joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b4230
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x6b4242
call fcn.006b3230
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x6b4286
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ClientNet::CUDPSession::Open___Socket_create_error_:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
push 4
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6b42d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ClientNet::CUDPSession::Open___setsockopt_error_:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x6b430f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ClientNet::CUDPSession::Open___bind_error_:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
push 3
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x6b434c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ClientNet::CUDPSession::Open___EventSelect_error_:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6b4370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
lea edx, [edi + 0x50]
lea ecx, [edi + 0x4c]
lea esi, [edi + 0x44]
mov ebx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 0x14]
jb 0x6b43a5
mov eax, dword [edx]
sub eax, dword [ecx]
add eax, dword [esi]
jne 0x6b4482
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov esi, edx
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
push 0
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax]
sub eax, ecx
mov dword [ebp - 8], 0
add eax, dword [edx]
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0x20], eax
lea eax, [edi + 0x54]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x10
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
je 0x6b4457
mov eax, dword [ebp - 4]
lea edx, [edi + 0x40]
mov dword [edi + 0x64], eax
mov eax, dword [ebp - 8]
add dword [ebx], eax
mov ecx, dword [edi + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, 0xffffffff
je 0x6b4427
mov eax, dword [ebx]
sub eax, dword [edi + 0x48]
je 0x6b4440
lea esi, [edi + 0x44]
push str.ClientNet::CUDPSession::Recv___UDP_packet_is_invalid_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 8
lea ecx, [edi + 0x40]
call fcn.006b23d0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
inc eax
mov edx, dword [ebp - 0x18]
jmp 0x6b4386
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x6b4482
call esi
push eax
push str.ClientNet::CUDPSession::Recv___WSARecvFrom_error_:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6b4490
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
push esi
push edi
lea ecx, [eax + 0x34]
mov dword [ebp - 4], eax
call fcn.006b26a0
mov esi, eax
mov dword [ebp - 8], 0
xor ebx, ebx
xor edi, edi
test esi, esi
je 0x6b457f
nop dword [eax + eax]
cmp edi, dword [ebp + 8]
jae 0x6b4571
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
push 0
push 0
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x14]
mov dword [ebp - 8], 0
push dword [eax + 0x10]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6b4538
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x6b456b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.ClientNet::CUDPSession::Send___WSASendTo_error_:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
push esi
call fcn.006b27a0
mov ecx, eax
call fcn.006b2720
mov ecx, dword [ebp - 4]
lea ecx, [ecx + 0x34]
call fcn.006b26a0
mov esi, eax
inc edi
test esi, esi
jne 0x6b44c0
cmp ebx, 0xffffffff
pop edi
setne al
pop esi
dec eax
pop ebx
mov esp, ebp
pop ebp
ret 4
xor ebx, ebx
test esi, esi
je 0x6b457f
mov ecx, dword [ebp - 4]
push 1
push esi
lea ecx, [ecx + 0x34]
call fcn.006b26d0
xor eax, eax
cmp ebx, 0xffffffff
pop edi
setne al
pop esi
dec eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6b48d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, 1
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edx + 0xd]
test edi, eax
lea ecx, [edx + 4]
cmove ecx, edx
rol eax, 1
mov edx, ecx
sub esi, 1
jne 0x6b48e2
test edi, 0x4000
lea eax, [edx + 0x10]
cmove eax, edx
test edi, 0x8000
mov edx, edi
lea ecx, [eax + 0x20]
cmove ecx, eax
test edi, 0x10000
lea eax, [ecx + 4]
cmove eax, ecx
test edx, 0x10000
lea ecx, [eax + 1]
cmove ecx, eax
test edi, 0x20000
lea eax, [ecx + 4]
cmove eax, ecx
test edi, 0x40000
lea ecx, [eax + 8]
cmove ecx, eax
test edi, 0x80000
lea eax, [ecx + 4]
cmove eax, ecx
test edi, 0x100000
lea ecx, [eax + 1]
cmove ecx, eax
test edi, 0x200000
lea eax, [ecx + 1]
cmove eax, ecx
test edi, 0x400000
lea ecx, [eax + 4]
cmove ecx, eax
test edi, 0x800000
lea eax, [ecx + 4]
cmove eax, ecx
test edi, 0x1000000
lea ecx, [eax + 4]
cmove ecx, eax
test edi, 0x2000000
lea eax, [ecx + 4]
cmove eax, ecx
test edi, 0x4000000
lea ecx, [eax + 8]
cmove ecx, eax
test edi, 0x8000000
lea eax, [ecx + 2]
cmove eax, ecx
test edi, 0x10000000
lea ecx, [eax + 2]
cmove ecx, eax
test edi, 0x20000000
lea edx, [ecx + 2]
cmove edx, ecx
test edi, 0x40000000
pop edi
pop esi
lea eax, [edx + 1]
cmove eax, edx
pop ebp
ret
Function at 0x6c1f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x71a808
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00451630
add esp, 0xc
push 2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x6c3110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.006dfb70
mov eax, dword [0x766480]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1004]
push eax
call fcn.006c3270
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
push str.Error__line__d__:__s
call fcn.006c30a0
add esp, 0x18
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x6c3160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.006dfb70
mov eax, dword [0x766480]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push eax
call fcn.006c3270
lea eax, [ebp - 0x1004]
push eax
push str.Error_:__s
call fcn.006c30a0
add esp, 0x14
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x6c31b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Error__line__d__:__s
call fcn.006c30a0
add esp, 0xc
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x6c8150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
shr edx, 2
movd xmm0, edi
pshufd xmm1, xmm0, 0
test edx, edx
je 0x6c81c7
cmp edx, 0x10
jb 0x6c81c7
mov ecx, edx
push ebx
and ecx, reloc.WS2_32.dll_ntohs
jns 0x6c8185
dec ecx
or ecx, 0xfffffff0
inc ecx
mov ebx, edx
sub ebx, ecx
lea ecx, [esi + 0x20]
nop dword [eax]
movups xmm0, xmmword [ecx - 0x20]
add eax, 0x10
lea ecx, [ecx + 0x40]
xorps xmm0, xmm1
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
xorps xmm0, xmm1
movups xmmword [ecx - 0x50], xmm0
movups xmm0, xmmword [ecx - 0x40]
xorps xmm0, xmm1
movups xmmword [ecx - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x30]
xorps xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
cmp eax, ebx
jl 0x6c8190
pop ebx
cmp eax, edx
jge 0x6c81d8
nop dword [eax + eax]
xor dword [esi + eax*4], edi
inc eax
cmp eax, edx
jl 0x6c81d0
pop edi
pop esi
pop ebp
ret

Function at 0x6cb140
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push str.LUA_PATH
push esi
call fcn.006c9670
push 0xffffd8ef
push esi
call fcn.006c9070
push 0xffffffffffffffff
push esi
call fcn.006c9dd0
push 0xfffffffffffffffe
push esi
mov edi, eax
call fcn.006c9b50
add esp, 0x20
test edi, edi
je 0x6cb17d
mov eax, edi
pop edi
pop esi
pop ebp
ret
push str.LUA_PATH
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov ecx, str.___.lua
test eax, eax
cmovne ecx, eax
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x6cd3e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [ebp + 8]
mov esi, 1
call fcn.006c90c0
mov ebx, eax
add esp, 4
sub ebx, esi
je 0x6cd4d6
push edi
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 8]
dec ebx
call fcn.006c9ee0
add esp, 8
cmp eax, 3
jne 0x6cd49d
test esi, esi
je 0x6cd442
push edi
push dword [ebp + 8]
call fcn.006c9cb0
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.00451630
add esp, 0x10
test eax, eax
jg 0x6cd4cc
xor esi, esi
inc edi
test ebx, ebx
jne 0x6cd404
pop edi
test esi, esi
jne 0x6cd4d6
mov ebx, dword [ebp + 8]
push ebx
call fcn.006c9630
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call esi
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
push eax
push 0x701a68
push ebx
call fcn.006c95a0
call esi
add esp, 0xc
movd xmm0, dword [eax]
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
push ebx
call fcn.006c9650
add esp, 0xc
mov eax, 3
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
call fcn.006d0df0
add esp, 0xc
test esi, esi
je 0x6cd442
push dword [ebp + 0xc]
push dword [ebp - 4]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x6cd442
mov esi, 1
jmp 0x6cd444
push 1
push dword [ebp + 8]
call fcn.006c94f0
add esp, 8
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6cd700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x766480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
mov dword [ebp - 0x218], ebx
call fcn.006d0d10
mov edi, dword [ebp + 0x10]
add esp, 8
mov ebx, dword [ebp - 0x214]
mov esi, 0x200
nop word [eax + eax]
lea eax, [ebp - 0x210]
push eax
call fcn.006d1780
cmp esi, edi
mov ecx, edi
push ebx
cmovbe ecx, esi
mov esi, ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add dword [ebp - 0x210], eax
add esp, 0x14
sub edi, eax
je 0x6cd781
cmp eax, esi
je 0x6cd750
lea eax, [ebp - 0x210]
push eax
call fcn.006d17c0
mov ebx, dword [ebp - 0x218]
add esp, 4
test edi, edi
je 0x6cd7ba
push 0xffffffffffffffff
push ebx
call fcn.006c9c00
add esp, 8
test eax, eax
jne 0x6cd7ba
