joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fee0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
mov ecx, 0xfffffffe
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x41fef0
mov eax, ecx
sar eax, 1
and ecx, 0x12
xor eax, 9
add eax, ecx
jns 0x41ff10
mov eax, 0xffffffff
jmp 0x41ff12
add eax, eax
push eax
call fcn.00407fc0
add esp, 4
mov esi, eax
mov dword [esp], 0x5b7b5b43
mov dword [esp + 4], 0x5b6b5b44
mov dword [esp + 8], 0x5aba5ab7
mov dword [esp + 0xc], 0x5b445b41
mov word [esp + 0x10], 0x5ae7
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [esp + eax*2]
lea ebx, [eax - 0x661967a9]
mov ebp, ebx
xor ebp, ecx
lea edx, [ebp*2]
not edx
add edx, ebp
and edx, ebx
mov ebx, edx
and ebx, 0x99e6987d
mov ebp, edx
and ebp, 2
or edx, 2
imul edx, ebp
xor ebp, 2
imul ebp, ebx
sub edx, eax
add edx, ebp
add edx, 0x661967a9
mov ebx, ecx
not ebx
and ebx, edx
not edx
and edx, ecx
sub edx, ebx
add edx, 0x3d48
mov word [esp + eax*2], dx
lea ecx, [eax + eax]
and ecx, 2
xor eax, 1
add eax, ecx
cmp eax, 9
jb 0x41ff50
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x41ffe1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41ffd0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420011
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420000
mov word [eax], 0
mov eax, esp
push eax
push esi
call fcn.0043c000
add esp, 8
mov edi, eax
mov ebx, dword [esp]
jmp dword [0x442990]
Function at 0x42265d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x9c
mov dword [esp + 0x20], 0xde4dde2e
mov dword [esp + 0x24], 0xdf9edf9d
mov dword [esp + 0x28], 0xde61de4b
mov dword [esp + 0x2c], 0xde63df95
mov dword [esp + 0x30], 0xde68de26
mov dword [esp + 0x34], 0xdf9ede71
mov dword [esp + 0x38], 0xdfa6df92
mov dword [esp + 0x3c], 0xde5fde5d
mov dword [esp + 0x40], 0xde5edfa9
mov dword [esp + 0x44], 0xdfacdfa4
mov dword [esp + 0x48], 0xde5cde5b
mov dword [esp + 0x4c], 0xdfa0de41
mov dword [esp + 0x50], 0xde52dfac
mov dword [esp + 0x54], 0xdfaadfac
mov dword [esp + 0x58], 0xdfbbde52
lea eax, [esp + 0x5c]
mov word [esp + 0x5c], 0xde29
mov ecx, 0x8a93
mov edx, 0x3208756c
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, word [esp + ecx*2 - 0x11506]
lea esi, [ecx - 0x32090000]
mov edi, ecx
and edi, ebx
mov ebp, edx
and ebp, 0x20083438
and esi, 0xc4210807
or esi, ebp
xor esi, ebx
xor esi, 0x29deb6b8
or esi, edi
not esi
add esi, edi
mov edi, esi
xor edi, 0xab66
not esi
and esi, 0x2b66
add esi, esi
sub esi, edi
inc esi
mov word [esp + ecx*2 - 0x11506], si
inc ecx
dec edx
cmp ecx, 0x8ab2
jne 0x4225e0
lea esi, [esp + 0x5e]
lea edx, [esp + 0x20]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x9a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x4482dc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x6cdfac3d
xor edx, edx
mov al, 1
nop
movzx edi, word [esp + edx*2 + 0x20]
mov ebx, 0x82615e51
sub ebx, edx
or ebx, edi
mov ebp, edx
xor ebp, 0x11
mov ecx, edx
sub ecx, edx
sub ecx, edx
add ecx, 0x5e51
or ecx, ebp
and ecx, edi
not ebx
or ebx, ecx
mov edi, ebx
and edi, 0x110af28d
mov ecx, ebx
and ecx, 2
mov ebp, ecx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, ecx
xor ebx, 0x130af28f
add ebp, ebx
add ebp, edi
and ebx, 1
or ebp, 1
xor ebp, ebx
lea ecx, [ebx*2]
add ecx, ebp
mov word [esp + edx*2 + 0x20], cx
mov edx, 1
test al, 1
mov eax, 0
jne 0x422680
xor eax, eax
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x20]
setne al
xor ebx, ebx
jmp dword [eax*4 + 0x442eac]
Function at 0x4256dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44c
mov dword [esp + 0x4c], 0xb60eb60a
mov dword [esp + 0x50], 0xb61db61e
mov dword [esp + 0x54], 0xb640b600
mov dword [esp + 0x58], 0xa9f8b61a
mov dword [esp + 0x5c], 0xb672b614
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [eax + 0x79f1]
xor cx, word [esp + eax*2 + 0x4c]
add ecx, 0x3078
mov word [esp + eax*2 + 0x4c], cx
inc eax
cmp eax, 0xa
jne case.default.0x4256bf
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
lea ebp, [esp + 0x4c]
lea edi, [esp + 0x3c]
mov ecx, edi
push ebp
call fcn.004383e0
mov ecx, edi
push 0x410
call fcn.004385b0
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4435ac]
lea ecx, [esp + 0x3c]
call fcn.004386b0
mov eax, ebx
add esp, 0x44c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x4c], 0x3200c225
mov dword [esp + 0x50], 0xc02f1326
mov dword [esp + 0x54], 0x302a350d
mov dword [esp + 0x58], 0x2337340f
mov dword [esp + 0x5c], 0x3c000c1e
mov dword [esp + 0x60], 0x33010c03
mov dword [esp + 0x64], 0x322e102e
mov dword [esp + 0x68], 0x320e3201
mov dword [esp + 0x6c], 0xe032002
mov dword [esp + 0x70], 0x32167b07
mov dword [esp + 0x74], 0x4b65131d
mov eax, 0x4140
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [esp + eax*2 - 0x8234]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
add ecx, 0xca920000
mov edx, ecx
xor edx, 0xa01
and ecx, 0x75fe
add ecx, ecx
sub ecx, edx
inc ecx
mov word [esp + eax*2 - 0x8234], cx
inc eax
cmp eax, 0x4156
jne 0x425740
lea eax, [esp + 0x28]
lea ecx, [esp + 0x3c]
push 0
push 0x2b
push ebp
push eax
call fcn.00438940
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
xor eax, eax
cmp esi, edi
sete al
jmp dword [eax*4 + 0x4435b4]
mov eax, edi
sub eax, esi
sar eax, 2
imul eax, eax, 0x421
push eax
call fcn.00407fc0
add esp, 4
jmp dword [0x4435c8]
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x4d]
mov dword [esp + 0x34], ecx
xor ecx, ecx
mov dword [esp + 0x24], edi
cmp esi, edi
setne cl
mov dword [esp + 0x1c], eax
mov edi, eax
jmp dword [ecx*4 + 0x4435cc]
mov dword [esp + 0x10], esi
mov esi, dword [esi]
push 0x400
push 0
push ebp
call fcn.00408050
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0x3c]
push eax
push 0x400
push ebp
push esi
call fcn.004388d0
cmp eax, 0xc0000000
setae al
cmp dword [esp + 8], 0
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x4435dc]
mov ebx, dword [esp + 0x20]
mov eax, ebx
and al, 1
movzx eax, al
jmp dword [eax*4 + 0x4435d4]
jmp dword [0x443634]
xor ebx, ebx
jmp dword [0x443640]
Function at 0x42e900
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x288
mov dword [esp + 0x26c], 0x444368
mov dword [esp + 0xb4], 0
lea eax, [esp + 0xb4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x43f5e8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x43f5f8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x268], eax
mov eax, dword [esp + 0x26c]
mov ecx, dword [esp + 0x268]
mov edi, dword [eax + ecx*4]
mov ecx, dword [0x444370]
mov edx, ecx
or edx, 0x80e67c0e
and ecx, 0x80e67c0e
sub ecx, edx
add edi, ecx
mov dword [esp + 0x264], 0x444374
mov dword [esp + 0x25c], 0x444380
mov dword [esp + 0x254], 0x44438c
mov dword [esp + 0x24c], 0x444398
mov dword [esp + 0x244], 0x4443a4
mov dword [esp + 0x23c], 0x443a80
mov eax, dword [0x4443b0]
mov dword [esp + 0x14c], eax
mov dword [esp + 0x238], 0x4443b8
mov dword [esp + 0x230], 0x443a80
mov eax, dword [0x4443c4]
mov dword [esp + 0xdc], eax
mov dword [esp + 0x22c], 0x4443cc
mov dword [esp + 0x224], 0x4443d8
mov dword [esp + 0x21c], 0x443a80
mov ecx, dword [0x4443e4]
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x218], 0x4443ec
mov dword [esp + 0x210], 0x4443f8
mov dword [esp + 0x208], 0x443a80
mov ecx, dword [0x444404]
mov dword [esp + 0x178], ecx
mov dword [esp + 0x204], 0x44440c
mov dword [esp + 0x1fc], 0x444418
mov dword [esp + 0x1f4], 0x444424
mov dword [esp + 0x1ec], 0x444430
mov dword [esp + 0x1e4], 0x44443c
mov dword [esp + 0x1dc], 0x443a80
mov ecx, dword [0x444448]
mov dword [esp + 0x170], ecx
mov dword [esp + 0x1d8], 0x444450
mov dword [esp + 0x1d0], 0x44445c
mov dword [esp + 0x1c8], 0x444468
mov dword [esp + 0x1c0], 0x443a80
mov ecx, dword [0x444474]
mov dword [esp + 0x16c], ecx
mov dword [esp + 0x1bc], 0x443a80
mov eax, dword [0x44447c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x1b8], 0x443a80
mov ecx, dword [0x444484]
mov dword [esp + 0x168], ecx
mov dword [esp + 0x1b4], 0x44448c
mov dword [esp + 0x1ac], 0x443a80
mov ecx, dword [0x444498]
mov dword [esp + 0x174], ecx
mov dword [esp + 0x1a8], 0x443a80
mov esi, dword [0x4444a0]
mov dword [esp + 0x1a4], 0x443a80
mov edx, dword [0x4444a8]
mov dword [esp + 0x1a0], 0x443a80
mov ecx, dword [0x4444b0]
mov dword [esp + 0x19c], 0x443a80
mov eax, dword [0x4444b8]
mov dword [esp + 0x144], eax
mov dword [esp + 0x198], 0x443a80
mov ebx, dword [0x4444c0]
mov dword [esp + 0x164], ebx
mov dword [esp + 0x194], 0x443a80
mov eax, dword [0x4444c8]
mov dword [esp + 0x160], eax
mov dword [esp + 0x190], 0x443a80
mov ebx, dword [0x4444d0]
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x18c], 0x443a80
xor eax, eax
mov ebx, dword [0x4444d8]
jmp edi
Function at 0x4303e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.004133d0
sub esp, 0x10
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x430419
jmp 0x4305a8
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x430455
jmp 0x4305a2
mov dword [ebp - 0x14], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.00424300
add esp, 4
xor ebx, ebx
cmp eax, 0
je 0x430591
mov dword [ebp - 0x1c], eax
mov ebx, eax
add ebx, 1
sub esp, 4
mov dword [esp], ebx
call fcn.00407fc0
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.00408c30
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov word [edi], 0x84be
mov word [edi + 2], 0xf947
mov word [edi + 4], 0xf85d
mov word [edi + 6], 0xff51
mov word [edi + 8], 0xbb55
mov word [edi + 0xa], 0xf146
mov word [edi + 0xc], 0x6947
xor eax, eax
cmp eax, 7
jae 0x43055e
movzx ecx, word [edi + eax*2]
mov edx, eax
add edx, 1
mov ebx, eax
xor ebx, 0xffffffff
or ebx, 0x2d67ba55
add ebx, edx
shl ebx, 1
mov esi, eax
xor esi, 0x2d67ba55
add esi, ebx
mov ebx, esi
xor ebx, 0x42b7bf72
mov edx, esi
or edx, 0xbd48408d
and edx, ebx
and esi, 0x42b7bf72
xor esi, 0x42b7bf72
or edx, esi
xor edx, ecx
xor edx, 0x42b7bf72
mov ecx, edx
add ecx, 0x2d57
mov esi, 0x12a8
sub esi, edx
and esi, 0x3902
and ecx, 0xc6fd
add ecx, 1
sub ecx, esi
add cx, 0x3902
mov word [edi + eax*2], cx
add eax, 1
jmp 0x4304e1
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], edi
mov esi, dword [ebp - 0x18]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.00408dc0
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], esi
call fcn.00407fd0
add esp, 4
jmp 0x43058f
jmp 0x430591
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4305a2
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4383e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp], 0
mov eax, dword [0x4482e0]
mov edi, 0xffffffff
test eax, eax
je 0x438445
xor ecx, ecx
mov edx, dword [0x4482e4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x67f3d776
je 0x438420
inc ecx
cmp eax, ecx
jne 0x438410
jmp 0x438445
mov eax, dword [edx + ecx*8 + 4]
cmp eax, 0xffffffff
je 0x438445
mov ecx, esp
push ecx
push 0
push 0
push 5
push 0x10
push eax
push dword [0x4482e8]
call fcn.00439ac0
add esp, 0x1c
mov edi, eax
mov ebx, dword [esp + 0x20]
mov dword [esp + 4], 0x917dd178
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 + 4]
mov esi, 0xc263
sub esi, eax
mov ebp, esi
and ebp, edx
not edx
or edx, esi
add edx, eax
add edx, 0xaac83d9d
or edx, ebp
add edx, 0xa9be131f
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov word [esp + eax*2 + 4], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x438460
cmp edi, dword [esp + 4]
jne 0x438575
push dword [esp]
call fcn.00438390
add esp, 4
mov edx, dword [0x4482e0]
mov edi, 0xffffffff
test edx, edx
je 0x438516
mov ecx, dword [esp]
xor ebp, ebp
mov esi, dword [0x4482e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ebp*8], 0x67f3d776
je 0x4384f0
inc ebp
cmp edx, ebp
jne 0x4384e0
jmp 0x438516
mov edx, dword [esi + ebp*8 + 4]
cmp edx, 0xffffffff
je 0x438516
push 0
push ecx
push eax
push 5
push 0x10
push edx
push dword [0x4482e8]
mov esi, eax
call fcn.00439ac0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43856c
mov esi, dword [eax]
mov ecx, eax
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x438545
add edi, 2
cmp si, bp
je 0x438530
cmp si, bp
je 0x438557
mov esi, dword [ecx]
test esi, esi
jne 0x438520
mov edi, 0xc0000225
jmp 0x43856c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.004383b0
add esp, 4
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43b330
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], 0xeeffee2e
xor eax, eax
mov cl, 1
movzx edi, word [esp + eax*2]
mov edx, eax
or edx, 0x596e3a8e
lea ebx, [edi + edi]
not ebx
add ebx, edi
mov ebp, eax
xor ebp, 1
mov esi, 0xc571
sub esi, eax
or esi, ebp
and esi, edi
not edi
or edi, ebx
and edi, edx
or esi, edi
mov ebx, esi
not ebx
lea edi, [esi + ebx*2]
mov edx, 0xfffffffe
sub edx, edi
mov ebp, edx
xor ebp, 0xd470
mov edi, edx
or edi, 0x2b8f
and edi, ebp
lea esi, [esi + ebx*2]
inc esi
mov ebx, esi
not ebx
and esi, 0xc315
and edx, 0x3cea
or edx, esi
xor edx, 0xe89a
and ebx, 0x2b8f
or ebx, edx
lea edx, [ebx + edi]
inc edx
mov word [esp + eax*2], dx
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x43b340
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43b790
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx ecx, word [eax]
mov dword [esp + 4], 0x1d827b5c
xor edx, edx
mov bl, 1
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + edx*2 + 4]
lea eax, [edx + edx*2]
mov edi, eax
xor edi, 0xac7e03c9
lea ebp, [esi + esi]
not ebp
add ebp, esi
and ebp, edi
xor eax, 0xfc36
and eax, esi
or eax, ebp
mov esi, eax
not esi
lea eax, [eax + esi*2]
mov esi, 0xffffe1b6
sub esi, eax
mov word [esp + edx*2 + 4], si
mov edx, 1
xor eax, eax
test bl, 1
mov ebx, 0
jne 0x43b7b0
xor edx, edx
cmp dword [esp + 4], ecx
setne dl
jmp dword [edx*4 + 0x445b48]
Function at 0x43bc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43bca0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x43bcbb
mov eax, 0xffffffff
jmp 0x43bcbe
add eax, 0xa
push eax
call fcn.00407fc0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43bd01
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43bcf0
mov word [ecx], 0
lea ecx, [edi*2 + 8]
mov word [esp + 8], cx
lea ecx, [edi*2 + 0xa]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x785d785e
xor ebx, ebx
mov dl, 1
nop
nop
nop
movzx edi, word [esp + ebx*2]
mov esi, 0x6366
sub esi, ebx
mov ecx, ebx
add ecx, 0x5d6e9c99
xor esi, ecx
and esi, edi
xor esi, ecx
mov ecx, esi
mov edi, esi
xor edi, 0x148b1b37
add edi, esi
and esi, 0x140a1b37
and ecx, 0x4964e4c8
sub edi, ecx
mov ecx, edi
and ecx, esi
xor edi, esi
lea ecx, [edi + ecx*2]
inc ecx
mov word [esp + ebx*2], cx
mov ebx, 1
test dl, 1
mov edx, 0
jne 0x43bd60
mov esi, dword [esp]
mov ecx, dword [0x4482e0]
test ecx, ecx
je 0x43be22
xor edx, edx
mov edi, dword [0x4482e4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x5f7891a5
je 0x43bde0
inc edx
cmp ecx, edx
jne 0x43bdd0
jmp 0x43be22
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43be22
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x4482e8]
mov edi, eax
call fcn.00439ac0
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00407fd0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2601130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, dword [0x2613cc8]
test ebp, ebp
je 0x2601198
cmp dword [esp + 0x10], 0
je 0x2601198
push esi
push 2
push 0x65
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x260115f
pop esi
pop edi
xor al, al
pop ebp
ret
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test ebx, ebx
je 0x2601191
test eax, eax
je 0x2601191
mov ecx, dword [esp + 0x18]
mov dword [ebp], ebx
pop ebx
pop esi
pop edi
mov dword [ecx], eax
mov al, 1
pop ebp
ret
pop ebx
pop esi
pop edi
xor al, al
pop ebp
ret
pop edi
xor al, al
pop ebp
ret
Function at 0x2601fc0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 8]
je 0x2602057
test ebp, ebp
je 0x2602057
mov eax, ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x2601fe0
sub eax, edx
push ebx
sar eax, 1
shr eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 2]
push edi
call fcn.02602b4f
mov esi, eax
add esp, 4
test esi, esi
je 0x2602052
push edi
push 0
push esi
call fcn.02605770
push esi
push ebp
mov eax, ebx
call fcn.026014d0
add esp, 0x14
xor eax, eax
test ebx, ebx
jbe 0x260202b
xor byte [eax + esi], bl
inc eax
cmp eax, ebx
jb 0x2602023
mov ecx, dword [esp + 0x18]
lea eax, [ebx + ebx]
push eax
push ecx
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov bl, 1
call fcn.02604b4e
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x2602900
Capabilities:
Read file on windows
Read pipe

Disassembly:
sub esp, 8
cmp dword [esp + 0xc], 0
push esi
push edi
mov esi, eax
je 0x26029df
cmp dword [esp + 0x18], 0
je 0x26029df
call fcn.02602870
test al, al
je 0x26029df
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor eax, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], eax
xor edi, edi
test eax, eax
ja 0x260296b
mov ecx, dword [esi + 0x20c]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push ecx
call ebx
push 0x3e8
call ebp
mov eax, dword [esp + 0x10]
inc edi
cmp edi, 0x14
jl 0x2602940
pop ebp
pop ebx
test eax, eax
je 0x26029df
push eax
call fcn.02602b4f
mov edi, eax
add esp, 4
test edi, edi
je 0x26029df
mov edx, dword [esp + 8]
push edx
push 0
push edi
call fcn.02605770
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x20c]
add esp, 0xc
push 0
lea eax, [esp + 0x10]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x26029d6
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 8]
jne 0x26029d6
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], edi
pop edi
mov dword [edx], eax
mov al, 1
pop esi
add esp, 8
ret 8
push edi
call fcn.02604b4e
add esp, 4
mov eax, dword [esi + 0x20c]
cmp eax, 0xffffffff
je 0x26029fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20c], 0xffffffff
pop edi
xor al, al
pop esi
add esp, 8
ret 8

Function at 0x2604512
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [str.FgGR]
jne 0x260451c
repz ret
jmp fcn.0260607c
Function at 0x260e0e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.02606f6e
and dword [ebp - 4], 0
cmp dword [0x2613be0], 0
mov ebx, eax
jne 0x260e19a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x260e24b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x260e24b
push eax
call fcn.02606efc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x2613be0], eax
call esi
push eax
call fcn.02606efc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x2613be4], eax
call esi
push eax
call fcn.02606efc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x2613be8], eax
call esi
push eax
call fcn.02606efc
pop ecx
mov dword [0x2613bf0], eax
test eax, eax
je 0x260e19a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.02606efc
pop ecx
mov dword [0x2613bec], eax
mov eax, dword [0x2613bec]
cmp eax, ebx
je 0x260e1f2
cmp dword [0x2613bf0], ebx
je 0x260e1f2
push eax
call fcn.02606f77
push dword [0x2613bf0]
mov esi, eax
call fcn.02606f77
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x260e1f2
test edi, edi
je 0x260e1f2
call esi
test eax, eax
je 0x260e1e9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x260e1e9
test byte [ebp - 0xc], 1
jne 0x260e1f2
or dword [ebp + 0x10], 0x200000
jmp 0x260e22b
mov eax, dword [0x2613be4]
cmp eax, ebx
je 0x260e22b
push eax
call fcn.02606f77
pop ecx
test eax, eax
je 0x260e22b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x260e22b
mov eax, dword [0x2613be8]
cmp eax, ebx
je 0x260e22b
push eax
call fcn.02606f77
pop ecx
test eax, eax
je 0x260e22b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2613be0]
call fcn.02606f77
pop ecx
test eax, eax
je 0x260e24b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x260e24d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret