joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d310
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46d4bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46d49c
mov dl, 1
mov eax, dword [0x41a474]
call fcn.00403384
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404144
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46d48b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045a338
test al, al
je 0x46d47e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x46d4cc
lea eax, [ebp - 0x254]
call fcn.004098d4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46d47e
xor eax, eax
push ebp
push 0x46d477
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46d504
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46d460
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004043b4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46d460
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004043b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d47e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46d381
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ec24
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d4c2
lea eax, [ebp - 0x260]
call fcn.00404144
ret

Function at 0x46ddf0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4cdc0c]
cmp byte [eax + 0xa5], 0
jne 0x46de61
cmp dword [0x4cdc24], 0
jne 0x46de22
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46ddac
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4cdc24], eax
cmp dword [0x4cdc20], 0
jne 0x46de3d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4cdc20], eax
cmp dword [0x4cdc28], 0
jne 0x46de61
push esp
push 0
push 0
push 0x46dd50
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4cdc28], eax
pop edx
ret
Function at 0x46df88
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46df9f
add esp, 0xfffffff0
call fcn.00403718
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424ba0
mov eax, dword [0x4cc0a4]
cmp word [eax + 2], 0
jne 0x46dfc7
mov eax, dword [0x4cc0a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046f678
mov eax, dword [0x4cc224]
cmp word [eax + 2], 0
jne 0x46dfe1
mov eax, dword [0x4cc224]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046f870
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419e10]
call fcn.00403384
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419e10]
call fcn.00403384
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4271dc]
call fcn.0042ec80
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46e168
mov eax, dword [0x4cbe7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042f050
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46fe10
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cbe7c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d8c0
test eax, eax
je 0x46e0d6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409298
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d8e8
test eax, eax
je 0x46e0ea
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004043b4
mov eax, dword [0x4cbbac]
cmp byte [eax], 0
jne 0x46e11e
mov eax, ebx
call fcn.0046e290
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0046ffec
mov eax, ebx
call fcn.004709b0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46e15e
call fcn.00403770
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e510
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4cdc0c]
cmp dword [eax + 0x30], 0
je 0x46e5ba
cmp dword [ebx + 0x94], 0
jne 0x46e5b4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46e4a0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46e5b4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46e57a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46e5b4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c678
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46e589
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46f11c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46f151
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404234
jmp 0x46f15e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404198
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4701c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x470209
mov eax, esi
call fcn.00455900
test al, al
je 0x470209
mov eax, dword [ebx + 0x84]
call fcn.004555fc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x470209
push 0
mov eax, dword [ebx + 0x84]
call fcn.004555fc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x494c27
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4cafc2
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x494c7f
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4cafe3
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x494c75
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x494c83
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4b6530
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4b6574
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.00409464
add esp, 0x200
pop ebx
ret
Function at 0x4bc808
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x40]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x4bc843
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [esi + 0x40]
call fcn.0041c678
mov al, byte [eax + 0x2a8]
xor al, 1
push eax
mov edx, ebx
mov eax, dword [esi + 0x40]
call fcn.0041c678
pop edx
mov byte [eax + 0x2a8], dl
inc ebx
dec edi
jne 0x4bc81b
pop edi
pop esi
pop ebx
ret
Function at 0x46d805
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.0046d845
bnd jle 0x46d85c
add dword [esp + esi*4], ebx
js 0x46d815
in al, 0xfb
out dx, eax
pop eax
out 0x7e, al
inc esp
neg esi
sub dword [ebp + reloc.mscoree.dll__CorExeMain], ecx
movsd dword es:[edi], dword [esi]
sbb eax, 0x66467f6c
pop word [esp]
Function at 0x4fbaeb
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov esi, dword [esp + 0xd]
lea esp, [esp + 0xc]
mov ebp, esi
and ebp, ecx
stc
jmp 0x4fba2c
cpuid
add esp, 0
pop dword [esp + 5]
neg edi
xchg byte [esp + 4], dl
setl ah
jmp 0x4fb9b4
pop word [esp + 4]
mov bl, 0x5b
setl ah
inc ecx
cpuid
bt di, di
jmp 0x4fb9ca
add esp, 0
lea ecx, [ebp*4]
add esp, 0
mov ecx, dword [esp]
jmp 0x4fba3e
mov dh, 0xbc
mov ax, 0xb5bd
mov byte [esp], ch
mov edx, 0xc6fc5050
bts esi, esi
mov ecx, esi
jmp 0x4fb9f7
btr edx, ecx
cpuid
pop di
setbe al
xchg cx, dx
xchg byte [esp], dh
jmp 0x4fba0d
mov dl, cl
neg si
mov edx, dword [esp]
rdtsc
inc dl
setbe ah
jmp 0x4fba96
xchg word [esp + 5], bp
pop dx
xchg byte [esp + 2], ch
mov ecx, edi
pop word [esp]
xchg dword [esp + 0xe], eax
jmp 0x4fb9e4
bswap ebx
bt cx, ax
rdtsc
stc
rdtsc
xchg byte [esp], bl
jmp 0x4fbabd
std
mov ax, 0x2a2c
lea edx, [ecx + edx]
cpuid
mov byte [esp], dl
mov esi, ebp
jmp 0x4fba75
mov byte [esp], bl
call fcn.004fbaa7
cpuid
ror bl, 0
jmp 0x4fba5b

