joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464460
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48d5b4]
cmp dword [eax + 0x30], 0
je 0x46450a
cmp dword [ebx + 0x94], 0
jne 0x464504
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4643f0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x464504
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4644ca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x464504
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004155dc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4644d9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x465224
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x465259
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f5c
jmp 0x465266
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404ec0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x466640
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4666ae
mov eax, esi
call fcn.004507c0
test al, al
je 0x4666ae
mov eax, dword [ebx + 0x84]
call fcn.00450420
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4666ae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4666a2
push 0
mov eax, dword [ebx + 0x84]
call fcn.00450420
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00448730
jmp 0x4666ae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046647c
pop esi
pop ebx
ret
Function at 0x483e5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
call fcn.00404e6c
push esp
push 0x20019
push 0
mov eax, esi
call fcn.00405330
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x483edc
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
mov eax, edi
call fcn.00405330
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x483ed3
cmp dword [esp + 4], 0
jle 0x483ed3
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004050dc
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x110
pop edi
pop esi
pop ebx
ret
Function at 0x427e78
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427b38

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x419b24
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x46b008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x250
push eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x254]
push eax
call fcn.0042f710
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push str..unverified
push dword [ebp + 8]
call main
test eax, eax
js 0x419b85
push 7
push dword [ebp - 0x258]
call main
cmp dword [ebp + 8], 0
jne 0x419c6c
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 0xc]
call main
test eax, eax
js 0x419c6c
lea eax, [ebp - 0x260]
push eax
push 0x44b8e8
push dword [ebp - 0x258]
call main
test eax, eax
js 0x419c6c
push esi
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x419c6b
test byte [ebp - 0x254], 0x10
jne 0x419c52
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 2
jbe 0x419c2a
push 0x2e
pop ecx
cmp cx, word [ebp + eax*2 - 0x22c]
jne 0x419c2a
movzx eax, word [ebp + eax*2 - 0x22a]
push 0x52
pop ecx
cmp cx, ax
je 0x419c52
push 0x72
pop ecx
cmp cx, ax
je 0x419c52
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
call main
test eax, eax
js 0x419c52
push dword [ebp - 0x25c]
call main
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x419be4
push esi
call dword [sym.imp.kernel32.dll_FindClose]
pop esi
cmp dword [ebp - 0x25c], 0
je 0x419c80
push dword [ebp - 0x25c]
call main
cmp dword [ebp - 0x260], 0
je 0x419c94
push dword [ebp - 0x260]
call main
cmp dword [ebp - 0x258], 0
je 0x419ca8
push dword [ebp - 0x258]
call main
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042de30
leave
ret 8
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40108c
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00402000
push 5
call sub.USER32.DLL_GetDesktopWindow
push eax
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
push dword [0x4054ac]
push dword [0x4054ac]
push 0x3e7
call fcn.00402140
lea eax, [esp + 0xc]
push eax
call fcn.00403350
push 0x3e7
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextW
push 1
push dword [esp + 4]
push dword [esp + 0x10]
call fcn.00402190
mov ebx, eax
and ebx, ebx
je 0x401108
push dword [esp + 4]
pop eax
mov dword [esp + 0xc], eax
jmp 0x40111a
push 2
push dword [esp + 8]
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
je 0x40112c
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40112c
jmp 0x401133
mov eax, 1
jmp 0x401135
xor eax, eax
and eax, eax
je 0x4010b3
mov eax, dword [esp + 0xc]
jmp 0x401145
push dword [esp]
call fcn.004033d0
push dword [esp + 8]
call fcn.004033d0
add esp, 0x10
pop ebx
ret 4

Function at 0x40115d
Capabilities:
Hide graphical window

Disassembly:
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401162
push dword [0x4054ac]
push dword [0x4054ac]
push dword [0x4054ac]
push dword [0x4054ac]
call fcn.00402671
mov edx, dword [0x4050c0]
add dword [esp], edx
call fcn.00403055
lea eax, [esp + 4]
push eax
call fcn.00403350
mov edx, dword [esp]
push dword [0x4054ac]
push edx
call fcn.00403400
mov edx, str...configiwp_win.ini
push edx
call fcn.00403400
lea eax, [esp + 8]
push eax
call fcn.00403350
push dword [esp + 4]
call fcn.00402ae1
mov eax, str.vmports
push eax
call fcn.00402b1f
push dword [0x4054ac]
push dword [0x4054ac]
push dword [0x4054ac]
mov eax, str.10000
push eax
mov eax, str.PortOffset
push eax
call fcn.00402c13
mov edx, dword [0x4050c0]
add dword [esp], edx
call fcn.00402200
pop dword [0x4054ac]
push edx
push eax
fild qword [esp]
pop eax
fstp dword [esp]
pop eax
mov dword [esp + 8], eax
push dword [0x4054ac]
push dword [0x4054ac]
push dword [0x4054ac]
mov eax, 0x405024
push eax
mov eax, 0x4050aa
push eax
call fcn.00402c13
mov edx, dword [0x4050c0]
add dword [esp], edx
call fcn.00402200
pop dword [0x4054ac]
push edx
push eax
fild qword [esp]
pop eax
fstp dword [esp]
pop eax
mov dword [esp + 0xc], eax
call fcn.00402d07
fld dword [esp + 8]
fadd dword [esp + 0xc]
fadd dword [0x4050b4]
fstp dword [esp + 0x10]
push 0x7530
call fcn.00402119
push dword [0x4054ac]
mov edx, str.QEMU__IWPServer_
push edx
call fcn.00403400
push dword [0x4054ac]
push dword [0x4054ac]
fld dword [esp + 0x1c]
sub esp, 8
fistp qword [esp]
call fcn.00402340
pop eax
mov edx, 0x405020
push edx
call fcn.00403400
lea eax, [esp + 0x18]
push eax
call fcn.00403350
push dword [esp + 0x14]
call fcn.0040108c
mov dword [esp + 0x18], eax
push 0
push dword [esp + 0x1c]
call sub.USER32.DLL_ShowWindow
xor eax, eax
push dword [esp]
call fcn.004033d0
push dword [esp + 4]
call fcn.004033d0
push dword [esp + 0x14]
call fcn.004033d0
add esp, 0x1c
ret
Function at 0x401114
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d004]
jne 0x40111e
repz ret
jmp fcn.004018f5

Function at 0x4065db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402861
and dword [ebp - 0x14], 0
cmp dword [0x42fda4], 0
mov dword [ebp - 0x18], eax
jne 0x40668e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406736
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406736
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42fda4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42fda8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42fdac], eax
call edi
push eax
call esi
mov dword [0x42fdb4], eax
test eax, eax
je 0x40668e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42fdb0], eax
mov eax, dword [0x42fdb0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4066e7
cmp dword [0x42fdb4], ecx
je 0x4066e7
push eax
call esi
push dword [0x42fdb4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4066e7
test ebx, ebx
je 0x4066e7
call edi
test eax, eax
je 0x4066de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4066de
test byte [ebp - 8], 1
jne 0x4066e7
or dword [ebp + 0x10], 0x200000
jmp 0x40671a
mov eax, dword [0x42fda8]
cmp eax, dword [ebp - 0x18]
je 0x40671a
push eax
call esi
test eax, eax
je 0x40671a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40671a
mov eax, dword [0x42fdac]
cmp eax, dword [ebp - 0x18]
je 0x40671a
push eax
call esi
test eax, eax
je 0x40671a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42fda4]
call esi
test eax, eax
je 0x406736
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406738
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401114
leave
ret
Function at 0x421b80
Capabilities:
Create pipe

Disassembly:
sub esp, 0x41c
mov eax, dword [0x42d004]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [esp + 0x420]
mov eax, dword [eax]
push ebx
mov ebx, dword [0x431b3c]
push edi
mov edi, dword [0x433fbc]
call fcn.00421ac0
cmp dword [0x433fbc], 0x2f
jne 0x421c14
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00421af0
mov ecx, dword [esp + 0x420]
pop edi
pop ebx
xor ecx, esp
call fcn.00401114
add esp, 0x41c
ret
Function at 0x422030
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x433fbc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push edi
mov ebx, 0x1519af
mov edi, 0x8e46a6f0
jmp 0x422050
mov dword [0x433c24], edi
cmp eax, 0x3dc
jne 0x42206a
push 0
push 0
push 0
call esi
mov eax, dword [0x433fbc]
dec ebx
jne 0x422050
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
xor esi, esi
jmp 0x422080
cmp eax, 0xa5f
jne 0x4220a2
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
mov eax, dword [0x433fbc]
cmp esi, 0x846143
jne 0x4220b9
mov eax, dword [0x42ebf0]
add eax, 0xa231
mov dword [0x433fbc], eax
cmp eax, 0x141
jne 0x4220d4
mov dword [0x4302c8], 0xec58acac
mov dword [0x4302cc], 0xffffffff
inc esi
cmp esi, 0x12d12ba
jl 0x422080
call fcn.00421c30
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x300093c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30009436
mov eax, dword [ebp + 8]
test eax, 3
je 0x300093f8
cmp word [eax], 0
je 0x300093f1
lea eax, [eax + 2]
test eax, 3
je 0x300093f8
jmp 0x300093df
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30009433
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x300093f8
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30009433
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30009433
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x300093f8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x3000bfd5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30004144]
jne 0x3000c546
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30011ee8], eax
mov dword [0x30011ee4], ecx
mov dword [0x30011ee0], edx
mov dword [0x30011edc], ebx
mov dword [0x30011ed8], esi
mov dword [0x30011ed4], edi
mov word [0x30011f00], ss
mov word [0x30011ef4], cs
mov word [0x30011ed0], ds
mov word [0x30011ecc], es
mov word [0x30011ec8], fs
mov word [0x30011ec4], gs
pushfd
pop dword [0x30011ef8]
mov eax, dword [ebp]
mov dword [0x30011eec], eax
mov eax, dword [ebp + 4]
mov dword [0x30011ef0], eax
lea eax, [ebp + 8]
mov dword [0x30011efc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30011e38], 0x10001
mov eax, dword [0x30011ef0]
mov dword [0x30011dec], eax
mov dword [0x30011de0], 0xc0000409
mov dword [0x30011de4], 1
mov eax, dword [0x30004144]
mov dword [ebp - 0x328], eax
mov eax, dword [0x30011d14]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x30011e30], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x30004180
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x30011e30], 0
jne 0x3000c636
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x3000c356
Capabilities:
Encode data using add xor sub operations

Disassembly:
pushal
xchg eax, eax
test ebp, 0x6bc05635
test edi, ebx
imul eax, edi, 0x8ab7e545
mov eax, edx
mov edi, ecx
push 0x1cb426
cmp ebp, 0xb671
jo 0x3000c326
sbb dh, bh
imul ebp, ecx, 0x5f1489bd
mov eax, ecx
push 0x2bac8c
push 0x65f038
mov ah, cl
adc al, 0x6d
call 0x3000c356
dec ebx
mov ah, dl
jmp 0x3000c347
mov bh, 0x87
inc eax
mov edx, 0x2575e7ed
cmp ecx, 0xb103
add byte [eax], al
xor al, 0x4f
or eax, 0xa7642f0e
mov eax, ebp
or edx, 0xef6f6296
mov ah, 0x68
add dh, ch
sub esi, ebx
add ebp, 0x636d
xchg ah, cl
mov ah, 0xb
inc ecx
pop ebx
sub eax, 0xbcbdd614
xchg edi, eax
dec edi
imul edx, edi
dec ebp
imul edi, ebx
scasd eax, dword es:[edi]
sti
add edx, edx
test dh, 0xc2
movzx ebp, bl
mov dl, 0xe2
or dl, dl
sub edi, ecx
imul esi, edx
xor esi, 0xf0dc2110
lea edi, [0x435213f0]
xchg eax, ecx
mov ebp, 0x19434
test dl, bh
sub ebp, 0xdb977
imul edi, ebx, 0xf53b69fd
Function at 0x3000c387
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
xchg eax, eax
test ebp, 0x6bc05635
test edi, ebx
imul eax, edi, 0x8ab7e545
mov eax, edx
mov edi, ecx
push 0x1cb426
cmp ebp, 0xb671
jo 0x3000c326
sbb dh, bh
imul ebp, ecx, 0x5f1489bd
mov eax, ecx
push 0x2bac8c
push 0x65f038
mov ah, cl
adc al, 0x6d
call 0x3000c356
dec ebx
mov ah, dl
jmp 0x3000c347
mov bh, 0x87
inc eax
mov edx, 0x2575e7ed
cmp ecx, 0xb103
add byte [eax], al
xor al, 0x4f
or eax, 0xa7642f0e
mov eax, ebp
or edx, 0xef6f6296
mov ah, 0x68
add dh, ch
sub esi, ebx
add ebp, 0x636d
xchg ah, cl
mov ah, 0xb
inc ecx
pop ebx
sub eax, 0xbcbdd614
xchg edi, eax
dec edi
imul edx, edi
dec ebp
imul edi, ebx
scasd eax, dword es:[edi]
sti
add edx, edx
test dh, 0xc2
movzx ebp, bl
mov dl, 0xe2
or dl, dl
sub edi, ecx
imul esi, edx
xor esi, 0xf0dc2110
lea edi, [0x435213f0]
xchg eax, ecx
mov ebp, 0x19434
test dl, bh
sub ebp, 0xdb977
imul edi, ebx, 0xf53b69fd

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.004015fd
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401eca
sub eax, fcn.00401695
push eax
push fcn.00401695
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401079
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401527
mov eax, ebx
call fcn.00401578
mov eax, 0x40b054
lea edx, [ebx + 0x1b600]
or al, 1
imul eax, ebx
or edx, ebx
mov ebx, 0x40b054
sub ebx, eax
mov eax, ebx
lea ebx, [ebp - 2]
call fcn.00401695
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop edx
pop ecx
pop ebx
ret

Function at 0x4015fd
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path

Disassembly:
push ebx
push ecx
push edx
enter 0x324, 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x104
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0
push 0
call dword [sym.imp.USER32.DLL_GetSystemMenu]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
lea eax, [ebp - 0x324]
push eax
movzx ebx, byte [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebx - 0x41]
leave
pop edx
pop ecx
pop ebx
ret
Function at 0x1000100a
Capabilities:
Enumerate gui resources
Get file size
Read file on windows

Disassembly:
jmp 0x10001050
push ecx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.s.dat
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 4]
push 0
push ecx
push eax
push 0x1002d0c0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0x1002d0c0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
pop ecx
ret

Function at 0x10018f37
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10018f6f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100176a6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1001767e
jmp 0x10018f7b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4