joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cbf4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 8
jb 0x40cc0b
add edi, 4
mov eax, dword [edi]
jmp 0x40cc10
add edi, 4
mov eax, edi
push ebx
push esi
push eax
lea eax, [ebp - 0x1c]
call fcn.00403761
push 0
lea eax, [ebp - 0x1c]
call fcn.0040cb6e
pop ecx
mov bl, al
neg bl
push 0
sbb bl, bl
push 1
lea esi, [ebp - 0x1c]
inc bl
call fcn.0040115f
pop esi
test bl, bl
pop ebx
je 0x40cc44
xor al, al
jmp 0x40cc5b
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x40cc4f
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop edi
leave
ret

Function at 0x40cc5e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x452210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
push esi
mov esi, edx
jb 0x40cc82
mov eax, dword [eax + 4]
jmp 0x40cc85
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x40cc90
mov ecx, dword [ecx + 4]
jmp 0x40cc93
add ecx, 4
lea edx, [ebp - 0x210]
push edx
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x40ccc9
and word [ebp - 6], 0
lea eax, [ebp - 0x210]
push eax
call fcn.00431e7f
pop ecx
lea ecx, [ebp - 0x210]
call fcn.004011a6
mov al, 1
jmp 0x40cccb
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00431f15
leave
ret

Function at 0x40cd9f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40cda7
mov dword [ecx*4 + 0x45a160], eax
inc ecx
cmp ecx, 0x100
jb 0x40cda2
pop esi
ret

Function at 0x40cfca
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40cff7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40cff7
xor al, al
jmp 0x40d012
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0043c270
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
leave
ret 4
Function at 0x40d1c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
push ebx
push esi
jbe 0x40d1dc
mov dword [ebp + 0xc], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x20], ebx
je 0x40d2a0
jmp 0x40d298
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 4], ecx
jae 0x40d2a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea esi, [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040cfca
test al, al
jne 0x40d23e
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push ebx
push dword [ebp - 0xc]
mov eax, edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0040d078
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xc], esp
call fcn.0040378d
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp eax, ebx
jne 0x40d2a0
mov ecx, dword [ebp + 8]
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add eax, ecx
push eax
push dword [edi]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
add dword [ebp - 4], ecx
cmp eax, ebx
jne 0x40d210
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
pop esi
mov dword [ecx], edx
pop ebx
leave
ret 0xc
Function at 0x41d8f0
Capabilities:
Hash data using crc32b

Disassembly:
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x41d907
add eax, eax
xor eax, 0x4c11db7
jmp 0x41d909
add eax, eax
dec edx
test edx, edx
jg 0x41d8fa
mov dword [ecx*4 + 0x4568a8], eax
inc ecx
cmp ecx, 0x100
jb 0x41d8f2
ret
Function at 0x42caec
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x452210]
xor eax, ebp
mov dword [ebp + 0x394], eax
push esi
push edi
xor edi, edi
push 0x40e
lea eax, [ebp - 0x7a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x7c], di
call fcn.00431dc0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x3a0]
mov dword [ebp - 0x80], edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x42cb3f
xor al, al
jmp 0x42cb82
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x42cb60
cmp dword [ebp - 0x80], edi
je 0x42cb3b
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x42cb3b
lea eax, [ebp - 0x7c]
push eax
call fcn.00431e7f
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.004011a6
cmp dword [ebp - 0x80], edi
je 0x42cb80
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp + 0x394]
pop edi
xor ecx, ebp
pop esi
call fcn.00431f15
add ebp, 0x398
leave
ret