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006dfb52
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006dfb52
mov esp, ebp
pop ebp
ret

Function at 0x6d2460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x6d2481
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x44], eax
mov eax, dword [ecx + 0x58]
push 1
add eax, 4
push eax
call sub.VCRUNTIME140.dll_longjmp
mov eax, dword [ecx + 0x10]
push ecx
mov eax, dword [eax + 0x28]
call eax
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x6e09b1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6e09f0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6e09f0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6e09f0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6e09f0
cmp dword [ecx + 0x74], 0xe
jbe 0x6e09f0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5a5d59ab
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x900e34b5
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617
Function at 0x10001f0b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001d058]
jne 0x10001f15
repz ret
jmp fcn.1000359a

Function at 0x1000b06c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001d058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100045b5
and dword [ebp - 0x14], 0
cmp dword [0x1001f0c4], 0
mov dword [ebp - 0x18], eax
jne 0x1000b11f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000b1c7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000b1c7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001f0c4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001f0c8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001f0cc], eax
call edi
push eax
call esi
mov dword [0x1001f0d4], eax
test eax, eax
je 0x1000b11f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001f0d0], eax
mov eax, dword [0x1001f0d0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000b178
cmp dword [0x1001f0d4], ecx
je 0x1000b178
push eax
call esi
push dword [0x1001f0d4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000b178
test ebx, ebx
je 0x1000b178
call edi
test eax, eax
je 0x1000b16f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000b16f
test byte [ebp - 8], 1
jne 0x1000b178
or dword [ebp + 0x10], 0x200000
jmp 0x1000b1ab
mov eax, dword [0x1001f0c8]
cmp eax, dword [ebp - 0x18]
je 0x1000b1ab
push eax
call esi
test eax, eax
je 0x1000b1ab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000b1ab
mov eax, dword [0x1001f0cc]
cmp eax, dword [ebp - 0x18]
je 0x1000b1ab
push eax
call esi
test eax, eax
je 0x1000b1ab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001f0c4]
call esi
test eax, eax
je 0x1000b1c7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000b1c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001f0b
leave
ret
Function at 0x404b70
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push edx
mov ecx, eax
mov edx, 0x427d60
call fcn.00419320
mov dword [0x42968c], eax
test eax, eax
je 0x404be7
mov ebx, 4
mov edx, 1
mov eax, 0x42b9a4
mov ecx, dword [0x42968c]
call fcn.00419410
mov ebx, 4
mov edx, 1
mov eax, 0x42b9a8
mov ecx, dword [0x42968c]
call fcn.00419410
imul eax, dword [0x42b9a8], 0x50
mov ebx, 0x50
call fcn.004080e0
mov ecx, dword [0x42968c]
mov edx, dword [0x42b9a8]
mov dword [0x42b9ac], eax
call fcn.00419410
pop edx
pop ecx
pop ebx
ret
push ecx
push 0x427d63
call fcn.004195f0
add esp, 8
mov eax, 1
jmp fcn.00419613

Function at 0x40ea70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov ecx, dword [0x430914]
mov esi, dword [0x430918]
mov ebp, dword [0x42995c]
mov ebx, dword [0x4308ec]
mov edx, dword [0x4308e8]
mov eax, ebx
sub eax, edx
test eax, eax
jle 0x40eb72
test ebx, ebx
jle 0x40eb72
cmp edx, 0x140
jge 0x40eb72
cmp ebx, 0x140
jl 0x40eac8
mov eax, 0x140
mov ebx, 0x13f
sub eax, edx
test edx, edx
jl 0x40eb23
mov ecx, dword [0x4308f4]
mov esi, dword [0x42f0c8]
add edx, ecx
mov ecx, dword [0x42f0cc]
mov dword [0x430910], edx
add ecx, edx
shl edx, 2
add esi, edx
dec eax
cmp eax, 0xffffffff
je 0x40eb72
mov ebx, dword [0x4308f0]
mov edx, esi
cmp ebx, dword [esi]
ja 0x40eb47
mov dx, word [0x43090c]
inc ecx
add word [0x430908], dx
mov edx, dword [0x4308f8]
add esi, 4
add dword [0x4308f0], edx
jmp 0x40eaed
mov eax, ebx
mov bx, word [0x43090c]
imul ebx, edx
imul edx, dword [0x4308f8]
sub word [0x430908], bx
sub dword [0x4308f0], edx
xor edx, edx
jmp 0x40eacc
xor edx, esi
mov dx, word [0x430908]
sar edx, 8
mov dword [esi], ebx
and edx, 0xff
cmp byte [0x429960], 0
jne 0x40eb68
mov byte [ecx], dl
jmp 0x40eb03
lea edi, [edx + ebp]
cmp byte [edi], 0
je 0x40eb64
jmp 0x40eb03
mov dword [0x42995c], ebp
mov dword [0x430918], esi
mov dword [0x430914], ecx
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret