joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f80
Capabilities:
Receive http response
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x401feb
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4020ee
mov edx, dword [ebp - 8]
add edx, 1
push edx
call fcn.004123a6
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402030
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.0041241c
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4020ee
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004122f0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x402086
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041241c
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4020ee
push 0
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4020c6
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0041241c
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4020ee
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041241c
add esp, 4
cmp dword [ebp - 8], 0
ja 0x401fba
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4033d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
push eax
call fcn.00410962
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
shl ecx, 2
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
shl edx, 2
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
jmp 0x403434
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jae 0x40347d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004108da
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [edx + ecx*4], eax
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
push edx
push 0x403000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
jmp 0x40342b
push 0
push 0xffffffffffffffff
push 1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov esp, ebp
pop ebp
ret
Function at 0x4034a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42b060]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0x42d6a8
call fcn.00409210
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x40c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00410d26
add esp, 0xc
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x4034f4
xor eax, eax
jmp 0x403672
call fcn.00409300
push eax
mov edx, dword [ebp - 0x410]
push edx
call fcn.00410a91
add esp, 8
mov dword [ebp - 0x424], eax
call fcn.00409440
push eax
mov eax, dword [ebp - 0x424]
push eax
call fcn.00410a91
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x40353e
mov ecx, dword [ebp - 0x418]
cmp dword [ecx], 2
je 0x403559
mov edx, dword [ebp - 0x410]
push edx
call fcn.00402350
add esp, 4
xor eax, eax
jmp 0x403672
mov eax, dword [ebp - 0x418]
push eax
call fcn.00410ba2
add esp, 4
mov dword [ebp - 0x41c], eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x423361
push 0x42d6a8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea edx, [ebp - 0x108]
push edx
call fcn.00409560
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.004022f0
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push ecx
push 0x4233bc
push 0x104
lea edx, [ebp - 0x310]
push edx
call fcn.00403680
add esp, 0x10
call fcn.00409720
push eax
push 0x42d6a8
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.00402650
add esp, 0x10
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
je 0x40360b
mov edx, dword [ebp - 0x410]
push edx
call fcn.00402350
add esp, 4
xor eax, eax
jmp 0x403672
call fcn.00409800
push eax
mov eax, dword [ebp - 0x410]
push eax
call fcn.00410a91
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x40363a
mov ecx, dword [ebp - 0x414]
cmp dword [ecx], 1
je 0x40364f
mov edx, dword [ebp - 0x410]
push edx
call fcn.00402350
add esp, 4
xor eax, eax
jmp 0x403672
mov eax, dword [ebp - 0x414]
push eax
call fcn.004033d0
add esp, 4
mov ecx, dword [ebp - 0x410]
push ecx
call fcn.00402350
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412702
mov esp, ebp
pop ebp
ret
Function at 0x40cc00
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x42b060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str._s__s
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.004022f0
add esp, 0x14
call fcn.00408980
push eax
call fcn.004087d0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x3d4], 0x10007
push 0x44
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004122f0
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x3e8]
push edx
call fcn.004122f0
add esp, 0xc
lea eax, [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [ebp - 0x3d8]
test eax, eax
je 0x40ccd0
push 0x493e0
mov eax, dword [ebp - 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40ccd5
mov eax, 0x1fff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412702
mov esp, ebp
pop ebp
ret

Function at 0x40ce10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x42de80], 0x94
push 0x42de80
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x42de90], 2
jne 0x40ce3d
cmp dword [0x42de84], 5
jae 0x40ce47
call fcn.00408ce0
mov dword [ebp - 4], eax
jmp 0x40ce88
cmp dword [0x42de84], 6
jb 0x40ce80
cmp dword [0x42de88], 2
jb 0x40ce63
call fcn.00408de0
mov dword [ebp - 4], eax
jmp 0x40ce7e
cmp dword [0x42de88], 1
jne 0x40ce76
call fcn.00408e90
mov dword [ebp - 4], eax
jmp 0x40ce7e
call fcn.00408f50
mov dword [ebp - 4], eax
jmp 0x40ce88
call fcn.00408fe0
mov dword [ebp - 4], eax
call fcn.0040cdc0
movsx eax, al
test eax, eax
je 0x40ce9d
mov dword [ebp - 8], 0x40
jmp 0x40cea4
mov dword [ebp - 8], 0x20
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push str._s__d
push 0x400
push 0x42df18
call fcn.004022f0
add esp, 0x14
mov eax, 0x42df18
mov esp, ebp
pop ebp
ret
Function at 0x40d030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x4233dc
movzx eax, word [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d118
push 0x28
call fcn.00413414
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 4]
add edx, 0x18
push edx
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040cf10
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0xc]
call eax
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x20]
jmp 0x40d11a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40d2b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40d2d5
xor eax, eax
jmp 0x40d30a
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d308
cmp dword [ebp - 4], 4
jne 0x40d308
mov eax, 1
jmp 0x40d30a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x29
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40d397
xor eax, eax
jmp 0x40d507
lea eax, [ebp - 8]
push eax
push 0x3c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d2b0
add esp, 0xc
test eax, eax
jne 0x40d3c0
mov edx, dword [ebp - 4]
push edx
call fcn.004134e9
add esp, 4
xor eax, eax
jmp 0x40d507
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040d2b0
add esp, 0xc
test eax, eax
jne 0x40d3fe
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004134e9
add esp, 4
xor eax, eax
jmp 0x40d507
cmp dword [ebp - 0x14], 0x4550
je 0x40d421
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40d507
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x98
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040d2b0
add esp, 0xc
test eax, eax
jne 0x40d459
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40d507
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040d2b0
add esp, 0xc
test eax, eax
jne 0x40d488
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40d507
push 0
push 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40d4c1
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40d507
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0x28
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40d4f2
cmp dword [ebp - 0x10], 0x28
jne 0x40d4f2
mov eax, dword [ebp - 4]
jmp 0x40d507
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x42b060]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x423410]
mov word [ebp - 0x210], ax
push 0x208
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004122f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 0
cmp dword [ebp - 0x214], 0xffffffff
jne 0x40d59e
xor eax, eax
jmp 0x40d6ab
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.0040d370
add esp, 4
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x40d68f
push 0x29
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x21c], eax
push 2
push 0
push 0xffffffffffffffd8
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
jne 0x40d616
mov eax, dword [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40d6ab
mov dword [ebp - 0x220], 0
push 0
lea ecx, [ebp - 0x220]
push ecx
push 0x28
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x40d657
cmp dword [ebp - 0x220], 0x28
je 0x40d671
mov ecx, dword [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x40d6ab
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x218], edx
mov eax, 1
imul ecx, eax, 0x28
mov edx, dword [ebp - 0x218]
mov byte [edx + ecx], 0
cmp dword [ebp - 0x214], 0
je 0x40d6a5
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412702
mov esp, ebp
pop ebp
ret
Function at 0x40dab0
Capabilities:
Get common file path
Get disk information
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x42b060]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
jmp 0x40daf2
mov eax, dword [ebp - 0x468]
add eax, 1
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0x10
jge 0x40db09
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x468]
mov byte [ecx], 0
jmp 0x40dae3
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], 1
lea edx, [ebp - 0x46c]
push edx
mov eax, dword [ebp - 0x460]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [ebp - 0x46c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x460], eax
lea edx, [ebp - 0x46c]
push edx
mov eax, dword [ebp - 0x460]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [ebp - 0x460]
mov dword [ebp - 0x464], ecx
jmp 0x40db76
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x40dbb0
mov ecx, dword [ebp - 0x464]
cmp dword [ecx + 0x1a0], 6
jne 0x40dbae
push 6
mov edx, dword [ebp - 0x464]
add edx, 0x194
push edx
mov eax, dword [ebp + 8]
add eax, 6
push eax
call fcn.00412dd0
add esp, 0xc
jmp 0x40dbb0
jmp 0x40db68
mov ecx, dword [ebp - 0x460]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x400
lea edx, [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 8
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, 2
imul eax, edx, 3
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0x18
jae 0x40dc04
jmp 0x40dc09
call fcn.00412cf1
xor ecx, ecx
mov edx, dword [ebp - 0x470]
mov word [ebp + edx - 0x1c], cx
push 0x40
lea eax, [ebp - 0x5c]
push eax
push 0
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp - 0x474]
push edx
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40dc56
push 4
lea ecx, [ebp - 0x474]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xc
push edx
call fcn.00412dd0
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412702
mov esp, ebp
pop ebp
ret
Function at 0x41199b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
add edi, 0xdeadbeef
push 0xc
add edi, ecx
pop eax
mov esi, edi
mov ebp, edi
cmp ecx, eax
jbe switch.0x00411a92
lea eax, [ecx - 0xd]
xor edx, edx
push 0xc
pop ecx
div ecx
inc eax
mov dword [esp + 0x1c], eax
movzx edx, byte [ebx + 7]
movzx ecx, byte [ebx + 6]
movzx eax, byte [ebx + 5]
shl edx, 8
add edx, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
shl edx, 8
add edx, eax
movzx eax, byte [ebx + 4]
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 0xa]
add esi, edx
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 9]
add edx, edi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov edi, edx
add ecx, eax
rol edi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ecx, eax
sub ecx, edx
add edx, esi
add ecx, ebp
xor edi, ecx
sub esi, edi
mov eax, edi
rol eax, 6
add edi, edx
xor eax, esi
mov ecx, eax
sub edx, eax
rol ecx, 8
add eax, edi
xor ecx, edx
sub edi, ecx
mov ebp, ecx
rol ebp, 0x10
add ecx, eax
xor ebp, edi
mov esi, ebp
sub eax, ebp
ror esi, 0xd
add ebp, ecx
xor esi, eax
sub ecx, esi
mov edi, esi
rol edi, 4
add esi, ebp
xor edi, ecx
mov ecx, dword [esp + 0x18]
push 0xc
pop eax
sub ecx, eax
add ebx, eax
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
jne 0x4119d1
cmp ecx, eax
ja 0x411afb
jmp dword [ecx*4 + 0x411b47]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 8]
add edi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 4]
add esi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add ebp, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add ebp, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add ebp, eax
movzx eax, byte [ebx]
add ebp, eax
xor edi, esi
mov eax, esi
rol eax, 0xe
sub edi, eax
mov eax, edi
mov edx, edi
rol eax, 0xb
xor edx, ebp
sub edx, eax
xor esi, edx
mov eax, edx
ror eax, 7
sub esi, eax
mov eax, esi
xor edi, esi
rol eax, 0x10
sub edi, eax
mov eax, edi
mov ecx, edi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor esi, ecx
rol eax, 0xe
sub esi, eax
mov eax, esi
xor edi, esi
ror eax, 8
sub edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41e82c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00418446
mov dword [ebp - 0x14], eax
cmp dword [0x42f5dc], esi
jne 0x41e91f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41e8ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41e9ff
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41e9ff
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41e9ff
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42f5dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42f5e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42f5e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42f5ec], eax
test eax, eax
je 0x41e91c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42f5e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41e944
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41e937
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41e959
push 4
pop eax
jmp 0x41ea01
cmp dword [ebp - 0x14], esi
je 0x41e959
push dword [0x42f5dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41e93e
mov eax, dword [0x42f5e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41e9b7
cmp dword [0x42f5ec], edi
je 0x41e9b7
push eax
call ebx
push dword [0x42f5ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41e9b7
test eax, eax
je 0x41e9b7
call ecx
test eax, eax
je 0x41e9ac
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41e9ac
test byte [ebp - 8], 1
jne 0x41e9b7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41e9e7
mov eax, dword [0x42f5e0]
cmp eax, edi
je 0x41e9e4
push eax
call ebx
test eax, eax
je 0x41e9e4
call eax
mov esi, eax
test esi, esi
je 0x41e9e4
mov eax, dword [0x42f5e4]
cmp eax, edi
je 0x41e9e4
push eax
call ebx
test eax, eax
je 0x41e9e4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42f5dc]
call ebx
test eax, eax
je 0x41e9ff
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41ea01
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412702
mov esp, ebp
pop ebp
ret