joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013a0
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f845
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x418040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
call fcn.0040233e
mov dword [ebp - 0x24], eax
mov dword [eax], 0x401110
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x401530
push 0
push 0
call fcn.004055df
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4014cc
push 4
mov dword [ebp - 4], 1
call fcn.0040233e
mov dword [ebp - 0x24], eax
mov dword [eax], 0x401250
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x401530
push 0
push 0
call fcn.004055df
add esp, 0x1c
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4014f4
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 0
je 0x4014ed
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x4014e6
push 0
push ecx
push dword [ebp - 0x18]
call fcn.00402026
add esp, 0xc
test eax, eax
jne 0x4014df
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
cmp dword [ebp - 0x1c], eax
je 0x4014ed
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
je 0x4014e6
push 0
push ecx
push dword [ebp - 0x20]
call fcn.00402026
add esp, 0xc
test eax, eax
jne 0x4014df
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
cmp dword [ebp - 0x14], eax
jne 0x4014da
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402330
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call fcn.00401d69
call fcn.00405670
push 2
call fcn.00401d69
push 5
call fcn.00401d69
push 1
call fcn.00401d69
push 6
mov dword [ebp - 0x1c], 0
call fcn.00401d69
int3

Function at 0x402d63
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402da2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402da2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402da2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402da2
cmp dword [ecx + 0x74], 0xe
jbe 0x402da2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4079b6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412324
push 0x41231c
push str.FlsAlloc
push 0x1f
call fcn.00407835
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4079ea
push dword [ebp + 8]
mov ecx, esi
call dword [0x410158]
call esi
jmp 0x4079f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407a34
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412334
push 0x41232c
push str.FlsGetValue
push 0x21
call fcn.00407835
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407a6b
push dword [ebp + 8]
mov ecx, esi
call dword [0x410158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x407a73
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41233c
push 0x412334
push str.FlsSetValue
push 0x22
call fcn.00407835
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407aad
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x410158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x409b55
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409bf2
push ebx
push esi
call fcn.00409b1e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409ab2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x409b9f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409bf1
push edi
push eax
call fcn.004085ff
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409bbf
call fcn.0040709f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409bf0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409ab2
add esp, 0x20
test eax, eax
jne 0x409bde
push edi
call fcn.0040709f
jmp 0x409be6
push ebx
call fcn.0040709f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f400
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f42d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f42d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4044f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xed0d0e2c
jmp 0x40453e
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x471b4238
mov eax, dword [ebp - 0x14]
cmp eax, 0x471b4237
jg 0x404570
cmp eax, 0xed0d0e2c
jne 0x40453e
mov eax, 0x746b6ff7
cmp dword [ebp - 4], 0
je 0x40455f
mov eax, 0x5fc521b4
mov dword [ebp - 0x14], eax
jmp 0x40453e
cmp eax, 0x5fc521b4
je 0x404530
cmp eax, 0x746b6ff7
jne 0x40458e
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0x471b4238
jmp 0x40453e
cmp eax, 0x471b4238
jne 0x40453e
mov eax, dword [ebp - 8]
add esp, 0x1c
pop ebp
ret

Function at 0x4045a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8e4b07c6
jmp 0x4045e0
mov dword [ebp - 0x18], 0x6121342
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x18]
cmp eax, 0x369e07f4
jg 0x404610
cmp eax, 0x9d961db8
jg 0x404620
cmp eax, 0x8e4b07c6
jne 0x4045e0
mov eax, 0x168f2249
cmp dword [ebp - 8], 0
je 0x404608
mov eax, 0x9d961db9
mov dword [ebp - 0x18], eax
jmp 0x4045e0
cmp eax, 0x369e07f5
jne 0x4045e0
jmp 0x4045d1
cmp eax, 0xb3c2166d
jg 0x40463e
cmp eax, 0x9d961db9
jne 0x4045e0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x1c2aeb4a
jmp 0x4045e0
cmp eax, 0x6121341
jg 0x40464e
cmp eax, 0xb3c2166e
jne 0x4045e0
jmp 0x404698
cmp eax, 0x6121342
je 0x40466f
cmp eax, 0x168f2249
jne 0x404681
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0x1c2aeb4a
