joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d9a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408fab
mov dword [ebp - 0x14], eax
cmp dword [0x814560], esi
jne 0x40da9b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40da28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40db7b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40db7b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40db7b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x814560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x814564], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x814568], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x814570], eax
test eax, eax
je 0x40da98
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81456c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dac0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dab3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40dad5
push 4
pop eax
jmp 0x40db7d
cmp dword [ebp - 0x14], esi
je 0x40dad5
push dword [0x814560]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40daba
mov eax, dword [0x81456c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40db33
cmp dword [0x814570], edi
je 0x40db33
push eax
call ebx
push dword [0x814570]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40db33
test eax, eax
je 0x40db33
call ecx
test eax, eax
je 0x40db28
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40db28
test byte [ebp - 8], 1
jne 0x40db33
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40db63
mov eax, dword [0x814564]
cmp eax, edi
je 0x40db60
push eax
call ebx
test eax, eax
je 0x40db60
call eax
mov esi, eax
test esi, esi
je 0x40db60
mov eax, dword [0x814568]
cmp eax, edi
je 0x40db60
push eax
call ebx
test eax, eax
je 0x40db60
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x814560]
call ebx
test eax, eax
je 0x40db7b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40db7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404315
mov esp, ebp
pop ebp
ret
Function at 0x794058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7941a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x79407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x79406a
add dl, dl
jne 0x794089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7940dc
xor eax, eax
add dl, dl
jne 0x794096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x79417d
add dl, dl
jne 0x7940a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7940b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7940bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7940c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7940d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x794075
mov eax, 1
add dl, dl
jne 0x7940ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7940f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7940e1
sub eax, ebx
mov ebx, 1
jne 0x794128
mov ecx, 1
add dl, dl
jne 0x79410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x794119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x794105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x794075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x79413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x79414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x794136
cmp eax, 0x7d00
jae 0x79416d
cmp eax, 0x500
jb 0x794168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x794075
cmp eax, 0x7f
ja 0x794170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x794075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x79419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x794075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x593f9ca7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x593f9cb6
pop dword [ebp - 0x10]
mov eax, 0x593f9cb6
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x5203ee65
sub dword [ebp - 0x20], 0x3b1a91a
mov dword [ebp - 0x1c], 0xe420eb45
sub dword [ebp - 0x1c], 0xb1ed9f00
mov dword [ebp - 0x18], 0x89175929
add dword [ebp - 0x18], 0xc334eb05
mov dword [ebp - 0x14], 0xb717327e
add dword [ebp - 0x14], 0x48e8cd82
lea eax, [ebp - 0x20]
push eax
mov eax, 0x76a77005
sub eax, 0x1d685fa1
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xaf59d414
sub dword [ebp - 0x20], 0x3ae76abe
mov dword [ebp - 0x1c], 0x2b4fcfb9
sub dword [ebp - 0x1c], 0xe9e36e44
mov dword [ebp - 0x18], 0x6d517fd9
add dword [ebp - 0x18], 0xf61dec93
mov dword [ebp - 0x14], 0xe4be9986
sub dword [ebp - 0x14], 0xe4be9986
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xf18681e1
sub eax, 0x98477159
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3961b
push 0
call eax
mov ecx, 0xb59bbf1b
sub ecx, 0xb59b7193
xor ebx, ebx
add ebx, eax
mov edi, 0x2edffcf6
sub edi, 0xd59f0cf6
add edi, dword [ebp - 0x10]
mov edx, 0x890ecfae
sub edx, 0xcaa35e5a
sub dword [ebp - 4], 0x8d74e3e9
mov esi, dword [edi]
mov dword [ebp - 4], 0xf6a62a56
xor esi, edx
add dword [ebp - 8], 0xca41de24
mov dword [ebx], esi
add dword [ebp - 0xc], 0xb19bb5f4
add ebx, 0xc1a1351b
sub ebx, 0xc1a13517
add edi, 0x285d76be
add edi, 0xd7a28946
loop 0x593f9dd5