Function at 0x42cef2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x42cf00
and dword [esi], 0
and dword [ebp + 0x10], 0
xor eax, eax
inc eax
cmp dword [ebp + 0xc], 0
jbe 0x42cf3c
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x42cf1a
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x42cf3c
mov ecx, dword [ebp + 0x10]
add dword [esi], ecx
test eax, eax
setne al
push eax
call fcn.0040c27b
pop ecx
pop esi
pop ebp
ret 0xc
Function at 0x42d53e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
push edi
mov edi, dword [ebp + 8]
jb 0x42d68a
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + ecx - 4]
push ebx
mov dword [ebp - 8], ecx
push esi
lea esi, [eax + edi]
jmp 0x42d57a
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x42d57f
inc esi
cmp esi, dword [ebp - 8]
jb 0x42d571
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 8]
jae 0x42d66b
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x42d5fe
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp - 4], eax
je 0x42d5ab
cmp cl, 0xff
jne 0x42d62d
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
sub edi, eax
sub edi, dword [ebp + 0xc]
test edx, edx
mov ebx, edi
mov dword [ebp - 0xc], ebx
je 0x42d63e
movzx edi, byte [edx + 0x443278]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
shr ebx, cl
test bl, bl
je 0x42d5ee
cmp bl, 0xff
jne 0x42d63b
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, dword [ebp - 0xc]
jmp 0x42d5c6
dec ecx
shl edx, cl
and edx, 7
je 0x42d598
movzx ecx, byte [edx + 0x443278]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x443270], 0
mov cl, byte [ebx + 4]
je 0x42d62a
test cl, cl
je 0x42d62a
cmp cl, 0xff
jne 0x42d598
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x42d56c
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x42d56c
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
pop edi
leave
ret

Function at 0x42f7a2
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x42fb13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ecx, ecx
call fcn.0042fafb
mov ebx, eax
call fcn.0042fb07
mov edi, eax
mov esi, 0x100
movzx eax, byte [ebx + ecx]
mov byte [eax + edi], cl
inc ecx
cmp ecx, esi
jb 0x42fb31
call fcn.0042faf5
mov edx, eax
call fcn.0042fb01
lea ecx, [eax + 0xc00]
mov dword [ebp - 0x18], eax
sub dword [ebp - 0x18], edx
mov dword [ebp - 0x10], ebx
sub dword [ebp - 0x10], edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], edi
lea ecx, [edx + 0x800]
mov esi, 0xff
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movzx edi, byte [eax + edx]
mov eax, edi
and al, 0x80
neg al
lea edx, [edi + edi]
mov dword [ebp - 0x14], edi
sbb eax, eax
and eax, 0x1b
xor eax, edx
and eax, esi
mov edx, eax
