joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013e0
Capabilities:
Create process on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
mov ecx, 0xf
push edi
push esi
push ebx
lea edi, [ebp - 0x54]
sub esp, 0x5c
mov esi, dword [ebp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x50], 0x8440
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
mov dword [esp], eax
call sub.SHELL32.DLL_ShellExecuteExW
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x1c]
push edx
push edx
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
push ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str.ShellExecute__s:__s__s_n
call sub.msvcrt.dll_wprintf
mov eax, dword [ebp - 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40147a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x64c
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x630]
mov dword [esp], ebx
mov dword [esp + 4], 0x104
call sub.KERNEL32.dll_GetWindowsDirectoryW
push edi
push edi
lea edi, [ebp - 0x220]
mov dword [esp + 8], ebx
mov dword [esp], ebx
mov dword [esp + 4], str._sSystem32cmd.exe
call sub.USER32.dll_wsprintfW
lea edx, [ebp - 0x428]
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], str._c_Toolsinit.cmd__s
mov dword [ebp - 0x63c], edx
call sub.USER32.dll_wsprintfW
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [esp + 4], str._c_Toolsonexit.cmd__s
call sub.USER32.dll_wsprintfW
mov edx, dword [ebp - 0x63c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.open
mov dword [esp], 0
call fcn.004013e0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call fcn.004013e0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], str.open
mov dword [esp], 0
call fcn.004013e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, ebx
stc
xor ecx, dword [ebx + 0x50511f4d]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov esi, dword [0x405384]
call [ecx]
test eax, eax
jne 0x40a3e8
pop esi
pop ebp
js 0x40a479
add byte [ecx - 0x37ffa2a], al
or al, byte [eax]
pop esi
pop ebp
daa
or byte [eax], al
xor eax, eax
pop ebp
ret 0x80
inc eax
add byte [ebx], dh
das
ret

Function at 0x40abf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
nop
in al, dx
or byte [ebx + 0x56530c55], cl
push edi
mov edi, dword [edx]
test dword [ecx + ecx*4], ebp
sub al, 0x89
jge 0x40abff
jne 0x40ac13
adc byte [edi], dl
xor ebp, dword [ecx + 0x5de58b5b]
sub dl, byte [eax]
mov dword [ebx + 0x45b5fc7d], ecx
mov ch, 0x45
adc al, 0x83
cmp byte [eax], al
je 0x40ac05
xchg ebp, eax
mov ch, 0xa8
retf
Function at 0x40377f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403822
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.004056ea
pop ecx
pop ecx
test eax, eax
je 0x40380b
test ebx, ebx
je 0x4037ff
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004055b1
pop ecx
pop ecx
test eax, eax
jle 0x40380b
push ebx
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037cc
xor edi, edi
cmp ebx, edi
jne 0x403826
xor eax, eax
jmp 0x403892
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403855
call fcn.0040473f
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403822
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403822
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403845
cmp dword [ebp - 0x70], edi
je 0x403888
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x9c
leave
ret
Function at 0x4045b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x10000
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
push edi
call fcn.0040a156
add esp, 0x18
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x4045fd
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0xc]
push edi
call fcn.0040a156
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [0x420018], edi
je 0x404696
push str.J2D_D3D
call fcn.0040885f
pop ecx
mov esi, str.false
cmp eax, edi
je 0x404630
push esi
push eax
call fcn.00417995
pop ecx
pop ecx
test eax, eax
jne 0x404630
mov dword [0x420018], edi
push ebx
push str.J2D_D3D_PRELOAD
call fcn.0040885f
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x404655
push esi
push ebx
call fcn.00417995
pop ecx
pop ecx
test eax, eax
jne 0x404655
mov dword [0x420018], edi
cmp dword [0x420018], edi
jge 0x404688
mov dword [0x420018], edi
cmp ebx, edi
je 0x404695
push str.true
push ebx
call fcn.00417995
pop ecx
pop ecx
test eax, eax
jne 0x404682
mov dword [0x420018], 1
cmp dword [0x420018], edi
je 0x404695
push str.preloadD3D
call fcn.0040449c
pop ecx
pop ebx
mov esi, dword [ebp - 8]
cmp esi, edi
je 0x4046ba
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4046c3
push dword [ebp + 0x14]
call dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x421130], edi
pop edi
pop esi
je 0x4046d2
call fcn.00403e6f
mov eax, dword [ebp - 4]
leave
ret
Function at 0x404934
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.004047a1
push 8
mov esi, eax
call fcn.004046d7
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40499f
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x4049a6
and dword [ebx + 4], 0
jmp 0x4049bb
xor eax, eax
jmp 0x404a86
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a6c
push edi
call fcn.00408090
pop ecx
cmp eax, 4
jl 0x404992
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404992
add eax, 0xfffffffd
push 0x4197b4
push eax
mov dword [ebp - 0x74], eax
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
je 0x404a01
push 0x4197b0
push dword [ebp - 0x74]
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push 0x3b
push edi
call fcn.004097a0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push dword [ebp - 0x78]
call fcn.00408090
push edi
mov ebx, eax
call fcn.00408090
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046d7
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.004081b0
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.004081b0
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047f7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404992
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040473f
push ebx
call fcn.0040473f
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x214
leave
ret
Function at 0x404c84
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
cmp dword [esi + 4], 0xffffffff
push ebx
push edi
je 0x404cd7
cmp dword [esi], 0xffffffff
je 0x404cd7
push 0
push dword [esi + 8]
push dword [ebp + 8]
call fcn.00416522
add esp, 0xc
test eax, eax
js 0x404cd7
mov eax, dword [esi + 4]
inc eax
push eax
call fcn.0040a284
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404cd7
mov edi, dword [esi + 4]
push edi
push ebx
push dword [ebp + 8]
call fcn.00415a5c
add esp, 0xc
cmp eax, edi
je 0x404cdd
push ebx
call fcn.0040a3c5
pop ecx
xor eax, eax
pop edi
pop ebx
leave
ret
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp eax, ecx
jne 0x404cf9
mov eax, dword [ebp + 0xc]
mov byte [edi + ebx], cl
cmp eax, ecx
je 0x404cf5
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov eax, ebx
jmp 0x404cd9
cmp eax, 8
jne 0x404cd7
push 0x40
push str.1.2.3
lea eax, [ebp - 0x44]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
call fcn.00405903
add esp, 0x10
test eax, eax
js 0x404cd0
mov edi, dword [esi]
lea eax, [edi + 1]
push eax
call fcn.0040a284
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x404cd0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 1
push eax
mov dword [ebp - 0x30], edi
call fcn.00405a93
pop ecx
pop ecx
push ebx
test eax, eax
jns 0x404d64
call fcn.0040a3c5
push dword [ebp - 4]
call fcn.0040a3c5
pop ecx
jmp 0x404cd6
mov eax, dword [esi]
mov edi, dword [ebp - 4]
mov byte [edi + eax], 0
call fcn.0040a3c5
lea eax, [ebp - 0x44]
push eax
call fcn.00406cef
pop ecx
pop ecx
test eax, eax
jns 0x404d87
push edi
jmp 0x404cd1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x404d92
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, edi
jmp 0x404cd9
Function at 0x404d99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push 2
push 0xffffffffffffffea
push edi
call fcn.00416522
mov ebx, eax
add esp, 0xc
test ebx, ebx
jns 0x404dbd
or eax, 0xffffffff
jmp 0x404ead
push esi
mov esi, dword [ebp + 0xc]
push 0x16
push esi
push edi
call fcn.00415a5c
add esp, 0xc
test eax, eax
js 0x404ea9
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi]
shl eax, 8
or eax, ecx
cmp eax, 0x6054b50
jne 0x404e01
mov eax, ebx
jmp 0x404eac
push 2
push 0
push edi
call fcn.00416522
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
js 0x404ea9
mov esi, 0x10015
mov ebx, eax
cmp eax, esi
jl 0x404e26
mov ebx, esi
mov eax, ebx
push 2
neg eax
push eax
push edi
call fcn.00416522
add esp, 0xc
test eax, eax
js 0x404ea9
push esi
call fcn.0040a284
mov edi, eax
pop ecx
test edi, edi
je 0x404ea9
push ebx
push edi
push dword [ebp + 8]
call fcn.00415a5c
add esp, 0xc
test eax, eax
js 0x404ea2
lea ebx, [edi + eax]
lea esi, [ebx - 0x16]
jmp 0x404e9e
cmp byte [esi], 0x50
jne 0x404e9d
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 1]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, 0x50
cmp eax, 0x6054b50
jne 0x404e9d
movzx eax, byte [esi + 0x15]
movzx ecx, byte [esi + 0x14]
shl eax, 8
or eax, ecx
lea eax, [eax + esi + 0x16]
cmp eax, ebx
je 0x404eb1
dec esi
cmp esi, edi
jae 0x404e60
push edi
call fcn.0040a3c5
pop ecx
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
push 0x16
push esi
push dword [ebp + 0xc]
call fcn.004081b0
push edi
call fcn.0040a3c5
mov eax, esi
sub eax, ebx
add esp, 0x10
add eax, dword [ebp - 4]
jmp 0x404eac
Function at 0x4088d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4088e3
repz ret
jmp fcn.00410778

Function at 0x409ffa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40a021
call fcn.00409b9c
mov dword [eax], esi
call fcn.00409b89
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040c55f
mov eax, esi
jmp 0x40a076
test dword [ebp + 0xc], 0xfffffff9
jne 0x40a007
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a04e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409baf
pop ecx
call fcn.00409b89
mov eax, dword [eax]
jmp 0x40a076
test al, 0x10
jne 0x40a074
test al, 1
je 0x40a074
test byte [ebp + 0xc], 2
je 0x40a074
call fcn.00409b9c
mov dword [eax], 5
call fcn.00409b89
mov dword [eax], 0xd
jmp 0x40a045
xor eax, eax
pop esi
pop ebp
ret
Function at 0x413c75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c5a6
and dword [ebp - 0x14], 0
cmp dword [0x421ddc], 0
mov dword [ebp - 0x18], eax
jne 0x413d28
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413dd0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x413dd0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x421ddc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x421de0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x421de4], eax
call edi
push eax
call esi
mov dword [0x421dec], eax
test eax, eax
je 0x413d28
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x421de8], eax
mov eax, dword [0x421de8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413d81
cmp dword [0x421dec], ecx
je 0x413d81
push eax
call esi
push dword [0x421dec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413d81
test ebx, ebx
je 0x413d81
call edi
test eax, eax
je 0x413d78
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413d78
test byte [ebp - 8], 1
jne 0x413d81
or dword [ebp + 0x10], 0x200000
jmp 0x413db4
mov eax, dword [0x421de0]
cmp eax, dword [ebp - 0x18]
je 0x413db4
push eax
call esi
test eax, eax
je 0x413db4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413db4
mov eax, dword [0x421de4]
cmp eax, dword [ebp - 0x18]
je 0x413db4
push eax
call esi
test eax, eax
je 0x413db4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x421ddc]
call esi
test eax, eax
je 0x413dd0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413dd2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xa736571
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6cb476b9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x402d30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51eaf8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x553150]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [0x599e78]
mov edx, dword [0x599e74]
mov ecx, 0x599e74
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 4]
xor esi, esi
push 0xffffffffffffffff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], esi
call eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], esi
movzx ecx, word [0x599e70]
push 2
lea edx, [esp + 0x14]
push edx
mov eax, edi
mov dword [esp + 0x18], ecx
call fcn.00482540
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x599e6c]
mov dword [esp + 0x14], eax
mov eax, dword [ecx]
mov edx, 0x599e68
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
mov ebx, ecx
jmp 0x402dd4
mov eax, dword [esp + 0x24]
cmp edx, 0x599e68
jne 0x402ede
cmp eax, ebx
sete cl
test cl, cl
sete cl
test cl, cl
je 0x402ee8
test edx, edx
je 0x402ede
cmp eax, dword [edx + 4]
je 0x402ee3
mov esi, dword [eax + 0x10]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x402e19
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x10], ecx
jmp 0x402e21
mov dword [esp + 0x10], 0
movzx eax, byte [esi + 0x28]
movzx edx, word [esi + 0x2a]
push 4
lea ecx, [esi + 4]
mov dword [esp + 0x1c], eax
push ecx
mov eax, edi
mov dword [esp + 0x24], edx
call fcn.00482540
push 4
lea edx, [esi + 8]
push edx
mov eax, edi
call fcn.00482540
push 4
lea eax, [esp + 0x1c]
push eax
mov eax, edi
call fcn.00482540
push 4
lea ecx, [esp + 0x20]
push ecx
mov eax, edi
call fcn.00482540
push 1
lea edx, [esi + 0x5c]
push edx
mov eax, edi
call fcn.00482540
push 4
lea eax, [esi + 0x64]
push eax
mov eax, edi
call fcn.00482540
push 4
lea ecx, [esp + 0x14]
push ecx
mov eax, edi
call fcn.00482540
movzx edx, word [esi + 0x54]
push 2
lea eax, [esp + 0x14]
push eax
mov eax, edi
mov dword [esp + 0x18], edx
call fcn.00482540
mov eax, dword [esp + 0x10]
cmp ax, 1
jb 0x402ec9
cmp dword [esi + 0x58], 0x10
jb 0x402eba
mov esi, dword [esi + 0x44]
jmp 0x402ebd
add esi, 0x44
movzx ecx, ax
push ecx
push esi
mov eax, edi
call fcn.00482540
lea edx, [esp + 0x20]
call fcn.004068a0
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x402dd0
jmp fcn.00404b60
jmp fcn.00406050
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 0
je 0x402f12
mov edx, dword [0x599e74]
mov eax, dword [edx + 0xc]
mov ecx, 0x599e74
call eax
neg eax
sbb eax, eax
add eax, 1
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret