joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41055c
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4192f8
call fcn.0040f780
push 8
call fcn.0040ec2b
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x6e9548], esi
jne 0x410590
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x6e9544], esi
mov al, byte [ebp + 0x10]
mov byte [0x6e9540], al
cmp dword [ebp + 0xc], edi
jne 0x4105da
cmp dword [0x6eade8], edi
je 0x4105ca
mov eax, dword [0x6eade4]
sub eax, 4
mov dword [0x6eade4], eax
cmp eax, dword [0x6eade8]
jb 0x4105ca
mov eax, dword [eax]
cmp eax, edi
je 0x4105ab
call eax
jmp 0x4105ab
push 0x42b02c
mov eax, 0x42b024
call fcn.004104da
pop ecx
push 0x42b038
mov eax, 0x42b030
call fcn.004104da
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41060b
cmp dword [ebp + 0x10], edi
jne 0x410619
mov dword [0x6e9548], esi
push dword [ebp + 8]
call fcn.00410498
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x410618
push 8
call fcn.0040eb76
pop ecx
ret
call fcn.0040f7bb
ret

Function at 0x41065f
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x42b5cc]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x42b1d0]
je 0x410694
inc eax
cmp eax, 0x13
jb 0x410685
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x42b1d0]
jne 0x4107ba
mov eax, dword [0x6e9398]
cmp eax, 1
je 0x410792
cmp eax, edx
jne 0x4106c4
cmp dword [0x42b078], 1
je 0x410792
cmp ecx, 0xfc
je 0x4107ba
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4106fa
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00411110
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00411210
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41072e
mov eax, edi
push eax
call fcn.00411210
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4196f0
push edi
call fcn.00412e20
add esp, 0x10
push edi
call fcn.00411210
push dword [esi + 0x42b1d4]
mov ebx, eax
call fcn.00411210
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004110d0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00411110
push edi
push ebx
call fcn.00411120
push 0x4196d0
push ebx
call fcn.00411120
push dword [esi + 0x42b1d4]
push ebx
call fcn.00411120
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00412d26
add esp, 0x2c
jmp 0x4107ba
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x42b1d4]
push dword [esi]
call fcn.00411210
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00411d12
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x410c3c
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x6e975c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x410c85
call ebp
mov esi, eax
cmp esi, ebx
je 0x410c6b
mov dword [0x6e975c], 1
jmp 0x410c8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x410c80
push 2
pop eax
mov dword [0x6e975c], eax
jmp 0x410c85
mov eax, dword [0x6e975c]
cmp eax, 1
jne 0x410ce2
cmp esi, ebx
jne 0x410c9d
call ebp
mov esi, eax
cmp esi, ebx
jne 0x410c9d
xor eax, eax
jmp 0x410d89
cmp word [esi], bx
mov eax, esi
je 0x410cb2
inc eax
inc eax
cmp word [eax], bx
jne 0x410ca4
inc eax
inc eax
cmp word [eax], bx
jne 0x410ca4
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.0040db03
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x410cd5
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x410d89
push ebp
push esi
push edi
call fcn.00412f60
add esp, 0xc
jmp 0x410cc7
cmp eax, 2
je 0x410ceb
cmp eax, ebx
jne 0x410c96
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x410c96
cmp byte [ebp], bl
mov esi, ebp
je 0x410d21
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x410c96
push esi
add edi, eax
call fcn.00411210
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x410cfe
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.0040db03
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x410d9a
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x410d7b
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x410d90
push edi
call fcn.00411210
push esi
lea edi, [edi + eax + 1]
call fcn.00412f44
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x410d41
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.0040d9eb
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x410c96
Function at 0x410da6
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x6e9760]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x410de6
call esi
test eax, eax
je 0x410dcb
mov dword [0x6e9760], 1
jmp 0x410deb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x410de2
mov dword [0x6e9760], 2
jmp 0x410df4
xor eax, eax
jmp 0x410e42
cmp eax, 1
jne 0x410def
call esi
jmp 0x410e42
cmp eax, 2
jne 0x410de2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x410e3a
lea eax, [esi + esi]
push eax
call fcn.0040db03
mov ebp, eax
test ebp, ebp
pop ecx
je 0x410e3a
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x410e3e
push ebp
call fcn.0040d9eb
pop ecx
xor eax, eax
jmp 0x410e40
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4116d8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x42b5cc]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x411709
xor eax, eax
jmp 0x411892
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x6eace0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x411745
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0041346c
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x411820
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x41185e
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x4117a9
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x41179a
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x41177a
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4117e9
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x4117f2
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x41176b
jmp 0x4117f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x41188d
cmp dword [ebp - 0x6c], edi
je 0x41185e
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x411853
call fcn.00411e50
mov dword [eax], 9
call fcn.00411e59
mov dword [eax], esi
jmp 0x411888
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411848
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x4117f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x4117f4
push dword [ebp - 0x6c]
call fcn.00411e62
pop ecx
jmp 0x411888
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x411876
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x411876
xor eax, eax
jmp 0x411890
call fcn.00411e50
mov dword [eax], 0x1c
call fcn.00411e59
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x411890
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.00411d12
add ebp, 0x3a0
leave
ret
Function at 0x41230d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x41233b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x412342
cmp ebx, dword [eax + 4]
jae 0x412342
xor eax, eax
jmp 0x412532
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x412353
xor eax, eax
inc eax
jmp 0x412531
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x412369
cmp ecx, edx
jae 0x4124ae
cmp dword [eax + 4], 0
je 0x412372
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x41235a
cmp dword [ebp + 8], 0
je 0x412394
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4124ae
cmp eax, esi
jae 0x4124ae
mov eax, dword [0x6e9770]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4123b9
cmp dword [esi*4 + 0x6e9778], edi
je 0x4124b2
inc esi
cmp esi, eax
jl 0x4123a7
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41252e
cmp dword [ebp - 8], 0x1000000
jne 0x41252e
test byte [ebp - 0xc], 0xcc
je 0x412437
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41252e
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41252e
cmp word [eax + 0x18], 0x10b
jne 0x41252e
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41252e
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x412437
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x412437
test byte [ecx + 0x27], 0x80
jne 0x4124ae
push 1
push 0x6e97b8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x41234b
mov ecx, dword [0x6e9770]
test ecx, ecx
mov edx, ecx
jle 0x41246b
lea eax, [ecx*4 + 0x6e9774]
cmp dword [eax], edi
je 0x41246b
dec edx
sub eax, 4
test edx, edx
jg 0x41245f
test edx, edx
jne 0x41249c
push 0xf
pop ebx
cmp ecx, ebx
jg 0x412478
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x412490
lea eax, [edx*4 + 0x6e9778]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x41247e
cmp ecx, 0x10
jge 0x41249c
inc ecx
mov dword [0x6e9770], ecx
push 0
push 0x6e97b8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x41234b
xor eax, eax
jmp 0x412531
test esi, esi
jle 0x41234b
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x6e97b8
call ebx
test eax, eax
jne 0x41234b
cmp dword [esi*4 + 0x6e9778], edi
je 0x412508
mov eax, dword [0x6e9770]
lea esi, [eax - 1]
test esi, esi
jl 0x4124f6
cmp dword [esi*4 + 0x6e9778], edi
je 0x4124f2
dec esi
jns 0x4124e6
test esi, esi
jge 0x412506
cmp eax, 0x10
jge 0x412501
inc eax
mov dword [0x6e9770], eax
lea esi, [eax - 1]
jmp 0x412508
je 0x412520
xor ecx, ecx
test esi, esi
