joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4364d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.004ae440
mov eax, dword [0x51d56c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x43651f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x43651f
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
call fcn.004accea
add eax, 0x40
push eax
call fcn.004aff35
add esp, 0xc
jmp 0x43665f
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x436527
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004afd10
mov esi, esp
test esi, esi
jne 0x43654b
mov esi, str.no_stack_
jmp 0x4365d0
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x436572
test edi, edi
je 0x436572
mov edx, dword [ebp + 8]
movsx cx, byte [eax + edx]
mov word [esi + eax*2], cx
inc eax
cmp eax, edi
jb 0x436561
xor eax, eax
test edi, edi
je 0x4365d0
cmp word [esi + eax*2], 0x25
jne case.0x436595.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x436595.43
movzx edx, byte [edx + 0x436690]
jmp dword [edx*4 + 0x436678]
inc eax
add ecx, 2
jmp 0x436583
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x436595.43
mov edx, 0x73
jmp 0x4365c6
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x436595.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x436578
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.004afe0d
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x436649
call fcn.00436390
test eax, eax
jle 0x436649
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x43665f
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x43665f
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab15e
mov esp, ebp
pop ebp
ret

Function at 0x436710
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x436732
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x436726
pop esi
movzx eax, cl
pop edi
ret
Function at 0x47db50
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x47dc33
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x47dbcd
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
jmp 0x47dc1e
shl edx, 0x10
cmp edi, 2
jne 0x47dbdd
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x47dc0a
lea edx, [edi + 0x3c]
jmp 0x47dc17
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x47db70
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x480840
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.004ae440
mov eax, dword [0x51d56c]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x4808b5
cmp ebx, dword [esi]
je 0x4808ac
test edi, edi
je 0x480892
cmp dword [esp + 0xa0], eax
jge 0x4808ac
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004ab15e
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x4808bb
mov ebx, dword [esi]
test ebx, ebx
je 0x480892
push ebp
test edi, edi
je 0x48098d
push ebx
call fcn.00440130
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x4808eb
push str.j____int_sizeof_ctx__key_
push 0x6a
push str..cryptohmachmac.c
call fcn.004366e0
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x480945
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.0043e4e0
add esp, 0xc
test eax, eax
je 0x480a3a
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.0043e690
add esp, 0xc
test eax, eax
je 0x480a3a
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.0043e6a0
add esp, 0xc
test eax, eax
je 0x480a3a
jmp 0x48096a
cmp eax, 0x80
ja 0x480a3a
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.004abca0
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x480995
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.004abb90
add esp, 0xc
jmp 0x480995
test eax, eax
je 0x480a26
xor eax, eax
jmp 0x4809a0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x4809a0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.0043e4e0
add esp, 0xc
test eax, eax
je 0x480a3a
push ebx
call fcn.00440130
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.0043e690
add esp, 0x10
test eax, eax
je 0x480a3a
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x4809e4
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.0043e4e0
add esp, 0xc
test eax, eax
je 0x480a3a
push ebx
call fcn.00440130
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.0043e690
add esp, 0x10
test eax, eax
je 0x480a3a
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.0043e830
add esp, 8
test eax, eax
jne 0x480a3e
xor eax, eax
jmp 0x480a43
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ab15e
add esp, 0x88
ret
Function at 0x4928e7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.004ae440
mov eax, dword [0x51d56c]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x492a4a
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.00479aa0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.00479b20
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.004cc000
push ebp
call fcn.00479aa0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.00479b20
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004cc000
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x492903
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.004ab15e
add esp, 0xa0
ret
Function at 0x499c40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x499c59
mov esi, edi
mov edi, eax
jmp 0x499c5b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x499c6b
mov eax, ebx
jmp 0x499c75
push eax
push ebx
call fcn.0042f370
add esp, 8
test eax, eax
jne 0x499c7d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x499c99
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x499c84
cmp eax, dword [esi + 4]
jge 0x499cb0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x499ca0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x499cd1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x499cce
dec eax
test eax, eax
jg 0x499cc0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4ab15e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x51d56c]
jne 0x4ab168
repz ret
jmp fcn.004b15bf

Function at 0x4bb3de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51d56c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004b3448
and dword [ebp - 0x14], 0
cmp dword [0x52181c], 0
mov dword [ebp - 0x18], eax
jne 0x4bb491
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4bb539
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x511d84
push ebx
call edi
test eax, eax
je 0x4bb539
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x52181c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x521820], eax
call edi
push eax
call esi
push 0x511d44
push ebx
mov dword [0x521824], eax
call edi
push eax
call esi
mov dword [0x52182c], eax
test eax, eax
je 0x4bb491
push 0x511d2c
push ebx
call edi
push eax
call esi
mov dword [0x521828], eax
mov eax, dword [0x521828]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4bb4ea
cmp dword [0x52182c], ecx
je 0x4bb4ea
push eax
call esi
push dword [0x52182c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4bb4ea
test ebx, ebx
je 0x4bb4ea
call edi
test eax, eax
je 0x4bb4e1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4bb4e1
test byte [ebp - 8], 1
jne 0x4bb4ea
or dword [ebp + 0x10], 0x200000
jmp 0x4bb51d
mov eax, dword [0x521820]
cmp eax, dword [ebp - 0x18]
je 0x4bb51d
push eax
call esi
test eax, eax
je 0x4bb51d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4bb51d
mov eax, dword [0x521824]
cmp eax, dword [ebp - 0x18]
je 0x4bb51d
push eax
call esi
test eax, eax
je 0x4bb51d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x52181c]
call esi
test eax, eax
je 0x4bb539
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4bb53b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ab15e
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x677d306b
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x50e941c4
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5721b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00572140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00572140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00572140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00572140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x572bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x572c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x58487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x572c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x572c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4081ba
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40822a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x40820c
mov dl, byte [eax - 1]
cmp dl, 0x20
je 0x40820b
cmp dl, 0x5c
je 0x40820b
cmp dl, 0x2f
jne 0x408216
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x4081f9
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40822c
xor eax, eax
leave
ret 4

Function at 0x408300
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x408335
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x4086e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x408727
cmp byte [esi], al
je 0x408727
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40e8c0]
push eax
push ecx
call fcn.0040a1aa
test eax, eax
je 0x408755
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x408730
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408715
sub ecx, edi
push ecx
push esi
push eax
call fcn.004088a0
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408730
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8

Function at 0x408760
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4087b9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4087b8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40e8c0]
push eax
push ecx
jmp loc.00410000
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x40c1a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004079ab
mov dword [ebp - 0x14], eax
cmp dword [0x4ab3e0], esi
jne 0x40c29b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c228
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c37b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c37b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c37b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ab3e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ab3e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ab3e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab3f0], eax
test eax, eax
je 0x40c298
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab3ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2c0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2b3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c2d5
push 4
pop eax
jmp 0x40c37d
cmp dword [ebp - 0x14], esi
je 0x40c2d5
push dword [0x4ab3e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2ba
mov eax, dword [0x4ab3ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c333
cmp dword [0x4ab3f0], edi
je 0x40c333
push eax
call ebx
push dword [0x4ab3f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c333
test eax, eax
je 0x40c333
call ecx
test eax, eax
je 0x40c328
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c328
test byte [ebp - 8], 1
jne 0x40c333
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c363
mov eax, dword [0x4ab3e4]
cmp eax, edi
je 0x40c360
push eax
call ebx
test eax, eax
je 0x40c360
call eax
mov esi, eax
test esi, esi
je 0x40c360
mov eax, dword [0x4ab3e8]
cmp eax, edi
je 0x40c360
push eax
call ebx
test eax, eax
je 0x40c360
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ab3e0]
call ebx
test eax, eax
je 0x40c37b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c37d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b15
mov esp, ebp
pop ebp
ret