joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509af0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x509b0b
jmp 0x509b18
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x509b20
jmp 0x509b28
jmp 0x509bda
xor eax, eax
push 0x509bb7
push ebp
push 0x4147c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040cdd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x509b99
jmp 0x509bac
cmp dword [ebp - 8], 0
jne 0x509ba1
jmp 0x509bac
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x509bda
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54cc00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.0054cbe0
push ebp
push 0x414440
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a650
cmp dword [ebp - 0xc], 0
jg 0x54cc4c
jmp 0x54cc6c
mov eax, dword [ebp - 0xc]
lea eax, [eax + 1]
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x54cc5f
mov eax, 0x5d22f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a650
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040ad90
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x54cc95
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x54cca1
mov eax, 0x5d22f0
call fcn.0042f1c0
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0054cbe0
mov esp, ebp
pop ebp
ret
Function at 0x54e310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5c8e60
call fcn.0040e4e0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0054e300
push ebp
push 0x414440
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.004088d0
mov eax, dword [ebp - 0xc]
mov edx, fcn.004dafb0
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.00409220
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.004088d0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.0054c270
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0054e9a0
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x54e415
jmp 0x54e434
mov eax, dword [ebp - 4]
call fcn.004fd390
test al, al
je 0x54e423
jmp 0x54e434
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0054e300
mov esp, ebp
pop ebp
ret
Function at 0x401040
Capabilities:
Link many functions at runtime
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwarePaloAlto
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4010b9
push 0x419af0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push str.C:KeyOpenFailed.txt
push eax
call fcn.004043b0
add esp, 0xc
test eax, eax
jne 0x4010aa
push dword [ebp - 0xc]
call fcn.00402e63
add esp, 4
push str.Error_Creating_and_opening_key_n
call fcn.00401010
add esp, 4
jmp 0x401117
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.PanCar
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40110e
push 0x419af0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push str.C:KeyValueFailed.txt
push eax
call fcn.004043b0
add esp, 0xc
test eax, eax
jne 0x401101
push dword [ebp - 0xc]
call fcn.00402e63
add esp, 4
push str.Error_writing_key_n
call fcn.00401010
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push esi
push edi
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
push 0x80
mov dword [ebp - 0xc], ebx
call fcn.004043f7
add esp, 4
mov esi, eax
push str.Process32First
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebx
push str.AllocConsole
push dword [ebp - 0xc]
mov dword [esi], eax
call ebx
push 0x419ba4
push dword [ebp - 0xc]
mov dword [esi + 4], eax
call ebx
push str.OpenFile
push dword [ebp - 0xc]
mov dword [esi + 8], eax
call ebx
push str.AddAtomA
push dword [ebp - 0xc]
mov dword [esi + 0xc], eax
call ebx
push 0x419bcc
push dword [ebp - 0xc]
mov dword [esi + 0x10], eax
call ebx
push 0x419bdc
push dword [ebp - 0xc]
mov dword [esi + 0x14], eax
call ebx
push str.OpenMutexA
push dword [ebp - 0xc]
mov dword [esi + 0x18], eax
call ebx
push str.NotifyWinEvent
push edi
mov dword [esi + 0x1c], eax
call ebx
mov edi, dword [ebp - 0xc]
push str.EnumResourceNamesA
push edi
mov dword [esi + 0x20], eax
call ebx
push str.Thread32First
push edi
mov dword [esi + 0x24], eax
call ebx
push str.WinExec
push edi
mov dword [esi + 0x28], eax
call ebx
push str.OpenThread
push edi
mov dword [esi + 0x2c], eax
call ebx
push str.ResumeThread
push edi
mov dword [esi + 0x30], eax
call ebx
push str.K32EnumProcesses
push edi
mov dword [esi + 0x34], eax
call ebx
push str.SetFilePointer
push edi
mov dword [esi + 0x38], eax
call ebx
mov dword [esi + 0x3c], eax
xor edi, edi
nop
push dword [esi]
push esi
push edi
push str._d_p_____08x_n
call fcn.00401010
inc edi
add esp, 0x10
add esi, 4
cmp edi, 0x10
jl 0x401210
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040123d
mov esp, ebp
pop ebp
ret
Function at 0xac03be
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
ret
neg eax
jmp 0xea7287
dec eax
jmp 0x999ac1
push edx
bswap dx
push eax
push esi
mov dl, 0x61
cwde
movzx eax, si
push edi
push ecx
rdtsc
push ebx
mov dl, cl
cdq
pushfd
ror ah, 0xf0
sal cx, 0x13
cwd
push ebp
rcr edx, 0xb3
rcl edx, cl
and eax, edx
mov ecx, 0
dec dx
push ecx
bsf dx, si
shr dx, 0x87
mov ebp, dword [esp + 0x28]
stc
rdtsc
neg ebp
xchg di, bx
bts edx, ecx
cmc
rol ebp, 1
adc edi, esi
shrd dx, si, 0x3d
bswap ebp
test di, 0x7d28
sub ebp, 0x5db46107
cmp si, 0x34d7
lea ebp, [ebp + ecx]
or di, bx
mov edi, esp
rcr dh, 0x75
sub esp, 0xc0
mov ebx, ebp
btc edx, 0x5b
mov edx, 0
sub ah, 0xfe
inc esi
and al, dh
sub ebx, edx
lea esi, [0xac0445]
cmovge ax, bx
add eax, edx
sal ax, 0x8a
mov eax, dword [ebp]
test esp, 0x18466088
cmp sp, 0x26d9
lea ebp, [ebp + 4]
clc
xor eax, ebx
jmp 0xaa4804
dec eax
xor eax, 0x29023412
test edx, edx
xor ebx, eax
add esi, eax
jmp 0x820dc4
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40704c], 1
mov dword [0x407050], 1
mov dword [0x407054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401670
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], str.STEALTHY.A
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
jne 0x4016d5
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error_starting_setup___Damaged_file
mov dword [esp + 4], str.This_setup_file_is_damaged._Please_download_a_fixed_version_of_this_file.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 0
jmp 0x401721
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._Corruptor
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x64
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x40170e
leave
ret 0x10
Function at 0x401a0a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0x4050e9
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._FindFiles
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x401a36