jmp 0x4045e0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0xb3c2166e
jmp 0x4045e0
cmp eax, 0x1c2aeb4a
jne 0x4045e0
mov dword [ebp - 0x18], 0x6121342
jmp 0x4045e0
mov eax, dword [ebp - 4]
add esp, 0x20
pop ebp
ret
Function at 0x405890
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x134
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.00404cb0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], 0x37a27640
lea esi, [ebp - 0x121]
jmp 0x4058f0
mov dword [ebp - 0x12c], 0x84b694cb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x12c]
cmp eax, 0xee7032ef
jg 0x405910
cmp eax, 0x84b694cb
jne 0x4058f0
mov dword [ebp - 0x12c], 0xee7032f0
jmp 0x4058f0
cmp eax, 0x599960fe
jg 0x405940
cmp eax, 0x37a2763f
jg 0x405949
cmp eax, 0xfb451de5
je 0x40596b
cmp eax, 0x261f6ce6
je 0x4058db
cmp eax, 0xee7032f0
jne 0x4058f0
jmp 0x405a26
cmp eax, 0x599960ff
jne 0x4058f0
jmp 0x4058db
cmp eax, 0x37a27640
jne 0x4058f0
mov eax, 0xfb451de5
cmp dword [ebp - 0x128], 0
je 0x405963
mov eax, 0x599960ff
mov dword [ebp - 0x12c], eax
jmp 0x4058f0
mov dword [esp], esi
mov dword [esp + 8], 0x105
mov dword [esp + 4], 0
call fcn.00404110
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00404110
mov dword [esp], esi
mov dword [esp + 4], 0x105
call fcn.00404f10
mov dword [esp], esi
call fcn.00404cb0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], edi
call fcn.004046a0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
sub ecx, edx
add edx, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.004046a0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], 0x37a27640
jmp 0x4058f0
add esp, 0x134
pop esi
pop edi
pop ebp
ret
Function at 0x409970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x409630
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00417d73
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x34a633df
jmp 0x4099d0
mov dword [ebp - 0x10], 0x4838fb10
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cmp eax, 0xe2df241a
jg 0x4099f0
cmp eax, 0x98f63f88
jne 0x4099d0
jmp 0x4099c4
cmp eax, 0x761c611
jg 0x409a20
cmp eax, 0xe2df241b
jne 0x4099d0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0x761c612
jmp 0x4099d0
cmp eax, 0x34a633de
jg 0x409a33
cmp eax, 0x761c612
jne 0x4099d0
jmp 0x409af5
cmp eax, 0x4838fb0f
jg 0x409a59
cmp eax, 0x34a633df
jne 0x4099d0
mov eax, 0x666d7c25
cmp dword [ebp - 4], 0
je 0x409a51
mov eax, 0x6a72fb75
mov dword [ebp - 0x10], eax
jmp 0x4099d0
cmp eax, 0x666d7c24
jg 0x409a77
cmp eax, 0x4838fb10
jne 0x4099d0
mov dword [ebp - 0x10], 0x68999fd8
jmp 0x4099d0
cmp eax, 0x6a72fb74
jg 0x409a98
cmp eax, 0x666d7c25
je 0x409ac6
cmp eax, 0x67aa0cde
jne 0x409ad2
mov dword [ebp - 0x10], 0x98f63f88
jmp 0x4099d0
cmp eax, 0x6a72fb75
jne 0x4099d0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x10], 0x68999fd8
jmp 0x4099d0
mov dword [ebp - 0x10], 0x98f63f88
jmp 0x4099d0
cmp eax, 0x68999fd8
jne 0x4099d0
mov eax, 0xe2df241b
cmp dword [ebp - 0xc], 0
jne 0x409aed
mov eax, 0x761c612
mov dword [ebp - 0x10], eax
jmp 0x4099d0
add esp, 0x28
pop ebp
ret
Function at 0x41f81a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cd3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041c678
mov dword [ebp - 0x14], eax
cmp dword [0x4cec7c], edi
jne 0x41f90b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41f898
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41f9eb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41f9eb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41f9eb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4cec7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4cec80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4cec84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cec8c], eax
test eax, eax
je 0x41f908
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cec88], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41f930
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41f923
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41f945
push 4
pop eax
jmp 0x41f9ed
cmp dword [ebp - 0x14], edi
je 0x41f945
push dword [0x4cec7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41f92a
mov eax, dword [0x4cec88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41f9a3
cmp dword [0x4cec8c], esi
je 0x41f9a3
push eax
call ebx
push dword [0x4cec8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41f9a3
test eax, eax
je 0x41f9a3
call ecx
test eax, eax
je 0x41f998
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41f998
test byte [ebp - 8], 1
jne 0x41f9a3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41f9d3
mov eax, dword [0x4cec80]
cmp eax, esi
je 0x41f9d0
push eax
call ebx
test eax, eax
je 0x41f9d0
call eax
mov edi, eax
test edi, edi
je 0x41f9d0
mov eax, dword [0x4cec84]
cmp eax, esi
je 0x41f9d0
push eax
call ebx
test eax, eax
je 0x41f9d0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4cec7c]
call ebx
test eax, eax
je 0x41f9eb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41f9ed
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419789
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x7a5613a9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rsrc
mov ebx, 0x4304d8
nop
