joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x54
push ebx
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
mov dword [esp + 0x44], eax
call ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
push ecx
mov dword [esp + 0x64], str.Warcraft_III_Root
call dword [sym.imp.USER32.dll_RegisterClassA]
mov ebp, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea edx, [esp + 0x10]
push edx
call ebp
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add eax, ecx
push 0
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, edx
push 0
cdq
sub eax, edx
mov edi, eax
sar esi, 1
sar edi, 1
sub esi, 0x10
sub edi, 0x10
call ebx
push eax
push 0
call ebp
push eax
push 0x10
push 0x10
push edi
push esi
push 0x80000000
push str.Launching_Warcraft_III
push str.Warcraft_III_Root
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 1
push eax
mov dword [0x40aad0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x40aad0]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x40aad0]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
je 0x401b6a
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [0x40aad0]
push 0
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call edi
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x20]
push ecx
call ebp
mov edx, dword [0x40aad0]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
jne 0x401b32
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x401b80
Capabilities:
Create thread

Disassembly:
push esi
call fcn.00401a40
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 1
push 0
mov dword [0x40aadc], 1
call esi
push 0
push 0
push 1
push 0
mov dword [0x40aad4], eax
call esi
push 0
push 0x2000
push 0x401890
mov dword [0x40aad8], eax
call fcn.0040203b
mov eax, dword [0x40aad0]
add esp, 0xc
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x40aad0]
pop esi
ret
Function at 0x404ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40a4e0
cmp edx, dword [eax]
je 0x404af2
add eax, 8
inc ecx
cmp eax, 0x40a570
jl 0x404ae3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40a4e0]
jne 0x404c20
mov eax, dword [0x40aae8]
cmp eax, 1
je 0x404bfa
test eax, eax
jne 0x404b23
cmp dword [0x4080c0], 1
je 0x404bfa
cmp edx, 0xfc
je 0x404c20
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404b5a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004054f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402900
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404b9d
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402900
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40751c
push edi
call fcn.004059a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004054f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405500
lea eax, [ebp - 0xa0]
push 0x4074fc
push eax
call fcn.00405500
push dword [esi + 0x40a4e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405500
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405915
add esp, 0x2c
pop edi
jmp 0x404c20
lea eax, [ebp + 8]
lea esi, [esi + 0x40a4e4]
push 0
push eax
push dword [esi]
call fcn.00402900
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x774409
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x7749c8
adc al, 0x85
adc eax, 0xa6498f7c
movsb byte es:[edi], byte ss:[esi]
ret
lea esp, [esp + 4]
jbe 0x7742df
sub esp, 0x1e
jmp 0x774430

Function at 0x774a01
Capabilities:
Execute anti-debugging instructions

Disassembly:
jne 0x7742c9
seto bl
pop ebx
jmp 0x7742df
mov dword [ebp - 4], eax
pushal
mov byte [esp + 0xa], ch
lea esp, [esp + 0x24]
jmp 0x7749b9
push esp
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x7749e1
Function at 0x7794f2
Capabilities:
Encrypt data using aes