Function at 0x401cfc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x4028d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4028ef
mov eax, 0
jmp 0x402933
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402912
mov eax, 0
jmp 0x402933
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40292e
mov eax, 0
jmp 0x402933
mov eax, 1
leave
ret

Function at 0x402935
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402994
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40298c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40298c
mov eax, dword [ebp - 4]
jmp 0x4029a8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402969
mov eax, 0
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x470c54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x470c5d
jmp 0x470d12
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x470cb6
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x470cbb
jmp 0x47060e
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x470d02
lea eax, [ebp - 0x714]
push eax
call fcn.0046ec7c
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
Function at 0x405f64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edi
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
invalid
invalid

Function at 0x406aa4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x406ab8
jmp 0x406477
cmp dword [ebp - 0x37c], 0
je 0x406ac6
jmp 0x406b7b
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
dec dword [ecx - 0x37f7b]
inc dword [ebx - 0x37f43]
invalid
invalid
je 0x406b1f
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x406b24
jmp 0x406477
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x406b6b
lea eax, [ebp - 0x714]
push eax
call fcn.00404ae5
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00404a9a
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x406b76
jmp 0x406b7b
jmp 0x406477
cmp dword [ebp - 0x37c], 0
jne 0x406c25
mov eax, dword [ebp - 0x748]
invalid
invalid
Function at 0x10001e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001ea8
cmp byte [esi + ebx - 1], 0xa
je 0x10001e7c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10003118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4060a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41bb18]
jne 0x4060ac
repz ret
jmp fcn.0040ec00

Function at 0x4140de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004093e6
and dword [ebp - 4], 0
cmp dword [0x9c9818], 0
mov ebx, eax
jne 0x41418f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x414240
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x414240
push eax
call fcn.00409374
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x9c9818], eax
call esi
push eax
call fcn.00409374
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x9c981c], eax
call esi
push eax
call fcn.00409374
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x9c9820], eax
call esi
push eax
call fcn.00409374
pop ecx
mov dword [0x9c9828], eax
test eax, eax
je 0x41418f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409374
pop ecx
mov dword [0x9c9824], eax
mov eax, dword [0x9c9824]
cmp eax, ebx
je 0x4141e7
cmp dword [0x9c9828], ebx
je 0x4141e7
push eax
call fcn.004093ef
push dword [0x9c9828]
mov esi, eax
call fcn.004093ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4141e7
test edi, edi
je 0x4141e7
call esi
test eax, eax
je 0x4141de
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4141de
test byte [ebp - 0xc], 1
jne 0x4141e7
or dword [ebp + 0x10], 0x200000
jmp 0x414220
mov eax, dword [0x9c981c]
cmp eax, ebx
je 0x414220
push eax
call fcn.004093ef
pop ecx
test eax, eax
je 0x414220
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x414220
mov eax, dword [0x9c9820]
cmp eax, ebx
je 0x414220
push eax
call fcn.004093ef
pop ecx
test eax, eax
je 0x414220
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x9c9818]
call fcn.004093ef
pop ecx
test eax, eax
je 0x414240
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414242
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10026a7
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
inc eax
cmp dword [0x1005338], eax
mov dword [ebp - 8], 0x37
mov dword [ebp - 0xc], eax
jl 0x100272a
push ebx
push esi
mov ebx, 0x1005360
xor esi, esi
inc esi
cmp dword [0x1005334], esi
mov dword [ebp - 4], 0xc
jl 0x1002713
push 0xcc0020
xor eax, eax
mov al, byte [ebx + esi]
push 0
push 0
and eax, 0x1f
push dword [eax*4 + 0x1005a20]
push 0x10
push 0x10
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add dword [ebp - 4], 0x10
inc esi
cmp esi, dword [0x1005334]
jle 0x10026db
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 0x10
add ebx, 0x20
cmp eax, dword [0x1005338]
jle 0x10026c9
pop esi
pop ebx
leave
ret 4

Function at 0x1002d55
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [eax*4 + 0x10050d0]
push dword [0x1005950]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x1002d7a
Capabilities:
Set registry value

Disassembly:
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
mov eax, dword [esp + 0xc]
push 1
push 0
push dword [eax*4 + 0x10050d0]
push dword [0x1005950]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x10040fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x10013b0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004153
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x10013ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004146
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1004155
xor eax, eax
pop esi
leave
ret 4

Function at 0x101f227
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x101f23c
popal
leave
ret 0xc
Function at 0x42d7e0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.0042db90
ret 0x18

Function at 0x42da70
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0xfffffff
imul eax, eax, 8
jo 0x42da90
test ecx, 0x10000000
je 0x42da8d
or eax, 0x80000000
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42daa0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0x3fffffff
imul eax, eax, 2
jo 0x42daca
test ecx, 0x40000000
je 0x42dabd
or eax, 0x80000000
test ecx, 0x80000000
je 0x42dac7
or al, 1
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]

Function at 0x42dad0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, esi
and ecx, 0x3ffffff
imul ecx, ecx, 0x20
jo 0x42db0e
and eax, 0xf8000000
cdq
and edx, 0x7ffffff
add eax, edx
sar eax, 0x1b
and eax, 0x1f
or ecx, eax
test esi, 0x4000000
pop esi
je 0x42db09
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42db20
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, eax
xor edx, ecx
jge 0x42db35
add eax, ecx
jo 0x42db46
ret 8
xor eax, 0x80000000
add eax, ecx
jo 0x42db46
xor eax, 0x80000000
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x42db50
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
mov eax, ebx
and ecx, 1
imul ecx, ecx, 0x40000000
jo 0x42db87
and al, 0xfc
cdq
and edx, 3
add eax, edx
sar eax, 2
and eax, 0x3fffffff
or ecx, eax
test bl, 2
pop ebx
je 0x42db82
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop