joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c271
Capabilities:
Compute adler32 checksum

Disassembly:
sub ebx, 0x15b0
mov eax, 0x15b
jmp 0x48c220
movzx edx, byte [esi]
add ecx, edx
movzx edx, byte [esi + 1]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 2]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 3]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 4]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 5]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 6]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 7]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 8]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 9]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xa]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xb]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xc]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xd]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xe]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xf]
add edi, ecx
add ecx, edx
add edi, ecx
add esi, 0x10
sub eax, 1
jne 0x48c220
mov eax, 0x80078071
mul ecx
loope 0x48c274
ljmp 0xff00
inc dword [ebx]
retf 0x71b8
add byte [edi], 0x80
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
sub ebp, 1
jne 0x48c210
pop ebp
test ebx, ebx
je 0x48c3b3
cmp ebx, 0x10
jb 0x48c37e
mov eax, ebx
shr eax, 4
nop
movzx edx, byte [esi]
add ecx, edx
movzx edx, byte [esi + 1]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 2]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 3]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 4]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 5]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 6]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 7]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 8]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 9]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xa]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xb]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xc]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xd]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xe]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xf]
add edi, ecx
add ecx, edx
sub ebx, 0x10
add edi, ecx
add esi, 0x10
sub eax, 1
jne 0x48c2f0
test ebx, ebx
je 0x48c38f
movzx eax, byte [esi]
add ecx, eax
dec ebx
inc esi
add edi, ecx
test ebx, ebx
jne 0x48c382
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
mov eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
ret

Function at 0x4a3541
Capabilities:
Compute adler32 checksum

Disassembly:
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 5]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 6]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 7]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 8]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 9]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xa]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xb]
add edi, ecx
add ecx, edx
movzx edx, byte [esi + 0xc]
Function at 0x659ae1
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jge 0x659b23
push edx
pushal
cmpsd dword [esi], dword es:[edi]
ja 0x659b4b
mov edx, 0xf9da74b8
or eax, 0xc5f920b2
salc
cmp byte [eax], ch
out 6, eax
les edx, [edi]
salc
and byte [edx - 0x5e], bh
dec ecx
invalid
mov eax, 0xd7566021
cmp ecx, dword fs:[ebp - 0x16a8c33c]
mov bl, 0x6f
push eax
ret
pop edi
jns 0x659bc9
les edx, [ecx + 0x3beafd14]
test dword [eax + 0x46146f7b], ebp
mov eax, 0xe48acb4b
aas
imul eax, edi, 0x2c
mov ebp, 0x2c5eb409
pop ecx
mov cl, 0x1b
inc edi
sub byte [ebx - 0xb], bh
push esi
cmp dword [edx - 0x10], ecx
iretd
or al, 0x55
shl byte [edi], 1
invalid
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00408e60
mov cx, word [esp + 0x74]
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 1
push 0
mov word [esp + 0x64], cx
mov ecx, dword [esp + 0x80]
push 0
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
mov dword [esp + 0x90], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x40109d
cmp byte [esp + 0x6c], 0
je 0x401089
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x68]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
mov eax, dword [esp + 0x68]
pop esi
add esp, 0x5c
ret
Function at 0x401650
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x60
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
push esi
push edi
push 0x44
mov edi, eax
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00408e60
add esp, 0xc
xor ecx, ecx
mov eax, ebp
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 1
mov word [esp + 0x58], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401690
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4016a6
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov ebx, eax
mov eax, str.xcopy__E__Q__Y
mov edx, ebx
add esp, 4
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4016e0
mov eax, edi
mov edx, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4016f3
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401703
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401722
mov eax, dword [0x410320]
mov dword [edi], eax
mov eax, ebp
mov edx, ebp
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401740
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401750
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x4017c1
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
test ebx, ebx
je 0x4017ce
push ebx
call fcn.00403545
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
neg eax
pop ebp
sbb eax, eax
pop ebx
add esp, 0x60
ret
Function at 0x4017e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x60
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
push esi
push edi
push 0x44
mov edi, eax
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00408e60
add esp, 0xc
xor ecx, ecx
mov eax, ebp
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 1
mov word [esp + 0x58], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401820
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401836
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov ebx, eax
mov eax, str.xcopy__Q__Y
mov edx, ebx
add esp, 4
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401870
mov eax, edi
mov edx, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401883
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401893
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4018b2
mov eax, dword [0x410320]
mov dword [edi], eax
mov eax, ebp
mov edx, ebp
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4018d0
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4018e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x401951
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
test ebx, ebx
je 0x40195e
push ebx
call fcn.00403545
add esp, 4
mov eax, dword [esp + 0x14]
pop edi
pop esi
neg eax
pop ebp
sbb eax, eax
pop ebx
add esp, 0x60
ret
Function at 0x402110
Capabilities:
Copy file

Disassembly:
mov eax, dword [0x413f78]
lea edx, [eax + 2]
jmp 0x402120
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402120
sub eax, edx
push ebx
sar eax, 1
push ebp
push esi
mov edx, eax
mov eax, dword [0x413f80]
push edi
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402140
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 0xf]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov ecx, dword [0x413f78]
mov ebp, eax
add esp, 4
mov edx, ebp
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x402176
lea eax, [ebp - 2]
lea ebx, [ebx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402190
mov ecx, dword [str.instcore_]
mov dword [eax], ecx
mov edx, dword [0x410408]
mov dword [eax + 4], edx
mov ecx, dword [0x41040c]
mov dword [eax + 8], ecx
mov edx, dword [0x410410]
mov dword [eax + 0xc], edx
mov ecx, dword [0x410414]
mov dword [eax + 0x10], ecx
mov dx, word [0x410418]
mov word [eax + 0x14], dx
mov eax, dword [0x413f80]
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4021e0
sub eax, edx
lea edi, [ebp - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4021f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 2]
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402210
mov ecx, dword [0x41041c]
mov dword [eax], ecx
mov edx, dword [0x410420]
mov dword [eax + 4], edx
mov eax, dword [0x413f74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402235
sub eax, edx
sar eax, 1
jmp loc.00427c80
Function at 0x402340
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x1c
mov eax, dword [0x41203c]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x413f78], 0
push ebx
push esi
push edi
jne 0x402470
cmp dword [0x413f74], 0
jne 0x4023a1
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push str.Temp
call edi
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
add esp, 4
push esi
push eax
push str.Temp
mov dword [0x413f74], eax
call edi
mov eax, dword [0x413f74]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xffffffff
je 0x4023be
test al, 0x10
jne 0x4023e2
mov ecx, dword [0x413f74]
push 0
push ecx
call ebx
test eax, eax
jns 0x4023e2
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00403536
add esp, 0x1c
ret
mov edx, dword [0x413f74]
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4023f0
sub eax, esi
sar eax, 1
cmp word [edx + eax*2 - 2], 0x5c
je 0x402419
push 0x413f74
mov eax, 0x410368
call fcn.00401970
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xa
lea edx, [esp + 0x10]
push edx
push eax
call fcn.00403bdb
push 0x413f74
mov eax, str.ans_install_tmp
call fcn.00401970
push 0x413f74
lea eax, [esp + 0x20]
call fcn.00401970
mov eax, dword [0x413f74]
add esp, 0x14
push eax
call edi
cmp eax, 0xffffffff
je 0x40245d
test al, 0x10
jne 0x402470
mov ecx, dword [0x413f74]
push 0
push ecx
call ebx
test eax, eax
js 0x4023cd
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403536
add esp, 0x1c
ret
Function at 0x402860
Capabilities:
Get session user name
Query environment variable
Set environment variable