Disassembly:
not dh
lea esp, [esp + 4]
movzx edx, byte [eax + 8]
jmp 0x779512
mov dword [esp], eax
jmp 0x7794da
xor edx, esi
push esp
mov esi, dword [esp + 1]
jmp 0x779564
shl edx, 8
setnp bl
sub esp, 4
mov edi, 0x36f7535e
jmp 0x7794f7
not di
pushal
xor edx, esi
xchg bp, bx
bswap ebx
jmp 0x779572
shl edx, 8
bsr bx, cx
jmp 0x77a573
lea esp, [esp + 8]
movzx esi, byte [eax + 0xa]
shl edx, 8
push esp
jmp 0x779540
lea esp, [esp + 0x24]
movzx esi, byte [eax + 0xb]
jmp 0x77954d
mov ebx, ecx
lea ebx, [ebx + 0xc]
mov dword [ebx], edx
pop ebx
setns bh
jmp 0x7795dd
xor edx, eax
rol bp, cl
mov bp, word [esp]
push ebx
jmp 0x779592
shr eax, 0x10
mov esi, 0xff
mov ebp, dword [esp]
shl di, cl
jmp 0x77961b
inc edi
neg esi
mov eax, edx
ror si, cl
and bp, 0xcec2
jmp 0x7795be
xor edx, esi
lea esi, [edi + edi]
shl edx, 8
not bh
jmp 0x7795b2
mov edx, eax
jmp 0x779700
pushal
and eax, esi
push edx
jmp 0x779604
lea esp, [esp + 0x14]
movzx eax, byte [eax + 0xf]
mov di, 0xd523
shl edx, 8
jmp 0x7795f8
shr bh, 3
sub esp, 0x12
lea ebx, [edi*4]
lea esp, [esp + 2]
jmp 0x779690
shr edi, 8
mov ebp, ecx
and edi, esi
mov ebp, 0x98cc8742
jmp 0x779646
lea esp, [esp + 0x10]
and edi, 0xff0000
bt ebp, edx
mov bp, bx
jmp 0x7796e7
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutOpen]
mov bl, byte [esp]
jmp 0x77967a
clc
sub bl, ah
jmp 0x77966c
lea esp, [esp + 0x20]
xor eax, 0x1000000
xchg bl, bh
inc ebx
mov edi, edx
jmp 0x7796a9
mov ebx, dword [ecx + 4]
lea ebp, [ecx*4]
lea ebp, [ecx - 0xb]
jmp 0x779728
mov bp, word [esp]
jmp 0x7796d0
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_waveOutOpen
mov eax, dword [edx]
pop edx
jmp 0x7796c0
xor eax, edi
clc
lea ebp, [edi + edi]
jmp 0x779790
mov ebp, 0x7b84dd06
and eax, 0xff000000
not bp
mov bp, 0x43ab
jmp 0x779712
and edi, esi
mov edi, dword [edi*4 + reloc.WINMM.dll_waveOutOpen]
mov ebp, 0xff00
jmp 0x779771
lea esp, [esp + 3]
sub esp, 0xe
add esp, 6
lea esp, [esp + 1]
jmp 0x779866
xor eax, edi
mov edi, edx
neg bp
mov bp, 0xa529
jmp 0x77973b
push edx
mov byte [esp + 2], ch
mov word [esp], sp
and edi, ebp
push edx
jmp 0x77974b
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x756574]
jmp 0x779764
sub esp, 0x1a
pop dword [esp + 0x10]
inc ebp
xchg edi, ebx
lea esp, [esp + 2]
jmp 0x779635
lea esp, [esp + 0xc]
xor eax, dword [ecx]
call fcn.007797eb
xor eax, edi
bswap edi
lea edi, [eax + edi]
lea edi, [esi + 0x6d]
jmp 0x779840
xor edx, esi
mov bx, 0x8445
mov esi, 0x64f0440e
movzx esi, byte [eax + 0xe]
jmp 0x7797ad
mov ebx, 0x9cfd8ad4
shl edx, 8
push edx
pop ebp
mov edi, ebp
jmp 0x7798ca
mov dword [ecx + 8], edx
lea ebx, [edi*4]
movzx edx, byte [eax + 0xc]
mov edi, dword [esp]
jmp 0x779901
xor edx, esi
movzx esi, byte [eax + 0xd]
mov ebp, dword [esp]
bsr bp, cx
jmp 0x779ae9
Function at 0x77a272
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
movzx ebx, byte [esi + 0x11]
jmp 0x77a4c5
pushal
lea edi, reloc.WINMM.dll_waveOutOpen
lea esp, [esp + 0x20]
add esi, 0x10
call fcn.0077a2d8
and ebx, ecx
jmp 0x77a3c6
mov edi, dword [esi]
pop esi
pushal
jmp 0x77a386
adc al, 0xd7
sbb dword [eax + 0x5b], edi
mov dl, 0xad
push esi
mov esi, edi
lea esi, [esi*4]
lea esi, reloc.WINMM.dll_waveOutOpen
jmp 0x77a39d
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
jmp 0x77a427
and ebx, ecx
call fcn.0077a3f1
lea ebx, [edx + esi*4]
aad 0x24
out 0xfd, eax
imul edi, ecx, 0x1dde6b98
mov bl, byte [eax]
jg 0x77a3ad
dec ecx
stosd dword es:[edi], eax
ret 0xf7d
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
sub esp, 0
jmp 0x77a40b
neg di
shl edi, 9
neg dh
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
mov di, bx
jmp 0x77a373

Function at 0x77a2be
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x77a327
lea esp, [esp + 9]
add esp, 0
lea esp, [esp + 1]
jmp 0x77a304
bsf si, si
neg dx
cmc
mov dword [esp + 0x14], edi
stc
clc
jmp 0x77a2ee
popal
jmp 0x77a30b
shr edi, 0x18
push edx
pushal
jmp 0x77a2da
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_waveOutOpen
mov edi, dword [edx]
pop edx
clc
call 0x77a34f
loope 0x77a343
arpl word [edx - 0x3b7c1b0b], bx
add eax, dword [ebx + reloc.WINMM.dll_waveOutOpen]
and al, 1
add esp, 3
add esp, 0
lea esp, [esp + 1]
popal
stc
sub esp, 0xa
jmp 0x77a2c0
outsb dx, byte [esi]
popfd
pop edi
jns 0x77a344
xchg edx, eax
cmc
add al, 0xc1
dec ecx
call 0x225f8e5d
and edi, ecx

Function at 0x77a4e6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0x77a53c
clc
cmc
popal
lea edx, [edx*4]
lea edx, reloc.WINMM.dll_waveOutOpen
jmp 0x77a60e
push edx
pushal
mov ecx, dword [esp]
mov dword [esp + 0x14], edi
jmp 0x77a509
sub esp, 2
push word [esp + 1]
mov dword [esp], esi
jmp 0x77a525
mov ebx, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
sub esp, 2
lea esp, [esp + 2]
jmp 0x77a5f1
movzx ebx, byte [esi + 6]
sub esp, 8
mov dword [esp + 1], ecx
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x77a585
lea esp, [esp + 2]
and ebx, ecx
lea esp, [esp + 0x54]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
jmp 0x77a59f
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
mov bl, 0xb0
mov bl, byte [esp]
jmp 0x77a7ae
and ebx, ecx
sub esp, 0x16
push word [esp + 9]
jmp 0x77a5d4
mov edi, dword [edx]
pop edx
sub esp, 0x18
sub esp, 0x12
pop dword [esp + 0x1e]
push edx
jmp 0x77a5c1
movzx ebx, byte [esi + 9]
sub esp, 0xc
and edx, ecx
push edx
call fcn.0077a681
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.WINMM.dll_waveOutOpen]
rol bl, 5
jmp 0x77ad94
movzx ebx, byte [esi + 0xa]
call fcn.0077aca8
call fcn.0077bd39
sub al, 0xaf
aas
pop edx
test eax, 0x56c04a72
xor eax, eax
jo 0x77adac
sal byte [eax - 3], 0xcc
pop edi
cmpsb byte [esi], byte es:[edi]
sal dword [eax + ebp*8 + reloc.WINMM.dll_waveOutOpen], 1
int3
Function at 0x77a98e
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
sub esp, 0x16
sub esp, 0x1a
push dword [esp + 0x1e]
mov byte [esp + 0x2f], ah
jmp 0x77a890
and edx, ecx
mov edx, dword [edx*4 + reloc.WINMM.dll_waveOutOpen]
sub esp, 0xa
lea esp, [esp + 2]
jmp 0x77a8b6
stc
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x77a8eb

Function at 0x77b47f
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.0077b4da
sbb dword [eax + 0x4b88791e], ecx
mov cl, 0x25
mov ch, 0xdc
das
lea esp, [esp + 4]
jb 0x77ab2c
cmc
call 0x77b47f
mov esi, 0xb3e9f954
add dword [eax], eax
add byte [ebp + 0xbf89909], al
iretd
mov dword [esp], esi
jmp 0x77b46e

Function at 0x77b495
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.0077b4da
sbb dword [eax + 0x4b88791e], ecx
mov cl, 0x25
mov ch, 0xdc
das
lea esp, [esp + 4]
jb 0x77ab2c
cmc
call 0x77b47f
mov esi, 0xb3e9f954
add dword [eax], eax
add byte [ebp + 0xbf89909], al
iretd
mov dword [esp], esi
jmp 0x77b46e

Function at 0x77b528
Capabilities:
Encrypt data using aes

Disassembly:
xchg dword [ecx], esp
idiv bh
dec dword [edi]
xchg al, ch
cmc
invalid
jbe 0x77aaf9
ja 0x77ac17
in eax, dx
jle 0x77b506
mov eax, dword [esi - reloc.WINMM.dll_waveOutOpen]
cmpsb byte [esi], byte es:[edi]
push ebp
in eax, dx
push esi
rol dword [eax + reloc.WINMM.dll_waveOutOpen], 0x24
mov dword [esp], eax
mov dword [esp], eax
lea esp, [esp + 4]
jmp 0x77b50b

Function at 0x77b531
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
mov word [esp], dx
lea esp, [esp]
lea esp, [esp + 3]
jmp 0x77b5f5
cmp dl, 0x2b
call fcn.0077b5d8

Function at 0x77b5a7
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 4]
je 0x77aaf9
jmp 0x77b564

Function at 0x77b5b7
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
jne 0x74c5ba
je 0x77aaf9
push eax
retf

Function at 0x77b5d8
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], di
mov word [esp], dx
lea esp, [esp + 4]
cmp dl, 0x2f
push esp
jmp 0x77b55b
lea esp, [esp + 4]
je 0x77aaf9
push edx
jmp 0x77b57d
Function at 0x77b764
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
pushal
lea esp, [esp + 2]
jmp 0x77b609

Function at 0x77badf
Capabilities:
Encode data using xor

Disassembly:
pushal
pop dword [esp + 0xe]
jmp 0x77bb4a
lea esp, [esp + 4]
jne 0x77ad1a
je 0x77bb3d
push 0x3f
jmp 0x77ad31
lea esp, [esp + 0x1c]
movzx esi, bl
stc
call fcn.0077bf1e
lcall 0x28ca, 0xbf89909
dec ebx
loop 0x77bbc7
push dword [esp + 7]
push dword [esp + 3]

Function at 0x87f526
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 0x15]
bswap edi
bsr si, cx
add cx, 0x6b76
clc
mov ebx, 0x2b112864
jmp 0x87f4fd
lea ecx, [esi - 0x1d]
mov dl, 0xb4
mov eax, 0xfb91fcfc
mov word [esp + 6], bx
inc bp
btc edx, ebx
jmp 0x87f498
lea edi, [esi*4]
bswap ebp
pop dword [esp]
add esp, 1
xchg byte [esp + 4], dl
pop bx
jmp 0x87f52d
xchg byte [esp + 0x25], al
pop dword [esp + 0x10]
xchg byte [esp + 0x20], dl
setge ah
add esp, 0x19
add esp, 0
jmp 0x87f4d4
not dx
mov ebx, eax
jmp 0x87f4be
xchg bh, cl
cpuid
mov bl, bh
pop bx
rdtsc
mov al, ah
jmp 0x87f5ac
mov cx, 0xc977
xchg bx, si
xchg ecx, ebp
mov bl, byte [esp]
bswap edx
inc ebx
jmp 0x87f55f
pop dx
mov ebx, dword [esp]
mov esi, dword [esp]
rdtsc
mov al, byte [esp]
not ax
jmp 0x87f589

Function at 0x87f993
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x2c]
push dword [esp + 0x2c]
lea esp, [esp + 0x39]
setp bh
jmp 0x87f997
xchg word [esp + 0x11], ax
mov byte [esp + 0x13], bh
mov word [esp + 8], bx
push dword [esp + 8]
jmp 0x87f965
bswap ebp
jmp 0x87f97b
cpuid
xchg ebp, ecx
mov dh, byte [esp]
mov bl, 0x50
lea eax, [ebp + 0x87]
not esi
jmp 0x87f9df
mov ch, byte [esp + 0xc]
lea eax, reloc.WINMM.dll_waveOutOpen
sub esp, 0x1e
xchg ecx, eax
xchg dword [esp + 0x25], edi
pushal
jmp 0x87fa52
sub esp, 0x1c
push word [esp + 6]
pop dword [esp + 0x15]
xchg word [esp + 0xf], bp
mov bp, 0x7fff
mov dword [esp + 0x13], eax
jmp 0x87f9bf
mov edi, esi
pushal
xchg dword [esp], ecx
pop dword [esp + 0x12]
ror esi, 7
mov word [esp + 0x18], dx
jmp 0x87fa79
mov edi, dword [esp + 1]
sub ax, 0xe1b0
mov si, word [esp + 2]
pop edx
rdtsc
not ax
jmp 0x87fa0b
lea esp, [esp + 0x59]
mov eax, ebp
mov dl, dh
push edx
cpuid
mov byte [esp + 1], ch
jmp 0x87fa2d
bsf cx, si
mov si, sp
lea esp, [esp + 0xd]
mov word [esp + 0xc], sp
jmp 0x87fae0
btr ecx, esp
xchg word [esp + 0x15], ax
btr edi, esp
cld
xchg byte [esp + 7], dl
mov ecx, 0x5743f8b8
jmp 0x87fa63
mov bl, bh
neg di
inc cl
pushal
rdtsc
call fcn.0087faa6
dec ebx
invalid
mov bl, 0x10
push dword [esp + 7]
inc cl
rdtsc
bsr bx, cx
bsr cx, bp
jmp 0x87fac5
Function at 0x87fb8e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [edx + esi]
bswap eax
mov si, dx
mov dx, 0xa28d
rdtsc
xchg cx, dx
jmp 0x87fbf7
xchg bh, cl
rdtsc
mov bp, di
add ebx, ebp
setnp bh
mov eax, dword [esp + 0x11]
jmp 0x87fb57
pop word [esp]
bswap ecx
jmp 0x87fb76
push dword [esp + 0x1a]
not dh
pop word [esp + 0x27]
xchg si, bx
clc
mov dword [esp + 0x1a], esi
jmp 0x87fbe0
mov byte [esp + 0x11], bh
xchg edx, ebp
lea ebx, [edi + ebp]
bswap edx
push edx
mov ax, 0x32e5
jmp 0x87fb96
mov dx, word [esp + 0x16]
cpuid
sub esp, 6
sub esp, 0x10
xchg bh, cl
jmp 0x87fc2d
add esp, 5
xchg word [esp + 9], bp
mov bx, word [esp]
neg ah
jmp 0x87fbca
lea esi, [ebx + edi]
xchg word [esp + 0x17], di
push dword [esp + 0x1b]
push edx
lea ecx, [ebx*4]
inc edi
jmp 0x87fbb8
xchg dword [esp + 0x1e], ebx
xchg byte [esp + 0x11], dl
popal
mov byte [esp + 0x14], ch
call fcn.0087fc0e
insd dword es:[edi], dx
hlt