jl 0x412520
lea eax, [ecx*4 + 0x6e9778]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41250e
push 0
push 0x6e97b8
call ebx
jmp 0x41234b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412d26
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x6e97cc], ebx
push esi
push edi
jne 0x412da6
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x412de1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x6e97cc], eax
je 0x412de1
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x6e97d0], eax
call esi
cmp dword [0x6e9508], 2
mov dword [0x6e97d4], eax
jne 0x412da6
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x6e97dc], eax
je 0x412da6
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x6e97d8], eax
mov eax, dword [0x6e97d8]
test eax, eax
je 0x412deb
call eax
test eax, eax
je 0x412dd2
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x6e97dc]
test eax, eax
je 0x412dd2
test byte [ebp - 8], 1
jne 0x412deb
cmp dword [0x6e9514], 4
jb 0x412de5
or byte [ebp + 0x12], 0x20
jmp 0x412e0a
xor eax, eax
jmp 0x412e1a
or byte [ebp + 0x12], 4
jmp 0x412e0a
mov eax, dword [0x6e97d0]
test eax, eax
je 0x412e0a
call eax
mov ebx, eax
test ebx, ebx
je 0x412e0a
mov eax, dword [0x6e97d4]
test eax, eax
je 0x412e0a
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x6e97cc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4145de
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004110d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414679
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x6e9508]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x414679
cmp eax, 1
je 0x41469a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x414679
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x414646
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x414675
xor eax, eax
inc eax
jmp 0x4146b9
cmp edi, eax
jae 0x41467d
xor eax, eax
jmp 0x4146b9
cmp eax, esi
jae 0x414684
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x6e9508]
jmp 0x41469d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x36700660
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x67222d06
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x9b07e8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9b0938
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9b080e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b07fa
add dl, dl
jne 0x9b0819
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b086c
xor eax, eax
add dl, dl
jne 0x9b0826
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9b090d
add dl, dl
jne 0x9b0835
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b0840
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b084b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b0856
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9b0862
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9b0805
mov eax, 1
add dl, dl
jne 0x9b087a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b0885
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b0871
sub eax, ebx
mov ebx, 1
jne 0x9b08b8
mov ecx, 1
add dl, dl
jne 0x9b089e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b08a9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b0895
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b0805
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9b08cf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b08da
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9b08c6
cmp eax, 0x7d00
jae 0x9b08fd
cmp eax, 0x500
jb 0x9b08f8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b0805
cmp eax, 0x7f
ja 0x9b0900
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b0805
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9b092e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9b0805
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x6f0fd305
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6fae5018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6fae5018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6f0fd409
jmp 0x6f0fd4ed
jmp 0x6f0fd5d1
jmp 0x6f0fd6b5
jmp 0x6f0fd799
jmp 0x6f0fd87d
jmp 0x6f0fd961
jmp 0x6f0fda45
jmp 0x6f0fdb29
jmp 0x6f0fdc0d
jmp 0x6f0fdcf1
jmp 0x6f0fddd5
jmp 0x6f0fdeb9
jmp 0x6f0fdf9d
jmp 0x6f0fe081
jmp 0x6f0fe165
mov dword [ebp - 0x14], 0
jmp 0x6f0fe250
jmp 0x6f0fe334
jmp 0x6f0fe418
jmp 0x6f0fe4fc
jmp 0x6f0fe5e0
jmp 0x6f0fe6c4
jmp 0x6f0fe7a8
jmp 0x6f0fe88c
jmp 0x6f0fe970
jmp 0x6f0fea54
jmp 0x6f0feb38
jmp 0x6f0fec1c
jmp 0x6f0fed00
jmp 0x6f0fede4
jmp 0x6f0feec8
jmp 0x6f0fefac
