joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003af60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x15
mov dword [ebp - 8], 0
jmp 0x1003af82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x1003afc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5b16eeed]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003afbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003af79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003afe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbb
mov dword [ebp - 8], 0
jmp 0x1003b002
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1003b041
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6c25646a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003b03c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003aff9
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xaa
mov dword [ebp - 8], 0
jmp 0x1003b082
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x1003b0c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x35ed5b32]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003b0bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003b079
mov eax, dword [ebp - 0xc]
mov byte [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x69
mov dword [ebp - 8], 0
jmp 0x1003b102
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x1003b141
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x8df6d15]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003b13c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003b0f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xcc
mov dword [ebp - 8], 0
jmp 0x1003b182
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1003b1c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x67ba51ee]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003b1bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003b179
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x64
mov dword [ebp - 8], 0
jmp 0x1003b202
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2c
jge 0x1003b241
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x10984ca5]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003b23c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003b1f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2c], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x36
mov dword [ebp - 8], 0
jmp 0x1003b282
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x1003b2c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0xa88dfb0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003b2bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003b279
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
call fcn.1003b420
movzx eax, al
test eax, eax
je 0x1003b6fc
mov byte [ebp - 0x34], 0x46
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x6c
mov byte [ebp - 0x2f], 0x20
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x20
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x7a
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x21
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x3a
mov byte [ebp - 3], 0x20
mov byte [ebp - 2], 0x38
mov byte [ebp - 1], 0
mov ecx, dword [0x10067828]
call fcn.10001480
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [0x1006782c]
call fcn.10010a30
mov esp, ebp
pop ebp
ret

Function at 0x1003d386
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10066b44]
jne 0x1003d390
repz ret
jmp fcn.1003d9dc
Function at 0x1003f070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1003f178
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003f178
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1003f178
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003dda0
add esp, 0x10
cmp eax, 2
je 0x1003f0b9
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1003f0ad
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1003dda0
add esp, 0x10
cmp eax, 4
jne 0x1003f0ad
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1003f0e8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003dda0
add esp, 0x10
cmp eax, 2
jne 0x1003f0ad
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1003f143
cmp eax, 0x8664
jne 0x1003f0ad
push 0x108
push ebx
push edi
push esi
call fcn.1003dda0
add esp, 0x10
cmp eax, 0x108
jne 0x1003f0ad
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1003dda0
add esp, 0x10
cmp eax, 0xf8
jne 0x1003f0ad
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417060
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [edi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push ebx
push ebp
mov ebp, dword [edi + 4]
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 0xc], 0
jbe 0x41712a
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x4170c9
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x38]
test ebx, ebx
jle 0x41710e
mov eax, dword [edi + 0x34]
mov ecx, dword [esi - 4]
mov edx, dword [edi + 0x1c]
push eax
push 4
push 0x1000
add ecx, ebp
push ebx
push ecx
call edx
add esp, 0x14
test eax, eax
je 0x417134
mov eax, dword [esi - 4]
push ebx
add eax, ebp
push 0
push eax
mov dword [esi - 8], eax
call fcn.0045c3c0
jmp 0x41710b
mov ecx, dword [esi + 4]
add ecx, eax
cmp dword [esp + 0x18], ecx
jb 0x417134
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x1c]
push edx
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebp
push eax
call ecx
add esp, 0x14
test eax, eax
je 0x417134
mov eax, dword [esi + 4]
mov edx, dword [esi]
add eax, dword [esp + 0x14]
mov ebx, dword [esi - 4]
push edx
add ebx, ebp
push eax
push ebx
call fcn.0045fc90
mov dword [esi - 8], ebx
add esp, 0xc
mov ecx, dword [edi]
mov eax, dword [esp + 0xc]
movzx edx, word [ecx + 6]
add eax, 1
add esi, 0x28
cmp eax, edx
mov dword [esp + 0xc], eax
jl 0x417087
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x417290
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
sub edx, 1
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
test esi, esi
mov dword [esp + 0x18], edx
jne 0x4172d6
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x4172cf
mov esi, dword [eax + 0x20]
jmp 0x4172d6
test bl, bl
jns 0x4172d6
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
cmp word [eax + 6], si
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], esi
jbe 0x4173b6
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x3c]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
sub esi, 1
not esi
and esi, ebp
test edi, edi
jne 0x417329
mov ecx, dword [ebx]
test cl, 0x40
je 0x417322
mov edi, dword [eax + 0x20]
jmp 0x417329
test cl, cl
jns 0x417329
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x417362
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x417362
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
call fcn.00417140
test eax, eax
je 0x4173d7
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x41738e
mov eax, dword [ebx]
test eax, 0x2000000
je 0x41737b
test dword [esp + 0x20], 0x2000000
je 0x41737b
or dword [esp + 0x20], eax
jmp 0x417388
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
add ecx, 1
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x417302
lea eax, [esp + 0x14]
mov ecx, edi
mov dword [esp + 0x24], 1
call fcn.00417140
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x43fe10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x43fe29
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x43fe64
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x43fe60
lea ebx, [ebx]
cmp esi, eax
jae 0x43fe64
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x43fe50
cmp esi, eax
jb 0x43fe6a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x44128d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4412d3
call fcn.0044451e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x4412d3
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x441316
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4412ff
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4412ff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x441313
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44988a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4498cd
call fcn.0044451e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x4498cd
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x4498e8
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00449441
test ebx, ebx
mov esi, eax
je 0x4498e6
test edi, edi
je 0x4498e6
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x45a500
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x488590]
jne 0x45a50a
repz ret
jmp fcn.0045f432
Function at 0x4689dc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0045f69b
xor ebx, ebx
cmp dword [0x48c264], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x468ab1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x468a1c
xor eax, eax
jmp 0x468b75
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x47a0f8
push edi
call esi
cmp eax, ebx
je 0x468a15
push eax
call fcn.0045f638
mov dword [esp], 0x47a0e8
push edi
mov dword [0x48c264], eax
call esi
push eax
call fcn.0045f638
mov dword [esp], 0x47a0d4
push edi
mov dword [0x48c268], eax
call esi
push eax
call fcn.0045f638
mov dword [0x48c26c], eax
lea eax, [ebp - 8]
push eax
call fcn.0045bf9f
test eax, eax
pop ecx
pop ecx
je 0x468a7f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045a990
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x468ab1
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0045f638
cmp eax, ebx
pop ecx
mov dword [0x48c274], eax
je 0x468ab1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045f638
pop ecx
mov dword [0x48c270], eax
mov eax, dword [0x48c270]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x468b2a
cmp dword [0x48c274], esi
je 0x468b2a
push eax
call fcn.0045f6a4
pop ecx
call eax
cmp eax, ebx
je 0x468af7
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x48c274]
call fcn.0045f6a4
pop ecx
call eax
test eax, eax
je 0x468af7
test byte [ebp - 0x18], 1
jne 0x468b2a
lea eax, [ebp - 0xc]
push eax
call fcn.0045bfd6
test eax, eax
pop ecx
je 0x468b12
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045a990
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x468b21
or dword [ebp + 0x10], 0x200000
jmp 0x468b5b
or dword [ebp + 0x10], 0x40000
jmp 0x468b5b
mov eax, dword [0x48c268]
cmp eax, esi
je 0x468b5b
push eax
call fcn.0045f6a4
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x468b5b
mov eax, dword [0x48c26c]
cmp eax, esi
je 0x468b5b
push dword [ebp - 4]
push eax
call fcn.0045f6a4
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x48c264]
