joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10176785
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10176701
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x101768f4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x101768f4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x101768a9
jg 0x101767e1
test eax, eax
je 0x1017689f
push 1
push 0x1000
call fcn.101673e0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10176804
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10176896
push 0x8000
push ebx
call fcn.10176630
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1017682d
jg 0x10176828
cmp ecx, 0x1000
jb 0x1017682d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10167e4d
add esp, 0x10
cmp eax, 0xffffffff
je 0x10176872
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10176828
jl 0x10176859
test ecx, ecx
jne 0x1017681a
push dword [ebp - 0xc]
push ebx
call fcn.10176630
push esi
call fcn.10165290
add esp, 0xc
xor ebx, ebx
jmp 0x10176902
cmp byte [edi + 0x24], 0
je 0x10176889
cmp dword [edi + 0x20], 5
jne 0x10176889
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10176894
mov ebx, dword [edi + 0x18]
jmp 0x10176896
xor ebx, ebx
push esi
call fcn.10165290
pop ecx
jmp 0x10176902
test ecx, ecx
jg 0x1017686b
jl 0x101768a9
test eax, eax
jae 0x1017686b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1016b954
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x101768c9
cmp byte [edi + 0x1c], 0
je 0x1017686b
jmp 0x101768fa
push ebx
call fcn.10163539
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1017686b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10176902
cmp byte [edi + 0x1c], 0
je 0x101768ff
mov ebx, dword [edi + 0x18]
jmp 0x10176902
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1016b954
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10177510
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1017753d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1017753d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x101e6000
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
bt ecx, 0
btr cx, 0xd
xchg cx, bp
mov ebp, esp
test esi, edx
sar ax, 0xa1
push 0xffffffffffffffff
or ax, sp
push 0x10177d78
or al, 0x15
sal al, cl
cmovne ax, ax
mov eax, dword fs:[0]
btr ecx, esi
push eax
cmc
mov dword fs:[0], esp
shrd ecx, esp, 0x39
sal cx, 0x80
sub esp, 0xe8
movsx ecx, dx
xchg ecx, ecx
lea ecx, [ebp - 0x3c]
jmp 0x101e9325
push eax
jmp loc.1000bf45
call fcn.10009280
mov byte [ebp - 4], 1
seta ah
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
movzx eax, bx
mov ax, 0xb738
push 0xf0000000
push 1
push 0
push 0
movzx ax, al
mov ah, 0x3c
movsx ax, dh
lea eax, [ebp - 0x14]
jmp 0x101e6793
call fcn.10009280
mov dword [ebp - 4], 0
movzx ecx, bp
xchg ecx, ecx
lea ecx, [ebp - 0xf4]
jmp 0x101e7fd1

Function at 0x101e6799
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
bsr ax, di
mov ebp, esp
btc ax, 0xa3
sub esp, 0x18
rdtsc
jmp loc.1000e2a7

Function at 0x101ea2b2
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
xchg bp, ax
lahf
mov ebp, esp
push 0xffffffffffffffff
setl al
lahf
push 0x101780ff
mov eax, dword fs:[0]
jmp loc.1000c5ab

Function at 0x101eb310
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
dec ax
xor bp, sp
not bp
mov ebp, esp
push 0xffffffffffffffff
bswap ax
push 0x10177dbd
mov eax, dword fs:[0]
and cx, bp
push eax
sbb ecx, 0x89407
rcr ax, cl
and cl, 0xa3
mov dword fs:[0], esp
cwde
test di, si
sub esp, 0xfc
not cl
lahf
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
mov ch, 0x26
bswap ecx
movsx ecx, si
lea ecx, [ebp - 0x20]
jmp loc.10008dfd