Function at 0x4fbdaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ebp, esp
xchg bx, ax
lea ebx, reloc.mscoree.dll__CorExeMain
pop dword [esp]
jmp 0x4fbdc9
not ebp
jmp 0x4fbd99
mov ebp, 0xc5a5aca8
mov edi, 0x838bd0c1
inc cx
bsf ecx, ecx
jmp 0x4fbe23
cpuid
xchg dl, ch
mov ecx, dword [esp + 3]
bswap edi
mov si, ax
cpuid
jmp 0x4fbdb3
pop word [esp + 1]
neg ebp
sub esp, 0x1d
push esp
mov di, cx
cpuid
jmp 0x4fbdff

Function at 0x4fbe66
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb bp, dx
rcl si, 9
mov si, word [esp + 1]
lea eax, [ebx*4]
xchg dword [esp + 4], eax
xchg al, dl
mov dword [esp + 0x13], edx
mov ax, word [esp + 0xc]
mov bl, byte [esp + 0x13]
mov ch, 0xd5
jmp 0x4fbbe7
shr dx, cl
lea eax, reloc.mscoree.dll__CorExeMain
bsf eax, eax
xchg word [esp + 4], di
pop word [esp + 0x10]
jmp 0x4fbc28
Function at 0x4fc378
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4fc3ef
mov bp, word [esp + 8]
push word [esp + 1]
mov bp, 0xa760
cpuid
lea esi, [eax*4]
jmp 0x4fc407
xchg dx, ax
xchg dword [esp + 6], eax
xchg edi, ebp
mov byte [esp + 1], ah
mov word [esp + 5], bx
btr si, di
jmp 0x4fc3d2
mov cl, 0x21
mov ax, bp
pop edi
cpuid
mov dx, word [esp + 5]
push dword [esp + 4]
jmp 0x4fc64b
xchg bh, al
lea esp, [esp + 0x16]
inc bx
rcl edx, 0xa
shl si, 0xe
jmp 0x4fc480
inc di
setl ch
pop ax
not cl
btc ebp, eax
lea esi, [edi*4]
jmp 0x4fc43f
std
xchg bp, ax
cpuid
xchg dword [esp], esi
mov word [esp + 1], di
jmp 0x4fc4ad
lea edx, [eax*4]
xchg dword [esp], eax
xchg word [esp], si
xchg cl, ah
lea esp, [esp]
bswap esi
jmp 0x4fc46a
mov ah, 0xe4
xchg dword [esp + 3], esi
mov cl, 0x5a
mov dword [esp + 3], eax
rcl ah, 6
jmp 0x4fc574
push dword [esp]
lea ebx, [ecx + esi]
lea eax, [esi + esi]
mov dword [esp + 1], eax
rdtsc
mov cl, byte [esp + 6]
jmp 0x4fc497
setbe bh
add esp, 0
rdtsc
lea ecx, [esp + eax]
bsf edi, eax
sub esp, 0x1a
jmp 0x4fc455
pop ax
mov word [esp + 3], bx
call fcn.004fc51e
pop word [esp]
xchg word [esp], bp
xchg byte [esp + 2], dl
bswap esi
mov esi, edi
xchg si, ax
jmp 0x4fc5ea
lea esp, [esp + 4]
popal
sub esp, 0xc
add esp, 0
push word [esp + 3]
jmp 0x4fc615
xchg dword [esp], edx
push word [esp + 2]
xchg dword [esp], edx
cld
btc ebx, esp
lea esp, [esp + 2]
jmp 0x4fc5b9
mov cx, si
xchg ch, ah
cpuid
mov bl, byte [esp + 3]
mov ebx, 0xbd118325
bsf ebp, edx
jmp 0x4fc5cf
mov word [esp + 8], dx
sub esp, 5
lea esp, [esp + 3]
lea esp, [esp + 0x10]
popfd
jmp 0x4fc681
mov ebx, ebp
add esp, 0xa
pop word [esp]
btc edi, edx
lea esp, [esp]
stc
jmp 0x4fc4cd

