joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.100ba4f0
mov eax, dword [0x101242d0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
movzx edx, byte [edi + 1]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
lea eax, [edi + 1]
movzx edx, byte [eax + 1]
mov dword [esp + 0x28], eax
inc eax
inc eax
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax]
inc eax
mov ebp, dword [esp + 0x40]
inc eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x2d], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x2c], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x20], edx
mov byte [esp + 0x30], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [esp + 0x44], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x100974e0
dec dword [esp + 0x18]
test esi, esi
jne 0x1009744c
mov ecx, dword [esp + 0x24]
push 1
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10053480
mov ebx, dword [esp + 0x28]
mov eax, ebx
shr eax, 8
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x39], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x3c], al
shr ecx, 8
shr edx, 0x10
shr eax, 0x18
add esp, 0xc
inc dword [esp + 0x10]
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], al
mov cl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor cl, byte [eax]
inc esi
mov byte [ebp], cl
inc eax
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
mov dword [esp + 0x3c], eax
jne 0x100973e8
cmp dword [esp + 0x10], 0
je 0x100974c7
mov eax, dword [esp + 0x28]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
inc eax
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
mov ecx, dword [esp + 0x20]
inc eax
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100b993a
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100b993a
add esp, 0x28
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b993a
add esp, 0x28
ret
Function at 0x1009e150
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x1009e169
mov esi, edi
mov edi, eax
jmp 0x1009e16b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1009e17b
mov eax, ebx
jmp 0x1009e185
push eax
push ebx
call fcn.10045a50
add esp, 8
test eax, eax
jne 0x1009e18d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x1009e1a9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x1009e194
cmp eax, dword [esi + 4]
jge 0x1009e1c0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x1009e1b0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x1009e1e1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1009e1de
dec eax
test eax, eax
jg 0x1009e1d0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100a63b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.100ba4f0
mov eax, dword [0x101242d0]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
mov ebx, dword [esp + 0x138]
push esi
mov esi, dword [esp + 0x158]
push edi
mov edi, dword [esp + 0x154]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], 1
call fcn.1004b690
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jge 0x100a6422
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100b993a
add esp, 0x130
ret
lea ecx, [esp + 0x28]
push ebp
push ecx
call fcn.100792f0
mov ebp, esi
mov esi, dword [esp + 0x160]
add esp, 4
mov eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jne 0x100a644c
mov dword [esp + 0x148], ebx
jmp 0x100a6472
cmp dword [esp + 0x148], 0xffffffff
jne 0x100a6472
mov eax, ebx
lea edx, [eax + 1]
jmp 0x100a6460
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100a6460
sub eax, edx
mov dword [esp + 0x148], eax
mov eax, esi
test esi, esi
jne 0x100a64a5
lea ecx, [esp + 0x2c]
push ecx
call fcn.10079390
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b993a
add esp, 0x130
ret
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
cmp eax, esi
jg 0x100a64af
mov esi, eax
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x18
push 0
mov byte [esp + 0x18], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x14c]
push edi
shr ecx, 0x10
push eax
mov byte [esp + 0x21], cl
lea ecx, [esp + 0x38]
shr edx, 8
push ebx
push ecx
mov byte [esp + 0x2a], dl
call fcn.10079030
add esp, 0x14
test eax, eax
je 0x100a65db
mov edx, dword [esp + 0x150]
mov eax, dword [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.10079230
add esp, 0xc
test eax, eax
je 0x100a65db
push 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.10079230
add esp, 0xc
test eax, eax
je 0x100a65db
push 0
lea ecx, [esp + 0x100]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.10079240
add esp, 0xc
test eax, eax
je 0x100a65db
push esi
lea eax, [esp + 0x100]
push eax
push ebp
call fcn.100b8d30
mov eax, dword [esp + 0x160]
add esp, 0xc
cmp eax, 1
jle 0x100a65be
dec eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push ebx
push edi
call fcn.10079400
add esp, 0x1c
test esi, esi
jle 0x100a65b7
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x100a65a8
mov edi, dword [esp + 0x24]
sub dword [esp + 0x1c], 1
jne 0x100a6573
mov eax, dword [esp + 0x10]
inc dword [esp + 0x18]
sub eax, esi
add ebp, esi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100a64a1
jmp 0x100a6476
lea eax, [esp + 0x2c]
push eax
call fcn.10079390
add esp, 4
xor eax, eax
jmp 0x100a6488
Function at 0x1012c750
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 4], 0x7e776a0e
push dword [esp]
lea esp, [esp + 8]
jmp fcn.100304bf