Function at 0x101eb433
Capabilities:
Decode data using base64 via winapi

Disassembly:
lea eax, [ebp - 0x14]
movzx cx, ah
push eax
push 0
cmovne ecx, ecx
jmp 0x101e9cf6
push 1
mov ch, 0x98
push 0
jmp loc.1000efb1
push 0
mov cx, cx
jmp 0x101e8225
push ebp
mov ebp, esp
bts eax, esi
shr cl, 0xbb
push 0xffffffffffffffff
adc ecx, 0x41f032e
push 0x10177d3d
sub ah, dh
sar ax, 4
btr ax, 7
mov eax, dword fs:[0]
rcl cl, cl
add ch, bl
push eax
mov dword fs:[0], esp
sbb ax, 0xc085
sub esp, 0x30
movzx eax, dx
cbw
mov dword [ebp - 0x18], 0
bswap eax
mov dword [ebp - 0x14], 0
seta al
mov ecx, 0xd5b0599c
push 0
jmp 0x101eb1d8
Function at 0x40a6a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4263d4]
jne 0x40a6aa
repz ret
jmp fcn.0041089c

Function at 0x41654c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4263d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040d53f
and dword [ebp - 0x14], 0
cmp dword [0x46846c], 0
mov dword [ebp - 0x18], eax
jne 0x4165ff
push 0x4037f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4166a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037e8
push ebx
call edi
test eax, eax
je 0x4166a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037d8
push ebx
mov dword [0x46846c], eax
call edi
push eax
call esi
push 0x4037c4
push ebx
mov dword [0x468470], eax
call edi
push eax
call esi
push 0x4037a8
push ebx
mov dword [0x468474], eax
call edi
push eax
call esi
mov dword [0x46847c], eax
test eax, eax
je 0x4165ff
push 0x403790
push ebx
call edi
push eax
call esi
mov dword [0x468478], eax
mov eax, dword [0x468478]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416658
cmp dword [0x46847c], ecx
je 0x416658
push eax
call esi
push dword [0x46847c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416658
test ebx, ebx
je 0x416658
call edi
test eax, eax
je 0x41664f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41664f
test byte [ebp - 8], 1
jne 0x416658
or dword [ebp + 0x10], 0x200000
jmp 0x41668b
mov eax, dword [0x468470]
cmp eax, dword [ebp - 0x18]
je 0x41668b
push eax
call esi
test eax, eax
je 0x41668b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41668b
mov eax, dword [0x468474]
cmp eax, dword [ebp - 0x18]
je 0x41668b
push eax
call esi
test eax, eax
je 0x41668b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46846c]
call esi
test eax, eax
je 0x4166a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4166a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a6a0
leave
ret
Function at 0x41e840
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.0041da20
cmp dword [0x8091f0], 0x37
jne 0x41e8d1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x4043f4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404414
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x8091f4]
mov edx, dword [0x805660]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x40cedf
Capabilities:
Encode data using xor

Disassembly:
test byte [edi - 0x32c7338c], cl
pop ebx
ljmp 0xbd76
push cs
sbb byte [ebx + eax - 0x7b], ah
fldcw word [ebx - 0x4c]
xor bh, byte [ebx + 3]
jnp 0x40ce91
lodsd eax, dword [esi]
clc
lodsd eax, dword [esi]
enter 0x62e0, 0x5f
lcall 0x8a03, 0x1da44db8
lds edx, [ecx - 0x5dd12c08]
mov dh, 0x3a
sbb byte [ecx + 0x67], al
jp 0x40cf33
imul esi, dword [ecx + ebp*2 + 0x75], 0xffffffd9
pushal
mov ecx, 0xe11877b5
dec eax
std
sar byte [ebx], cl
fidiv dword [edi - 0x6c]
je 0x40cf37
test al, 0xb8
mov esp, 0x7de17474
mov cl, 0x3e
cmp al, 0xad
out 0xd, eax
mov ah, 0xbd
in al, 0x82
mov dl, 0x6d
mov dh, 0x91
mov al, 0xe4
aaa
in eax, dx
call 0x314c1bb2
dec esp
or esi, dword [ecx]
push dword [eax + edx*4 - 0x2f896fe5]
xor eax, 0x711e0ef1
or ebx, dword [eax - 0x5f]
inc esi
pop esi
sub dword [ebp - 0x1e81be85], ecx
sub byte [edi - 0x17bf8b93], ch
jno 0x40cf37
pushal
inc ecx
aam 0x81
hlt

Function at 0x4164d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x2de47e76
invalid
mov ebx, 0x6f67ef5
cmc
jle 0x4164ca
push es
wait
bound esi, qword [ebx - 0x517acd69]
xor al, 0x5f
xlatb
test byte [ebx - 0x1875f0b3], al
inc edi
test edx, ecx
jne 0x4164d1
push 0x39
loop 0x416515
add byte [esi - 0x3c], bh
ror byte [edx], 1
loopne 0x416525
mov ebp, 0xe69dbfcf
dec ebx
invalid
mov ebp, 0xadaf53ff
call dword [ebx - 0x51]
lodsd eax, dword [esi]
inc edx
push ebx
adc byte [ebp + 0x78], dh
js 0x416516
fnstcw word [0x3b15874e]
lodsb al, byte [esi]
jb 0x416536
adc eax, 0xc72ac3b
pxor mm7, qword [eax - 0x6aa3ed3c]
mov edx, 0x1f3e4fa0
imul edx, dword cs:[bp + di + 0x1720], 0xffffff9e
jg 0x4164d5
subps xmm5, xmmword [edx]
fadd st(0), st(0)
sub dl, 0xcc
out dx, al
or ch, byte [edi]
cdq
ret

Function at 0x42438c
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
fstp xword [ecx]
loopne 0x4243b0
push cs
out 0xa, eax
push edi
pop edi
js 0x4243cf
cli
add eax, 0x5a978a
stosd dword es:[edi], eax
mov bh, 0x5a
rcl dword [ebx], 0xc7
js 0x4243ed
mul byte [edx + ebp]
leave
mov ecx, dword [ebx]
mov cl, byte [edx + 0x54862b56]
outsd dx, dword [esi]
xchg edx, ecx
sbb byte [edx - 0x21], ch
mov dword [ebp + 0x29], 0x94e6f4a
sbb dword gs:[ebx - 5], eax
fcmovnbe st(0), st(7)
xchg esi, eax
and eax, 0x3b1b1197
arpl word [ebx], bx
sbb dword [ecx], esp
cdq
and dword [esi], ebp
cdq
pop edx
sub byte [ebx + 0x1a], ch
push ds
imul dword [ebx + 0x67e66a07]
xchg esi, esi
jg 0x424408
mov edx, dword [ebx - 0x59]
invalid

Function at 0x4293d0
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
sbb byte [ebx - 0x794b7e28], ch
xor ch, bl
inc esp
mov al, byte [0x3f4efbc8]
mov eax, 0xe8b96d5f
push esi
jge fcn.004293d0
fmul dword [eax]
jmp [edi]
Function at 0x4446b0
Capabilities:
Encode data using xor

Disassembly:
sub byte [esi + ebx*2 - 0x4b], 0x17
cld
daa
xor byte [ecx + 0xc3d372b], bh
mov edx, 0x80bc3dda
popfd
aam 0xe8
xchg esp, eax
shl byte [ebx + 0x65], 1
adc ebp, dword [esi]
daa
arpl word [bx + si - 0x56], si
cdq
imul esp, edx, 0x4b
dec ebx
dec ebx
daa
enter 0xffffffffffffe592, 0x71
sbb byte [esi + ecx*4 + 1], ah
mov edi, 0x7207b0b4
push edx
mov edi, 0x4540a135
mov eax, 0xee9cb26e
dec esi
push ds
mov ch, 0xc1
cmp dword [eax], ebx
pop ecx
js 0x44468d
xchg ecx, eax
push eax
push ds
or dl, byte [esp + edi*2 - 0x37]
mov bl, 0x98
inc ebx
jb 0x444740
in eax, dx
pop esi
fmul st(7)
jmp 0x444725
cmp dword [ecx + 0x7b], esi
lea ebp, [ebx]
int3
fist dword [0x22df3183]
push edi
mov al, byte [0x12bccc39]
test ecx, edx
out dx, al
test byte [esi - 0x7d2d867a], ch
jmp 0xdf84a0d9

Function at 0x45256c
Capabilities:
Encode data using xor

Disassembly:
daa
aas
sbb dword [ecx], esi
sub esi, dword [edx]
sub dh, byte [ebx]
sub eax, 0x2c352d34
xor dword [ebx], ebp
xor ch, byte [edx]
xor ebp, dword [0x2c352d34]
aaa
cmp byte cs:[ecx], ah
cmp dword [edx], esp
cmp esp, dword [edx]
cmp esp, dword [edx]
cmp al, 0x25
cmp al, 0x25
cmp al, 0x25
cmp eax, 0x32193e24
sbb dword [edx], esi
xor ch, byte [0x24392e35]
sub eax, 0x24392e35
xor eax, 0x24392e
sub dword [edx], esi
add byte [ecx], ch
xor ch, byte [esi]
aaa
aaa
and dword [ebx], edi
sbb dword [ebx], esi
sub al, 0x36
das
aaa
and byte [edx], bh
daa
aas
sbb dword [ecx], esi
sub byte [ecx], dh
sub esi, dword [edx]
sub esi, dword [ebx]
sub dh, byte [ebx]
sub eax, 0x2c352d34
xor eax, 0x372f362f
aaa
and dword [eax], edi
and dword [ecx], edi
and byte [edx], bh
and bh, byte [esp]
cmp eax, 0x3f273e24
sbb dword [eax], eax
sub dword [eax], esi
sub dword [ecx], esi
sub dh, byte [ebx]
sub eax, 0x18352c34
xchg esp, eax
loopne 0x4524e4
loope 0x4524e7
out dx, al
lcall 0x99ec, 0x98ef9bee
in eax, dx
sahf
ljmp 0xe7a3
jecxz 0x452505
loopne 0x452504
loope 0x452507
loope 0x45250e
out dx, al
lcall 0x98ec, 0x98ef9bef
in eax, dx
sahf
ljmp 0xe6a2

Function at 0x48e76e
Capabilities:
Encode data using xor

Disassembly:
add al, 0xb8
ror dword [ecx], cl
add byte [eax], al
call 0x785d75
into
add dword [ecx + 0x6af075], ecx
call fcn.0048e7d0
and dword [ebp - 4], 0
fild word [ecx]
mov dword [esi], 0x80f908
call int.0047e72c
test eax, eax
jns 0x48e74d
add eax, ebp
xchg ebx, eax
and eax, dword [eax]
add byte [ebx + 0x760000c6], cl
das
add bl, al
push ebp
rol byte [ecx], 0x56
mov esi, ecx
call 0x48e76e
add byte [ebp + 8], al
add dword [eax + ebx - 0x14], esi
je 0x48e767
in al, dx
add dword [eax], ecx
add al, 0x75
or byte [esi - 0x18], dl
loopne 0x48e759
add byte [eax], al
jmp 0x48e766
pop ecx
mov eax, dword [eax]
add byte [ebp - 0x3e], bl
add al, 0
push esi
pop eax
add dword [ebp + 0x6c70846], ecx
or cl, bh
add byte [eax], al
push eax
call dword [0x137968c]
mov ecx, esi
pop esi
jmp 0x5aaedf
xchg edi, eax
aam 0xa3
invalid
Function at 0x628da5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632390
cmp edx, dword [eax]
je 0x628dc7
add eax, 8
inc ecx
cmp eax, 0x632420
jl 0x628db8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632390]
jne 0x628ef5
mov eax, dword [0x63bd20]
cmp eax, 1
je 0x628ecf
test eax, eax
jne 0x628df8
cmp dword [0x6322bc], 1
je 0x628ecf
cmp edx, 0xfc
je 0x628ef5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628e2f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629790
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629c20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628e72
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629c20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea34
push edi
call fcn.0062baf0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629790
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006297a0
lea eax, [ebp - 0xa0]
push 0x62ea14
push eax
call fcn.006297a0
push dword [esi + 0x632394]
lea eax, [ebp - 0xa0]
push eax
call fcn.006297a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062ba64
add esp, 0x2c
pop edi
jmp 0x628ef5
lea eax, [ebp + 8]
lea esi, [esi + 0x632394]
push 0
push eax
push dword [esi]
call fcn.00629c20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406a78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ce14]
jne 0x406a82
repz ret
jmp fcn.0040da9b