add eax, 0x128f3
xor ebx, ebx
add ebx, eax
add eax, 0x8d318be2
add eax, 0x72ce7423
mov ecx, 0x9f87f890
sub ecx, 0x4648f890
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x593faa70
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetFocus]
mov esi, ecx
push dword [esi + 8]
call edi
push dword [esi + 0xc]
call edi
push 5
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x18]
call edi
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x70]
push 0
mov dword [esi], 1
push dword [ecx + eax*4 + 0x24]
push 0x186
push dword [esi + 0x18]
call dword [sym.imp.vsansi.dll_SendMessageW]
and dword [esi], 0
pop edi
xor eax, eax
pop esi
ret

Function at 0x593fbcd7
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp edi, dword [esi + 8]
je 0x593fbd16
call fcn.593f9ca7
push 0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, dword [esi + 0x14]
je 0x593fbd06
mov eax, dword [esi + 0x3c]
test eax, eax
jle 0x593fbd0f
dec eax
mov dword [esi + 0x3c], eax
jmp 0x593fbd0f
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.593fb8d4
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x593fc691
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
ret 8
Function at 0x593fc6ab
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.vsansi.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop esi
ret 0xc

Function at 0x593fc6d7
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.vsansi.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x593fc6e2
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x59404d9b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.59404d84
and byte [esi + 0xc], 0
mov eax, 0x593f0000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x59404df5
cmp dword [ebp - 0x18], 5
jb 0x59404e0d
jmp 0x59404e09
cmp dword [ebp - 0xc], 1
jne 0x59404e0d
cmp dword [ebp - 0x18], 4
ja 0x59404e09
jne 0x59404e0d
cmp dword [ebp - 0x14], 0
jbe 0x59404e0d
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x59407090
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x655d33ed
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1da81fc1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4097ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x409831
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x409800
jmp 0x409831
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x409821
pop esi
pop ebp
ret

Function at 0x40a5cb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40a600
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40a62a
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40a62a
test edi, edi
je 0x40a5f7
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40a5f7
test edi, edi
je 0x40a632
mov eax, edi
jmp 0x40a5f9
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40a5f9
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040da56
add esp, 0xc
int3
Function at 0x40da8a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCasting.exe_gMozillaPoisonSize], eax
call fcn.0040a5cb
pop ecx
mov ecx, dword [sym.TestCasting.exe_gMozillaPoisonSize]
mov dword [sym.TestCasting.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40dac2
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCasting.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x401d4a
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [0x418714], 0
mov eax, dword [0x418714]
mov ebx, 0xffffffff
push ebx
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov dword [0x418ebf], eax
mov dword [0x418174], 0
mov eax, dword [0x418174]
lea edx, [edx + 0x418977]
add dword [0x4195a1], edx
sub edx, eax
shr edx, 1
add edx, eax
mov ecx, edx
add ecx, 0x94e
add dword [0x418b51], ecx
ror ecx, 2
shr ecx, 1
sub ecx, eax
add dword [0x418e06], ecx
call fcn.00402f28
mov dword [0x41818c], eax
push 0x2547545c
pop edi
push edi
mov esi, 0x1eeae871
mov eax, esi
push eax
mov eax, 0x535b7a47
mov esi, eax
push esi
mov edi, 0x174cf46c
mov ebp, edi
push ebp
push 0x418ab134
pop ebx
push ebx
push 0x21ff1beb
pop eax
push eax
push 0x67cf697b
pop edx
push edx
mov edx, 0x47777e77
push edx
mov esi, 0
mov edi, esi
push edi
push 0x30a185
pop ebx
add ebx, 0x103f1b
push dword [ebx]
pop dword [0x41855f]
mov ebx, dword [0x41855f]
call ebx
mov dword [0x418f49], eax
or eax, eax
je 0x401e19
sub ebp, edi
ret

Function at 0x401240
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18e0
call fcn.00402d20
mov eax, dword [0x42606c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x18d6
lea eax, [ebp - 0x18dc]
push str.jjjjB
push eax
call fcn.00403550
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x18e0]
add esp, 0xc
mov dword [ebp - 0x18e0], 0
push eax
push 0x40
push 0xf831
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4012ab
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401fd1
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov bl, byte [ebp - 0x18dc]
mov ecx, edi
push esi
lea esi, [ebp - 0x18dc]
xor bl, 0x90
sub esi, edi
mov edx, 0x18d5
mov al, byte [esi + ecx]
nop
lea ecx, [ecx + 1]
nop
nop
xor al, bl
nop
nop
nop
mov byte [ecx - 1], al
sub edx, 1
jne 0x4012c5
push edx
push edi
push edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.00401fd1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c828
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407067
mov dword [ebp - 0x14], eax
cmp dword [0x430ff4], esi
jne 0x40c91b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c8a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c9fb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c9fb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c9fb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x430ff4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x430ff8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x430ffc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431004], eax
test eax, eax
je 0x40c918
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431000], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c940
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c933
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c955
push 4
pop eax
jmp 0x40c9fd
cmp dword [ebp - 0x14], esi
je 0x40c955
push dword [0x430ff4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c93a
mov eax, dword [0x431000]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9b3
cmp dword [0x431004], edi
je 0x40c9b3
push eax
call ebx
push dword [0x431004]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9b3
test eax, eax
je 0x40c9b3
call ecx
test eax, eax
je 0x40c9a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c9a8
test byte [ebp - 8], 1
jne 0x40c9b3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9e3
mov eax, dword [0x430ff8]
cmp eax, edi
je 0x40c9e0
push eax
call ebx
test eax, eax
je 0x40c9e0
call eax
mov esi, eax
test esi, esi
je 0x40c9e0
mov eax, dword [0x430ffc]
cmp eax, edi
je 0x40c9e0
push eax
call ebx
test eax, eax
je 0x40c9e0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x430ff4]
call ebx
test eax, eax
je 0x40c9fb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c9fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f7b
mov esp, ebp
pop ebp
ret
Function at 0x10008ec9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10008ed8
pop dword [ebp - 0x14]
mov eax, 0x2f9ad01
sub eax, 0xf2f91e29
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x903cc6e8
add dword [ebp - 0x24], 0xbe157e63
mov dword [ebp - 0x20], 0xc3d157d3
add dword [ebp - 0x20], 0x6e61f472
mov dword [ebp - 0x1c], 0xf3bd7293
sub dword [ebp - 0x1c], 0xa7712e65
mov dword [ebp - 0x18], 0x1355be3e
sub dword [ebp - 0x18], 0x1355be3e
lea eax, [ebp - 0x24]
push eax
mov eax, 0x93e03169
sub eax, 0x83df7145
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf63ce729
add dword [ebp - 0x24], 0x7e35822d
mov dword [ebp - 0x20], 0x1f3c3c71
add dword [ebp - 0x20], 0x22302504
mov dword [ebp - 0x1c], 0x4f8006a3
add dword [ebp - 0x1c], 0x13ef65c9
mov dword [ebp - 0x18], 0x8fd7f9fd
add dword [ebp - 0x18], 0x70280603
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba90
push 0
call eax
mov ecx, 0x56b6
xor esi, esi
add esi, eax
mov edi, 0x10047400
add edi, dword [ebp - 0x14]
mov edx, 0xc8eda709
sub edx, 0xeb7a9efe
xor dword [ebp - 8], eax
mov ebx, dword [edi]
sub dword [ebp - 0x10], edi
sub ebx, edx
sub dword [ebp - 8], esi
mov dword [esi], ebx
add dword [ebp - 0x10], edi
add esi, 0xc4d3ed13
sub esi, 0xc4d3ed0f
add edi, 4
loop 0x10008feb
add eax, 0x53d5c779
sub eax, 0x53d479ce
xor ebx, ebx
add ebx, eax
add eax, 0xd1e9bbb5
add eax, 0x2e164450
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x101906ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
xchg dx, ax
jmp 0x101906d0
xchg dx, ax
sub esp, 7
mov byte [esp + 3], al
rdtsc
jmp 0x101906ba
push word [esp + 2]
jge 0x10190686
lea esp, [esp + 2]
jmp 0x10190693
setg dh
bswap ecx
setae dh
bt eax, edx
jmp 0x10190729
sub esp, 7
mov byte [esp + 3], al
rdtsc
jmp 0x101906ba
rdtsc
bsr ecx, ebx
jmp 0x1019079c
not eax
rdtsc
setge dl
not cx
mov edx, 0x60aaf10b
xchg dx, ax
jmp 0x10190738
jb 0x101907d1
lea esp, [esp + 3]
jmp 0x101907d5
lea ecx, [esi + ebp]
not esi
not edx
or dl, 0xc8
jmp 0x10190771
mov dx, word [esp]
shl dl, cl
jmp 0x1019077b
setge dl
not cx
mov edx, 0x60aaf10b
jmp 0x10190718
jns 0x10190748
mov dx, word [esp]
shl dl, cl
jmp 0x1019074e
dec esi
setg dh
shl eax, 4
js 0x101907a8
setl al
mov dh, bl
bswap eax
jmp 0x101907b5
jno 0x10190709
not eax
rdtsc
jmp 0x10190764
setl al
jmp 0x101907b1
mov dh, bl
bswap eax
not esi
jmp 0x1019081e
mov ax, word [esp]
jmp 0x101907fa
lea esp, [esp + 3]
lea esp, [esp + 4]
xor esi, 0x42af955b
jmp 0x101906fe
lea esp, [esp + 3]
jmp 0x10190807
mov dx, di
mov ax, word [esp + 6]
pop dword [esp]
jmp 0x101907e4
lea esp, [esp + 4]
neg esi
mov cx, word [esp]
bsr eax, ecx
jmp 0x1019092b
rdtsc
mov cl, ah
sub esp, 0xb
jp 0x101907b9
mov ax, word [esp]
mov dx, di
mov ax, word [esp + 6]
pop dword [esp]
lea esp, [esp + 3]
jmp 0x10190807
sbb al, cl
mov eax, 0xd71f01c5
jmp 0x1019088a
mov dx, word [esp]
sub esp, 0x1d
lea esp, [esp + 1]
jmp fcn.101908ac
add esi, dword [edi]
rcl edx, cl
jg 0x1019086f
mov dx, word [esp]
jmp 0x101908e6
sub esp, 0x1d
lea esp, [esp + 1]
jmp fcn.101908ac
jb 0x1019083c
sbb al, cl
mov eax, 0xd71f01c5
jmp 0x10190843