Function at 0x10136784
Capabilities:
Hash data using murmur3

Disassembly:
push 0x26f0e7ae
push dword [esp]
pushfd
mov dword [esp + 0x2c], 0x50ea2ebc
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0x38]
jmp fcn.100304bf

Function at 0x101771b9
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x40]
call fcn.10140d4c
sub di, 0xf829
btr di, bp
mov edi, eax
bt esp, ecx
cmp edi, 0xffffffff
call fcn.101860aa
mov ch, 0xcd
jge 0x10177248
inc eax
sbb eax, 0xf065461
cmp eax, 0x61039f83
stosb byte es:[edi], al
js 0x10177229
cli
adc ecx, ebp
sahf
pop esi
sahf
xchg byte [edi - 0x3d6aee1], bh
mov ebx, 0xa2c0fe49
dec esi
pop edx
int3
inc esp
bound esi, qword [eax + esi]
cmp eax, 0x88c259f3
popal
push eax
test al, 0x53
aad 0x11
clc
xor bh, dl
jnp 0x1017721f
sub byte [ecx], bh
fisttp qword [esi + 0x749d957e]
mov ah, 0xb5
jge 0x10177268
adc eax, dword [esi - 0x5a17cf27]
pushal
push ebp
call fcn.101d6d5f
adc edi, ebx
add eax, 0xc79c5300
push ebx
pushfd
mov dword [esp + 8], 0x5d36ae3e
mov ebp, 0xe168b20b
push ds
cmpsb byte [esi], byte es:[edi]
mov edi, 0xe4282444
add ch, bl
nop

Function at 0x1017c469
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 4], 0x912067ed
jmp 0x101e9e7f
mov dword [esp], 0x5cbf24a6
pushal
pushfd
pushfd
push dword [esp + 4]
lea esp, [esp + 0x2c]
jmp fcn.100304bf
jmp 0x101e6439

Function at 0x101cd8ed
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
pushal
mov dword [esp + 0x20], 0x90ee1d3b
jmp fcn.101d735e
jmp 0x1024e905
lea esp, [esp + 0xc]
jnp 0x100342ff
push 0x90ee1d3b
jnp 0x1017bfbe
push 0x6b6a9aff
pushfd
mov byte [esp], dh
lea esp, [esp + 4]
jmp fcn.100304bf
push esi
push 0x925ce628
mov dword [esp + 4], 0x6b6a9aff
push 0x3d9649c1
lea esp, [esp + 8]
jmp fcn.100304bf

Function at 0x10206ee1
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push dword [esp]
mov dword [esp + 0xc], 0x5529d0f6
push dword [esp]
pushal
lea esp, [esp + 0x30]
jmp fcn.100304bf

Function at 0x1020b345
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x10217117
pushfd
mov dword [esp + 0x24], 0xf66f5dd6
mov byte [esp + 0x10], dl
pushfd
lea esp, [esp + 0x28]
jmp fcn.100304bf

Function at 0x1020f79c
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 4], 0x43
mov dword [esp + 0x30], 0x321e9f21
pushfd
mov byte [esp], 0x33
push dword [esp]
lea esp, [esp + 0x38]
jmp fcn.100304bf

Function at 0x10232300
Capabilities:
Hash data using murmur3

Disassembly:
cmp dword [ebp + 8], 0
pushal
jmp 0x102527d1
xchg dword [esp + 0x24], esi
mov word [esp + 4], 0x5dde
movzx si, al
mov esi, ecx
call fcn.1021983e

Function at 0x1024c56c
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushal
mov dword [esp + 0x3c], 0x103002e0
mov byte [esp + 8], cl
pushfd
pushfd
lea esp, [esp + 0x44]
jmp loc.10031c9d
in eax, dx
inc ebx
out dx, al
and bl, byte [edx]
popal
pushal
jmp 0x1024c5da
sub al, 0x5f
jmp 0x10210415
Function at 0x10261184
Capabilities:
Hash data using murmur3

Disassembly:
pushal
mov dword [esp + 0x28], 0x6c5b8347
push ecx
lea esp, [esp + 0x2c]
jmp fcn.100304bf

Function at 0x1026893a
Capabilities:
Hash data using murmur3

Disassembly:
pushal
pushal
push 0x92d4b079
push dword [esp]
lea esp, [esp + 0x48]
jmp fcn.100304bf
call fcn.101fea0e
push ecx
shr dword [ebx + 0x1d31535b], cl
xchg ebp, eax
scasb al, byte es:[edi]
inc edx
js 0x102688e3
cld
bound ebx, qword [eax - 0x4c]
pop ebp
lahf
add ebx, dword [ecx + 0x5f]
mov esi, dword [ecx]
jmp 0xbdeb7108

Function at 0x10290f29
Capabilities:
Hash data using murmur3

Disassembly:
pushal
mov dword [esp + 0x28], 0x1d92ce4d
pushfd
mov byte [esp], 0x6c

Function at 0x1029a447
Capabilities:
Check for software breakpoints

Disassembly:
lea esp, [esp + 8]
je 0x1029a457
test bl, 0x5b
cmp ah, 0x2e
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x60713566
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7e414a0a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4f2e1c1a
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2aa06857
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
mov ecx, 0x7e57564
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4fc12e34
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430006
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5d4d055d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5af975b7
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x405e90
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x405ece
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x405ec6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x405ed0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x405eb6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x405fb0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x405fe1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x405fe1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x405fe1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx + 0x3c]
push ebx
push esi
mov dword [ebp - 0xc], edx
xor esi, esi
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
mov dword [ebp - 4], ecx
push edi
mov edx, dword [eax + 0x18]
mov ebx, dword [eax + 0x1c]
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ebx
test edx, edx
je 0x40106c
add edi, ecx
lea ebx, [eax + ecx]
movzx eax, word [ebx]
mov edx, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
lea eax, [edx + eax*4]
add eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
add eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x401075
mov ecx, dword [ebp - 4]
inc esi
add ebx, 2
add edi, 4
cmp esi, dword [ebp - 0x10]
jb 0x401035
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov eax, dword [eax]
add eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x402100]
xor ecx, ecx
movq xmm0, qword [str.AlpAoflftU]
mov dword [ebp - 0xc], eax
mov al, byte [0x402104]
mov byte [ebp - 8], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], str.user32.dll
movq qword [ebp - 0x14], xmm0
nop dword [eax]
test cl, 1
jne 0x4010da
xor byte [eax], 0xd
jmp 0x4010dd
xor byte [eax], 0x14
inc ecx
inc eax
cmp ecx, 0xb
jle 0x4010d0
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call section..text
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x20]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040116b
mov esp, ebp
pop ebp
ret
Function at 0x415554
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430618]
jne 0x41555e
repz ret
jmp fcn.0041bf6a

Function at 0x4246ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041b7a2
and dword [ebp - 0x14], 0
cmp dword [0x468b00], 0
mov dword [ebp - 0x18], eax
jne 0x42475f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x424807
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x424807
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x468b00], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x468b04], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x468b08], eax
call edi
push eax
call esi
mov dword [0x468b10], eax
test eax, eax
je 0x42475f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x468b0c], eax
mov eax, dword [0x468b0c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4247b8
cmp dword [0x468b10], ecx
je 0x4247b8
push eax
call esi
push dword [0x468b10]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4247b8
test ebx, ebx
je 0x4247b8
call edi
test eax, eax
je 0x4247af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4247af
test byte [ebp - 8], 1
jne 0x4247b8
or dword [ebp + 0x10], 0x200000
jmp 0x4247eb
mov eax, dword [0x468b04]
cmp eax, dword [ebp - 0x18]
je 0x4247eb
push eax
call esi
test eax, eax
je 0x4247eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4247eb
mov eax, dword [0x468b08]
cmp eax, dword [ebp - 0x18]
je 0x4247eb
push eax
call esi
test eax, eax
je 0x4247eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x468b00]
call esi
test eax, eax
je 0x424807
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x424809
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415554
leave
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10014cb2
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10014d0a
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10014cee
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10014d08
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017262
and dword [eax], 0
jmp 0x10014ce3
jmp 0x10014d2a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10014d2a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret