joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d767e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov edx, dword [esp + 0x28]
test edx, edx
je 0x4d788e
mov ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
imul esi, dword [esp + 0x20], 3
add ecx, dword [esp + 0x18]
push edi
mov edi, 0xff
cmp dword [esp + 0x3c], edi
jne 0x4d779c
lea ebp, [ecx + eax*4]
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [ecx + 0xcc]
imul ebx, eax
mov dword [esp + 0x2c], ebp
add ebx, dword [ecx + 0xc8]
add ebx, esi
cmp dword [esp + 0x34], 0
jle 0x4d776e
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
movzx edi, byte [ebp + 3]
mov esi, 0xff
movzx eax, byte [ebp + 2]
sub esi, edi
movzx ecx, byte [ebx + 2]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x4d76f3
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x3c]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
jne 0x4d7787
sub ebp, dword [esp + 0x20]
jmp 0x4d778b
add ebp, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
test edx, edx
jne 0x4d76cb
jmp 0x4d788a
lea ebx, [ecx + eax*4]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], eax
mov ebp, dword [ecx + 0xcc]
imul ebp, eax
mov dword [esp + 0x2c], ebx
add ebp, dword [ecx + 0xc8]
add ebp, esi
cmp dword [esp + 0x34], 0
jle 0x4d7861
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
movzx eax, byte [ebx + 3]
mov esi, 0xff
imul eax, dword [esp + 0x3c]
movzx ecx, byte [ebp + 2]
cdq
idiv edi
mov edi, eax
movzx eax, byte [ebx + 2]
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebp + 1]
mov byte [ebp + 2], al
movzx eax, byte [ebx + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [ebp]
movzx ecx, byte [ebx]
lea ebx, [ebx + 4]
imul eax, esi
imul ecx, edi
mov edi, 0xff
add eax, ecx
cdq
idiv edi
sub dword [esp + 0x30], 1
mov byte [ebp], al
lea ebp, [ebp + 3]
jne 0x4d77db
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
jne 0x4d787a
sub ebx, dword [esp + 0x20]
jmp 0x4d787e
add ebx, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
test edx, edx
jne 0x4d77b3
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x28
Function at 0x4d82bc
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x4d8368
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
add ecx, dword [esp + 0x18]
push ebp
lea edx, [ecx + eax*4]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x34], 0
jle 0x4d8349
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, edi
sub esi, 1
jne 0x4d8322
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x38], esi
jne 0x4d835e
sub edx, dword [esp + 0x20]
jmp 0x4d8362
add edx, dword [esp + 0x20]
test esi, esi
jne 0x4d8300
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x24
Function at 0x4da115
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push dword [esp + 0x78]
xor esi, esi
mov ebx, esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x4da2ac
push dword [esp + 0x28]
call fcn.0044d4cf
test eax, eax
je 0x4da155
push dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4da2ac
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x4da299
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x4da291
push 0x2c
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00436fb0
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x50], 0x28
mov word [esp + 0x5c], ax
pop eax
push esi
push esi
mov word [esp + 0x62], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x4da291
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push edi
call esi
push 2
xor eax, eax
push eax
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x90]
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x2c]
push edi
call esi
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x4da291
mov ebp, dword [esp + 0x38]
xor esi, esi
mov edx, dword [esp + 0x3c]
mov eax, ebp
shl eax, 2
mov dword [esp + 0x10], eax
test edx, edx
jle 0x4da291
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
sub ecx, esi
add eax, 3
dec ecx
xor ebx, ebx
imul ecx, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x7c], eax
test ebp, ebp
jle 0x4da288
push esi
push ebx
push edi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x7c]
test eax, eax
setne al
dec al
mov byte [ecx], al
add ecx, 4
mov ebp, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x7c], ecx
cmp ebx, ebp
jl 0x4da260
mov edx, dword [esp + 0x3c]
inc esi
cmp esi, edx
jl 0x4da243
mov ebx, dword [esp + 0x1c]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [esp + 0x2c]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x68
ret 4
Function at 0x132fe90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbd4000]
push edi
or ebp, 0xffffffff
jmp 0x132feb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x132feb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x132fea8
mov eax, 1
add ebx, ebx
jne 0x132fecb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x132fedc
jne 0x132fefb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x132fefb
dec eax
add ebx, ebx
jne 0x132fee8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x132fec0
add ebx, ebx
jne 0x132fef7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x132ff4d
xor ecx, ecx
sub eax, 3
jb 0x132ff13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x132ff82
sar eax, 1
mov ebp, eax
jmp 0x132ff1e
add ebx, ebx
jne 0x132ff1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x132feec
inc ecx
add ebx, ebx
jne 0x132ff2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x132feec
add ebx, ebx
jne 0x132ff39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x132ff2e
jne 0x132ff4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x132ff2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x132ff6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x132ff5e
jmp 0x132feae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x132ff6c
add edi, ecx
jmp 0x132feae
pop esi
mov edi, esi
mov ecx, 0x277de7
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x132ffa7
cmp byte [edi], 0x24
jne 0x132ff8c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x132ff8a
lea edi, [esi + 0xf2b000]
mov eax, dword [edi]
or eax, eax
je 0x132ffef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfba6bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfba7ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x132ffad
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfba7b0]
or eax, eax
je 0x132ffe9
mov dword [ebx], eax
add ebx, 4
jmp 0x132ffca
call dword [esi + 0xfba7c0]
mov ebp, dword [esi + 0xfba7b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1330023
sub esp, 0xffffff80
jmp 0x6a7ad4
Function at 0x1000b340
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x1004e010]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push ebp
mov edi, ecx
call sym.lua5.1.dll_luaL_buffinit
add esp, 8
mov esi, 0x200
lea ecx, [esp + 0xc]
push ecx
call sym.lua5.1.dll_luaL_prepbuffer
add esp, 4
cmp esi, edi
jbe 0x1000b386
mov esi, edi
push ebx
push esi
push 1
push eax
call fcn.1001ad35
add dword [esp + 0x1c], eax
add esp, 0x10
sub edi, eax
je 0x1000b39f
cmp eax, esi
je 0x1000b373
lea edx, [esp + 0xc]
push edx
call sym.lua5.1.dll_luaL_pushresult
add esp, 4
test edi, edi
je 0x1000b3d9
push 0xffffffffffffffff
push ebp
call sym.lua5.1.dll_lua_objlen
add esp, 8
test eax, eax
ja 0x1000b3d9
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1001a64b
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.1001a64b
add esp, 0x210
ret

Function at 0x10013020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, edi
shr eax, 5
inc eax
mov ebx, edi
mov ecx, edi
cmp edi, eax
jb 0x1001305f
jmp 0x10013040
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + ecx - 1]
mov esi, ebx
shl esi, 5
add edx, esi
mov esi, ebx
shr esi, 2
add edx, esi
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x10013040
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
dec ecx
and ecx, ebx
mov ebp, dword [edx + ecx*4]
test ebp, ebp
je 0x100130c7
cmp dword [ebp + 0xc], edi
jne 0x100130c0
mov esi, dword [esp + 0x18]
mov ecx, edi
lea edx, [ebp + 0x10]
cmp edi, 4
jb 0x1001309c
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x100130c0
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x10013088
test ecx, ecx
je 0x100130de
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100130c0
cmp ecx, 1
jbe 0x100130de
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100130c0
cmp ecx, 2
jbe 0x100130de
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x100130de
mov ebp, dword [ebp]
test ebp, ebp
jne 0x10013075
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
push edx
call fcn.10012f80
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x10]
movzx edx, byte [ecx + 0x14]
mov al, byte [ebp + 5]
movzx ecx, al
not edx
and ecx, 3
test cl, dl
je 0x100130fd
xor al, 3
mov byte [ebp + 5], al
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x1001a64b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004e010]
jne 0x1001a655
repz ret
jmp fcn.10022aea

