joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], edx
mov edx, ecx
xor eax, eax
push edi
xor edi, edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], eax
jle 0x100a66e0
push ebx
push esi
lea ecx, [ecx]
mov ecx, edi
cmp edi, 2
jge 0x100a667a
xor ecx, 1
mov eax, dword [edx + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x100a66e9
mov ebx, dword [eax + ecx*8]
mov al, byte [edx]
movzx ecx, byte [ebx]
mov esi, edx
movzx edx, byte [ecx + 0x10105440]
movzx ecx, al
movzx ecx, byte [ecx + 0x10105440]
sub ecx, edx
jne 0x100a66d2
sub ebx, esi
mov edi, edi
test al, al
je 0x100a66e5
movzx ecx, byte [ebx + esi + 1]
mov al, byte [esi + 1]
movzx edx, byte [ecx + 0x10105440]
inc esi
movzx ecx, al
movzx ecx, byte [ecx + 0x10105440]
sub ecx, edx
je 0x100a66b0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [edx + 0x14]
jl 0x100a6670
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x100a66d2
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push 0
add ecx, 0x18
call fcn.100e7ea0
mov eax, dword [eax + 8]
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x100a66de
jmp 0x100a66d5
Function at 0x100a68a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
xor edi, edi
cmp dword [ecx + 0x14], edi
jle 0x100a6934
mov ecx, edi
cmp edi, 2
jge 0x100a68c7
xor ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x100a68ca
mov dword [ebp - 0xc], edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100a6982
mov bl, byte [esi]
mov edx, ecx
mov ecx, dword [ebp - 4]
add edx, edx
mov ecx, dword [ecx + 0x10]
mov eax, esi
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x10105440]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x10105440]
sub esi, ecx
jne 0x100a6928
sub edx, eax
mov dword [ebp - 0x10], edx
test bl, bl
je 0x100a697b
movzx ecx, byte [edx + eax + 1]
mov bl, byte [eax + 1]
movzx edx, byte [ecx + 0x10105440]
inc eax
movzx ecx, bl
movzx esi, byte [ecx + 0x10105440]
sub esi, edx
mov edx, dword [ebp - 0x10]
je 0x100a6903
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 0x14]
jl 0x100a68b8
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x10105440]
sub eax, 0x73
jne 0x100a6972
mov esi, str.sqlite_master
sub esi, ebx
lea esp, [esp]
test dl, dl
je 0x100a69a9
movzx eax, byte [esi + ebx + 1]
mov dl, byte [ebx + 1]
movzx ecx, byte [eax + 0x10105440]
inc ebx
movzx eax, dl
movzx eax, byte [eax + 0x10105440]
sub eax, ecx
je 0x100a6950
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x100a6928
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
add ecx, ecx
push 0
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
mov edx, ebx
call fcn.100e7ea0
mov eax, dword [eax + 8]
add esp, 4
test eax, eax
jne 0x100a6974
jmp 0x100a692b
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x100a69bf
neg edx
sbb edx, edx
jmp 0x100a6a08
test edx, edx
je 0x100a6972
movzx eax, byte [edx]
mov bl, byte [edi]
movzx ecx, byte [eax + 0x10105440]
movzx eax, bl
mov esi, edi
movzx eax, byte [eax + 0x10105440]
sub eax, ecx
jne 0x100a6a03
sub edx, edi
test bl, bl
je 0x100a6a03
movzx eax, byte [edx + esi + 1]
mov bl, byte [esi + 1]
movzx ecx, byte [eax + 0x10105440]
inc esi
movzx eax, bl
movzx eax, byte [eax + 0x10105440]
sub eax, ecx
je 0x100a69e1
mov ecx, dword [ebp - 4]
mov edx, eax
test edx, edx
jne 0x100a6972
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x100a68b1
Function at 0x100d1690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
push edi
mov eax, dword [esi + 0x50]
push ebx
push esi
call eax
movzx eax, word [edi + 0x10]
mov edx, dword [edi + 0xc]
add esp, 0xc
mov dword [esp + 0x14], eax
cmp eax, edx
je 0x100d186f
movzx ecx, word [esi + 0x18]
movzx edi, word [edi + 0x12]
add ecx, dword [esi + 0x38]
lea eax, [ebx - 1]
add eax, edi
cmp eax, ecx
jbe 0x100d16ff
push 0x1010288c
push 0x10135
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub edx, dword [esp + 0x14]
mov esi, dword [esi + 0x34]
mov edi, dword [edi + ebx - 4]
bswap edi
mov ecx, dword [esi + 0x28]
sub ecx, 4
lea eax, [edx - 1]
add eax, ecx
xor edx, edx
div ecx
mov dword [esp + 0xc], esi
mov ebx, eax
test ebx, ebx
je 0x100d186f
lea esp, [esp]
dec ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
cmp edi, 2
jb 0x100d1845
cmp edi, dword [esi + 0x30]
ja 0x100d1845
test ebx, ebx
je 0x100d1781
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
mov edx, edi
mov ecx, esi
call fcn.100d3240
add esp, 8
test eax, eax
jne 0x100d1871
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x100d1790
mov esi, dword [esp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.100d5bf0
mov esi, eax
test esi, esi
je 0x100d17c2
mov ecx, dword [esi + 0x48]
cmp word [ecx + 0x1e], 1
je 0x100d17c2
push 0x1010288c
push 0x1015a
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x14
mov dword [esp + 0x10], 0xb
jmp 0x100d17d5
mov ecx, dword [esp + 0xc]
push edi
mov edx, esi
call fcn.100d18a0
add esp, 4
mov dword [esp + 0x10], eax
test esi, esi
je 0x100d182c
mov edx, dword [esi + 0x48]
test edx, edx
je 0x100d182c
test byte [edx + 0x1c], 0x20
je 0x100d1825
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
mov edi, dword [esi]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100070f0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x100d182c
mov ecx, edx
call fcn.100e2fe0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x100d1871
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x100d186f
mov esi, dword [esp + 0xc]
jmp 0x100d1730
push 0x1010288c
push 0x10146
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d2ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esp + 0xc], 0
test al, al
js 0x100d2b45
je 0x100d2bbf
mov ecx, dword [esi + 0x74]
call fcn.100d5a50
dec byte [esi + 0x44]
je 0x100d2b3a
mov edi, edi
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100d2b30
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100070f0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x100d2b35
call fcn.100e2fe0
dec byte [esi + 0x44]
jne 0x100d2ae0
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
jmp 0x100d2bd7
cmp dword [esi + 0x3c], 0
jne 0x100d2b5a
mov byte [esi], 0
mov eax, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x100d2b83
cmp al, 4
jne 0x100d2b6e
mov eax, dword [esi + 0x40]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x38]
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov dword [esi + 0x38], 0
mov byte [esi], 0
movzx eax, byte [esi + 2]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x3c]
mov ecx, dword [ecx + 4]
push eax
lea edi, [esi + 0x74]
push 0
push edi
call fcn.100d5ac0
mov ecx, eax
add esp, 0xc
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x100d2bb3
mov byte [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [eax + 2]
mov byte [esi + 0x45], al
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x100d2c3c
movzx eax, byte [eax + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x100d2c3c
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x2a], ax
mov eax, dword [esi + 0x74]
cmp word [eax + 0x16], 0
jbe 0x100d2bfd
mov byte [esi], 1
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 8], 0
jne 0x100d2b4b
cmp dword [eax + 4], 1
je 0x100d2c1e
mov ecx, 0xfcc4
call fcn.10067230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 9]
mov eax, dword [eax + 0x38]
mov edx, dword [ecx + eax + 8]
bswap edx
mov ecx, esi
mov byte [esi], 1
call fcn.100d2d00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1010288c
push 0xfcb7
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d7430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x44]
mov dword [esp + 0x14], esi
test al, al
js 0x100d752a
xor ebx, ebx
test al, al
jle 0x100d74c7
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
lea ebx, [ebx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100d74ae
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100070f0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x100d74b3
call fcn.100e2fe0
mov ecx, dword [esp + 0x10]
movsx eax, byte [esi + 0x44]
inc ebx
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x100d7460
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100d751f
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
mov edi, dword [esi]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100070f0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.100e2fe0
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100dbe00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test byte [esi + 0x1c], 4
mov ecx, dword [esi + 0x14]
je 0x100dbe31
mov eax, dword [ecx + 0x18]
cmp eax, dword [esi + 0x18]
jb 0x100dbe31
cmp dword [ecx + 0x60], 0
je 0x100dbe2d
mov ecx, esi
call fcn.100e0e80
test eax, eax
je 0x100dbe2d
mov ecx, esi
pop esi
jmp fcn.100dd450
xor eax, eax
pop esi
ret
mov eax, dword [ecx + 0x28]
test eax, eax
jne 0x100dbe2f
mov eax, dword [ecx + 0x94]
cmp eax, dword [ecx + 0x98]
mov ecx, esi
jbe 0x100dbe4e
pop esi
jmp fcn.100dbe60
pop esi
jmp fcn.100dc0b0
Function at 0x100ddb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x88]
push edi
mov dword [esp + 0xc], edx
test esi, esi
je 0x100ddbbe
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0
movq qword [eax], xmm0
jmp 0x100ddc42
movzx edi, word [ebx + 0x8c]
add edi, 0x28
mov eax, edi
or eax, 0
je 0x100ddc2e
push 0
push edi
call fcn.100ecdb0
mov esi, eax
add esp, 8
test esi, esi
je 0x100ddbec
push edi
push 0
push esi
call fcn.10003750
add esp, 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test esi, esi
jne 0x100ddc32
push dword [ebp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x98]
mov esi, dword [ebx + 0x3c]
push 0
mov edi, dword [esi]
cdq
dec ecx
push ecx
push edx
push eax
call fcn.100070f0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x100ddbf0
lea eax, [esi + 0x28]
mov dword [esi + 8], eax
mov dword [esi + 0x1c], 0x10020
mov dword [esi + 0x14], ebx
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
pop edi
mov dword [esi + 0x18], edx
inc dword [ebx + 0x78]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e88c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push esi
inc eax
cdq
push edi
push edx
push eax
call fcn.100ec7e0
mov edi, eax
dec ebx
add esp, 8
mov dword [ebp + 8], ebx
test edi, edi
je 0x100e8944
xor esi, esi
test ebx, ebx
jle 0x100e8937
mov eax, dword [ebp - 4]
movsx ebx, byte [eax + esi + 1]
movsx edx, byte [eax + esi]
mov ecx, ebx
sar ecx, 6
and cl, 1
mov al, cl
shl al, 3
sub al, cl
mov ecx, edx
sar ecx, 6
sub bl, al
and cl, 1
mov al, cl
shl al, 3
sub al, cl
sub dl, al
mov ecx, esi
and bl, 0xf
shl dl, 4
shr ecx, 1
xor bl, dl
add esi, 2
mov byte [ecx + edi], bl
cmp esi, dword [ebp + 8]
jl 0x100e88f2
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov byte [eax + edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ea4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x101272c0], 0
je 0x100ea547
mov eax, dword [0x10128368]
test eax, eax
je 0x100ea520
push eax
call dword [0x1012731c]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.100ece20
mov eax, dword [0x10128368]
test eax, eax
je 0x100ea542
push eax
call dword [0x10127324]
mov esi, dword [ebp - 4]
jmp 0x100ea551
mov esi, dword [ebp - 4]
jmp 0x100ea554
push 0x14
call dword [0x101272ec]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100ea562
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x101272c4], 0
mov ebx, dword [ebp + 8]
je 0x100ea5ac
mov eax, dword [0x101273c4]
test eax, eax
je 0x100ea585
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x100ea5ac
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x100ea5f0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.100020ca
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x100ea5bf
xorps xmm0, xmm0
movq qword [esi], xmm0
movq qword [esi + 8], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x100ea5d8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
out 1, eax
mov bl, 0x10
iretd
add ecx, dword [ebx + esi*4]
adc byte [edi + 0x26ef4c55], bl
mov ebp, 0xaad8b906
dec esp
out dx, eax
mov ebp, 0xaad8b906
cmpsd dword [esi], dword es:[edi]
sti
fsub dword [eax + 0x2c]
xchg byte [esi + 0x55], ah
movsb byte es:[edi], byte [esi]
cdq
stosd dword es:[edi], eax
mov bl, 0x6a
out 0x21, eax
dec ecx
pop es
xor eax, dword [edx]
mov bl, 0x10
out dx, al
xchg edi, eax
inc eax
out dx, eax
jb 0x4153be
test eax, 0x2db52229
scasb al, byte es:[edi]
daa
push esp
and al, 0x3f
xor eax, 0xd1854c16
mov ebp, 0xaad95316
sbb al, 7
mov dword [0x9e10b2e8], eax
push ebp
jl 0x4153ac
daa
out dx, eax
dec eax
fbld tbyte [ebp + edx*2 - 0xc]
scasd eax, dword es:[edi]
push edi
adc al, 0x4c
pop es
ja 0x4153b8
mov bl, 0x10
iretd
Function at 0x40593b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004032d6
and dword [ebp - 0x14], 0
cmp dword [0x40b7d8], 0
mov dword [ebp - 0x18], eax
jne 0x4059ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405a96
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405a96
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b7e0], eax
call edi
push eax
call esi
mov dword [0x40b7e8], eax
test eax, eax
je 0x4059ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b7e4], eax
mov eax, dword [0x40b7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405a47
cmp dword [0x40b7e8], ecx
je 0x405a47
push eax
call esi
push dword [0x40b7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405a47
test ebx, ebx
je 0x405a47
call edi
test eax, eax
je 0x405a3e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405a3e
test byte [ebp - 8], 1
jne 0x405a47
or dword [ebp + 0x10], 0x200000
jmp 0x405a7a
mov eax, dword [0x40b7dc]
cmp eax, dword [ebp - 0x18]
je 0x405a7a
push eax
call esi
test eax, eax
je 0x405a7a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405a7a
mov eax, dword [0x40b7e0]
cmp eax, dword [ebp - 0x18]
je 0x405a7a
push eax
call esi
test eax, eax
je 0x405a7a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b7d8]
call esi
test eax, eax
je 0x405a96
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405a98
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040269a
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4499e6
Capabilities:
Encode data using xor

Disassembly:
out dx, al
or ah, byte [edx + 0x11ef87a3]
fisub word [eax - 0x3cc7339f]
dec ebp
loope 0x449a54
sub bl, byte [eax - 0x574b07ce]
Function at 0x4015f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x25c
mov eax, dword [esp + 0x270]
lea edi, [esp + 0x24]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [sym.imp.USER32.dll_CharLowerBuffA]
sub esp, 8
mov dword [esp + 4], 0x104
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
je 0x4016d2
mov dword [esp + 0x128], 0x128
mov esi, eax
lea eax, [esp + 0x128]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_Process32First
sub esp, 8
mov ebx, eax
test eax, eax
je 0x4016c6
xor ebx, ebx
lea ebp, [esp + 0x14c]
mov dword [esp + 4], 0x104
mov eax, dword [esp + 0x1c]
mov dword [esp], ebp
call eax
sub esp, 8
mov dword [esp + 4], ebp
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
sub esp, 8
cmp eax, 1
lea eax, [esp + 0x128]
mov dword [esp], esi
adc ebx, 0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
jne 0x401682
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x25c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4016e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [esp + 4], 0
mov edi, dword [esp + 0x160]
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
je 0x401790
lea esi, [esp + 0x18]
mov dword [esp], eax
mov ebx, eax
mov dword [esp + 4], esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
je 0x401772
lea ebp, [esp + 0x3c]
jmp 0x401753
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
je 0x401772
mov dword [esp + 4], edi
mov dword [esp], ebp
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401740
mov eax, dword [esp + 0x20]
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
sub esp, 4
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.CreateToolhelp32Snapshot_Error__n
call fcn.004015c0
add esp, 0x14c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4017b0
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
je 0x401804
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
test esi, esi
setne al
add esp, 0x14
pop ebx
pop esi
ret