xor edx, edi
mov dword [ebp - 8], edx
shl edx, 8
or edx, edi
shl edx, 8
or edx, edi
shl edx, 8
or edx, eax
mov dword [ecx - 0x800], edx
mov edx, edi
shl edx, 8
mov ebx, edx
or edx, eax
or ebx, edi
shl edx, 8
or edx, dword [ebp - 8]
shl ebx, 8
or ebx, eax
shl eax, 8
or eax, dword [ebp - 8]
shl edx, 8
shl eax, 8
or eax, edi
shl eax, 8
or eax, edi
or edx, edi
shl ebx, 8
or ebx, dword [ebp - 8]
mov dword [ecx - 0x400], ebx
mov dword [ecx], edx
mov dword [ecx + 0x400], eax
mov eax, dword [ebp - 0xc]
movzx edi, byte [eax]
mov eax, edi
and al, 0x80
neg al
lea edx, [edi + edi]
sbb eax, eax
and eax, 0x1b
xor eax, edx
and eax, esi
mov ebx, eax
and al, 0x80
neg al
lea edx, [ebx + ebx]
mov dword [ebp - 0x20], ebx
sbb eax, eax
and eax, 0x1b
xor eax, edx
and eax, esi
mov edx, eax
and dl, 0x80
neg dl
mov dword [ebp - 0x14], eax
sbb edx, edx
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, esi
mov eax, edx
xor edx, edi
mov dword [ebp - 8], edx
mov edx, eax
xor eax, dword [ebp - 0x14]
xor edx, ebx
mov ebx, eax
xor edx, edi
xor ebx, edi
xor eax, dword [ebp - 0x20]
mov edi, edx
shl edi, 8
or edi, ebx
shl edi, 8
or edi, dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 4]
shl edi, 8
or edi, eax
mov dword [ebx - 0xc00], edi
mov edi, dword [ebp - 0x14]
shl edi, 8
or edi, dword [ebp - 8]
shl edi, 8
or edi, eax
shl edi, 8
or edi, edx
mov dword [ebx - 0x800], edi
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
shl edi, 8
or edi, eax
shl eax, 8
or eax, edx
shl edi, 8
or edi, edx
mov edx, dword [ebp - 4]
add dword [ebp - 4], 4
shl eax, 8
or eax, dword [ebp - 0x14]
shl edi, 8
or edi, dword [ebp - 0x14]
shl eax, 8
or eax, dword [ebp - 8]
inc dword [ebp - 0xc]
mov dword [ebx + ecx], edi
add ecx, 4
dec dword [ebp - 0x1c]
mov dword [edx], eax
jne 0x42fb6f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42fdd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
mov ecx, esi
call fcn.0042fcc0
mov eax, dword [esi]
lea eax, [eax*8 - 4]
pop ecx
xor ecx, ecx
test eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x42fe60
call fcn.0042fafb
mov edx, eax
call fcn.0042fb01
push ebx
push edi
mov ecx, dword [esi + ecx*4 + 0x14]
mov dword [ebp - 8], ecx
movzx edi, byte [ebp - 6]
movzx edi, byte [edi + edx]
mov edi, dword [eax + edi*4 + 0x800]
movzx ebx, ch
movzx ebx, byte [ebx + edx]
xor edi, dword [eax + ebx*4 + 0x400]
mov ebx, ecx
shr ebx, 0x18
movzx ebx, byte [ebx + edx]
xor edi, dword [eax + ebx*4 + 0xc00]
and ecx, 0xff
movzx ecx, byte [ecx + edx]
xor edi, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov dword [esi + ecx*4 + 0x14], edi
inc ecx
cmp ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jb 0x42fe0d
pop edi
pop ebx
leave
ret

Function at 0x430208
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, eax
test ebx, ebx
push edi
mov edi, ecx
je 0x43029f
push 0x10
pop eax
cmp ebx, eax
jb 0x43029f
sub ebx, eax
add ebx, eax
shr ebx, 4
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [edi]
push dword [esi + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x14]
lea eax, [ebp - 0x14]
call fcn.0042fe62
mov eax, dword [esi]
xor eax, dword [ebp - 0x24]
pop ecx
mov dword [edi], eax
mov eax, dword [esi + 4]
xor eax, dword [ebp - 0x20]
add edi, 0x10
mov dword [edi - 0xc], eax
mov eax, dword [esi + 8]
xor eax, dword [ebp - 0x1c]
pop ecx
mov dword [edi - 8], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebp - 0x18]
dec ebx
mov dword [edi - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
jne 0x430232
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x431f15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x452210]
jne 0x431f1f
repz ret
jmp fcn.00434158

Function at 0x4330d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x433105
call fcn.00432d93
mov dword [eax], esi
call fcn.00432d80
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004322d1
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4330e1
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x433134
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00432da6
pop ecx
call fcn.00432d80
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x43315b
test al, 1
je 0x43315b
test byte [esp + 0xc], 2
je 0x43315b
call fcn.00432d93
mov dword [eax], 5
call fcn.00432d80
mov dword [eax], 0xd
jmp 0x43312b
xor eax, eax
pop esi
ret
Function at 0x4351e9
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x452228]
je 0x435204
inc edi
cmp edi, 0x17
jb 0x4351f5
cmp edi, 0x17
jae 0x435384
push ebp
push 3
call fcn.0043a8f5
cmp eax, 1
pop ecx
je 0x435350
push 3
call fcn.0043a8f5
test eax, eax
pop ecx
jne 0x435238
cmp dword [0x452090], 1
je 0x435350
cmp ebx, 0xfc
je 0x435383
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x456070
push ebp
call fcn.00433efe
add esp, 0xc
test eax, eax
je 0x43526e
push esi
push esi
push esi
push esi
push esi
call fcn.004321d5
add esp, 0x14
push 0x104
mov esi, 0x456089
push esi
push 0
mov byte [0x45618d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4352b2
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00433efe
add esp, 0xc
test eax, eax
je 0x4352b2
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004321d5
add esp, 0x14
push esi
call fcn.00432140
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4352f7
push esi
call fcn.00432140
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x456384
push 0x441a2c
sub ecx, eax
push ecx
push eax
call fcn.0043a842
add esp, 0x14
test eax, eax
je 0x4352f7
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004321d5
add esp, 0x14
jmp 0x4352f9
xor esi, esi
push 0x441a28
push ebx
push ebp
call fcn.0043a7d1
add esp, 0xc
test eax, eax
je 0x435319
push esi
push esi
push esi
push esi
push esi
call fcn.004321d5
add esp, 0x14
push dword [edi*8 + 0x45222c]
push ebx
push ebp
call fcn.0043a7d1
add esp, 0xc
test eax, eax
je 0x43533b
push esi
push esi
push esi
push esi
push esi
call fcn.004321d5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043a614
add esp, 0xc
jmp 0x435383
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x435383
cmp ebp, 0xffffffff
je 0x435383
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x45222c]
push dword [esi]
call fcn.00432140
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43a614
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00434362
xor ebx, ebx
cmp dword [0x4567a8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43a6ea
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43a7ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43a7ca
push eax
call fcn.004342f4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4567a8], eax
call esi
push eax
call fcn.004342f4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4567ac], eax
call esi
push eax
call fcn.004342f4
mov dword [0x4567b0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00434b00
test eax, eax
pop ecx
pop ecx
je 0x43a6b8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004321d5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43a6ea
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004342f4
cmp eax, ebx
pop ecx
mov dword [0x4567b8], eax
je 0x43a6ea
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004342f4
pop ecx
mov dword [0x4567b4], eax
mov eax, dword [0x4567b4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43a76f
cmp dword [0x4567b8], ecx
je 0x43a76f
push eax
call fcn.0043436b
push dword [0x4567b8]
mov esi, eax
call fcn.0043436b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43a76f
cmp edi, ebx
je 0x43a76f
call esi
cmp eax, ebx
je 0x43a73c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43a73c
test byte [ebp - 0x18], 1
jne 0x43a76f
lea eax, [ebp - 0x10]
push eax
call fcn.00434b37
test eax, eax
pop ecx
je 0x43a757
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004321d5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43a766
or dword [ebp + 0x10], 0x200000
jmp 0x43a7aa
or dword [ebp + 0x10], 0x40000
jmp 0x43a7aa
mov eax, dword [0x4567ac]
cmp eax, dword [ebp - 8]
je 0x43a7aa
push eax
call fcn.0043436b
cmp eax, ebx
pop ecx
je 0x43a7aa
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43a7aa
mov eax, dword [0x4567b0]
cmp eax, dword [ebp - 8]
je 0x43a7aa
push eax
call fcn.0043436b
cmp eax, ebx
pop ecx
je 0x43a7aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4567a8]
call fcn.0043436b
cmp eax, ebx
pop ecx
je 0x43a7ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43a7cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219
Function at 0x401709
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x40185a
cmp dword [ebp - 0xc], 1
jne 0x401854
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0047f7a3
mov dword [ebp - 0xc], 0
jmp 0x401855
nop
jmp 0x401719
nop
leave
ret
Function at 0x401aaf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x401c0d
cmp dword [ebp - 0xc], 1
jne 0x401c07
mov eax, dword [ebp + 0x98]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0059b097
mov dword [ebp - 0xc], 0
jmp 0x401c08
nop
jmp 0x401abf
nop
leave
ret