joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fc50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp ebx, eax
je 0x1000fca0
mov edi, ecx
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x1000fca9
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [edi + 0x20]
push esi
push esi
push eax
call fcn.10035e25
add esp, 0x10
cmp eax, esi
mov esi, 0xffffffff
je 0x1000fca2
jmp 0x1000fd31
xor ebx, ebx
mov esi, ebx
jmp 0x1000fd31
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x19]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x1000fd2e
mov ebx, eax
cmp eax, 3
je 0x1000fd11
cmp ebx, 1
ja 0x1000fd2e
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.10035e25
add esp, 0x10
cmp eax, esi
jne 0x1000fd2e
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1000fcb4
jmp 0x1000fd26
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.10035e25
add esp, 0x10
cmp eax, ebx
jne 0x1000fd2e
mov ebx, dword [ebp + 8]
jmp 0x1000fca2
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1000fd80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x1000fda4
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.10035e25
add esp, 0x14
jmp 0x1000fdd4
test esi, esi
jle 0x1000fdcd
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ebx, eax
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x1000fdcf
inc edi
cmp esi, edi
mov eax, ebx
jne 0x1000fdad
mov edi, esi
jmp 0x1000fdcf
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1000fde0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x1005c010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x1000fe2f
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x1000fe47
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.10035e25
add esp, 0x10
cmp eax, 1
je 0x1000fe31
xor esi, esi
dec esi
jmp 0x1000fe31
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025727
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x1000fe2a
mov ebx, eax
cmp eax, 3
je 0x1000feaf
cmp ebx, 1
ja 0x1000fe2a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.10035e25
add esp, 0x10
cmp eax, esi
jne 0x1000fe2a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1000fe52
jmp 0x1000fec8
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.10035e25
add esp, 0x10
cmp eax, ebx
jne 0x1000fe2a
movzx esi, word [ebp + 8]
jmp 0x1000fe31

Function at 0x10010020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1001004f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10010031
pop esi
pop edi
pop ebp
ret 8

Function at 0x10010150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10010181
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10010161
pop esi
pop edi
pop ebp
ret 8
Function at 0x10014430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x10022bf0
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x1001448e
mov dl, byte [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movsx edx, dl
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x100145d2
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x1005edd4
call fcn.1001f00e
mov esi, eax
xor edi, edi
dec edi
mov eax, edi
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x100144c9
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x30]
push ebx
call eax
movzx edx, byte [ebp - 0x25]
test dl, dl
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov esi, edx
cmovs esi, eax
test esi, esi
je 0x100145ad
mov ecx, ebx
mov ebx, eax
mov dword [ebp - 0x34], edx
test dl, dl
mov esi, ecx
mov eax, ecx
mov dword [ebp - 0x24], edi
cmovs esi, edi
mov ecx, dword [ebp + 0xc]
mov edi, esi
test ecx, ecx
je 0x10014535
mov bl, byte [edi]
movzx eax, bl
mov edx, dword [ecx + 0x18]
cmp edx, dword [ecx + 0x1c]
je 0x10014548
lea esi, [edx + 1]
mov dword [ecx + 0x18], esi
mov byte [edx], bl
jmp 0x10014563
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
mov ecx, ebx
mov ebx, dword [ebp - 0x34]
mov esi, eax
jmp 0x1001457b
mov dword [ebp - 0x24], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], ecx
push eax
call edx
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
xor esi, esi
cmp eax, 0xffffffff
je 0x1001456c
mov esi, ecx
mov bl, byte [ebp - 0x25]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x30]
inc edi
test bl, bl
mov eax, esi
mov dword [ebp - 0x24], edx
cmovs esi, edx
mov edx, edi
mov dword [ebp - 0x34], ebx
movzx edi, bl
mov ebx, ecx
cmovs edi, ecx
add edi, esi
cmp edx, edi
mov edi, edx
mov ecx, dword [ebp - 0x20]
jne 0x1001451a
mov edx, dword [ebp - 0x34]
shr dl, 7
mov edi, dword [ebp - 0x24]
jmp 0x100145b3
shr dl, 7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test dl, dl
je 0x100145c8
push edi
call fcn.10024829
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10015e60
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 4], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x10022c60
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x14]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
push eax
sub esp, 0x18
mov ebx, esp
lea ecx, [ebx + 8]
call fcn.10024570
mov dword [ebx], edi
mov dword [ebx + 4], 0x14
lea eax, [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
call fcn.10024170
add esp, 0x1c
mov esp, dword [esi + 4]
mov dword [esi + 0x10], eax
lea edx, [esi + eax]
add edx, 0x50
mov ecx, edi
mov dword [esi + 0xc], edx
mov edi, dword [ebp + 0x10]
push edi
call fcn.100147fc
add esp, 4
mov dword [esi + 8], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
mov eax, dword [edi + 0x1c]
lea ecx, [esi + 0x1c]
mov dword [ecx], eax
mov dword [esi + 4], eax
lock inc dword [eax + 4]
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
push 0x1005edac
call fcn.1001f00e
mov ebx, eax
xor eax, eax
dec eax
mov ecx, dword [esi + 4]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x10015f51
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov ebx, dword [esi + 0xc]
push ebx
lea edi, [esi + 0x50]
push edi
call eax
mov ecx, dword [esi + 8]
mov eax, ecx
sub eax, edi
cmp ecx, ebx
mov ecx, dword [esi + 0x10]
lea ebx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ebx
movsx edi, byte [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push ebx
push eax
lea eax, [esi + 0x20]
push eax
call fcn.10014ae0
add esp, 0x14
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10015fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x10022c70
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x1001603f
movzx edx, word [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movzx edx, dx
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
jmp 0x10016185
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x1005eddc
call fcn.1001f00e
mov esi, eax
xor edi, edi
dec edi
mov eax, edi
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
mov bl, byte [ebp + 0x18]
jne 0x1001607a
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi]
xor bl, 1
movzx ecx, bl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea ebx, [ebp - 0x30]
push ebx
call eax
movzx edx, byte [ebp - 0x25]
test dl, dl
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov esi, edx
cmovs esi, eax
test esi, esi
je 0x10016160
mov esi, ebx
mov ebx, eax
mov dword [ebp - 0x34], edx
test dl, dl
mov dword [ebp - 0x24], edi
cmovns edi, esi
mov ecx, dword [ebp + 0xc]
mov eax, esi
test ecx, ecx
je 0x100160e1
movzx eax, word [edi]
mov esi, dword [ecx + 0x18]
cmp esi, dword [ecx + 0x1c]
je 0x100160f4
lea edx, [esi + 2]
mov dword [ecx + 0x18], edx
mov word [esi], ax
jmp 0x10016112
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
mov ecx, ebx
mov ebx, dword [ebp - 0x34]
mov esi, eax
jmp 0x1001612b
mov dword [ebp - 0x24], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
movzx eax, ax
mov dword [ebp - 0x20], ecx
push eax
call edx
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
xor esi, esi
cmp ax, 0xffff
je 0x1001611c
mov esi, ecx
mov bl, byte [ebp - 0x25]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
lea esi, [ebp - 0x30]
add edi, 2
test bl, bl
mov eax, esi
mov dword [ebp - 0x24], edx
cmovs esi, edx
mov edx, edi
mov dword [ebp - 0x34], ebx
movzx edi, bl
mov ebx, ecx
cmovs edi, ecx
lea esi, [esi + edi*2]
mov edi, edx
cmp edx, esi
mov ecx, dword [ebp - 0x20]
jne 0x100160c7
mov edx, dword [ebp - 0x34]
shr dl, 7
mov edi, dword [ebp - 0x24]
jmp 0x10016166
shr dl, 7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test dl, dl
je 0x1001617b
push edi
call fcn.10024829
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10022930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ecx - 0x3a]
test dword [eax + 0x3bfffff8], eax
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.100208d6
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.10020837
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x1002283e
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.100208c6
mov ah, 0x7f
push eax
daa
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x100228a9
lea eax, [ebp - 0x714]
push eax
call fcn.100208d6
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1002088b
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x100228a9
jmp 0x10022268
cmp dword [ebp - 0x37c], 0
je 0x100228b7
jmp 0x1002296c
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x10022910
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x10022915
jmp 0x10022268
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1002295c
lea eax, [ebp - 0x714]
push eax
call fcn.100208d6
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1002088b
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10022967
jmp 0x1002296c
jmp 0x10022268
cmp dword [ebp - 0x37c], 0
jne 0x10022a16
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10020aa2
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x10022a02
lea eax, [ebp - 0x714]
push eax
call fcn.100208d6
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.1002096b
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003e47a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003e485

Function at 0x10041a54
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10041a5f
Function at 0x422377
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004195c7
and dword [ebp - 4], 0
cmp dword [0x42efe8], 0
mov ebx, eax
jne 0x422428
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4224d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4224d9
push eax
call fcn.00419555
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42efe8], eax
call esi
push eax
call fcn.00419555
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42efec], eax
call esi
push eax
call fcn.00419555
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42eff0], eax
call esi
push eax
call fcn.00419555
pop ecx
mov dword [0x42eff8], eax
test eax, eax
je 0x422428
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419555
pop ecx
mov dword [0x42eff4], eax
mov eax, dword [0x42eff4]
cmp eax, ebx
je 0x422480
cmp dword [0x42eff8], ebx
je 0x422480
push eax
call fcn.004195d0
push dword [0x42eff8]
mov esi, eax
call fcn.004195d0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422480
test edi, edi
je 0x422480
call esi
test eax, eax
je 0x422477
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422477
test byte [ebp - 0xc], 1
jne 0x422480
or dword [ebp + 0x10], 0x200000
jmp 0x4224b9
mov eax, dword [0x42efec]
cmp eax, ebx
je 0x4224b9
push eax
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4224b9
mov eax, dword [0x42eff0]
cmp eax, ebx
je 0x4224b9
push eax
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42efe8]
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4224db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x12925a20
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x22e77330
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402039
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, 0x105
mov esi, ecx
push edi
push esi
je 0x402057
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
jmp 0x40205d
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, edi
mov dword [esi + 0x108], eax
jb 0x402073
and dword [esi + 0x108], 0
mov byte [esi], 0
jmp 0x4020c0
test eax, eax
je 0x4020c0
add eax, esi
cmp byte [eax - 1], 0x5c
je 0x402088
mov byte [eax], 0x5c
inc dword [esi + 0x108]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov eax, dword [esi + 0x108]
sub edi, eax
cmp edi, ebx
jbe 0x4020b5
push edi
push dword [ebp + 8]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add dword [esi + 0x108], ebx
jmp 0x4020bf
and dword [esi + 0x108], 0
mov byte [esi], 0
pop ebx
mov eax, dword [esi + 0x108]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4020d1
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4040ac]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4040ec], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x88], 2
sete al
test al, 1
je 0x402124
cmp dword [ebp - 0x94], 5
jb 0x402124
push 2
pop ecx
jmp 0x402126
xor ecx, ecx
or eax, ecx
test al, 2
je 0x40213c
cmp dword [ebp - 0x90], 1
jb 0x40213c
mov ecx, 0x80
jmp 0x40213e
xor ecx, ecx
or eax, ecx
test al, 1
jne 0x402152
cmp dword [ebp - 0x90], 0xa
jb 0x402152
push 8
pop ecx
jmp 0x402154
xor ecx, ecx
or eax, ecx
test al, 9
jne 0x40215f
push 4
pop ecx
jmp 0x402161
xor ecx, ecx
or eax, ecx
mov ecx, dword [0x4040ec]
cmp ecx, 0x3a4
mov dword [0x4040e8], eax
je 0x40218e
cmp ecx, 0x3a8
je 0x40218e
cmp ecx, 0x3b4
jbe 0x402196
cmp ecx, 0x3b6
ja 0x402196
or eax, 0x10
mov dword [0x4040e8], eax
test al, 2
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
je 0x4021b0
push 0x52
call esi
test eax, eax
je 0x4021b0
or dword [0x4040e8], 0x20
push 0x2a
call esi
test eax, eax
pop esi
je 0x4021d0
test byte [0x4040e8], 2
jne 0x4021c9
or dword [0x4040e8], 0x20
or dword [0x4040e8], 0x40
mov ecx, dword [ebp - 4]
call fcn.00402d1d
leave
ret

Function at 0x4022de
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4040ac]
push ebx
xor ebx, ebx
cmp dword [0x4040fc], ebx
mov dword [ebp - 4], eax
jne 0x40235e
lea eax, [ebp - 0x114]
push eax
push 0x40119c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40235e
push esi
push ebx
mov esi, 0x401190
push esi
lea ecx, [ebp - 0x110]
mov byte [ebp - 0x110], bl
mov dword [ebp - 8], ebx
call fcn.00402039
test eax, eax
je 0x40235d
push dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
push 1
push ebx
push esi
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.00402d1d
leave
ret