joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3cd0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x28]
push ebx
mov dword [ebp - 0x28], 8
mov eax, fcn.004e26b0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00413960
mov dword [ebp - 0x18], eax
mov eax, str.MAINICON
push eax
push dword [0x6722d0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4e3d24
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x14], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, str.Window
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne bl
je 0x4e3d9c
or dword [ebp - 0x28], 0x800
cmp dword [0x60e4a0], 6
jb 0x4e3d74
or dword [ebp - 0x28], 0x20000
lea esi, [esi]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, str.HintWindow
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne bl
lea esi, [esi]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e4db0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4e4e48
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4e4e48
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.004e4d90
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004e4d90
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5f280e72
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x41d51094
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x30001450
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
cmp word [ecx], 0x5a4d
jne 0x3001de98
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x3001de98
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
or byte [ebx - 0xafdf40], al
adc eax, fcn.30001060
ret

Function at 0x30003e2c
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x30003e6a
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x3001de9b
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jae 0x3001de9b
pop edi
pop esi
pop ebx
ret
xor eax, eax
jmp 0x30003e66
and byte [eax - 1], dl

Function at 0x300081fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jle 0x3000822e

Function at 0x3003162f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor byte [ebp - 0x76aff3bb], cl
jne 0x30031643
call fcn.300283d7
int3
je 0x300316bd
popal
jb 0x300316ae
and byte [esi + 0x61], al
imul ebp, dword [ebp + esi*2 + 0x72], 0x25203a65
jae 0x30031676
sub ch, byte [edx]
sub cl, byte [edx]
add byte [eax + 0x90], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dl
mov ecx, 0x8b563004
invalid
je 0x30031686
cmp word [esi], ax
je 0x30031682
inc esi
inc esi
dec edx
jne 0x30031678
test edx, edx
jne 0x3003168b
mov eax, 0x80070057
test edi, edi
pop esi
je 0x3003169c
test eax, eax
jl 0x30031699
sub ecx, edx
mov dword [edi], ecx
ret
and dword [edi], 0
ret
adc byte [edx + edx - 0x75], dh
push ebp
or al, 0x8d
add al, 0x4f
mov dword [edx], eax
Function at 0x2a30e3b1
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a3549f2
call fcn.2a30266e
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30e4a2
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30e45b
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30e458
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30e41f
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30e482
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30e4d7
test di, di
jne 0x2a30e4d4
push esi
push dword [ebx + 0x18]
call fcn.2a34d2db
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30e4d7
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a34d2db
xor ecx, ecx
jmp 0x2a30e4d7
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30e55e
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a34d2db
mov edi, dword [0x2a36db18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36db04]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [str.Pv0]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [str.Pv0]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a34d2db
cmp dword [ebp - 0x14], 0
je 0x2a30e550
lea ecx, [ebp - 0x18]
call fcn.2a34d2db
test al, al
je 0x2a30e550
lea ecx, [ebp - 0x18]
call fcn.2a33f665
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a34d2db
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30e582
mov eax, dword [0x2a36d7bc]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [str.Pv0]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30e5b6
push eax
mov eax, dword [0x2a36dabc]
cmp word [ebx + 0x196], cx
je 0x2a30e5a0
mov esi, dword [eax + 0x124]
jmp 0x2a30e5a6
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [str.Pv0]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302b96
ret
Function at 0x2a32d61e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35670e
call fcn.2a3041d5
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32d83f
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a34d2db
add esp, 0x10
test eax, eax
js 0x2a32d839
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32d6c2
push edi
call fcn.2a32eb0c
pop ecx
test al, al
je 0x2a32d6c2
mov eax, edi
call fcn.2a3534e0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32d6d4
push edi
lea ecx, [ebp - 0x424]
call fcn.2a34d2db
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a34d2db
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32d839
push 0x60
push ebx
push eax
call fcn.2a32edc8
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32d72c
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32edc8
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32d72c
call fcn.2a32be19
mov ebx, eax
jmp 0x2a32d808
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32d753
call fcn.2a32be19
jmp 0x2a32d7fb
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32d749
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32d786
mov ebx, 0x8007000e
jmp 0x2a32d7fd
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a34d2db
jmp 0x2a32d7ac
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32d77f
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a34d2db
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a34d2db
mov ebx, eax
test edi, edi
je 0x2a32d808
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32d821
lea ecx, [ebp - 0x418]
call fcn.2a32c4ed
or dword [ebp - 4], 0xffffffff
jmp 0x2a32d831
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32d827
mov eax, ebx
jmp 0x2a32d86d
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32d854
lea ecx, [ebp - 0x418]
call fcn.2a32c4ed
or dword [ebp - 4], 0xffffffff
jmp 0x2a32d864
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32d85a
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30420f
ret 0x10
Function at 0x2a34d2db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x2a34d2ea
pop dword [ebp - 0x44]
mov eax, 0xa18aa078
add eax, 0x88aa3272
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xf98ea442
add dword [ebp - 0x54], 0x54c3a109
mov dword [ebp - 0x50], 0x4314d530
sub dword [ebp - 0x50], 0x10e188eb
mov dword [ebp - 0x4c], 0x3a82f4bf
sub dword [ebp - 0x4c], 0xee36b091
mov dword [ebp - 0x48], 0x2dc4990e
add dword [ebp - 0x48], 0xd23b66f2
lea eax, [ebp - 0x54]
push eax
mov eax, 0x876c6992
sub eax, 0x5d36c90e
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x369cf5cd
add dword [ebp - 0x54], 0x3dd57389
mov dword [ebp - 0x50], 0x2d030d9
sub dword [ebp - 0x50], 0xc163cf64
mov dword [ebp - 0x4c], 0xc80397cf
add dword [ebp - 0x4c], 0x9b6bd49d
mov dword [ebp - 0x48], 0xf3b59860
add dword [ebp - 0x48], 0xc4a67a0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x7819baba
add eax, 0xb21be5d2
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x49bf7
push 0
call eax
mov ecx, 0xab0ed3f4
add ecx, 0x54f17159
mov ebx, eax
mov edx, 0xb5e51afd
add edx, 0x7452fb03
add edx, dword [ebp - 0x44]
mov edi, 0x2511d9b1
mov dword [ebp - 0xc], 0xb0fac88d
mov esi, dword [edx]
sub dword [ebp - 0x38], edx
xor esi, edi
xor dword [ebp - 0x14], ebx
mov dword [ebx], esi
mov dword [ebp - 0x40], 0xdede2932
add ebx, 4
add edx, 4
loop 0x2a34d406
add eax, 0x3997db76
sub eax, 0x3996d36f
mov ebx, eax
add eax, 5
mov ecx, 0x25918880
sub ecx, 0xfb618880
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4876b8
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
push 0x487658
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x49e1e0], eax
cmp dword [0x49e1e0], 0
jne 0x4876e2
call fcn.0040e9e4
pop ebp
ret