Function at 0x4124eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040afeb
and dword [ebp - 4], 0
cmp dword [0x44eaac], 0
mov ebx, eax
jne 0x41259c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41264d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41264d
push eax
call fcn.0040af79
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44eaac], eax
call esi
push eax
call fcn.0040af79
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44eab0], eax
call esi
push eax
call fcn.0040af79
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44eab4], eax
call esi
push eax
call fcn.0040af79
pop ecx
mov dword [0x44eabc], eax
test eax, eax
je 0x41259c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040af79
pop ecx
mov dword [0x44eab8], eax
mov eax, dword [0x44eab8]
cmp eax, ebx
je 0x4125f4
cmp dword [0x44eabc], ebx
je 0x4125f4
push eax
call fcn.0040aff4
push dword [0x44eabc]
mov esi, eax
call fcn.0040aff4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4125f4
test edi, edi
je 0x4125f4
call esi
test eax, eax
je 0x4125eb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4125eb
test byte [ebp - 0xc], 1
jne 0x4125f4
or dword [ebp + 0x10], 0x200000
jmp 0x41262d
mov eax, dword [0x44eab0]
cmp eax, ebx
je 0x41262d
push eax
call fcn.0040aff4
pop ecx
test eax, eax
je 0x41262d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41262d
mov eax, dword [0x44eab4]
cmp eax, ebx
je 0x41262d
push eax
call fcn.0040aff4
pop ecx
test eax, eax
je 0x41262d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44eaac]
call fcn.0040aff4
pop ecx
test eax, eax
je 0x41264d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41264f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
neg edi
bswap eax
bswap edx
dec esi
or edx, 0xc8
bswap esi
sbb esi, 0x51
add ebx, 0x93
dec edi
rol edx, 0xb
neg edx
not esi
neg esi
imul ebx
imul ebx
neg edx
sub eax, 0xa7
imul esi
bswap esi
bswap edi
imul eax
not edi
rol ebx, 0x67
sub esi, 0xf1
neg edi
dec edx
rol edx, 0xc6
and ebx, 0x12
sub edx, 0xa8
inc ebx
neg edx
rol esi, 0x88
neg eax
mov edx, 0xec
dec ebx
imul esi
or esi, 0xdd
inc esi
bswap eax
imul ebx
inc esi
sbb eax, 0xba
neg esi
imul edi
not esi
rcr eax, 0xba
add esi, 0xc3
rcr edx, 0xac
and edx, 0x37
or eax, 8
mov byte [ebp - 0x20], 1
mov byte [ebp - 0x1f], 0xe1
mov byte [ebp - 0x1e], 0xa9
mov byte [ebp - 0x1d], 0x15
mov byte [ebp - 0x1c], 0x26
mov byte [ebp - 0x1b], 0x3d
mov byte [ebp - 0x1a], 0x17
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0xf1
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0x97
mov byte [ebp - 0x15], 0xb3
mov byte [ebp - 0x14], 9
mov byte [ebp - 0x13], 0xe1
mov byte [ebp - 0x12], 0xa1
mov byte [ebp - 0x11], 0xa
mov byte [ebp - 0x10], 0xb7
mov byte [ebp - 0xf], 0x60
mov byte [ebp - 0xe], 0xe9
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x82
mov byte [ebp - 0xb], 0x4e
mov byte [ebp - 0xa], 0xf1
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x1e
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0xde
mov byte [ebp - 5], 0x18
mov byte [ebp - 4], 0x77
mov byte [ebp - 3], 0xb8
mov byte [ebp - 2], 0x6c
mov byte [ebp - 1], 0x63
mov dword [ebp - 0x24], 0x20
neg edi
bswap eax
bswap edx
dec esi
or edx, 0xc8
bswap esi
sbb esi, 0x51
add ebx, 0x93
dec edi
rol edx, 0xb
neg edx
not esi
neg esi
imul ebx
imul ebx
neg edx
sub eax, 0xa7
imul esi
bswap esi
bswap edi
imul eax
not edi
rol ebx, 0x67
sub esi, 0xf1
neg edi
dec edx
rol edx, 0xc6
and ebx, 0x12
sub edx, 0xa8
inc ebx
neg edx
rol esi, 0x88
neg eax
mov edx, 0xec
dec ebx
imul esi
or esi, 0xdd
inc esi
bswap eax
imul ebx
inc esi
sbb eax, 0xba
neg esi
imul edi
not esi
rcr eax, 0xba
add esi, 0xc3
rcr edx, 0xac
and edx, 0x37
or eax, 8
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00418a00
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x70490a12
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x70bb0018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x70bb0018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x70490a7f
jmp 0x70490acc
jmp 0x70490b19
jmp 0x70490b66
jmp 0x70490bb3
jmp 0x70490c00
jmp 0x70490c4d
jmp 0x70490c9a
jmp 0x70490ce7
jmp 0x70490d34
jmp 0x70490d81
jmp 0x70490dce
mov dword [ebp - 0x14], 0
jmp 0x70490e22
jmp 0x70490e6f
jmp 0x70490ebc
jmp 0x70490f09
jmp 0x70490f56
jmp 0x70490fa3
jmp 0x70490ff0
jmp 0x7049103d
jmp 0x7049108a
jmp 0x704910d7
jmp 0x70491124
jmp 0x70491171
mov dword [ebp - 0x18], 0
jmp 0x704911c5
jmp 0x70491212
jmp 0x7049125f
jmp 0x704912ac
jmp 0x704912f9
jmp 0x70491346
jmp 0x70491393
jmp 0x704913e0
jmp 0x7049142d
jmp 0x7049147a
jmp 0x704914c7
jmp 0x70491514
mov dword [ebp - 0x10], 0
jmp 0x70491568
jmp 0x704915b5
jmp 0x70491602
jmp 0x7049164f
jmp 0x7049169c
jmp 0x704916e9
jmp 0x70491736
jmp 0x70491783
jmp 0x704917d0
jmp 0x7049181d
jmp 0x7049186a
jmp 0x704918b7
mov dword [ebp - 0x10], 0
jmp 0x70492b17
jmp 0x70491910
jmp 0x7049195d
jmp 0x704919aa
jmp 0x704919f7
jmp 0x70491a44
jmp 0x70491a91
jmp 0x70491ade
jmp 0x70491b2b
jmp 0x70491b78
jmp 0x70491bc5
jmp 0x70491c12
jmp 0x70491c5f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x70bb0014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x70491cbd
jmp 0x70491d0a
jmp 0x70491d57
jmp 0x70491da4
jmp 0x70491df1
jmp 0x70491e3e
jmp 0x70491e8b
jmp 0x70491ed8
jmp 0x70491f25
jmp 0x70491f72
jmp 0x70491fbf
jmp 0x7049200c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x70bb001c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x7049206a
jmp 0x704920b7
jmp 0x70492104
jmp 0x70492151
jmp 0x7049219e
jmp 0x704921eb
jmp 0x70492238
jmp 0x70492285
jmp 0x704922d2
jmp 0x7049231f
jmp 0x7049236c
jmp 0x704923b9
mov eax, dword [0x70bb0008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x70492424
jmp 0x70492471
jmp 0x704924be
jmp 0x7049250b
jmp 0x70492558
jmp 0x704925a5
jmp 0x704925f2
jmp 0x7049263f
jmp 0x7049268c
jmp 0x704926d9
jmp 0x70492726
jmp 0x70492773
add dword [ebp - 0xc], 0x28
jmp 0x704927c4
jmp 0x70492811
jmp 0x7049285e
jmp 0x704928ab
jmp 0x704928f8
jmp 0x70492945
jmp 0x70492992
jmp 0x704929df
jmp 0x70492a2c
jmp 0x70492a79
jmp 0x70492ac6
jmp 0x70492b13
add dword [ebp - 0x10], 1
mov eax, dword [0x70bb0018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x704918c3
nop
leave
ret