joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2ec0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5f5184]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4c2ed3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4c2f14
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5f522c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4c2f46
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4c2f4a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4c2f3b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4c2f68
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4c2f6c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4c2f5d
xor ecx, ecx
mov eax, 0x5f5194
xor ebx, ebx
mov bl, byte [ecx + 0x5f523c]
cmp byte [esp + ebx + 0x14], 0
je 0x4c2f97
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5f5254]
cmp byte [esp + ebx + 0x14], 0
je 0x4c2fae
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4c2f7e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4c2f07
lea edx, [esp + 0x84]
push edx
call fcn.004c2ff0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4c97d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004c95d0
pop edi
add esp, 0x104
ret 4

Function at 0x4da7d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4da803
push esi
call fcn.004df4e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4da7fc
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4da889
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4da872
mov eax, dword [esi + 8]
test eax, eax
je 0x4da827
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4da86e
cmp eax, 2
je 0x4da872
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4da81a
cmp eax, 3
je 0x4da84d
cmp eax, 1
jne 0x4da81a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4da81a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4da81a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004da8c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4da8a9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004da8c0
add esp, 4
pop esi
ret

Function at 0x51176e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5117a6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0050f7fb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0050f7d3
jmp 0x5117b2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x512e63
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x512ea5
call fcn.00518be7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x512ea5
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x512e9c
xor eax, eax
jmp 0x512ead
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00512eb3
pop edi
pop esi
pop ebx
ret 4
Function at 0x519117
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x519145
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x519163
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0051907d
jmp 0x519163
mov eax, dword [esi + 0x14]
test eax, eax
je 0x519163
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0051907d
test edi, edi
mov eax, edi
jne 0x51914d
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1102b8b6
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 8], 0x6364
lea esp, [esp + 0x40]
jne 0x1101808a
pushfd
mov byte [edi - 1], 0
jmp 0x10f7cb0b
setle ah
pushal
pushal
mov dword [esp + 0x40], ebx
not eax
lea eax, [0x11025ae0]
push esi
lea esp, [esp + 0x44]
jns 0x1102b792
pushal
pushal
mov dword [esp + 0x3c], 0x11016101
push ecx
jmp 0x10f7cfd9
mov dword [esp + 0x3c], eax
pushfd
push dword [esp + 0x40]
ret 0x44
pushal
bt ax, bp
cmp ebp, esp
repne scasb al, byte es:[edi]
mov byte [esp + 4], cl
jmp 0x10eacf9e
mov edi, ebx
ror al, 1
pushal
mov al, 0x2e
jmp 0x10f8931e
pushfd
mov dword [esp], 0x11016101
pushfd
push dword [esp]
mov dword [esp + 4], eax
pushfd
pushfd
pushal
push dword [esp + 0x2c]
ret 0x30
push esp
lea esp, [esp + 8]
jns 0x1102bbcd
push 0x5b413a7a
lea esp, [esp + 4]
ja 0x10f900f1
stc
sub ebx, edi
push 0xb18fb96c
bswap di
adc di, bx
add esp, 4
add ebx, esp
jmp 0x11018151
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401ad0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401b30
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401c1d
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401b64
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401c16
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401b50
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401c5a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c3a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401c0f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401c0f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401c24
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402120
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402175
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40216e
test esi, esi
je 0x40216e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402150
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402390
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4023c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4023be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023b0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x44896c66
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2b8c502d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40505d
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
mov ebp, dword [esp + 0xc]
inc eax
push esi
mov ebx, dword [ebx]
mov esi, eax
push edi
push 0x20
pop edi
cmp dword [ebp], eax
jle 0x4050f5
push 0x42629c
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050e3
push 0x4261f8
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050e3
push 0x4262a4
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050df
push 0x4261f0
push dword [ebx + esi*4]
call fcn.00413d40
pop ecx
pop ecx
test eax, eax
je 0x4050df
call fcn.00401d51
test al, al
je 0x4050d5
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x4050e6
mov eax, dword [ebx + esi*4]
cmp byte [eax], 0x2d
jne 0x4050ec
jmp 0x4050e6
push 0x20
jmp 0x4050e5
push 0x40
pop edi
inc esi
cmp esi, dword [ebp]
jl 0x405078
cmp edi, 0x20
jne 0x405256
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004056c3
pop ecx
pop ecx
test al, al
jne 0x40511a
push 0x426310
call fcn.00405aa8
pop ecx
push 2
jmp 0x405265
mov eax, 0x426344
push eax
push 0x426294
push eax
push eax
push dword [esp + 0x2c]
push 0x426348
push dword [esp + 0x48]
push dword [esp + 0x48]
call fcn.00405c8b
push 0
push dword [esp + 0x50]
call fcn.00402e39
add esp, 0x28
cmp eax, 1
jge 0x40515f
push 0x426360
call fcn.00405aa8
jmp 0x405262
mov ebx, dword [esp + 0x18]
push 0
push ebx
push ebp
call fcn.004017b8
mov esi, eax
push 0x42557c
push esi
call fcn.00413d40
add esp, 0x14
test eax, eax
jne 0x405192
push 0x426398
call fcn.00405aa8
pop ecx
push 4
jmp 0x405265
push dword [esp + 0x28]
mov edi, dword [esp + 0x28]
push edi
push esi
push dword [esp + 0x28]
mov byte [edi], 0
call fcn.004057bf
add esp, 0x10
test al, al
jne 0x4051c0
push edi
push esi
push 0x4263c0
call fcn.00405aa8
add esp, 0xc
jmp 0x40518b
mov edi, dword [ebx]
xor esi, esi
cmp dword [ebp], esi
jle 0x405251
mov ecx, dword [0x431020]
test ecx, ecx
jns 0x4051fc
push dword [edi + esi*4]
push 0x426430
call fcn.00405681
xor ebx, ebx
pop ecx
inc ebx
pop ecx
mov ecx, dword [0x431020]
cmp eax, ebx
cmove ecx, ebx
mov dword [0x431020], ecx
jmp 0x4051ff
xor ebx, ebx
inc ebx
test ecx, ecx
je 0x405242
push dword [edi + esi*4]
push 0x426444
call fcn.00405681
pop ecx
pop ecx
cmp eax, ebx
je 0x40524a
push dword [edi + esi*4]
push 0x42645c
call fcn.00405681
pop ecx
pop ecx
test eax, eax
je 0x40524a
push dword [edi + esi*4]
push 0x426470
call fcn.00405681
pop ecx
pop ecx
cmp eax, ebx
je 0x40524a
mov ecx, dword [0x431020]
inc esi
cmp esi, dword [ebp]
jl 0x4051d3
jmp 0x405251
and dword [0x431020], 0
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push 0x4262b0
call fcn.00405aa8
pop ecx
pop ecx
push 1
call fcn.0040ed64
int3
Function at 0x418b2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x38
mov eax, 0x20
dec eax
lea ebp, [0xcc58]
dec eax
lea edi, [0xc9b9]
dec ecx
mov esp, ecx
mov word [esp + 0x20], ax
dec eax
lea esi, [0xc9ab]
call fcn.0042265e
dec eax
mov edx, dword [0x131f6]
dec eax
lea ecx, [eax*8 + 8]
dec eax
lea ebx, [0xc99d]
call fcn.0041a9ee
dec esp
lea ebx, [0xc98d]
inc ebp
xor ecx, ecx
inc ebp
xor edx, edx
nop dword [eax + eax]

Function at 0x418c93
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
je 0x418c24
inc ecx
cmp ch, 0x87
je 0x418d3e
jg 0x418c4e
inc ecx
cmp ch, 0x83
je 0x418d12
jg 0x418cb2
inc ecx
cmp ch, 0x81
je 0x418d2e
inc ecx
cmp ch, 0x82
jne 0x418cce
inc ebp
movsx edx, byte [esp + 1]
dec ebp
lea eax, [esp + 2]
mov edx, 0x24
inc esp
mov ecx, edx
and ecx, 0xf
cmp cl, 0xa
dec esp
mov ecx, ebx
dec eax
cmovne ecx, ebx
dec eax
add ecx, 1
dec ebp
mov esp, eax
nop
dec eax
add eax, 1
dec eax
add ecx, 1
mov byte [eax - 1], dl
movzx edx, byte [ecx - 1]
test dl, dl
jne 0x418bfe
inc ebp
movzx ebp, byte [esp]
dec ebp
lea eax, [esp + 1]
inc ebp
test ch, ch
jne 0x418ba1
inc ecx
and ecx, 1
je 0x418c31
inc ecx
cmp ch, 0x24
je 0x418d59
jle 0x418cde
inc ecx
cmp ch, 0x3d
jne 0x418d72
inc ebp
test edx, edx
je 0x418d8d
inc esp
mov edx, edx
inc ebx
lea ecx, [ecx + ecx]
and edx, 0xf
cmp edx, 1
dec eax
arpl dx, dx
inc esp
cmovne ecx, ecx
inc ecx
test dl, 0x10
dec eax
lea ecx, [ebp + edx*4]
je 0x418d95
invalid
add dh, al
add byte [edx], bh
mov byte [eax], 0x3a
movzx edx, byte [ecx]
dec eax
add eax, 1
dec eax
add ecx, 1
test dl, dl
dec ebp
mov esp, eax
jne 0x418bfe
jmp 0x418b8e
inc ecx
cmp ch, 0x84
je 0x418cfe
inc ecx
cmp ch, 0x86
mov edx, 0x24
dec eax
lea ecx, [0xc841]
je 0x418bf5
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x418b8e
inc ecx
cmp ch, 0x88
jne 0x418d4f
inc ecx
xor ecx, 1
dec ebp
mov esp, eax
inc ecx
mov ebp, 0x22
inc esp
mov byte [eax], ch
dec eax
add eax, 1
jmp 0x418b8e
dec eax
lea ecx, [0xc813]
dec ebp
mov esp, eax
mov edx, 0x24
jmp 0x418bfe
inc ecx
test cl, 1
dec eax
mov ecx, esi
dec eax
cmovne ecx, edi
inc ecx
sar ecx, 1
inc ebp
xor edx, edx
movzx edx, byte [ecx]
jmp 0x418c9e
inc ebp
movzx ebp, byte [esp + 1]
dec ecx
add esp, 2
jmp 0x418cf1
mov edx, 0x29
dec eax
lea ecx, [0xc7c3]
jmp 0x418bf5
inc ecx
cmp ch, 0x22
jne 0x418cce
mov byte [eax], 0x5c
inc esp
mov byte [esp + 0x20], ch
inc esp
mov edx, ebp
dec eax
add eax, 1
dec eax
lea ecx, [esp + 0x20]
jmp 0x418bf5
inc ecx
cmp ch, 0x5c
je 0x418d59
inc ecx
cmp ch, 0x27
je 0x418d59
inc esp
mov byte [eax], ch
dec ebp
mov esp, eax
dec eax
add eax, 1
jmp 0x418b8e
dec ebp
mov esp, eax
jmp 0x418cf1
movzx edx, byte [ecx]
jmp 0x418c9e
Function at 0x493fd6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3d70]
jne 0x493fe0
repz ret
jmp fcn.00498b5f

Function at 0x496ef0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c3d70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004913c2
and dword [ebp - 0x14], 0
cmp dword [0x4c6c1c], 0
mov dword [ebp - 0x18], eax
jne 0x496fa3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49704b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a0fc8
push ebx
call edi
test eax, eax
je 0x49704b
mov esi, dword [fcn.0048d650]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c6c1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c6c20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c6c24], eax
call edi
push eax
call esi
mov dword [0x4c6c2c], eax
test eax, eax
je 0x496fa3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c6c28], eax
mov eax, dword [0x4c6c28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048d654]
cmp eax, ecx
je 0x496ffc
cmp dword [0x4c6c2c], ecx
je 0x496ffc
push eax
call esi
push dword [0x4c6c2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x496ffc
test ebx, ebx
je 0x496ffc
call edi
test eax, eax
je 0x496ff3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x496ff3
test byte [ebp - 8], 1
jne 0x496ffc
or dword [ebp + 0x10], 0x200000
jmp 0x49702f
mov eax, dword [0x4c6c20]
cmp eax, dword [ebp - 0x18]
je 0x49702f
push eax
call esi
test eax, eax
je 0x49702f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49702f
mov eax, dword [0x4c6c24]
cmp eax, dword [ebp - 0x18]
je 0x49702f
push eax
call esi
test eax, eax
je 0x49702f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c6c1c]
call esi
test eax, eax
je 0x49704b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49704d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493fd6
leave
ret
Function at 0x1005d514
Capabilities:
Check for vm using instruction vpcext

Disassembly:
retf 0xabee
lds ecx, [eax]
ja 0x1005d482
xlatb
aaa
pop ds
out 0x7b, eax
xchg edx, eax
push edx
sbb eax, 0xa055ba94
sbb bl, byte [0x1fb96958]
popfd
and al, 0x9f
pop es
push esp
inc ebp
invalid
xchg esp, eax
mov edx, 0x1d1aa055
pop eax
imul edi, dword [ecx - 0x60db62e1], 0xf455407
aas
push ebp
rol dword [edi + 5], cl
cmp ecx, dword [ecx + edi + 0x6113e43c]
in al, 0x13
popal
in al, 0x13
popal
js 0x1005d4fa
mov dword [0x89d8243a], eax
pop ebp
push ecx
mov bh, 0x34
or ebx, eax
cmp al, 0x5f
mov bp, ax
sub dword [ebp + 0x7a], 0xd1c72ac0
jno 0x1005d4ee
mov eax, dword [0x434c962d]
outsb dx, byte [esi]
nop
in eax, dx
add byte [ebx + ecx*4 + 0x16f7d11f], bh
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
add eax, 0xb3137f75
insb byte es:[edi], dx
jno 0x1005d519
in eax, dx
invalid

Function at 0x10074463
Capabilities:
Encode data using xor

Disassembly:
std
or ecx, 0xfffffffa
pop es
cmp dl, byte [eax + 0x78]
cdq
push cs
invalid

Function at 0x100790c0
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
pop ss
mov esi, 0x93d1e094
setno byte [eax]
out dx, eax
pop esp
cdq
mov dword [ecx + 0x49], ebp
insb byte es:[edi], dx
or eax, 0x2655b653
pushal
cmp eax, dword [esp + ebx*2 + 0x7b]
insb byte es:[edi], dx
stosb byte es:[edi], al
dec eax
add al, 0x39
push es
out dx, eax
insb byte es:[edi], dx
xor eax, 0x1d997a26
mov esi, 0x8886cb2b
pop esp
shr byte [esi + 0x68], 1
push edx
jmp 0x1d11f276
lcall 0xd845, 0x209e97f3
sbb edi, ecx
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
cmp ecx, dword [esi]
insd dword es:[edi], dx
xor cl, bl
inc edx
loopne 0x10079139
or ecx, ecx
add byte [ebx - 0x35a51a97], dl
imul esi, dword [ebp + 0x177dd59e], 0xfffffff5
lds esp, [ebp + 0x20]
pushal
pop esp
jno 0x10079080
and ch, byte [eax - 0x553fb12e]
clc
je 0x100790ae
cdq
in eax, 0xaf
xor eax, 0x308ac33f
in al, dx
push ds
hlt
aad 0xf3
mov word [eax + 0x6e81a8bb], es
scasd eax, dword es:[edi]
sub eax, 0xcdb9a41f
pop ecx
invalid
inc edx
outsd dx, dword [esi]
or eax, 0xb7607f
salc
xor al, 0x74
popal
rcl byte [0x6f94dafd]
jp 0x10079199
jp 0x10079189
daa
mov ebp, 0x611f1e1b
invalid
mov bh, 0x78
cdq
fidivr word [eax]
push ebx
dec edx
mov edi, 0xe252ca00
sub dword [edx], 0x7482723a
adc cl, bl
inc edi
loop 0x100791cd
jb 0x1007910d
je 0x1007919d
fld dword [edi - 0x1e]
cmp al, 0xd4
in al, 0xab
aam 0xe4
stosd dword es:[edi], eax
hlt
cmpsd dword [esi], dword es:[edi]
dec eax
out 0xc0, al
loope 0x1007917a
loope 0x100791e2
cli
ret
adc byte [esi + ebx*2 - 0x10], al
jge 0x100791f6
lodsb al, byte [esi]
mov edx, 0xe06d075d
push edx
sbb byte [ecx + 0x6b2d6cab], bh
inc esp
movsb byte es:[edi], byte [esi]
mov dh, 0
fisttp dword [ebx + 0x113324c2]
loop 0x10079208
std
iretd
int3
inc esi
lcall 0xfe48, 0x839ab7e5
xor eax, 0xa2597d8b
stc
or dl, al
salc
movsb byte es:[edi], byte [esi]
pop edi
add ebp, ebp
dec ecx
loopne 0x1007921e
sbb dword [edi - 0x34], edx
push es
mov ah, 0x90
stosb byte es:[edi], al
invalid