Function at 0x4879d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404f54
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
jns 0x487a00
call fcn.004039cc
test eax, eax
je 0x487a28
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004050e8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x487a30
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x487a78
movzx esi, bx
sub esi, 0x30
jno 0x487a5d
call fcn.004039d4
add esi, 0x30
jno 0x487a67
call fcn.004039d4
cmp si, di
je 0x487a78
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x487a78
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x489b50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x489cc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49c908]
cmp byte [eax], 0
je 0x489ba6
mov eax, ebx
mov edx, dword [0x451f08]
call fcn.00403c20
test al, al
je 0x489bbf
mov eax, ebx
call fcn.0045d2a0
test al, al
je 0x489bbf
mov eax, ebx
call fcn.0045cf6c
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x489bbf
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004562f4
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00405104
jmp 0x489c9b
mov eax, ebx
mov edx, dword [0x451f08]
call fcn.00403c20
test al, al
jne 0x489c14
xor edx, edx
mov eax, ebx
call fcn.00489a64
mov edi, eax
test edi, edi
jne 0x489bf8
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004562f4
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00405104
jmp 0x489c9b
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004562f4
mov edx, dword [ebp - 0xc]
mov ecx, esi
lea eax, [edi + 0x38]
call fcn.0048350c
jmp 0x489c9b
mov edi, ebx
mov eax, edi
call fcn.0045d2a0
test al, al
jne 0x489c44
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.004562f4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00405104
mov edx, dword [ebp - 0x10]
mov ecx, esi
mov eax, ebx
call fcn.00489ab8
jmp 0x489c9b
mov eax, edi
call fcn.0045cf6c
push eax
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
add edx, 1
jno 0x489c5d
call fcn.004039d4
mov eax, esi
call fcn.004054f4
mov eax, dword [esi]
call fcn.00405190
push eax
mov eax, dword [esi]
call fcn.00405180
push eax
mov eax, edi
call fcn.0045cf6c
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [esi]
call fcn.00405190
mov edx, eax
sub edx, 1
jno 0x489c94
call fcn.004039d4
mov eax, esi
call fcn.004054f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489ccd
lea eax, [ebp - 0x14]
call fcn.00404848
lea eax, [ebp - 0x10]
call fcn.00404f54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040486c
ret
Function at 0x4919bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4919ce
add esp, 0xfffffff0
call fcn.00403df8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0044df04
test byte [ebx + 0x1c], 0x10
jne 0x491afb
xor ecx, ecx
mov dl, 1
mov eax, dword [0x490ea0]
call fcn.0046f75c
mov esi, eax
mov dword [ebx + 0x298], esi
mov eax, esi
xor edx, edx
call fcn.00455a58
mov eax, dword [ebx + 0x298]
xor edx, edx
call fcn.00455a34
mov eax, dword [ebx + 0x298]
mov edx, 0xffffff
call fcn.0045649c
mov eax, dword [ebx + 0x298]
mov dl, 1
call fcn.004705a0
push 0
mov eax, dword [ebx + 0x298]
call fcn.0045cf6c
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, dword [0x424f08]
call fcn.0042ac60
mov esi, eax
mov dword [ebx + 0x29c], esi
mov eax, esi
mov ecx, 0x491bd0
mov edx, dword [0x49d668]
call fcn.0042b648
mov eax, dword [ebx + 0x29c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov dl, 1
mov eax, dword [0x424f08]
call fcn.0042ac60
mov esi, eax
mov dword [ebx + 0x2a0], esi
mov eax, esi
mov ecx, 0x491bec
mov edx, dword [0x49d668]
call fcn.0042b648
mov eax, dword [ebx + 0x2a0]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov dl, 1
mov eax, dword [0x424f08]
call fcn.0042ac60
mov esi, eax
mov dword [ebx + 0x2a4], esi
mov eax, esi
mov ecx, 0x491c08
mov edx, dword [0x49d668]
call fcn.0042b648
mov eax, dword [ebx + 0x2a4]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebx + 0x298]
mov edx, 0xf0
call fcn.00455a34
mov eax, dword [ebx + 0x298]
mov edx, 0x32
call fcn.00455a58
mov dword [ebx + 0x2b0], 0xf0
mov dword [ebx + 0x2b4], 0x3c
mov al, byte [0x491c14]
mov byte [ebx + 0x2cc], al
mov byte [ebx + 0x2c0], 1
mov dword [ebx + 0x2c4], 5
mov dword [ebx + 0x2c8], 0x800000
mov byte [ebx + 0x2cd], 1
mov byte [ebx + 0x2d1], 0
mov byte [ebx + 0x2ce], 1
mov byte [ebx + 0x2d0], 1
mov byte [ebx + 0x2cf], 1
xor eax, eax
mov dword [ebx + 0x2a8], eax
mov byte [ebx + 0x2ac], 0
mov dl, 3
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x118]
mov edx, 0x12
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + pe_nt_image_headers32]
mov edx, 0xc
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x108]
mov edx, 0xc8
mov eax, ebx
call fcn.00455a34
mov eax, dword [ebx + 0x68]
mov edx, 0xa
call fcn.00426154
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x491bc1
call fcn.00403e50
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x493254
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404cf8
xor eax, eax
push ebp
push 0x4932df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x4932f4
mov edx, dword [ebp - 4]
call fcn.00404b54
mov eax, dword [ebp - 0xc]
call fcn.00404d08
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b08
add eax, 2
jno 0x4932ab
call fcn.004039d4
test eax, eax
jns 0x4932b4
call fcn.004039cc
push eax
push ebx
mov eax, dword [0x49e25c]
push eax
call sub.KERNEL32.DLL_WriteFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4932e6
lea eax, [ebp - 0xc]
call fcn.00404848
lea eax, [ebp - 4]
call fcn.00404848
ret