Function at 0x1001f6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1001f704
cmp dword [ebp - 0x398], 0
je 0x1001f8ce
cmp dword [ebp + 0xc], 1
je 0x1001f8ce
cmp dword [ebp + 0xc], 8
jne 0x1001f896
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1001ea20
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1001e9d5
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
call fcn.1001ea10
dec edi
add byte gs:[ecx - 0x80], ah
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.1001ea10
adc al, 0
popal
push 0xffffffffffffff80
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1001e9ee
or byte [eax + 0x2ff845c6], ah
invalid
inc ebp
Function at 0x100294e9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1002951a
call fcn.1001aea3
mov dword [eax], esi
call fcn.1001ae90
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.100237b1
add esp, 0x14
push 0x16
pop eax
jmp 0x1002956f
test dword [ebp + 0xc], 0xfffffff9
jne 0x100294f6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10029547
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001aeb6
pop ecx
call fcn.1001ae90
mov eax, dword [eax]
jmp 0x1002956f
test al, 0x10
jne 0x1002956d
test al, 1
je 0x1002956d
test byte [ebp + 0xc], 2
je 0x1002956d
call fcn.1001aea3
mov dword [eax], 5
call fcn.1001ae90
mov dword [eax], 0xd
jmp 0x1002953e
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10036b67
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10023be3
and dword [ebp - 4], 0
cmp dword [0x1005038c], 0
mov ebx, eax
jne 0x10036c18
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10036cc9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10036cc9
push eax
call fcn.10023b71
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1005038c], eax
call esi
push eax
call fcn.10023b71
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10050390], eax
call esi
push eax
call fcn.10023b71
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10050394], eax
call esi
push eax
call fcn.10023b71
pop ecx
mov dword [0x1005039c], eax
test eax, eax
je 0x10036c18
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10023b71
pop ecx
mov dword [0x10050398], eax
mov eax, dword [0x10050398]
cmp eax, ebx
je 0x10036c70
cmp dword [0x1005039c], ebx
je 0x10036c70
push eax
call fcn.10023bec
push dword [0x1005039c]
mov esi, eax
call fcn.10023bec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10036c70
test edi, edi
je 0x10036c70
call esi
test eax, eax
je 0x10036c67
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10036c67
test byte [ebp - 0xc], 1
jne 0x10036c70
or dword [ebp + 0x10], 0x200000
jmp 0x10036ca9
mov eax, dword [0x10050390]
cmp eax, ebx
je 0x10036ca9
push eax
call fcn.10023bec
pop ecx
test eax, eax
je 0x10036ca9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10036ca9
mov eax, dword [0x10050394]
cmp eax, ebx
je 0x10036ca9
push eax
call fcn.10023bec
pop ecx
test eax, eax
je 0x10036ca9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1005038c]
call fcn.10023bec
pop ecx
test eax, eax
je 0x10036cc9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10036ccb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x6eac57c7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x17303c8d
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x412867
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004126e6

Function at 0x416c5f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004165cd

Function at 0x416c6a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416808

Function at 0x409130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.qmpJQplM
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x409152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409148
mov eax, 1
add ebx, ebx
jne 0x40916b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409160
jne 0x40917c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409160
xor ecx, ecx
sub eax, 3
jb 0x409190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409202
mov ebp, eax
add ebx, ebx
jne 0x40919b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4091a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4091cc
inc ecx
add ebx, ebx
jne 0x4091b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4091ad
jne 0x4091c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4091ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4091ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4091dd
jmp 0x40914e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4091ec
add edi, ecx
jmp 0x40914e
pop esi
mov edi, esi
mov ecx, 5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40920a
cmp byte [edi], 0
jne 0x40920a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40920f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x40927e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa10c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40923c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa16c]
or eax, eax
je 0x409278
mov dword [ebx], eax
add ebx, 4
jmp 0x409259
call dword [esi + 0xa168]
mov ebp, dword [esi + 0xa170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4092b2
sub esp, 0xffffff80
jmp 0x40124f
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x767474b3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1f647832
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42fb20
Capabilities:
Hash data with md5

Disassembly:
push esi
push eax
mov dword [esp], ecx
mov word [0x498022], 0xdafc
mov dword [ecx], 0
mov eax, dword [0x492bb8]
mov edx, dword [0x492408]
add edx, eax
mov dword [0x492408], edx
mov dword [ecx + 4], 0
mov eax, dword [0x48c168]
and eax, 0x386
mov si, word [0x497e6c]
mov dx, si
lea eax, [edx + eax*4 + 0xf1a7]
mov si, ax
mov word [0x497e6c], si
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x48aef0]
mov edx, dword [0x48c5bc]
lea eax, [eax + edx - 0x1f65b263]
mov dword [0x48c5bc], eax
mov dword [ecx + 0xc], 0xefcdab89
mov dword [0x495638], 0xd7ede3fc
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x495744]
mov edx, eax
inc edx
mov dword [0x495744], edx
and eax, 0x5c7b
mov si, word [0x49b1b4]
mov dx, si
add edx, eax
mov si, dx
mov word [0x49b1b4], si
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x48de6c]
add eax, 0xf8bf92d9
mov dword [0x48de6c], eax
add esp, 4
pop esi
ret