joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d5a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x24], 0
je 0x4d5a78
mov eax, dword [0x5640f0]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x170]
cmp eax, dword [edx + 0x24]
jne 0x4d5a78
mov eax, dword [0x5640f0]
cmp byte [eax + 0x11c], 0
jne 0x4d5a78
mov eax, dword [0x5644d0]
mov edx, dword [0x5644d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx], eax
nop
mov ebx, dword [ebp - 4]
mov eax, dword [0x5644d0]
mov edx, dword [0x5644d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx]
jne 0x4d5b6e
mov eax, dword [0x5640f0]
cmp byte [eax + 0x11c], 0
jne 0x4d5b6e
mov eax, dword [0x5644d0]
mov edx, dword [0x5644d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.0054c2d0
mov eax, dword [0x5640f0]
cmp dword [eax + 0x170], 0
je 0x4d5b34
push 0x10
push 0
mov eax, dword [0x5640f0]
mov eax, dword [eax + 0x170]
push dword [eax + 0x254]
mov eax, dword [0x5640f0]
mov eax, dword [eax + 0x170]
push dword [eax + 0x248]
mov eax, dword [0x5640f0]
mov eax, dword [eax + 0x170]
push dword [eax + 0x12c]
push 0
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5640f0]
mov eax, dword [eax + 0x170]
call fcn.004f4f90
test al, al
je 0x4d5b34
push 0
mov eax, dword [0x5640f0]
call fcn.00421f70
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5640f0]
call fcn.00425170
jmp 0x4d5c04
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4d5bc2
mov eax, dword [ebp - 4]
mov edx, dword [0x5640f0]
mov eax, dword [eax + 0x24]
cmp eax, dword [edx + 0x170]
jne 0x4d5bc2
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5640f0]
call fcn.00425170
jmp 0x4d5c04
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4d5c04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
test dword [eax + 0x48c], 8
je 0x4d5c04
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5644d0]
mov edx, dword [0x5644d0]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d5c10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
mov ebx, eax
mov eax, dword [0x5644d0]
mov edx, dword [0x5644d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx]
jne 0x4d5ce0
mov eax, dword [0x5640f0]
cmp byte [eax + 0x11c], 0
jne 0x4d5ce0
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x5640f0]
cmp dword [eax + 0x170], 0
je 0x4d5cd4
mov eax, dword [0x5640f0]
mov eax, dword [eax + 0x170]
call fcn.004f4f90
test al, al
je 0x4d5cd4
mov eax, dword [0x5640f0]
mov eax, dword [eax + 0x170]
mov edx, dword [0x5640f0]
mov edx, dword [edx + 0x170]
mov edx, dword [edx]
call dword [edx + 0x344]
test al, al
je 0x4d5ccc
push 8
mov eax, dword [0x5640f0]
call fcn.00421f70
push eax
call sub.user32.dll_ShowWindow
lea esi, [esi]
call fcn.0054c3a0
lea esi, [esi]
mov eax, dword [0x5640f0]
call fcn.004251b0
jmp 0x4d5d44
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4d5d09
mov eax, dword [ebp - 4]
mov edx, dword [0x5640f0]
mov eax, dword [eax + 0x24]
cmp eax, dword [edx + 0x170]
jne 0x4d5d09
mov eax, dword [0x5640f0]
call fcn.004251b0
jmp 0x4d5d44
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
je 0x4d5d44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
test dword [eax + 0x48c], 8
je 0x4d5d44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xc], 1
mov eax, dword [0x5644d0]
mov edx, dword [0x5644d0]
mov edx, dword [edx]
call dword [edx + 0x90]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db2e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.004d9a80
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00413620
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x5df2d0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4db338
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
mov esi, esi
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4db3b4
or dword [ebp - 0x30], 0x800
cmp dword [0x57d550], 6
jb 0x4db38c
or dword [ebp - 0x30], 0x20000
mov esi, esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov esi, esi
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4dc450
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4dc4e8
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4dc4e8
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.004dc430
push ebp
push 0x414710
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004dc430
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dcb90
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004dcb70
push ebp
push 0x414710
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4dcc5c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.00469e40
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.00469d90
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.0046a550
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0046ba00
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4dccb3
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.004dcb50
push ebp
push 0x414710
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004dcb50
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004dcb70
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505420
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
jne 0x505448
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
lea esi, [esi]
cmp dword [ebp - 0xc], 0
je 0x5054fe
mov esi, esi
xor eax, eax
push 0x5054df
push ebp
push 0x414a90
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.0040cee0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
je 0x5054d4
cmp dword [ebp - 8], 0
je 0x5054d4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x5054fe
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54c6f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.0054c6d0
push ebp
push 0x414710
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.0040a760
cmp dword [ebp - 0xc], 0
jle 0x54c758
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x54c74c
mov eax, 0x5df2f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a760
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040aea0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x54c781
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x54c78d
mov eax, 0x5df2f0
call fcn.00430cb0
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0054c6d0
mov esp, ebp
pop ebp
ret
Function at 0x54db90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, ecx
mov edx, 0x5d4e60
call fcn.0040e5f0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0054db80
push ebp
push 0x414710
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
add eax, 0x34
xor edx, edx
call fcn.004089e0
mov eax, dword [ebp - 0xc]
mov edx, fcn.004d9a80
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
xor dx, dx
call fcn.00409330
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, 0x30
call fcn.004089e0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.0054be00
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054e200
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
jne 0x54dcac
mov eax, dword [ebp - 4]
call fcn.004f9a80
test al, al
jne 0x54dcac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0054db80
mov esp, ebp
pop ebp
ret
Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x68ae509d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3e6b1172
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Check mutex on windows
Hide graphical window

Disassembly:
sub esp, 0x48
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, str.MainWindowClass
push str.NetSchemeHandler
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401054
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40105f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x48
ret 0x10
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
mov dword [esp + 0x2c], 3
mov esi, dword [esp + 0x58]
mov dword [esp + 0x30], main
push esi
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [esp + 0x28]
lea ecx, [esp + 8]
push edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x40116a
push 0
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10cf0000
lea eax, [esp + 0x2c]
push str.NetSchemeHandler
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x40116a
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
je 0x40115e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call esi
test eax, eax
jne 0x40113e
pop ebx
mov eax, dword [esp + 0x14]
pop edi
pop esi
add esp, 0x48
ret 0x10
push 0x10
push str.Sorry
push str.Failed_to_register_main_class...
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x48
ret 0x10
Function at 0x451ac8
Capabilities:
Encode data using xor

Disassembly:
and dh, byte [ecx + 0x2c]
add eax, dword [esi]
push eax
jle 0x451abf
adc eax, 0xb90c0444
or al, 0xb9
pop ebp
xor ebp, edx
mov ah, 0xf1
mov ch, 0xc1
adc byte [eax + 0x57], 0xa0
ljmp 0xd056
mov ebp, 0x24b00a68
jne 0x451a7c
fstp xword [eax - 0x1aaf0938]
mov dword [0xd85d35c6], eax
xchg esi, eax
jo 0x451a71
adc eax, 0x31365b2d
div dword [ebp + 0x10577639]
adc al, al
mov al, byte [0xf05ff771]
rol byte [edx - 0x1d5f3820], 1
sub ch, dh
aam 0x73
jo 0x451b26
mov bl, 0xf4
sub ecx, dword [ebx - 0x1c]
push esp
test byte [edx], ch
adc al, 0xd7
cld
invalid
jle 0x451b53
int 0xac
mov cl, 0x99
scasb al, byte es:[edi]
ret 0xc78c
add al, 0x6a
les edi, [ebx + 5]
xor byte [edi + 0x76044700], dh
mov bh, 0
inc edi
add al, 0x76
add dword [eax + 0x477dfbbd], esp
xor al, 0x16
push ss
cld
mov dl, 0xed
jne 0x451b4d
cmpsd dword [esi], dword es:[edi]
int1
salc
movsd dword es:[edi], dword [esi]
in eax, 0xb3
xor al, 0xe6
out 0xc3, eax
cmp cl, byte [edi + 0x2c]
jl 0x451bd8
add eax, dword [ebx - 0x4c33aac0]
ljmp 0xab76
enter 0x3035, 0xffffffffffffffcc
outsb dx, byte [esi]
popfd
and byte [edi + 0x54], dh
jecxz 0x451b5f
mov bl, 0x74
or esp, 0xffffff96
aad 0x75
stosb byte es:[edi], al
xor eax, 0xb66603e6
out 0x8f, eax
cmpsd dword [esi], dword es:[edi]
dec edi
imul edi, dword [edi + 0x2b], 0x4f
call 0xb1d9cad8
and byte [ecx + edi], ch
adc dh, byte [edx]
hlt
dec edx
sub eax, 0x3067c69b
or bh, byte [ecx - 0x4821220d]
lcall 0xf7db, 0x809e94d3
popfd
salc
pop edi
jne 0x451b97
push cs
insd dword es:[edi], dx
daa
and dword [edx], eax
daa
push esi
mov edi, dword [eax]
sbb esp, dword [edx + 0xa]
inc eax
insb byte es:[edi], dx
stosb byte es:[edi], al
mov byte [0x484adcfd], al
xchg ecx, eax
out dx, al
mov ch, 0xd6
and ch, dh
loope 0x451c14
popfd
lcall 0x56f9, 0x761b5851
stc
push esi
js 0x451b9b
inc ebp
lodsd eax, dword [esi]
cmp eax, 0xf9b83234
salc
loope 0x451c58
adc dword [esi], ebx
xchg esi, eax
rcr cl, 1
mov dh, 0x28
push cs
idiv dword [esi + 0x5b5ff65d]
fild word [ebx + 0x634bf7d]
fdivr dword [ecx + esi - 0x71]
cmp al, 0xfd
ror byte [esi + 0x1c], 0x6a
jmp 0x3ef3756d
das
adc byte [esi + 0x6b], 0x38
or eax, 0xe817e995
inc ecx
or dword [ebx], esi
inc edi
adc al, 0x29
jle 0x451cad
mov cl, 0x1e
in eax, 0xf3
and byte [edi + 0x450805af], ah
sub al, 0xf4
xor eax, 0xcd53fa7c
bound eax, qword [esi]
mov ah, 0x2d
mov al, 0x83
je 0x451c63
invalid
invalid
Function at 0x48a457
Capabilities:
Encode data using xor

Disassembly:
leave
xor al, 0xd9
pushal
daa
push ebx
sub dl, byte [ebx - 0x72069e18]
popal
wait
fldcw word [edi]
lcall 0x71ea, 0x43399ba4
adc eax, 0x8fc8ef71
jp 0x48a479
loope 0x48a4bd
mov edi, 0x52961ddf
push 0xfffffffffffffff5
fistp word [0xf56a5296]
cdq
adc ah, byte [eax - 0x75]
mov esp, 0x61b98732
dec ebp
call 0xc709d784
popfd
cmp byte [edi], cl
cmp ebp, ebp
pop esp
je 0x48a501
push 0xffffffffffffffd1
cdq
mov eax, 0x1574b4cb
mov dword [0x339fa80f], edx
adc byte [eax - 0x25], 0xea
pop ebp
rcr dword [ecx + 0x74b4cbb8], 1
adc eax, 0xa80f1589
lahf
xor eax, dword [edx + 0x5deadb50]
mul dword [ecx]
mov bh, 0x73
xchg esi, eax
cld
movsb byte es:[edi], byte [esi]
sub eax, 0x3337354
push edx
inc esi
pop edi
inc esp
bound edi, qword [0x734b7e2]
xor al, 7
xor byte [ebx + edi*4 - 0x397f4f27], dh
out 0x82, al
neg dl
imul ebp, esi, 0xffffffa9
loopne 0x48a496
lcall 0xf1f0, 0x42402136
mov esi, 0xf7b5e3de
inc edi
daa
je 0x48a536
in eax, 0xa6
jno 0x48a53b
add edx, dword [esi]
std
xchg edi, eax
rol ebp, 1
mov byte [0x8117e195], al
xchg esi, eax
and dword [ecx], esp
dec esi
inc edi
or bl, byte [ebp - 0x695de6c]
fbld tbyte [ecx]
inc esi
sbb eax, 0xb996ed56
inc esi
ror dword [edx - 0x7691f99d], 0x55
int1
xchg esi, eax
mov ecx, 0x638ac146
push es
outsb dx, byte [esi]
mov dword [ebp - 0xf], edx
mov ebx, es
adc byte [edi + ecx], 0x23
pop ss
add dword [edi], ebp
push esi
sal byte [ecx + 0x4f], cl
or dword [edi - 0x7d], esi
sub eax, 0xe0200746
nop
xlatb
movsb byte es:[edi], byte [esi]
ret
dec edi
or dh, byte [0x2560331]
rol bp, 0xb6
rcr esi, 1
jmp 0xb5108e79
push esi
add ah, byte [esi - 0x3f]
lds esi, [esi + 0x31e9ded1]
jmp 0x320d5a11

Function at 0x4e8a3a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebp + 0x722b4c99], ah
add ah, byte [edi - 0x5af241d5]
pop bp
mov dword [ebp - 0x12c84ad7], esp
popfd
ret
jae 0x4e89ca
inc ebp
push esi
cmp dword [esi + 0x1711790b], 0xffffffb3
mov dl, 0xc9
cmpsd dword [esi], dword es:[edi]
aas
lcall 0xb80f, 0xc84de1db
ret
fnsave dword [edx + 0x1c55824d]
mov dword [0x8572bd62], eax
leave
xchg ebp, eax
fldcw word [ebx - 0x36]
jno 0x4e8a13
invalid
cwde
push edi
mov byte [edi - 0xd], cl
mov edi, 0xc00a7e35
or byte [ecx + 0x34752b49], bl
xor al, 0xd7
clc
ja 0x4e8a4b
das
pop edi
pop ds
dec esp
inc esp
pop esp
in eax, dx
xor cl, byte [ebp + 0x2597d502]
pushal
push ds
push ss
and al, 0x87
dec eax
cmp ch, 0xa2
cmp eax, 0x550245b2
adc ah, byte [esi - 0x6c0c4a9e]
ret

Function at 0x51f223
Capabilities:
Check for software breakpoints

Disassembly:
enter 0x3cb3, 0xffffffffffffff9d
dec esi
les ecx, [0x502b3b14]
test eax, 0x147c39a1
inc esp
jbe 0x51f22e
mov esp, 0x3881d03
in al, dx
invalid

Function at 0x5347f8
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
pushfd
pop ebx
inc dword [ecx]
test byte [ebp - 0x6fdc637a], ah
imul eax, dword [ecx - 0x52], 0xd075535
dec ebp
xor esp, edi
fld dword [0xaf2531dd]
fnsave dword [ecx]
and eax, 0xbf2767af
mov edx, 0x4a8647db

Function at 0x5b1216
Capabilities:
Encode data using xor

Disassembly:
fst qword [edx]
jmp 0x5b122e
salc
pop ds
test eax, 0x1c6aa360
aad 0x46
invalid