Function at 0x87fe59
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea ebx, [edx*4]
mov byte [esp + 0x11], ah
push word [esp + 0x12]
add esp, 0xe
jmp 0x87fe10
mov cx, 0xdb45
lea esp, [esp + 9]
btr ebp, edx
lea ebx, [esi*4]
mov byte [esp + 3], ah
neg edi
jmp 0x87fdd8
bsf bx, ax
mov di, word [esp + 5]
lea ebp, [edx*4]
push edx
jmp 0x87ff93
sub esp, 0x18
pop word [esp + 0xd]
xchg word [esp + 0x17], dx
mov bp, word [esp + 0x18]
bsr bp, bp
pop word [esp + 0xb]
jmp 0x87fdf6
mov bl, 0x48
mov ax, bx
rdtsc
cpuid
lea ebp, [esp + edx]
jmp 0x87fe2b
add esp, 0x34
push word [esp + 4]
mov dx, di
neg si
pop ax
pushal
jmp 0x87ff13
mov cl, 0xa2
pop dword [esp + 7]
cld
xor dl, ch
lea esi, [ecx + 3]
cld
jmp 0x87fe67
rcl bx, cl
bswap ecx
sub esp, 0x16
mov dword [esp + 0x10], eax
xor bp, 0xb5e4
push dword [esp + 0x38]
jmp 0x87fe81
mov dword [esp + 0x13], ecx
lea esp, [esp + 0xf]
pop di
mov di, word [esp]
not ch
rdtsc
jmp 0x87fef9
neg ebp
bsf dx, ax
mov esi, 0x51c9548
not edi
pop dword [esp + 0x1a]
pop dword [esp + 0x18]
jmp 0x87feb9
mov al, ah
pushal
mov ecx, esi
pop bx
mov bx, dx
not ch
jmp 0x87ff3e
push esp
xchg dword [esp + 0x1b], edx
mov cl, 0xe2
bsr dx, bp
mov cx, 0xf6f3
setg ch
jmp 0x87fee2
bswap eax
mov cl, 0x52
cpuid
pop bx
lea eax, [edx + ebx]
sub esp, 2
jmp 0x87ff79
pop dx
pop esi
clc
pop dword [esp + 0xc]
xchg ecx, eax
mov edi, ecx
jmp 0x87ff27
push dword [esp + 0x1a]
mov bx, word [esp + 0x20]
mov eax, dword [esp + 0x1f]
jmp 0x880144
cmc
push word [esp + 7]
lea ecx, [edx + edx]
ror dh, 7
xchg dword [esp + 6], ebp
jmp 0x87ff4b
btr ebx, esp
mov word [esp + 0xc], dx
lea ecx, [edx*4]
lea edi, [esi + 0x55]
mov edx, eax
jmp 0x87ff62
push word [esp + 2]
mov si, 0x88d9
mov byte [esp + 7], ah
add esp, 0xa
xchg byte [esp], bl
pushal
jmp 0x87fea2
clc
mov cl, ch
lea esp, [esp + 1]
mov eax, dword [esp + 0xd]
lea eax, [ebx + ebp]
push dword [esp + 4]
jmp 0x87ffbf
xchg bh, cl
pop edx
rcl si, cl
inc ax
ror eax, 7
xchg dword [esp + 0x1a], ecx
jmp 0x87ffe0
setne bh
mov ebx, dword [esp + 0x21]
mov dword [esp + 5], ebp
mov bl, bh
stc
inc bx
jmp 0x880011
xchg word [esp + 0x1d], bx
mov al, ah
xchg esi, eax
mov bh, byte [esp + 0x11]
xchg ch, dl
xchg si, ax
jmp 0x88009f
Function at 0x40eb00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov ax, word [0x42bf5c]
mov word [ebp - 0x10], ax
xor eax, eax
mov byte [ebp - 0xe], al
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x40eb3f
jmp 0x40ebd1
mov eax, dword [ebp + 8]
push eax
call fcn.00418f70
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, dword [0x439df8]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x20]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call fcn.00418dde
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40eb78
jmp 0x40ebd1
push str.debug:
mov eax, dword [ebp - 4]
push eax
call fcn.00418e70
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00418e80
add esp, 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00418e80
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0
movzx ecx, word [ebp - 0x14]
push ecx
push 0
call sub.PSI32.dll_Ordinal_85
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
push eax
call fcn.00418da6
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x411380
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0x14]
jne 0x4113b2
xor al, al
jmp 0x4113b4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424581
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x438330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041d38d
mov dword [ebp - 0x14], eax
cmp dword [0x43acd4], esi
jne 0x424674
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x424601
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x424754
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x424754
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424754
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43acd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43acd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43acdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ace4], eax
test eax, eax
je 0x424671
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ace0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x424699
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42468c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4246ae
push 4
pop eax
jmp 0x424756
cmp dword [ebp - 0x14], esi
je 0x4246ae
push dword [0x43acd4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x424693
mov eax, dword [0x43ace0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42470c
cmp dword [0x43ace4], edi
je 0x42470c
push eax
call ebx
push dword [0x43ace4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42470c
test eax, eax
je 0x42470c
call ecx
test eax, eax
je 0x424701
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x424701
test byte [ebp - 8], 1
jne 0x42470c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42473c
mov eax, dword [0x43acd8]
cmp eax, edi
je 0x424739
push eax
call ebx
test eax, eax
je 0x424739
call eax
mov esi, eax
test esi, esi
je 0x424739
mov eax, dword [0x43acdc]
cmp eax, edi
je 0x424739
push eax
call ebx
test eax, eax
je 0x424739
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43acd4]
call ebx
test eax, eax
je 0x424754
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x424756
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418922
mov esp, ebp
pop ebp
ret