mov dword [ebp - 0x18], 0
jmp 0x6f0ff097
jmp 0x6f0ff17b
jmp 0x6f0ff25f
jmp 0x6f0ff343
jmp 0x6f0ff427
jmp 0x6f0ff50b
jmp 0x6f0ff5ef
jmp 0x6f0ff6d3
jmp 0x6f0ff7b7
jmp 0x6f0ff89b
jmp 0x6f0ff97f
jmp 0x6f0ffa63
jmp 0x6f0ffb47
jmp 0x6f0ffc2b
jmp 0x6f0ffd0f
jmp 0x6f0ffdf3
mov dword [ebp - 0x10], 0
jmp 0x6f0ffede
jmp 0x6f0fffc2
jmp 0x6f1000a6
jmp 0x6f10018a
jmp 0x6f10026e
jmp 0x6f100352
jmp 0x6f100436
jmp 0x6f10051a
jmp 0x6f1005fe
jmp 0x6f1006e2
jmp 0x6f1007c6
jmp 0x6f1008aa
jmp 0x6f10098e
jmp 0x6f100a72
jmp 0x6f100b56
jmp 0x6f100c3a
mov dword [ebp - 0x10], 0
jmp 0x6f1053ce
jmp 0x6f100d2a
jmp 0x6f100e0e
jmp 0x6f100ef2
jmp 0x6f100fd6
jmp 0x6f1010ba
jmp 0x6f10119e
jmp 0x6f101282
jmp 0x6f101366
jmp 0x6f10144a
jmp 0x6f10152e
jmp 0x6f101612
jmp 0x6f1016f6
jmp 0x6f1017da
jmp 0x6f1018be
jmp 0x6f1019a2
jmp 0x6f101a86
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6fae5014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6f101b7b
jmp 0x6f101c5f
jmp 0x6f101d43
jmp 0x6f101e27
jmp 0x6f101f0b
jmp 0x6f101fef
jmp 0x6f1020d3
jmp 0x6f1021b7
jmp 0x6f10229b
jmp 0x6f10237f
jmp 0x6f102463
jmp 0x6f102547
jmp 0x6f10262b
jmp 0x6f10270f
jmp 0x6f1027f3
jmp 0x6f1028d7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6fae501c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6f1029cc
jmp 0x6f102ab0
jmp 0x6f102b94
jmp 0x6f102c78
jmp 0x6f102d5c
jmp 0x6f102e40
jmp 0x6f102f24
jmp 0x6f103008
jmp 0x6f1030ec
jmp 0x6f1031d0
jmp 0x6f1032b4
jmp 0x6f103398
jmp 0x6f10347c
jmp 0x6f103560
jmp 0x6f103644
jmp 0x6f103728
mov eax, dword [0x6fae5008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x6f10382a
jmp 0x6f10390e
jmp 0x6f1039f2
jmp 0x6f103ad6
jmp 0x6f103bba
jmp 0x6f103c9e
jmp 0x6f103d82
jmp 0x6f103e66
jmp 0x6f103f4a
jmp 0x6f10402e
jmp 0x6f104112
jmp 0x6f1041f6
jmp 0x6f1042da
jmp 0x6f1043be
jmp fcn.6f1044a2
mov eax, dword [0x6fae5018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6f100c46
nop
leave
ret
Function at 0x401990
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x44d00c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
call fcn.004011a0
xor ebx, ebx
mov dword [esp + 0x14], 0
push str.Visit:_https:__whiteangel.click_CS2_n
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
call fcn.00401950
add esp, 4
push str.KeyBind___X_n
call fcn.00401950
add esp, 4
push str.Please_write_in_the_game_console_bind_o_attack__n
call fcn.00401950
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
add esp, 4
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 0x58
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x401b8f
test ebx, ebx
jne 0x401a78
lea eax, [esp + 0x24]
push eax
call esi
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add ebx, 2
push 0
add esi, 2
call edi
push ebx
mov edi, eax
push esi
push edi
call dword [sym.imp.GDI32.dll_GetPixel]
push edi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.USER32.dll_GetDC]
movzx eax, bl
mov dword [esp + 0x14], eax
movzx eax, bx
shr eax, 8
shr ebx, 0x10
mov dword [esp + 0x18], eax
movzx eax, bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], 1
lea eax, [esp + 0x24]
push eax
call esi
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add ebx, 2
push 0
add esi, 2
call edi
push ebx
mov edi, eax
push esi
push edi
call dword [sym.imp.GDI32.dll_GetPixel]
push edi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x14]
movzx ecx, bl
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jg 0x401ae6
mov eax, dword [esp + 0x18]
movzx ecx, bx
shr ecx, 8
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jg 0x401ae6
mov eax, dword [esp + 0x1c]
shr ebx, 0x10
movzx ecx, bl
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jle 0x401b52
mov edi, dword [esp + 0x20]
inc edi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x401b27
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x4f
push 0x100
push esi
call ebx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x4f
push 0x101
push esi
call ebx
mov ebx, dword [esp + 0x10]
jmp 0x401b30
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
push ebx
push edi
push str._rTrigger____d__Error____d
call fcn.00401950
add esp, 0xc
push 1
call fcn.00408a40
add esp, 4
push eax
call fcn.00409570
add esp, 4
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [esp + 0xc]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x23
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x401a05
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401f50
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov dword [esp + 0xc], ebx
jmp 0x401b62