x4dd98875
mov word [edi + 0x25], ds
inc edi
mov al, 0x6c
jle 0x412a64
salc
push es
dec esi
adc byte [edi - 0x488b7018], ah
dec ebx
popal
pop ebp
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
inc ecx
adc ebx, dword [esi]
inc edx
adc byte [ebp - 0x30e00f00], 0x76
imul edx, dword [eax + 0x66aee521], 0x2656501a
aam 0x8d
cmpsd dword [esi], dword es:[edi]
or bh, dh
sub eax, 0x63a52587
push ss
salc
xor byte [esi + 0x62], al
pushal
cmp dword ds:[edi - 0x19e1a4c8], edx
sub edx, dword [edx - 0x2909996a]
pop ebx
push ds
out 0x2b, al
xchg edx, eax
xchg esi, eax
not dh
xlatb
les ebp, [edx]
sbb edx, dword [edi]
sub eax, edx
clc
mov ah, 0x1f
scasd eax, dword es:[edi]
or dword [edi + 0x58], ebx
mov esi, 0x9e06e86e
mov dword [esi + eax*8 - 0x68], edi
pop es
outsd dx, dword [esi]
lahf
or dword [ecx - 0x7f0e30b9], ebx
jecxz 0x412a8f
ret 0xb4f8
cli
scasd eax, dword es:[edi]
leave
js 0x412acc
cmpsd dword [esi], dword es:[edi]
pop edi
or byte [ebx + 0x7e], 0x8d
aad 0x83
push 0xffffffffffffffe5
push edx
fadd qword [edi - 0x5cccee5]
loopne 0x412adb
shl edx, 1
invalid

Function at 0x42888f
Capabilities:
Encode data using xor

Disassembly:
push esi
add al, 0xa2
xor bh, al
adc eax, 0x60952ed6
xor byte [edi], 0xcd
mov es, word [ecx]
xchg ebp, eax
adc dh, byte [ebx + 0xf82b2c6]
push esi
invalid

Function at 0x4a5de5
Capabilities:
Encode data using xor

Disassembly:
adc eax, edx
pop esp
invalid
add ch, cl
xchg esp, eax
push edi
fst qword [ebp - 0x28a1507b]
std
popfd
test byte [edx + 0x7b], 0x6e
jge 0x4a5daf
sub al, 0x57
call 0xc4141045
stosb byte es:[edi], al
push ebx
mov ebx, es
ficom word [edi - 0x24]
adc dl, byte [edx]
out dx, eax
cli
jns 0x4a5e7f
sub bl, byte [ecx - 0x7d00ea29]
ja 0x4a5e38
invalid
rcr esi, cl
adc eax, 0x17070122
imul ebp, dword [edi], 0xffffff84
cmpsd dword [esi], dword es:[edi]
hlt
or ch, 0x70
push edx
test al, 0xf2
invalid

Function at 0x4a9108
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
in eax, dx
test byte [0xecb6e707], bh
mov dl, 0x90
dec esp
jb 0x4a9177
sal byte [edi - 0x3e], cl
pop edx
invalid
xor al, byte [esi + 0x7b]
dec eax
and ebp, dword [edi]
aas
invalid

Function at 0x4f51f4
Capabilities:
Encode data using xor

Disassembly:
imul esi, dword [edi], 0x29
inc esi
cdq
pop edx
xchg edx, eax
les edi, [ecx + 2]
mov dl, 0x86
sub eax, 0x6223ad74
aad 0x71
dec eax
xor dword [ebp - 0xa5dd272], 0xf4c15ae0
push esp
mov eax, dword [0x2405c6e1]
pop ebp
cmpsd dword [esi], dword es:[edi]
xor ecx, dword [edx + 0x60]
inc eax
outsb dx, byte [esi]
lahf
pop ebp
cmc
invalid