call fcn.0045f6a4
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46eb63
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x488590]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0046eaf8
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0045c3c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x46ebb2
cmp dword [ebp - 0x1c], 5
jb 0x46ebca
jmp 0x46ebc6
cmp dword [ebp - 0x10], 1
jne 0x46ebca
cmp dword [ebp - 0x1c], 4
ja 0x46ebc6
jne 0x46ebca
cmp dword [ebp - 0x18], 0
jbe 0x46ebca
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x47b308
call fcn.0046e9e9
test eax, eax
jge 0x46ebeb
mov byte [0x48c3bc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045a500
add ebp, 0x78
leave
ret
Function at 0x4077a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x415350], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x41534c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x415350], eax
cmp ecx, 0x26f
jl 0x4077b0
mov dword [0x412430], 0x270
ret

Function at 0x4077f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x414010]
cmp eax, dword [0x4123e0]
je 0x407808
mov dword [0x412430], 0x271
cmp dword [0x412430], 0x270
jl 0x407927
cmp dword [0x412430], 0x271
jne 0x40783f
mov eax, dword [0x414010]
call fcn.004077a0
mov eax, dword [0x414010]
not eax
mov dword [0x414010], eax
mov dword [0x4123e0], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x415354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x415350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x415984]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x412440]
xor edx, eax
mov dword [ebx*4 + 0x415350], edx
cmp ebx, 0xe2
jl 0x407848
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x415354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x415350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x414fc4]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x412440]
xor edx, eax
mov dword [ebx*4 + 0x415350], edx
cmp ebx, 0x26e
jl 0x40789c
mov eax, dword [0x415d0c]
and eax, 0x80000000
mov edx, dword [0x415350]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x415980]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x412440]
xor eax, edx
mov dword [0x415d0c], eax
mov dword [0x412430], 0
mov eax, dword [0x412430]
mov eax, dword [eax*4 + 0x415350]
add dword [0x412430], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x409190
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x412190]
cmp ax, 0xcb
je 0x40928c
cmp ax, 0xcc
je 0x40928c
mov edx, dword [0x415f60]
test edx, edx
je 0x4091c2
mov eax, dword [0x415e00]
call edx
mov ebx, eax
jmp 0x4091c7
mov ebx, 0x415e04
cmp word [0x415df0], 0
jle 0x4091ea
mov eax, 0x415dd0
call fcn.00409400
mov eax, ebx
call fcn.00408d70
mov eax, ebx
call fcn.00408de0
mov edi, dword [ebx]
jmp 0x40920a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x409205
mov edx, edi
mov eax, ebx
call fcn.00408240
jmp 0x409208
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4091f0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x415df0], 0
jle 0x40928c
mov edx, 0x415d10
mov eax, ebx
call fcn.00408370
mov edi, eax
test edi, edi
je 0x40925f
mov eax, dword [0x415da4]
mov dword [edi + 0xc], eax
cmp dword [0x415da4], 0
je 0x409254
mov eax, dword [0x415da4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x415da4], eax
sub word [0x415df0], 1
cmp word [0x415df0], 0
sete bl
mov eax, 0x415dd0
call fcn.00409410
test bl, bl
je 0x40928c
mov eax, 0x415dd0
call fcn.004093f0
pop edi
pop esi
pop ebx
ret

Function at 0x40c330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 8], eax
mov esi, esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040c2f0
test al, al
jne 0x40c367
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x40c348
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40c370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
lea esp, [esp - 0x48]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], eax
mov edx, dword [eax + 0x3c]
mov ecx, dword [esp + 0x3c]
lea eax, [edx + ecx]
mov eax, dword [eax + 0x78]
mov edx, dword [esp + 0x3c]
lea esi, [eax + edx]
mov edi, esp
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], 0
call fcn.0040c030
mov dword [esp + 0x28], eax
call fcn.0040c060
mov ebp, eax
mov eax, dword [esp + 0x18]
sub eax, 1
mov edi, eax
mov esi, 0
cmp edi, esi
jb 0x40c47a
sub esi, 1
nop
add esi, 1
mov eax, esi
shl eax, 2
add eax, dword [esp + 0x30]
mov eax, dword [eax]
add eax, dword [esp + 0x3c]
mov ebx, eax
mov edx, ebx
mov eax, ebp
call fcn.0040c2c0
test al, al
je 0x40c43c
mov eax, esi
shl eax, 1
add eax, dword [esp + 0x2c]
movzx eax, word [eax]
shl eax, 2
add eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edx, dword [esp + 0x40]
mov dword [edx], eax
mov al, byte [esp + 0x34]
test al, al
jne 0x40c47a
mov byte [esp + 0x34], 1
mov edx, ebx
mov eax, dword [esp + 0x28]
call fcn.0040c2c0
test al, al
je 0x40c472
mov eax, esi
shl eax, 1
add eax, dword [esp + 0x2c]
movzx eax, word [eax]
shl eax, 2
add eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edx, dword [esp + 0x44]
mov dword [edx], eax
mov al, byte [esp + 0x34]
test al, al
jne 0x40c47a
mov byte [esp + 0x34], 1
cmp edi, esi
ja 0x40c3f4
lea esp, [esp + 0x48]
pop ebp
pop edi
pop esi
pop ebx
ret