Function at 0x4fd9d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr cx, si
xchg byte [esp], dl
push ax
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0x4fd9bd
bts dx, bp
cmc
rdtsc
bswap ecx
std
lea eax, [edi*4]
jmp 0x4fd97e
bswap eax
lea ecx, reloc.mscoree.dll__CorExeMain
mov ecx, eax
mov cx, si
jmp 0x4fd9e4
btc ecx, ecx
mov edx, ebp
rol ax, 7
mov eax, ebp
sub esp, 0xa
pop dx
jmp 0x4fd9a7
mov dx, cx
lea esp, [esp + 0xb]
mov dx, bx
lea edx, [ebx + esi]
jmp 0x4fd994
push dword [esp + 9]
mov ch, 0x87
mov ah, 0xb
mov edx, 0x8defdec6
btc ax, dx
mov dh, byte [esp + 0xc]
jmp 0x4fda54
add esp, 6
mov eax, dword [esp]
neg dl
mov eax, dword [esp]
neg ecx
sub esp, 0x13
jmp 0x4fda12
pop eax
mov ah, byte [esp]
pop word [esp]
bswap edx
mov dx, si
xchg al, ch
jmp 0x4fda28

Function at 0x4fdbbe
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
sub esp, 0x1b
mov ecx, 0x13c26aba
jmp 0x4fdba8
Function at 0x4022a5
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x4022cc
inc edi
cmp edi, 0x1f6502b0
jl 0x4022b4
cmp dword [0x45f26c], 0x400
jne 0x402345
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push str.ketunuzututevutixaheve_kur_hucudecagixifelowizin
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.conixagewudopipulo
push esi
call fcn.00402798
push esi
push esi
call fcn.004028ee
pop ecx
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402570
fstp st(0)
push esi
call fcn.0040299b
push esi
call fcn.004029aa
add esp, 0x10
xor edi, edi
cmp edi, 0xd0fe
jge 0x402356
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x58bc6e
jg 0x402374
inc edi
cmp edi, 0xe52f
jl 0x402347
mov eax, dword [0x44f2f4]
mov dword [0x45f26c], eax
call fcn.0040202e
mov edi, 0x3078f
cmp dword [0x45f26c], 0x51f
jne 0x4023a2
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x402388
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x4068fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ed38]
jne 0x406908
repz ret
jmp fcn.00408ed3
Function at 0x408a9e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44ed38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403c00
and dword [ebp - 0x14], 0
cmp dword [0x459e20], 0
mov dword [ebp - 0x18], eax
jne 0x408b51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408bf9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408bf9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x459e20], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x459e24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x459e28], eax
call edi
push eax
call esi
mov dword [0x459e30], eax
test eax, eax
je 0x408b51
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x459e2c], eax
mov eax, dword [0x459e2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408baa
cmp dword [0x459e30], ecx
je 0x408baa
push eax
call esi
push dword [0x459e30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408baa
test ebx, ebx
je 0x408baa
call edi
test eax, eax
je 0x408ba1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408ba1
test byte [ebp - 8], 1
jne 0x408baa
or dword [ebp + 0x10], 0x200000
jmp 0x408bdd
mov eax, dword [0x459e24]
cmp eax, dword [ebp - 0x18]
je 0x408bdd
push eax
call esi
test eax, eax
je 0x408bdd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408bdd
mov eax, dword [0x459e28]
cmp eax, dword [ebp - 0x18]
je 0x408bdd
push eax
call esi
test eax, eax
je 0x408bdd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x459e20]
call esi
test eax, eax
je 0x408bf9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408bfb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004068fe
leave
ret
Function at 0xb87342
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], ax
mov dword [esp], edi
pop word [esp]
lea esp, [esp + 2]
jmp 0xb873be
push ebx
call fcn.00b87353

Function at 0xb87353
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edx
mov dword [esp], esp
call fcn.00b87390