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
lea eax, [esp + 0xc]
push eax
push 0
mov dword [esp + 0x14], 0
call esi
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov edi, eax
add esp, 4
lea eax, [esp + 0xc]
push eax
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.usrnam
call esi
test edi, edi
je 0x4028bd
push edi
call fcn.00403545
add esp, 4
push 0xa
call fcn.0040352b
mov ebx, eax
mov eax, 0x4104c4
mov edx, ebx
add esp, 4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4028d2
push 0xa
call fcn.0040352b
mov edi, eax
mov eax, str.15.0
mov edx, edi
add esp, 4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4028f6
push ebx
push str.ANSYS_REVN
call esi
push edi
push str.ANSYS_REVN_RL
call esi
mov ecx, dword [0x413f74]
push ecx
push str.ansTmpDir
call esi
mov edx, dword [0x413f78]
push edx
push str.mountDirectory
call esi
cmp byte [0x413f85], 0
push 0
push 0
push str.ICEMCFD_SYSDIR
je 0x402984
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x402959
push str.win64_amd
jmp 0x428450
push str._Windows_x64_
push str.ANSYS_SYSTEM_NAME
call esi
push str.win32
push str.ANSYS_SYSDIR32
call esi
push str.winx64
push str.ANSYSLIC_SYSDIR
call esi
push str.WINX64
jmp 0x4029c3
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40299a
push 0x410618
push str.ICEMCFD_SYSDIR
call esi
push str._Windows_32_
push str.ANSYS_SYSTEM_NAME
call esi
push str.intel
push str.ANSYS_SYSDIR32
call esi
push str.win32
push str.ANSYSLIC_SYSDIR
call esi
push str.WIN32
push 0x410610
call esi
mov eax, dword [0x413f80]
push eax
push str.SYSDIR
call esi
mov ecx, dword [0x413f80]
push ecx
push str.ANSYS_SYSDIR
call esi
push 0x4102cc
push str.ANSYS_SUBSYS
call esi
test ebx, ebx
je 0x4029fe
push ebx
call fcn.00403545
add esp, 4
test edi, edi
je 0x402a0b
push edi
call fcn.00403545
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x402fa0
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x210
mov eax, dword [0x41203c]
xor eax, esp
mov dword [esp + 0x20c], eax
xor eax, eax
jmp 0x402fc0
movzx ecx, word [eax + 0x4102cc]
mov word [esp + eax + 4], cx
add eax, 2
test cx, cx
jne 0x402fc0
push ebx
push ebp
push edx
push 0
push 0x410
mov byte [esp + 0x17], cl
xor bl, bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x4030c1
push 0x104
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x4030c1
push edi
push 0xa
call fcn.0040352b
mov edi, eax
mov eax, 0x410368
mov edx, edi
add esp, 4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403023
push esi
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.00403c2e
mov esi, eax
add esp, 8
test esi, esi
je 0x4030b2
push 0xf
push str.ans_install_tmp
push esi
call fcn.00403bf5
add esp, 0xc
test eax, eax
jne 0x403060
mov byte [esp + 0x13], 1
mov ecx, dword [esp + 0x224]
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403096
test dx, dx
je 0x403092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403096
add eax, 4
add ecx, 4
test dx, dx
jne 0x403070
xor eax, eax
jmp 0x40309b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4030a1
mov bl, 1
push edi
push 0
call fcn.00403c2e
mov esi, eax
add esp, 8
test esi, esi
jne 0x403047
pop esi
test edi, edi
je 0x4030c0
push edi
call fcn.00403545
add esp, 4
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
test bl, bl
pop ebx
je 0x4030ec
cmp byte [esp + 3], 0
je 0x4030ec
mov al, 1
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00403536
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
xor al, al
call fcn.00403536
add esp, 0x210
ret

Function at 0x4034a0
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push edi
push 0
push 0
push str.PROCESSOR_IDENTIFIER
call ebp
xor ecx, ecx
mov edi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
add esp, 4
push edi
mov esi, eax
push esi
push str.PROCESSOR_IDENTIFIER
call ebp
push str.EM64T
push esi
call fcn.00403eaa
add esp, 8
test eax, eax
jne 0x403515
push str.AMD64
push esi
call fcn.00403eaa
add esp, 8
test eax, eax
jne 0x403515
push str.Intel64
push esi
call fcn.00403eaa
jmp loc.004270c8
mov bl, 1
test esi, esi
je 0x403524
push esi
call fcn.00403545
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret

Function at 0x403536
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41203c]
jne 0x403540
repz ret
jmp fcn.004041b4
Function at 0x40ac00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
je 0x40ac3d
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40ac35
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40ac3f
inc edx
add eax, 0x28
cmp edx, esi
jb 0x40ac25
xor eax, eax
jmp 0x4274b0

Function at 0x40ad0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41203c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405c15
and dword [ebp - 0x14], 0
cmp dword [0x413f10], 0
mov dword [ebp - 0x18], eax
jne 0x40adbf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ae67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40ae67
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413f10], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413f14], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413f18], eax
call edi
push eax
call esi
mov dword [0x413f20], eax
test eax, eax
je 0x40adbf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413f1c], eax
mov eax, dword [0x413f1c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ae18
cmp dword [0x413f20], ecx
je 0x40ae18
push eax
call esi
push dword [0x413f20]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ae18
test ebx, ebx
je 0x40ae18
call edi
test eax, eax
je 0x40ae0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ae0f
test byte [ebp - 8], 1
jne 0x40ae18
or dword [ebp + 0x10], 0x200000
jmp 0x40ae4b
mov eax, dword [0x413f14]
cmp eax, dword [ebp - 0x18]
je 0x40ae4b
push eax
call esi
test eax, eax
je 0x40ae4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ae4b
mov eax, dword [0x413f18]
cmp eax, dword [ebp - 0x18]
je 0x40ae4b
push eax
call esi
test eax, eax
je 0x40ae4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413f10]
call esi
test eax, eax
je 0x40ae67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ae69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403536
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401923
push esp
mov dword [ebp - 0x24], 0x401640
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019c2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019a3
pop ebp
ret 0x10