joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a147
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0
push 0x451b2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x422886
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00401590
mov dword [ebp - 4], 0
push str.SpOrder.dll
lea ecx, [ebp - 0x230]
call fcn.00401a00
lea ecx, [ebp - 0x230]
call fcn.00402940
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x4227ec
push 0x451b50
lea ecx, [ebp - 0x248]
call fcn.00401590
mov byte [ebp - 4], 1
push 1
lea edx, [ebp - 0x230]
push edx
push 0x65
lea eax, [ebp - 0x248]
push eax
call fcn.00401040
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004016b0
lea ecx, [ebp - 0x230]
call fcn.00402940
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x422874
push str.Failed_to_load_SpOrder.dll__n
call fcn.00421c70
add esp, 4
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x422867
push str.Failed_to_load_ws2_32.dll__n
call fcn.00421c70
add esp, 4
mov dword [ebp - 0x258], 0x2726
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004016b0
mov eax, dword [ebp - 0x258]
jmp 0x4228e2
push str.Trying_to_use_ws2_32.dll_instead_of_sporder_n
call fcn.00421be0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004016b0
push 0x451bd0
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x4228bb
push str.Failed_to_use__GetProcAddress__n
call fcn.00421c70
add esp, 4
mov eax, 0x2726
jmp 0x4228e2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x250]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e9cd
mov esp, ebp
pop ebp
ret
Function at 0x422900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10010
call fcn.00431b20
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00423a90
push 0x451df0
mov eax, dword [ebp + 8]
push eax
call fcn.0042f048
add esp, 8
mov dword [ebp - 0x10008], eax
cmp dword [ebp - 0x10008], 0
jne 0x422940
xor eax, eax
jmp 0x4229ba
mov dword [ebp - 0x1000c], 0
mov ecx, dword [ebp - 0x10008]
push ecx
call fcn.0042ee65
add esp, 4
test eax, eax
jne 0x4229a5
mov edx, dword [ebp - 0x10008]
push edx
push 0xffff
push 1
lea eax, [ebp - 0x10004]
push eax
call fcn.0043279f
add esp, 0x10
mov dword [ebp - 0x10010], eax
lea ecx, [ebp - 0x1000c]
push ecx
mov edx, dword [ebp - 0x10010]
push edx
lea eax, [ebp - 0x10004]
push eax
call fcn.00423b60
add esp, 0xc
mov dword [ebp - 0x1000c], eax
jmp 0x42294a
mov ecx, dword [ebp - 0x10008]
push ecx
call fcn.0042d95d
add esp, 4
mov eax, dword [ebp - 0x1000c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e9cd
mov esp, ebp
pop ebp
ret

Function at 0x423160
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x423211
push str._SYSTEMROOT__system32
push 0x105
lea ecx, [ebp - 0x214]
push ecx
call fcn.00424100
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jge 0x4231d6
mov edx, dword [ebp - 0x21c]
push edx
push str.LoadUpdateProviderFunctions:_StringCchCopyA_failed:_0x_x_n
call fcn.00421c70
add esp, 8
jmp 0x4232a8
push 0x105
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x423211
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadUpdateProviderFunctions:_Unable_to_expand_environment_string:__d_n
call fcn.00421c70
add esp, 8
jmp 0x4232a8
push 0x451a54
push 0x105
lea edx, [ebp - 0x10c]
push edx
call fcn.004240b0
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jge 0x42324e
mov eax, dword [ebp - 0x21c]
push eax
push str.LoadUpdateProviderFunctions:_StringCchCatA_failed:_0x_x_n
call fcn.00421c70
add esp, 8
jmp 0x4232a8
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x423289
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x10c]
push edx
push str.LoadUpdateProviderFunctions:_Unable_to_load__s:__d_n
call fcn.00421c70
add esp, 0xc
jmp 0x4232a8
push str.WSCUpdateProvider
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x460bb0], eax
mov eax, dword [ebp - 0x218]
jmp 0x4232ca
cmp dword [ebp - 0x218], 0
je 0x4232c8
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x218], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e9cd
mov esp, ebp
pop ebp
ret
Function at 0x423770
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a1fe
mov eax, dword fs:[0]
push eax
mov eax, 0xc4a4
call fcn.00431b20
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45f2fc], 0
jne 0x4237ad
jmp 0x423a0c
mov eax, dword [str.RegisterLsp.log]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x451c24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [0x451c28]
mov dword [ebp - 0x18], edx
mov eax, dword [0x451c2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x461578]
and ecx, 1
jne 0x42380e
mov edx, dword [0x461578]
or edx, 1
mov dword [0x461578], edx
mov dword [ebp - 4], 0
mov ecx, 0x461560
call fcn.00404ec0
push 0x44b5f0
call fcn.0042d8dc
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x461560
call fcn.00403680
test eax, eax
jne 0x42384d
lea eax, [ebp - 0x124]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x124]
push ecx
mov ecx, 0x461560
call fcn.0040e2f0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x461560
call fcn.0040e7b0
push 0x451c30
mov ecx, 0x461560
call fcn.004056c0
push eax
call fcn.0042f048
add esp, 8
mov dword [ebp - 0xc4a8], eax
cmp dword [ebp - 0xc4a8], 0
je 0x423953
push 2
push 0
mov eax, dword [ebp - 0xc4a8]
push eax
call fcn.004328da
add esp, 0xc
mov ecx, dword [ebp - 0xc4a8]
push ecx
call fcn.00432cb2
add esp, 4
cmp eax, 0xf4240
jle 0x423944
push 2
push 0xc350
mov edx, dword [ebp - 0xc4a8]
push edx
call fcn.004328da
add esp, 0xc
mov eax, dword [ebp - 0xc4a8]
push eax
push 0xc350
push 1
lea ecx, [ebp - 0xc474]
push ecx
call fcn.0043279f
add esp, 0x10
mov dword [ebp - 0xc4b0], eax
mov edx, dword [ebp - 0xc4a8]
push edx
call fcn.0042d95d
add esp, 4
push 0x451c34
mov ecx, 0x461560
call fcn.004056c0
push eax
call fcn.0042f048
add esp, 8
mov dword [ebp - 0xc4a8], eax
cmp dword [ebp - 0xc4a8], 0
je 0x423942
mov eax, dword [ebp - 0xc4a8]
push eax
mov ecx, dword [ebp - 0xc4b0]
push ecx
push 1
lea edx, [ebp - 0xc474]
push edx
call fcn.0042db2b
add esp, 0x10
mov eax, dword [ebp - 0xc4a8]
push eax
call fcn.0042d95d
add esp, 4
jmp 0x423953
mov ecx, dword [ebp - 0xc4a8]
push ecx
call fcn.0042d95d
add esp, 4
push 0x451c38
mov ecx, 0x461560
call fcn.004056c0
push eax
call fcn.0042f048
add esp, 8
mov dword [ebp - 0xc4a8], eax
cmp dword [ebp - 0xc4a8], 0
je 0x423a0c
lea ecx, [ebp - 0xc48c]
call fcn.00404ec0
mov dword [ebp - 4], 1
push str._s____s
lea ecx, [ebp - 0xc48c]
call fcn.0040e2f0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xc4a4]
push eax
call fcn.004235e0
add esp, 4
mov dword [ebp - 0xc4ac], eax
mov ecx, dword [ebp - 0xc4ac]
call fcn.004056c0
push eax
lea ecx, [ebp - 0xc48c]
call fcn.004056c0
push eax
mov ecx, dword [ebp - 0xc4a8]
push ecx
call fcn.004322d1
add esp, 0x10
lea ecx, [ebp - 0xc4a4]
call fcn.00405000
mov edx, dword [ebp - 0xc4a8]
push edx
call fcn.0042d95d
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc48c]
call fcn.00405000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e9cd
mov esp, ebp
pop ebp
ret
Function at 0x423a90
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x4c11db7
mov dword [ebp - 4], 0
jmp 0x423aaf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xff
jg 0x423b4f
push 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00423a30
add esp, 8
shl eax, 0x18
mov edx, dword [ebp - 4]
mov dword [edx*4 + 0x461150], eax
mov dword [ebp - 8], 0
jmp 0x423ae9
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x423b2b
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x461150]
and edx, 0x80000000
je 0x423b09
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x423b10
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x461150]
shl edx, 1
xor edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x461150], edx
jmp 0x423ae0
push 0x20
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x461150]
push edx
call fcn.00423a30
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x461150], eax
jmp 0x423aa6
mov esp, ebp
pop ebp
ret
Function at 0x424720
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x45f300], 0xf
je 0x424746
mov eax, dword [0x45f300]
jmp 0x424938
mov dword [ebp - 0xa4], 0xd
push 0x9c
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00430db0
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x4247b1
mov dword [ebp - 0xa0], 0x94
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4247b1
mov eax, 0xe
jmp 0x424938
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
je 0x4248d2
cmp dword [ebp - 0xa8], 2
je 0x4247d8
jmp 0x424926
cmp dword [ebp - 0x9c], 4
ja 0x4247eb
mov dword [ebp - 0xa4], 3
cmp dword [ebp - 0x9c], 5
jne 0x424807
cmp dword [ebp - 0x98], 0
jne 0x424807
mov dword [ebp - 0xa4], 4
cmp dword [ebp - 0x9c], 5
jne 0x424823
cmp dword [ebp - 0x98], 1
jne 0x424823
mov dword [ebp - 0xa4], 5
cmp dword [ebp - 0x9c], 5
jne 0x424854
cmp dword [ebp - 0x98], 2
jne 0x424854
movzx ecx, byte [ebp - 6]
cmp ecx, 1
jne 0x42484a
mov dword [ebp - 0xa4], 5
jmp 0x424854
mov dword [ebp - 0xa4], 6
cmp dword [ebp - 0x9c], 6
jne 0x4248d0
cmp dword [ebp - 0x98], 2
jne 0x424887
movzx edx, byte [ebp - 6]
cmp edx, 1
jne 0x42487b
mov dword [ebp - 0xa4], 0xb
jmp 0x424885
mov dword [ebp - 0xa4], 0xc
jmp 0x4248d0
cmp dword [ebp - 0x98], 1
jne 0x4248b1
movzx eax, byte [ebp - 6]
cmp eax, 1
jne 0x4248a5
mov dword [ebp - 0xa4], 0xa
jmp 0x4248af
mov dword [ebp - 0xa4], 9
jmp 0x4248d0
movzx ecx, byte [ebp - 6]
cmp ecx, 1
jne 0x4248c6
mov dword [ebp - 0xa4], 7
jmp 0x4248d0
mov dword [ebp - 0xa4], 8
jmp 0x424926
cmp dword [ebp - 0x9c], 4
jne 0x4248ee
cmp dword [ebp - 0x98], 0
jne 0x4248ee
mov dword [ebp - 0xa4], 0
cmp dword [ebp - 0x9c], 4
jne 0x42490a
cmp dword [ebp - 0x98], 0xa
jne 0x42490a
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0x9c], 4
jne 0x424926
cmp dword [ebp - 0x98], 0x5a
jne 0x424926
mov dword [ebp - 0xa4], 2
mov edx, dword [ebp - 0xa4]
mov dword [0x45f300], edx
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e9cd
mov esp, ebp
pop ebp
ret

Function at 0x424bf0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c8f0
push 0x432ea0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x45f758]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x424c70
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424c90
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c8b0
push 0x432ea0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x45f758]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
push ebx
mov ebx, 0
mov eax, 1
invalid
Function at 0x427180
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], 0
push 1
push 0x452ed8
call fcn.00427460
add esp, 8
push 0x452eec
mov ecx, dword [ebp + 8]
call fcn.004056c0
push eax
call fcn.00430e79
add esp, 8
test eax, eax
jne 0x4271c6
mov dword [ebp - 0x10], connect
jmp 0x4271cd
mov dword [ebp - 0x10], reloc.OLEAUT32.dll_SysReAllocString
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
call fcn.004056c0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427268
mov ecx, dword [ebp + 0x10]
call fcn.004056c0
push eax
call fcn.00427400
add esp, 4
test eax, eax
je 0x427237
mov ecx, dword [ebp + 0x10]
call fcn.004056c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x427235
push 0
mov ecx, dword [ebp + 0x10]
call fcn.004056c0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
mov dword [ebp - 8], eax
jmp 0x42724f
push 0
mov ecx, dword [ebp + 0x10]
call fcn.004056c0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42725c
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x427298
mov ecx, dword [ebp + 0xc]
call fcn.004056c0
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00427530
add esp, 8
test eax, eax
jne 0x42728a
mov dword [ebp - 8], 2
jmp 0x427291
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push 0x452ef4
call fcn.00427460
add esp, 8
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x42bb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], ecx
call ebx
mov esi, eax
call edi
imul eax, esi
cdq
xor eax, edx
sub eax, edx
je 0x42bb26
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx + 8], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bb50
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44aee2
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xac], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov dword [ebp - 0xb0], edi
mov byte [edi], 0
cmp dword [esi + 0x14], 0x10
mov ebx, dword [esi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xa8], 0x10
jb 0x42bbcb
mov esi, dword [esi]
push 0xf0000020
push 1
push 0
push 0
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x42bcbd
lea eax, [ebp - 0xa0]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x42bcb4
push 0
push ebx
push esi
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x42bcab
push 0
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x9c]
push eax
push 2
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x42bc9d
xor esi, esi
jmp 0x42bc50
movzx eax, byte [ebp + esi - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push str._02x
push eax
call fcn.004318eb
add esp, 0xc
cmp byte [ebp - 0x1c], 0
jne 0x42bc74
xor ecx, ecx
jmp 0x42bc89
lea ecx, [ebp - 0x1c]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42bc80
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00410be0
inc esi
cmp esi, 0x10
jl 0x42bc50
jmp 0x42bccb
push str.Error_getting_hash_param
mov ecx, edi
call fcn.0040e2f0
jmp 0x42bccb
push 0x12
push str.Error_hashing_data
jmp 0x42bcc4
push 0x13
push str.Error_creating_hash
jmp 0x42bcc4
push 0x17
push str.Error_acquiring_context
mov ecx, edi
call fcn.004026d0
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e9cd
mov esp, ebp
pop ebp
ret
Function at 0x440cd6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45f758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004359c4
mov dword [ebp - 0x14], eax
cmp dword [0x462844], edi
jne 0x440dc7
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x440d54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x440ea7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x440ea7
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x440ea7
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x462844], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x462848], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x46284c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x462854], eax
test eax, eax
je 0x440dc4
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x462850], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x440dec
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x440ddf
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x440e01
push 4
pop eax
jmp 0x440ea9
cmp dword [ebp - 0x14], edi
je 0x440e01
push dword [0x462844]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x440de6
mov eax, dword [0x462850]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x440e5f
cmp dword [0x462854], esi
je 0x440e5f
push eax
call ebx
push dword [0x462854]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x440e5f
test eax, eax
je 0x440e5f
call ecx
test eax, eax
je 0x440e54
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x440e54
test byte [ebp - 8], 1
jne 0x440e5f
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x440e8f
mov eax, dword [0x462848]
cmp eax, esi
je 0x440e8c
push eax
call ebx
test eax, eax
je 0x440e8c
call eax
mov edi, eax
test edi, edi
je 0x440e8c
mov eax, dword [0x46284c]
cmp eax, esi
je 0x440e8c
push eax
call ebx
test eax, eax
je 0x440e8c
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x462844]
call ebx
test eax, eax
je 0x440ea7
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x440ea9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e9cd
leave
ret
Function at 0x4446c2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00437b12
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4446fa
xor eax, eax
jmp 0x444726
cmp esi, dword [ebp - 4]
je 0x444723
cmp dword [ebp + 0xc], 0
je 0x444723
push dword [edi + 0x9c]
call fcn.004442d0
push dword [edi + 0x9c]
mov esi, eax
call fcn.0042e9b4
pop ecx
pop ecx
cmp esi, eax
je 0x4446f6
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4819473b
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2fc602be
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219