Function at 0xb87390
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
push ax
push word [esp]
jmp 0xb8739f
jbe 0xb8737a
mov byte [esp + 1], ch
push ecx
jmp 0xb87408
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], esi
jmp 0xb873a8

Function at 0xb87489
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b78d40
jmp 0xb873c4
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 4], ecx
call fcn.00b87336
mov byte [esp + 1], ch
push ecx
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], esi
jmp 0xb873a8
pushal
lea esp, [esp + 9]
lea esp, [esp + 0x12]
lea esp, [esp + 1]
mov dword [esp], edi
jmp 0xb873da
not ebx
mov edi, dword [esp]
mov edi, 0x5b5a36ff
neg bp
jmp 0xb8744c
pushfd
jmp 0xb8735e
mov ebp, dword [esp + 0x2c]
lea ebx, [edi - 0x7d]
rdtsc
pushfd
jmp 0xb873ed
lea ebx, [esp + eax]
lea edi, [esp + 4]
sub esp, 0x1d
jae 0xb8742b
jb 0xb87415
lea esi, [edi*4]
lea esp, [esp + 1]
jmp 0xb87436
lea esi, [edi*4]
lea esp, [esp + 1]
sub esp, 0xa0
jmp 0xb87466
ja 0xb873dd
jbe 0xb873dd
mov eax, esp
mov ax, 0x3e54
mov esi, esp
rdtsc
clc
jl 0xb87450
jge 0xb875f3
mov dword [esp + 4], eax
push eax
mov dword [esp], ecx
mov dword [esp], edi
push si
jmp 0xb87369
mov eax, esp
mov ax, 0x3e54
jmp fcn.00b87456
Function at 0xb8b9b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b78d40
jmp 0xb8b9f6
push word [esp + 1]
jmp 0xb8ba0e
pushfd
mov word [esp + 2], di
lea esp, [esp + 2]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0xb8ba18
lea esp, [esp + 2]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0xb8ba18
lea ebx, [ebx*4]
mov edi, eax
bt bx, si
jmp 0xb8d114
jns 0xb8b9be
pushfd
mov word [esp + 2], di
jmp 0xb8b9e8
pushfd
jmp 0xb8b325
mov esi, dword [esp + 0x2c]
sub edx, 0x88c31c77
js 0xb8ce85
jns 0xb8bb88
mov ecx, 0x9bb4829
sbb byte [ebx + 0x52], bh
int 0x89
add al, 0x24
mov ebx, dword [esp]
mov ecx, dword [esp]
mov bh, byte [esp]
sub esp, 0xc0
call fcn.00b8ba69
lea edx, [eax*4]
push dword [esp + 8]
jmp 0xb8bbd3
rcl bl, cl
xchg dx, bx
jmp 0xb8ce8a
lea esp, [esp + 3]
rol esi, 0
jmp 0xb8bc70
not ax
mov ax, 0x88d7
sub esp, 0xb
mov eax, ecx
xchg word [esp], cx
jmp 0xb8bc07
ja 0xb8bb98
lea esp, [esp + 3]
jmp 0xb8bb9c
mov al, byte [esp + 4]
lea eax, [esi*4]
lea esp, [esp + 3]
jmp 0xb8bc3e
sub esp, 0xb
mov eax, ecx
xchg word [esp], cx
jmp 0xb8bc07
mov ecx, edx
mov dx, word [esp]
bts cx, dx
rol dl, cl
jmp 0xb8bc95
lea esp, [esp + 0x18]
add esi, 0x6576f771
dec cl
je 0xb8bc28
jne 0xb8bc56
mov byte [eax], dl
xchg cl, ah
adc byte [ecx - 0x357463f3], ah
mov ecx, edx
mov dx, word [esp]
bts cx, dx
jmp 0xb8bd17
js 0xb8bba5
not ax
mov ax, 0x88d7
jmp 0xb8bc1d
bswap ecx
mov eax, dword [esp]
mov edx, 0x61f8ce18
mov edx, 0x5332aa2a
jmp 0xb8bc9f
mov cx, 0xfaf3
mov dh, dl
dec esi
clc
jmp 0xb8bcd6
not esi
mov ax, 0x3889
mov ax, 0x7ef1
stc
jmp 0xb8bcdf
mov edx, 0x61f8ce18
mov edx, 0x5332aa2a
jmp 0xb8bc9f
je 0xb8bc7f
bswap ecx
mov eax, dword [esp]
jmp 0xb8bcb5
jl 0xb8bcf5
mov ah, 0x5a
mov eax, 0xdb3c4821
jmp 0xb8bd38
mov ah, 0x5a
mov eax, 0xdb3c4821
bt dx, dx
neg esi
lea eax, [edx*4]
sub esp, 0x13
jmp 0xb8bd69
rol dl, cl
mov cx, 0xfaf3
jmp 0xb8bc99
pushfd
rdtsc
lea esp, [esp + 3]
jmp 0xb8bd86
bt dx, dx
jmp 0xb8bd00
lea esp, [esp + 3]
jmp 0xb8bd86
call fcn.00b8c771
dec edx
jmp 0xb8bdad
jge 0xb8bd22
pushfd
rdtsc
jmp 0xb8bd3e
add esi, dword [ebp]
setp al
lea ecx, [eax + esi]
cmc
ja 0xb8bd44
jbe 0xb8bd49
loope 0xb8bdff
stc
cwde
imul ebx, esp, 8
stosd dword es:[edi], eax
invalid

Function at 0xb8ba69
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x7330
lea ecx, [ebx + esi]
sub esp, 0x12
xchg cl, ah
lea edx, reloc.kernel32.dll_WriteFile
jmp 0xb8ba53

Function at 0xb8ec87
Capabilities:
Check for software breakpoints

Disassembly:
xchg bh, cl
bswap ecx
xchg dword [esp], edx
jmp 0xb8ece5

Function at 0xb8ee24
Capabilities:
Check for software breakpoints

Disassembly:
cmc
cmc
cmc
push cx
lea esp, [esp + 2]
jmp 0xb8ee66
xchg dword [esp], edx
lea ebx, reloc.kernel32.dll_WriteFile
push dx
dec bh
call fcn.00b8ee50
xchg ecx, eax
setg dl
or dword [esi - reloc.kernel32.dll_WriteFile], esp
xchg byte [ecx], dh

Function at 0xbb8128
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [eax], 0
leave
ret
dec dword [ebp + 0x14]
test ecx, ecx
jne 0xbb769b
je 0xbb7dea
pop word [esp]
lea esp, [esp + 2]
mov ecx, dword [ebp + 0x14]
jmp 0xbb7e7c
Function at 0xbb83f8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x3c]
and ecx, 0xff0000
call fcn.00bb83a9
lea esp, [esp + 8]
and edi, 0xff000000
cmc
jmp 0xbb83e6
xor ecx, edi
mov edi, edx
call 0xbb83f0
mov esi, 0x1e8f221
add byte [eax], al
add byte [ecx - 0x55c5c615], cl
cmp byte [edi - 0x56], bl
outsb dx, byte [esi]
pop eax
iretd
Function at 0xe2ae89
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xe2aecb
btc ax, cx
bts si, cx
lea eax, [ebx + edi]
rdtsc
bsr si, cx
cld
jmp 0xe2af1d
lea esi, [edx + ebp]
lea esi, reloc.kernel32.dll_WriteFile
mov esi, 0xd8c0aa4f
jmp 0xe2af49
bswap eax
mov dh, byte [esp]
btr dx, bp
xchg dword [esp + 5], esi
xchg dword [esp + 1], esi
sub esp, 0x1b
jmp 0xe2af07
lea edx, [edi*4]
setg al
mov dh, 0x17
cld
jmp 0xe2af87
xchg byte [esp + 0x18], dh
mov dword [esp + 0x22], ebp
pop esi
push dword [esp + 5]
pop si
lea esp, [esp + 0x1a]
jmp 0xe2af33
mov dword [esp + 2], edx
lea esp, [esp + 0xa]
mov edx, dword [esp]
clc
mov dl, al
cmc
jmp 0xe2af71

Function at 0xe2b07b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x10], ah
lea esi, reloc.kernel32.dll_WriteFile
shr dl, 0
mov ah, bh
jmp 0xe2b04f
bswap esi
std
mov si, bp
not ax
xchg dl, dh
dec dh
jmp 0xe2b02a
pop dword [esp + 1]
lea eax, [ebp + 0xc4]
inc ah
xchg word [esp + 3], dx
lea edx, reloc.kernel32.dll_WriteFile
mov ah, bl
jmp 0xe2b093
jmp 0xe2b040
mov edx, 0x90b638b0
std
push dword [esp + 7]
cld
bsr edx, edi
jmp 0xe2b0c4
rdtsc
clc
not ah
mov dword [esp + 0xb], eax
rcl al, cl
mov si, word [esp + 0xd]
jmp 0xe2b07d