joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000760a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x100b8398]
add ecx, 0xfffffa75
mov dword [0x100b8398], ecx
mov dword [0x100b839c], 0x1cb0
mov dword [ebp - 0x10], eax
call fcn.10007eee
xor ecx, ecx
mov edx, eax
mov dword [0x100b8398], 0x1dce
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x100b839c], 0x1680
cmp dword [eax + esi], 0x4550
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
je 0x10007739
jmp 0x100076f5
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x100076d7
jmp 0x10007794
mov eax, dword [ebp - 0x24]
add eax, 1
mov cl, byte [ebp - 0x25]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x1d]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x2c], eax
jne 0x10007762
jmp 0x10007674
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x38]
mov edi, dword [esi + eax*4]
mov dword [0x100b839c], 0x1cb0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], edx
jmp 0x10007762
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x48]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x4c], edi
jmp 0x100077bc
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [0x100b839c], 0x29c
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x18]
add edx, dword [edx + eax + 0x20]
mov dword [0x100b8398], 0x8f7
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + eax + 0x18]
cmp edi, 0
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x4c], ecx
je 0x100077bc
jmp 0x1000774b
mov dword [0x100b8398], 0x2594
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jmp 0x100076f5
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jmp 0x100076ae
mov eax, dword [ebp - 0x2c]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], bh
mov byte [ebp - 0x1d], cl
je 0x10007674
jmp 0x10007680
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x50]
cmp edx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x4c], eax
jb 0x100076ae
mov eax, dword [ebp - 0x4c]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007810
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x100b83a4], 0
mov byte [0x100b83a8], 0
mov dword [0x100b839c], 0x231
mov dword [0x100b8398], 0x1c2f
mov dword [0x100b83a0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10007869
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov dword [0x100b839c], 0x704
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x100b8398], 0x1390
mov eax, dword [0x100b83a0]
add eax, 1
mov dword [0x100b83a0], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007869
xor eax, eax
mov dword [0x100b8398], 0x1898
mov dword [0x100b83a0], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x100b83ac], 0
mov dword [0x100b8398], 0xa82
mov edx, dword [0x100b83a4]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x100b83ac], edi
mov dword [0x100b8398], 0xfffff4b5
mov eax, edi
cdq
idiv ecx
mov dword [0x100b83a4], edx
mov dword [0x100b839c], 0xedf
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x100b83a8], cl
mov dword [0x100b8398], 0x140
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x100b83a8]
mov edx, dword [0x100b83a4]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x100b83a0]
add edx, 1
mov dword [0x100b83a0], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x100078bc
jmp 0x10007861
Function at 0x1000797c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x100b83a0], 0
mov dword [0x100b83a4], 0
mov dword [0x100b83b0], 0
mov dword [0x100b8398], 0x1e35
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
je 0x10007ae5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, eax
add edi, 1
mov dword [0x100b8398], 0x1238
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x100b83a0], edx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100b83a4], edx
mov dword [0x100b839c], 0x269b
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x100b83a8], cl
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov edx, dword [0x100b8398]
add edx, 0x4e1
mov dword [0x100b8398], edx
mov cl, byte [0x100b83a8]
mov edx, dword [0x100b83a4]
mov byte [ebx + edx], cl
mov edx, dword [0x100b83a0]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x100b83a4]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x100b83b0], ecx
mov dword [0x100b839c], 0x193
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
xor cl, byte [edx + esi]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov dword [0x100b8398], 0x880
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x38], edi
je 0x10007ae5
mov eax, dword [0x100b83a0]
mov ecx, dword [0x100b83a4]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x100079e3
mov dword [0x100b8398], 0x44e
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007c3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x100b8398], 0x1a7a
mov dword [0x100b839c], 0x8b0
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, ecx, 0xb4
mov edi, edx
add edi, esi
add edi, 0xac
mov esi, ecx
add esi, 1
imul ecx, ecx, 0xb4
add edx, ecx
add edx, 0xb0
mov ecx, dword [edx]
movzx edx, word [edi]
xor edx, ecx
add edx, eax
cmp esi, 0x405
mov eax, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x138], eax
jne 0x10007c75
mov dword [0x100b8398], 0xfffffa04
xor eax, eax
mov dword [ebp - 0x140], eax
jmp 0x10007ce6
mov eax, dword [ebp - 0x140]
mov cl, byte [eax + 0x1008a0d0]
mov dl, byte [eax + 0x1008a0a1]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x140], eax
jne 0x10007ce6
lea eax, [ebp - 0x12c]
mov dword [0x100b839c], 0x1e8b
mov dword [0x100b8398], 0x1731
mov dword [ebp - 0x144], eax
call fcn.10008322
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.1000717b
mov ecx, eax
mov dword [0x100b83b4], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
mov dword [ebp - 0x148], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], eax
jmp 0x10007d8f
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
mov esi, ecx
add esi, 1
imul edi, ecx, 0xb4
mov ebx, edx
add ebx, edi
add ebx, 0xb0
imul edi, ecx, 0xb4
mov dword [ebp - 0x154], eax
mov eax, edx
add eax, edi
add eax, 0xa8
imul ecx, ecx, 0xb4
add edx, ecx
add edx, 0xac
mov ecx, dword [ebp - 0x148]
mov edi, dword [ebp - 0x154]
add ecx, edi
mov ebx, dword [ebx]
mov eax, dword [eax]
movzx edx, word [edx]
xor edx, ebx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x15c], esi
call fcn.10006db4
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
add eax, ecx
mov edx, dword [ebp - 0x15c]
cmp edx, 0x405
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], eax
jne 0x10007d8f
lea eax, [0x1008a0af]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x100b8398], 0x1190
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.10007810
mov dword [0x100b839c], 0x1b7b
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.1000797c
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x3061b
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x13a400
mov ecx, dword [ebp - 0x148]
add ecx, 0x2c520
mov dword [edx + 8], ecx
mov dword [0x100b8398], 0x1b93
mov dword [edx + 0xc], 0x1fc0
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008147
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x100b8398], 0x8f3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov eax, 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 0
sete dl
mov esi, dword [ebp - 0x10]
cmp esi, 0
sete dh
and dl, dh
test dl, 1
mov dword [ebp - 0x18], eax
jne 0x10008317
jmp 0x1000825f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
add ecx, 1
mov edx, dword [ebp - 0x20]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov word [ebp - 0x2a], si
mov word [ebp - 0x2c], bx
jb 0x100081d5
mov ax, word [ebp - 0x2a]
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x30]
cmp esi, edi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x31], bl
mov dword [ebp - 0x1c], esi
jne 0x10008196
jmp 0x10008246
mov eax, dword [ebp - 0x38]
mov cx, word [eax + 0x24]
mov edx, dword [eax + 0x28]
mov dword [0x100b8398], 0x16a6
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x39]
and bh, bl
test bh, 1
mov word [ebp - 0x3c], cx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x40], esi
jne 0x100082c9
jmp 0x100082d6
mov al, byte [ebp - 0x31]
test al, 1
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], edx
jne 0x10008317
jmp 0x100082b0
mov dword [0x100b8398], 0x2494
mov dword [0x100b839c], 0x19da
mov ecx, dword fs:[0x18]
mov dword [0x100b8398], 0x1c42
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [0x100b8398], 0x1840
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
setne dl
mov esi, eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x39], dl
mov dword [ebp - 0x44], esi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x48]
cmp eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
je 0x10008317
jmp 0x1000820a
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x10008317
xor eax, eax
mov dword [0x100b8398], 0x1380
mov ecx, dword [0x100b839c]
add ecx, 0xf05
mov dword [0x100b839c], ecx
mov dx, word [ebp - 0x3c]
shr dx, 1
movzx ecx, dx
cmp dx, 0
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], esi
je 0x100082b0
jmp 0x10008196
mov eax, dword [ebp - 0x18]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405d7e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1244], 0
push esi
jne 0x405db5
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d8f
mov dword [ecx*4 + 0x7a1240], eax
inc ecx
cmp ecx, 0x100
jl 0x405d8a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405de6
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1240]
xor eax, esi
inc ecx
dec edx
jne 0x405dc8
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41fd66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a4a0]
jne 0x41fd70
repz ret
jmp fcn.004263ca

Function at 0x42eb0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a4a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00425ca2
and dword [ebp - 0x14], 0
cmp dword [0x468898], 0
mov dword [ebp - 0x18], eax
jne 0x42ebbf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42ec67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x42ec67
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x468898], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46889c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4688a0], eax
call edi
push eax
call esi
mov dword [0x4688a8], eax
test eax, eax
je 0x42ebbf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4688a4], eax
mov eax, dword [0x4688a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42ec18
cmp dword [0x4688a8], ecx
je 0x42ec18
push eax
call esi
push dword [0x4688a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42ec18
test ebx, ebx
je 0x42ec18
call edi
test eax, eax
je 0x42ec0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42ec0f
test byte [ebp - 8], 1
jne 0x42ec18
or dword [ebp + 0x10], 0x200000
jmp 0x42ec4b
mov eax, dword [0x46889c]
cmp eax, dword [ebp - 0x18]
je 0x42ec4b
push eax
call esi
test eax, eax
je 0x42ec4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42ec4b
mov eax, dword [0x4688a0]
cmp eax, dword [ebp - 0x18]
je 0x42ec4b
push eax
call esi
test eax, eax
je 0x42ec4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x468898]
call esi
test eax, eax
je 0x42ec67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42ec69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fd66
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x39b97963
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x4d1c0d07
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0xe08444
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe0844e
pushal
call 0xe08454
pop ebp
sub ebp, 0x10
sub ebp, 0xa08444
jmp 0xe0846a
mov eax, 0xa08444
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x2692eecb
xor byte [eax], dl
inc eax
dec ecx
jne 0xe08481
jmp 0xe08494
inc eax
push es
inc eax
inc edx
test ebx, 0xa4acbcb
xor ecx, ebx
retf
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 4
push esp
push 0x40
mov eax, 0x4082a8
sub eax, fcn.00401000
push eax
push fcn.00401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
ret

Function at 0x411a8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449354]
jne 0x411a95
repz ret
jmp fcn.00416e23

Function at 0x4148db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x449354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041004a
and dword [ebp - 0x14], 0
cmp dword [0x44b298], 0
mov dword [ebp - 0x18], eax
jne 0x41498e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414a36
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x414a36
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44b298], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44b29c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44b2a0], eax
call edi
push eax
call esi
mov dword [0x44b2a8], eax
test eax, eax
je 0x41498e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44b2a4], eax
mov eax, dword [0x44b2a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4149e7
cmp dword [0x44b2a8], ecx
je 0x4149e7
push eax
call esi
push dword [0x44b2a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4149e7
test ebx, ebx
je 0x4149e7
call edi
test eax, eax
je 0x4149de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4149de
test byte [ebp - 8], 1
jne 0x4149e7
or dword [ebp + 0x10], 0x200000
jmp 0x414a1a
mov eax, dword [0x44b29c]
cmp eax, dword [ebp - 0x18]
je 0x414a1a
push eax
call esi
test eax, eax
je 0x414a1a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414a1a
mov eax, dword [0x44b2a0]
cmp eax, dword [ebp - 0x18]
je 0x414a1a
push eax
call esi
test eax, eax
je 0x414a1a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44b298]
call esi
test eax, eax
je 0x414a36
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x414a38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411a8b
leave
ret
Function at 0x418f20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x54
push ebx
mov ebx, dword [esp + 0x5c]
push esi
push 0x444234
push eax
call fcn.00409240
mov esi, eax
add esp, 8
test esi, esi
jne 0x418f43
pop esi
pop ebx
add esp, 0x54
ret
push 0
push 0xc
push esi
call fcn.0040a239
add esp, 0xc
mov dword [esp + 8], 0x10
push edi
lea esp, [esp]
push esi
push 1
lea ecx, [esp + 0x24]
push 8
push ecx
call fcn.00409c38
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, 0x61746164
je 0x418fe9
cmp eax, 0x20746d66
jne 0x418fb7
push esi
push 1
lea edx, [esp + 0x30]
push 0x10
push edx
call fcn.00409c38
add esp, 0x10
cmp edi, 0x10
jbe 0x418fd1
add edi, 0xfffffff1
push 1
and edi, 0xfffffffe
push edi
push esi
call fcn.0040a239
add esp, 0xc
jmp 0x418fd1
inc edi
push 1
and edi, 0xfffffffe
push edi
push esi
call fcn.0040a239
push esi
call fcn.0040b1c2
add esp, 0x10
test eax, eax
jne 0x418fd7
dec dword [esp + 0xc]
jne 0x418f60
push esi
call fcn.0040a322
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x54
ret
mov ecx, dword [esp + 0x68]
xor eax, eax
push 0
lea edx, [esp + 0x2c]
mov dword [esp + 0x50], edx
mov word [esp + 0x3c], ax
mov dword [esp + 0x4c], eax
mov eax, dword [0x47da94]
push ebx
lea edx, [esp + 0x44]
mov dword [esp + 0x44], 0x24
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x418fd7
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x28]
push edx
push edi
push 0
push eax
mov eax, dword [ecx + 0x2c]
call eax
cmp eax, 0x88780096
je 0x418fd7
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41906c
mov ecx, dword [esp + 0x10]
push esi
push 1
push ecx
push eax
call fcn.00409c38
add esp, 0x10
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x419089
mov edx, dword [esp + 0xc]
push esi
push 1
push edx
push ecx
call fcn.00409c38
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov edi, dword [esp + 0xc]
mov eax, dword [ebx]
mov edx, dword [eax]
mov edx, dword [edx + 0x4c]
push edi
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push eax
call edx
push esi
call fcn.0040a322
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x54
ret
Function at 0x41d230
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, 0x4ffb40
mov ecx, dword [esi]
mov dl, byte [ecx]
mov eax, ecx
test dl, dl
je 0x41d24d
movzx edx, dl
lea eax, [eax + edx*4]
mov dl, byte [eax]
test dl, dl
jne 0x41d241
movzx edx, byte [eax + 2]
movzx ebx, byte [eax + 1]
sub edx, ebx
lea edx, [edx*4 + 8]
push edi
sub edx, ecx
push 1
add edx, eax
push edx
push ecx
call fcn.0040ae5d
add esi, 4
add esp, 0x10
cmp esi, 0x5ffb40
jl 0x41d237
push edi
call fcn.0040a322
add esp, 4
pop esi
mov eax, 1
pop ebx
ret

Function at 0x41d950
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 8]
fld1
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fdivrp st(1)
push 0x475590
fstp dword [0x475378]
call esi
lea ecx, [esp + 8]
push ecx
call esi
mov edx, dword [esp + 8]
sub edx, dword [0x475590]
mov eax, dword [esp + 0xc]
sbb eax, dword [0x475594]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
fild qword [esp + 8]
pop esi
fmul dword [0x475378]
fstp dword [0x17c2de8]
fldz
fstp dword [0x17c2d40]
add esp, 0x10
ret