Function at 0x495ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword [0x49cc24]
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x495c0a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00404848
mov eax, 0x101
call fcn.00408d60
mov ebx, eax
mov eax, dword [esi]
call fcn.00476ea0
push 0
push edi
push pe_nt_image_headers32
push ebx
mov eax, dword [0x49e250]
push eax
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [edi]
test eax, eax
jns 0x495b1f
call fcn.004039cc
mov byte [ebx + eax], 0
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404a40
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404b10
cmp dword [edi], 0x100
jae 0x495af9
jmp 0x495bb1
mov eax, dword [esi]
call fcn.00476ea0
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x495c20
call fcn.00404e4c
mov ecx, eax
sub ecx, 1
jno 0x495b66
call fcn.004039d4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d68
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x495c2c
call fcn.00404b54
mov eax, dword [ebp - 0x10]
call fcn.0049341c
mov edx, dword [ebp - 4]
mov eax, 0x495c20
call fcn.00404e4c
mov ecx, eax
add ecx, 1
jno 0x495ba4
call fcn.004039d4
lea eax, [ebp - 4]
mov edx, 1
call fcn.00404da8
mov edx, dword [ebp - 4]
mov eax, 0x495c20
call fcn.00404e4c
test eax, eax
jg 0x495b42
cmp dword [ebp - 4], 0
je 0x495be0
lea eax, [ebp - 0x18]
mov edx, 0x495c2c
mov ecx, dword [ebp - 4]
call fcn.00404b54
mov eax, dword [ebp - 0x18]
call fcn.0049341c
mov eax, ebx
call fcn.0040277c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c11
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040486c
lea eax, [ebp - 4]
call fcn.00404848
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4038fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408398]
jne 0x403906
repz ret
jmp fcn.00403dae

Function at 0x42e003
Capabilities:
Check for vm using instruction vpcext
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x713f4d0d
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x53d42ab7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4f943c11
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4bc12003
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219