joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c9e8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x50c464]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x4adfc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00494bb8
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00495de0
mov eax, dword [esi]
call fcn.0048350c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x49ca5a
mov eax, dword [esi]
call fcn.0048350c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00483518
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x49ca7e
mov eax, dword [esi]
call fcn.00483518
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00483500
cmp eax, dword [ebp - 0x18]
jle 0x49ca94
mov eax, dword [esi]
call fcn.00483500
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004834f4
cmp eax, dword [ebp - 0xc]
jle 0x49caaa
mov eax, dword [esi]
call fcn.004834f4
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0049b370
push eax
call fcn.004087c0
call fcn.00407d30
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x49cb71
mov eax, ebx
call fcn.0040537c
cmp eax, 0x64
jge 0x49cb71
cmp dword [0x506440], 0
je 0x49cb71
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00408810
cmp dword [ebp - 8], 0
je 0x49cb71
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00408810
cmp dword [ebp - 8], 0
je 0x49cb34
mov bl, 2
jmp 0x49cb4f
lea edx, [ebp - 0x20]
mov eax, dword [0x523d18]
call fcn.0049fc80
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x49cb4d
xor ebx, ebx
jmp 0x49cb4f
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x506548]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.0049b370
push eax
call dword [0x506440]
mov eax, dword [0x50c284]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.00498aa4
push 4
mov eax, dword [ebp - 4]
call fcn.0049b370
push eax
call fcn.00408808
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adfc8
call fcn.00407d30
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4ae558
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0x4ae57c
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0x4ae56a
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4ae90c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4ae931
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.004ae8cc
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.004ae8cc
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.004ae8cc
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.004ae8cc
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4ae94d
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.004ae8cc
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.004ae8cc
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4aea9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4aeac1
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.004ae8cc
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.004ae8cc
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.004ae8cc
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.004ae8cc
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4aeadd
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.004ae8cc
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.004ae8cc
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cb264
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4cb295
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cb27d
add dl, dl
jne 0x4cb2a0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cb2f1
xor eax, eax
add dl, dl
jne 0x4cb2ad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cb38e
add dl, dl
jne 0x4cb2bc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cb2c7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cb2d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cb2dd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4cb2e7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4cb28c
mov eax, 1
add dl, dl
jne 0x4cb2ff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cb30a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cb2f6
sub eax, ebx
mov ebx, 1
jne 0x4cb33d
mov ecx, 1
add dl, dl
jne 0x4cb323
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4cb32e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cb31a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cb28c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4cb354
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4cb35f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cb34b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cb28c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4cb3af
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4cb28c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4cccd4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4ccd05
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ccced
add dl, dl
jne 0x4ccd10
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ccd61
xor eax, eax
add dl, dl
jne 0x4ccd1d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ccdfe
add dl, dl
jne 0x4ccd2c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd42
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd4d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4ccd57
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4cccfc
mov eax, 1
add dl, dl
jne 0x4ccd6f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd7a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ccd66
sub eax, ebx
mov ebx, 1
jne 0x4ccdad
mov ecx, 1
add dl, dl
jne 0x4ccd93
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ccd9e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ccd8a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cccfc
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4ccdc4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ccdcf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ccdbb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cccfc
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4cce1f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4cccfc
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4ccd14
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4ccd05
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ccced
add dl, dl
jne 0x4ccd10
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ccd61
xor eax, eax
add dl, dl
jne 0x4ccd1d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4ccdfe
add dl, dl
jne 0x4ccd2c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd42
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd4d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4ccd57
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4cccfc
mov eax, 1
add dl, dl
jne 0x4ccd6f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4ccd7a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ccd66
sub eax, ebx
mov ebx, 1
jne 0x4ccdad
mov ecx, 1
add dl, dl
jne 0x4ccd93
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ccd9e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ccd8a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cccfc
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4ccdc4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4ccdcf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4ccdbb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cccfc
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4cce1f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4cccfc
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4d290c
Capabilities:
Parse pe header

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
je 0x4d2934
mov ebx, edx
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4d2934
add ebx, dword [eax + 0x3c]
mov eax, ebx
cmp dword [eax], 0x4550
jne 0x4d2934
cmp word [eax + 0x18], 0x20b
sete cl
mov eax, ecx
pop ebx
ret

Function at 0x4d2938
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
test esi, esi
je 0x4d2991
mov edi, esi
push 0x40
push edi
call fcn.00407dd0
test eax, eax
jne 0x4d2991
cmp word [edi], 0x5a4d
jne 0x4d2991
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x4d2991
cmp eax, 0x10000
jge 0x4d2991
add esi, eax
push 0x120
push esi
call fcn.00407dd0
test eax, eax
jne 0x4d2991
cmp dword [esi], 0x4550
jne 0x4d2991
mov ax, word [esi + 0x18]
cmp ax, 0x10b
je 0x4d298f
cmp ax, 0x20b
jne 0x4d2991
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x411be1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040dc32
and dword [ebp - 4], 0
cmp dword [0x5dfe5c], 0
mov ebx, eax
jne 0x411c92
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411d43
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x416b04
push edi
call esi
test eax, eax
je 0x411d43
push eax
call fcn.0040dbc0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5dfe5c], eax
call esi
push eax
call fcn.0040dbc0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5dfe60], eax
call esi
push eax
call fcn.0040dbc0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5dfe64], eax
call esi
push eax
call fcn.0040dbc0
pop ecx
mov dword [0x5dfe6c], eax
test eax, eax
je 0x411c92
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dbc0
pop ecx
mov dword [0x5dfe68], eax
mov eax, dword [0x5dfe68]
cmp eax, ebx
je 0x411cea
cmp dword [0x5dfe6c], ebx
je 0x411cea
push eax
call fcn.0040dc3b
push dword [0x5dfe6c]
mov esi, eax
call fcn.0040dc3b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411cea
test edi, edi
je 0x411cea
call esi
test eax, eax
je 0x411ce1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411ce1
test byte [ebp - 0xc], 1
jne 0x411cea
or dword [ebp + 0x10], 0x200000
jmp 0x411d23
mov eax, dword [0x5dfe60]
cmp eax, ebx
je 0x411d23
push eax
call fcn.0040dc3b
pop ecx
test eax, eax
je 0x411d23
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411d23
mov eax, dword [0x5dfe64]
cmp eax, ebx
je 0x411d23
push eax
call fcn.0040dc3b
pop ecx
test eax, eax
je 0x411d23
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5dfe5c]
call fcn.0040dc3b
pop ecx
test eax, eax
je 0x411d43
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411d45
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x24bf3c97
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3952048a
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x79022ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x79068330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
movzx eax, byte [0x790703cd]
test eax, eax
je 0x79022f0b
mov eax, 1
jmp 0x790230b1
mov eax, dword [0x7906f1b8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.79037510
add esp, 4
mov dword [ebp - 0xc], eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [0x7906f1b0], eax
cmp dword [ebp - 0x10], 0
je 0x790230af
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.790390a0
add esp, 0xc
mov dword [ebp - 0x14], fcn.7903cd5b
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xe9
jne 0x79022f85
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 5]
mov dword [ebp - 0x14], eax
jmp 0x79022fa4
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp ecx, 0xeb
jne 0x79022fa4
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx], 0x1b8
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax], 0x12c200
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x50
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x790230af
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov edx, 0x7902301d
mov dword [ebp - 0x70], edx
mov eax, 0x7902305f
sub eax, edx
mov dword [ebp - 0x6c], eax
jmp 0x7902305f
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.790390a0
add esp, 0xc
push 0x50
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x68]
call eax
push 0x8000
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [0x790703cd], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.79039e56
mov esp, ebp
pop ebp
ret

Function at 0x7902edf7
Capabilities:
Encrypt data using tea

Disassembly:
push dword [esp]
lea esp, [esp + 0x2c]
jne 0x79158f10
jmp int.79091cc1

Function at 0x7903236f
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
xchg dword [esp + 0x2c], ecx
pop ecx
bswap cx
pushfd
lea ecx, [ebp - 0x4a0]
jmp fcn.790ab317
Function at 0x79076dec
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
popal
cmc
rol ax, 4
dec al
mov eax, dword [ebp - 8]
jmp 0x7917c338
sets al
bswap ax
mov ax, 0x14e6
mov eax, dword [ebp + 8]
pushfd
pushfd
mov dword [esp + 4], eax
push esi
call fcn.7914389f
adc ch, al
clc
mov ecx, dword [eax + 0x2bcc34]
test bl, 0x72
test ax, cx
push ebx
mov dword [ebp - 0x14], ecx
pushfd
push 0xdc3c7bd2
clc
mov byte [esp + 4], 0x99
cmp dword [ebp - 0x14], 0
pushal
lea esp, [esp + 0x2c]
jne 0x79119f7d
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x790d72ce

Function at 0x79078354
Capabilities:
Encrypt data using tea

Disassembly:
mov word [ebp - 0x390], ax
pushfd
lea esp, [esp + 0x2c]
jmp 0x790b9ad3

Function at 0x79078925
Capabilities:
Encrypt data using xtea

Disassembly:
lea ecx, [edx*4 + 0x477a1ba0]
sub edx, 0x61c88647
dec cl
aas
mov dword ss:[ebp - 4], edx
ror eax, cl
cmp ebx, ebx
clc
mov eax, dword ss:[ebp - 8]
add dx, dx
shl eax, 4
movzx dx, dl
btc edx, 0xc
test bh, ch
mov ecx, dword ss:[ebp - 8]
rol dl, 2
btc edx, esp
not dh
adc dl, 0x37
shr ecx, 5
pushal
bswap dx
stc
lea edx, [eax*4 + 0x1f8c154]
xor eax, ecx
btr edx, edx
mov edx, dword ss:[ebp - 8]
cmc
xor edx, dword ss:[ebp - 4]
rol cx, 0xe
ror cl, cl
add eax, edx
add cl, 0x9e
mov ecx, dword ss:[ebp - 4]
sal dh, cl
shr ecx, 0xb
btc dx, 0xa
and ecx, 3
or dh, cl
mov edx, dword ss:[ebp + 8]
pushal
stc
stc
add eax, dword ds:[edx + ecx*4]
and cx, sp
dec ch
shr ch, 1
push 0x551573a2
mov ecx, dword ss:[ebp - 0x10]
cmp dh, 0x1f
cmc
add ecx, eax
jmp 0x790bf197
mov word [esp + 4], 0x9e05
mov dword ss:[ebp - 0x10], ecx
mov word [esp], bp
lea esp, [esp + 0x48]
jmp 0x7911f856

Function at 0x7907ce24
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
bsr ax, cx
mov eax, dword [ebp - 0x24]
pushal
rcr ch, 5
shrd cx, ax, cl
bt ecx, esp
sub eax, dword [ebp - 0x7c]
bsr dx, dx
pop edx
or ch, 0x1b
cmc
mov dword [ebp - 0x24], eax
xchg cl, ah
mov eax, dword [ebp - 0x20]
clc
pushfd
bt ecx, esi
movzx ecx, word [eax]
rol al, 5
pop eax
xchg edx, eax
sub ax, si
sub ecx, dword [ebp - 0x7c]
rdtsc
clc
bt cx, 2
mov edx, dword [ebp - 0x20]
movsx ax, bl
mov word [edx], cx
pushal
rdtsc
xor ah, 0x84
mov eax, dword [ebp - 0x60]
xor edx, edi
xadd cl, dl
xchg dl, cl
mov dword [ebp - 0x28], eax
btc ax, bx
btc dx, dx
call fcn.7918d05a