mov ecx, 0x427e0bc6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x146cc0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x63bf163e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000451d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10004103
push eax
push esi
push dword [ebp + 8]
call fcn.100040b8
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100040f3
jmp dword [edi]
popfd
pop ss
clc
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.100040f3
in al, dx
cmp dword [edx - 0x18], 0xffffff8d
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x100062b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x100062ce
sbb byte [edx + eax - 0x6a], dh
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.100040f3
xor esp, dword [esp]
mov dh, 0x8b
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100040f3
push 0x70
imul esi, dword [esi - 0x74cb74b7], 3
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x100062e0
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x100062e0
call fcn.100040f3
mov ah, 0x27
and al, 0x9d
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.100040f3
dec edi
into
test byte [edi - 0xf78a01], ch
jne 0x10006329
push dword [ebp]
call fcn.100048f3
je 0x10006332
invalid
xor esi, esi
inc esi
mov eax, esi
jmp 0x10006339
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10006950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100062b0

Function at 0x300093c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30009436
mov eax, dword [ebp + 8]
test eax, 3
je 0x300093f8
cmp word [eax], 0
je 0x300093f1
lea eax, [eax + 2]
test eax, 3
je 0x300093f8
jmp 0x300093df
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30009433
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x300093f8
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30009433
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30009433
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x300093f8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44f004]
jne 0x40100a
repz ret
jmp fcn.004016f4

Function at 0x405698
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040305b
and dword [ebp - 4], 0
cmp dword [0x450cd8], 0
mov ebx, eax
jne 0x405749
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057fa
push eax
call fcn.00402fe9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x450cd8], eax
call esi
push eax
call fcn.00402fe9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x450cdc], eax
call esi
push eax
call fcn.00402fe9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x450ce0], eax
call esi
push eax
call fcn.00402fe9
pop ecx
mov dword [0x450ce8], eax
test eax, eax
je 0x405749
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402fe9
pop ecx
mov dword [0x450ce4], eax
mov eax, dword [0x450ce4]
cmp eax, ebx
je 0x4057a1
cmp dword [0x450ce8], ebx
je 0x4057a1
push eax
call fcn.00403064
push dword [0x450ce8]
mov esi, eax
call fcn.00403064
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4057a1
test edi, edi
je 0x4057a1
call esi
test eax, eax
je 0x405798
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405798
test byte [ebp - 0xc], 1
jne 0x4057a1
or dword [ebp + 0x10], 0x200000
jmp 0x4057da
mov eax, dword [0x450cdc]
cmp eax, ebx
je 0x4057da
push eax
call fcn.00403064
pop ecx
test eax, eax
je 0x4057da
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4057da
mov eax, dword [0x450ce0]
cmp eax, ebx
je 0x4057da
push eax
call fcn.00403064
pop ecx
test eax, eax
je 0x4057da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x450cd8]
call fcn.00403064
pop ecx
test eax, eax
je 0x4057fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44acf0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x44f004]
xor eax, esp
mov dword [esp + 0x428], eax
cmp edi, 0x182
jne 0x44ad1e
lea eax, [esp + 0xc]
push eax
push str.tuzudinuyodawiz_xivizevobikotuletife
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x44ad52
cmp edi, 0x19f
jne 0x44ad52
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.wofoyamev_wexededukocoh
push str.vazew_xajinoguwumofeforupatetonaxoc_vasufadogenanajeyu_wiwarerimefozenodav
push str.besudufawocugiforacir_nawiyay_yirideculaxabafulewasu_seyihet_zazadubavoxuyucawitiwituzunacare
push str.bemoxaxoyuguxejoxipavav_damilagorifoki_meyogupusosojezogayihasawuzerebu_moyeta
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
xor esi, esi
test edi, edi
jle 0x44adc2
lea esp, [esp]
lea ecx, [esp + 8]
mov dword [esp + 4], 5
mov dword [esp + 8], 0
call fcn.0044ace0
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
mov cl, byte [esp + 4]
xor byte [ebx + esi], cl
cmp edi, 0xf
jne 0x44adbd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x44ad60
pop esi
cmp edi, 0x2d
jne 0x44addc
mov dword [0x529500], 0xa62e7790
mov dword [0x529504], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x710c67
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x7109ec
and ecx, edx
call fcn.00710ca8
or ecx, edx
sub ecx, 0x3a4ba93
add ecx, 1
xor dword [edi], eax
mov edx, 0x944e1eb8
sub edx, 0x18178a84
inc edi
add ecx, 1
mov edx, ecx
cmp edi, esi
jne fcn.00710c67
sub esp, 4
mov dword [esp], edx
pop ecx
ret