joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x457940]
or eax, 0x856cd741
cmp eax, 0xa59f9d60
je 0x405e93
mov ax, word [0x478bd4]
movsx ecx, ax
movsx eax, word [0x47c044]
add eax, 0xdd682e7b
add ecx, eax
mov eax, dword [0x45d558]
xor eax, 0x2661ffbb
cmp eax, ecx
jle 0x405e93
add dword [0x465040], 0x18c388d0
movzx eax, word [0x472100]
push esi
push edi
mov edi, dword [ebp + 8]
add eax, 0x7632151
mov word [0x472100], ax
mov ecx, edi
call fcn.0041aab0
movzx ecx, word [0x472a1a]
mov esi, eax
add ecx, 0x6b42837a
mov word [0x472a1a], cx
mov ecx, edi
call fcn.0040ea60
cmp esi, eax
je 0x405f23
imul eax, dword [0x4675b0], 0x74501c99
mov ecx, edi
add eax, 0xa8348153
and dword [0x46b47c], eax
mov byte [esi], 0
inc esi
inc dword [0x46a780]
mov eax, dword [0x46a780]
xor eax, 0x145caf1f
and eax, dword [0x45bdc0]
mov dword [0x45bdc0], eax
mov eax, dword [0x457e28]
sar eax, 1
and eax, 0x18e3bce9
xor dword [0x46d98c], eax
call fcn.0040ea60
cmp esi, eax
jne 0x405ed2
mov edx, dword [0x45bda0]
mov ecx, edi
mov eax, dword [0x45cbc8]
sub edx, eax
mov eax, dword [0x45ab44]
and eax, edx
and eax, 0x87f3dbad
mov dword [0x45ab44], eax
call fcn.0041ba90
movsx eax, word [0x47af4e]
dec word [0x47af4e]
sub eax, 0x1fbd74bd
pop edi
pop esi
cmp eax, 0xb3cb8888
jge 0x405f6e
or dword [0x469618], 0x12f2e7fd
pop ebp
ret
Function at 0x406810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46dee0]
lea ecx, [eax*8 + 0x369a2372]
movzx eax, word [0x47b37c]
or ecx, 0x19733c69
and eax, ecx
mov word [0x47b37c], ax
inc word [0x4729b0]
movzx eax, word [0x4729b0]
movsx ecx, word [0x47afd6]
sar ecx, 9
cwde
sub ecx, 0x3b6acdd4
xor eax, 0xd00ce596
cmp ecx, eax
jg 0x406877
movsx eax, word [0x47077a]
mov ecx, 0x73c8ff13
sub ecx, eax
mov eax, dword [0x465a74]
imul eax, ecx
mov dword [0x465a74], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, edi
jne 0x406889
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movsx eax, word [0x47c616]
not eax
cmp eax, 0x6f1e2251
je 0x4068a8
mov eax, dword [0x46ac04]
and eax, 0x2e9e813
mov dword [0x4616ec], eax
push esi
mov esi, dword [edi + 4]
dec esi
test esi, esi
jle 0x4068c4
mov eax, dword [edi + 8]
lea eax, [eax + esi*4]
cmp dword [eax], 0
jne 0x4068c4
dec esi
sub eax, 4
test esi, esi
jg 0x4068b7
movzx eax, word [0x472cf6]
mov ecx, 0x705a6379
or eax, 0xd278dee2
inc esi
mov word [0x472cf6], ax
movsx eax, word [0x47c1a8]
sub ecx, eax
mov eax, dword [0x4631d0]
add eax, ecx
mov dword [0x46742c], eax
dec word [0x47c1a8]
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, 0x4800
push esi
push ebx
mov word [0x474b06], ax
call fcn.00406060
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
jne 0x406985
movsx ecx, word [0x4724ce]
sar ecx, 0xa
imul ecx, ecx, 0xb1f2ab3
cmp ecx, 0xff768df7
jle 0x40693a
add dword [0x46dfb0], 0x351fdcc8
mov eax, dword [ebx + 4]
shl eax, 2
push eax
push 0
push dword [ebx + 8]
call fcn.0042d6c0
movzx eax, word [0x478910]
sub eax, 0x699a67f8
mov word [0x478910], ax
lea eax, [esi*4]
push eax
push dword [edi + 8]
push dword [ebx + 8]
call fcn.0042a040
add esp, 0x18
imul eax, dword [0x468a14], 0x30250090
mov dword [0x468a14], eax
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416d30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x45c134], 0xa75a24f2
jg 0x416d46
or dword [0x464fa4], 0x8100f38a
push dword [0x456df0]
call fcn.00419d10
and dword [0x462090], 0x1c33786c
add esp, 4
push 1
call fcn.0042e1a0
int3
Function at 0x419680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x458898]
not eax
mov dword [ebp - 4], 0
xor eax, 0xb4911c0a
and dword [0x4580c8], eax
add dword [0x462974], 0x48022503
mov eax, dword [0x463278]
mov ecx, dword [0x465b3c]
not eax
add ecx, eax
movsx eax, word [0x470b32]
inc word [0x470b32]
xor ecx, 0x93c61386
and eax, 0x4768869c
cmp eax, ecx
jl 0x4196e6
movzx eax, word [0x47b54c]
imul eax, eax, 0xfd72ff9d
mov word [0x47b54c], ax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
cdq
and esi, 0x1f
and edx, 0x1f
mov dword [ebp + 0xc], esi
push edi
lea ebx, [edx + eax]
mov edx, dword [0x45d430]
movzx ecx, word [0x475f44]
and edx, 0xffcf96f7
or edx, 0xd38d0697
sar ebx, 5
add ecx, edx
mov word [0x475f44], cx
dec dword [0x45d430]
movsx eax, word [0x47a224]
sar eax, 4
imul ecx, eax, 0xe0a12a25
mov eax, dword [0x46c2a8]
or eax, 0x28b0540
cmp ecx, eax
je 0x41974e
add dword [0x46db80], 0xd889fcb5
mov esi, dword [ebp + 8]
test ebx, ebx
jle 0x4197f4
mov eax, dword [0x469da0]
mov ecx, 0xe9344d66
sub ecx, eax
mov eax, dword [0x45e758]
imul eax, ecx
mov dword [0x45e758], eax
xor eax, eax
mov ecx, dword [esi + 4]
sub ecx, ebx
test ecx, ecx
jle 0x41979b
lea edi, [ebx*4]
mov edx, dword [esi + 8]
lea edi, [edi + 4]
mov ecx, dword [edi + edx - 4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [esi + 4]
sub ecx, ebx
cmp eax, ecx
jl 0x419784
mov ecx, dword [0x469d20]
sub ecx, 0x12178d98
or ecx, 0x9bda1a29
sub dword [0x459434], ecx
cmp eax, dword [esi + 4]
jge 0x4197d0
jmp 0x4197c0
mov ecx, dword [esi + 8]
mov dword [ecx + eax*4], 0
inc eax
cmp eax, dword [esi + 4]
jl 0x4197c0
mov eax, dword [0x46f4b0]
mov ecx, dword [0x45c41c]
add eax, 0x20455f55
or ecx, eax
or ecx, 0x259d4089
mov dword [0x45c41c], ecx
dec dword [0x46f4b0]
movsx eax, word [0x4748f2]
mov ebx, dword [ebp + 0xc]
sub eax, 0xa3d40c6
and eax, 0xa1160ee5
add dword [0x4670bc], eax
inc word [0x4748f2]
test ebx, ebx
jle 0x4198f7
and dword [0x45f2b4], 0x297f76f1
mov edi, dword [esi + 4]
dec edi
js 0x4198e2
mov ecx, 0x20
sub ecx, ebx
mov dword [ebp + 0xc], ecx
jmp 0x419840
dec dword [0x45f994]
mov eax, dword [0x45f994]
mov dword [0x45e3fc], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + edi*4]
imul eax, dword [0x45ec80], 0x58e71da
shl edx, cl
mov ecx, ebx
mov dword [0x45ec80], eax
mov eax, dword [esi + 8]
shr dword [eax + edi*4], cl
inc dword [0x45e198]
mov eax, dword [0x45e198]
mov ecx, dword [ebp - 4]
or eax, 0xe2aec78f
xor eax, dword [0x45d9f0]
mov dword [0x45d9f0], eax
mov eax, dword [esi + 8]
mov dword [ebp - 4], edx
or dword [eax + edi*4], ecx
mov eax, dword [0x45b85c]
mov ecx, dword [0x46083c]
imul eax, eax, 0x8f8bb8c1
xor ecx, eax
xor ecx, 0x8e3e8869
mov dword [0x46083c], ecx
mov ax, word [0x472b02]
mov ecx, dword [0x460568]
cwde
sub ecx, eax
mov eax, dword [0x45a730]
sub ecx, eax
mov dword [0x460568], ecx
inc word [0x472b02]
dec edi
mov ecx, dword [ebp + 0xc]
jns 0x419840
imul eax, dword [0x45edd0], 0xc7718b2d
mov dword [0x463398], eax
dec dword [0x45edd0]
or dword [0x458b50], 0xc822487b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e2f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
inc word [0x471aa8]
mov cx, word [0x471aa8]
dec dword [0x465e30]
mov eax, dword [0x465e30]
movsx ecx, cx
sub ecx, eax
sub ecx, 0x7961ace1
or ecx, dword [0x468884]
mov dword [0x468884], ecx
movzx eax, word [0x47618e]
add eax, 0x53901ad0
cmp dword [0x47c7a0], 0
mov word [0x47618e], ax
jne 0x41e3c9
dec dword [0x46cdd0]
mov edx, dword [0x46cdd0]
mov eax, dword [0x46a994]
imul ecx, eax, 0x2c14d9b6
mov eax, dword [0x460eb8]
shl eax, 7
sub ecx, eax
lea eax, [edx + 0x3895a718]
cmp ecx, eax
jge 0x41e37f
movzx eax, word [0x475090]
and eax, 0x3110d8e8
mov word [0x475090], ax
call fcn.00418e90
mov dword [0x47c7a0], eax
movsx eax, word [0x47122a]
not eax
or eax, 0x2143ea58
cmp eax, 0x749ff555
jg 0x41e3c9
mov eax, dword [0x46557c]
shl eax, 0xa
add eax, 0x4099ee6f
cmp eax, 0x7961417f
jl 0x41e3ba
mov ax, word [0x479a80]
jmp 0x41e3c9
imul eax, dword [0x461718], 0xe57f3c01
mov dword [0x461718], eax
or dword [0x45d854], 0x1142241c
push esi
push edi
push 3
push 0x151f
call fcn.0040d520
mov cx, word [0x47b216]
mov esi, eax
mov edx, dword [0x45cd3c]
movsx ecx, cx
imul edx, ecx
push esi
push dword [ebp + 8]
imul ecx, edx, 0x9d2876f3
mov word [0x47b216], cx
inc dword [0x45cd3c]
call fcn.0042e5d1
mov ecx, dword [0x466bf4]
mov edi, eax
xor ecx, 0x9350c8bf
sub dword [0x466c34], ecx
inc dword [0x466bf4]
push esi
push 3
call fcn.0041b660
add dword [0x46eafc], 0x93f45d7f
add esp, 0x18
test edi, edi
jne 0x41e4df
imul eax, dword [0x466678], 0xdcbe747f
push 0x3e8
mov dword [0x466678], eax
call dword [0x4575fc]
movsx eax, word [0x474154]
movsx ecx, word [0x47b814]
sar eax, 1
or ecx, eax
mov eax, dword [0x462cc4]
or eax, ecx
or eax, 0x70dd328e
push 3
mov word [0x47b814], ax
dec dword [0x462cc4]
push 0x151f
call fcn.0040d520
mov esi, eax
mov eax, 0x1294
push esi
push dword [ebp + 8]
mov word [0x47ab78], ax
call fcn.0042e5d1
inc dword [0x469d5c]
mov edi, eax
mov ecx, dword [0x469d5c]
mov eax, dword [0x469e34]
imul eax, ecx
push esi
push 3
mov dword [0x469e34], eax
call fcn.0041b660
add esp, 0x18
mov dword [0x46747c], 0x88e6c999
movzx eax, word [0x4779ce]
xor eax, 0xa41b62db
mov word [0x4779ce], ax
test edi, edi
je 0x41e5b4
mov eax, dword [0x4602b4]
mov ecx, 0x4dc56728
sub ecx, eax
cmp ecx, 0xd090515f
jg 0x41e52d
imul eax, dword [0x464140], 0x7c9a6c07
mov ecx, dword [0x4616a8]
add eax, 0x2263e0c2
imul ecx, eax
mov dword [0x4616a8], ecx
jmp 0x41e54c
movsx ecx, word [0x4797c8]
movzx eax, word [0x47233a]
sar ecx, 6
or ecx, 0xbac9cd1e
add eax, ecx
mov word [0x47233a], ax
push edi
push 1
push 4
push 0x47c7a0
call fcn.0042e784
imul eax, dword [0x45ad28], 0xb25cc3d5
push edi
mov dword [0x45ad28], eax
call fcn.0042e496
mov eax, dword [0x4672dc]
add esp, 0x14
not eax
cmp eax, 0xb2d7b9d0
jne 0x41e5b4
mov ecx, dword [0x466d14]
add ecx, dword [0x465fe4]
movsx eax, word [0x470664]
and ecx, 0x1a1e32aa
not eax
cmp ecx, eax
jne 0x41e5b4
movsx eax, word [0x4708cc]
mov ecx, 0xdcf07a55
sub ecx, eax
xor dword [0x4691c0], ecx
add dword [0x460a94], 0x8aa1cc52
pop edi
pop esi
pop ebp
ret
Function at 0x4258a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov dword [0x458e10], 0xfad815e9
dec dword [0x45e250]
mov ecx, dword [0x45e250]
mov eax, dword [0x46b57c]
and ecx, 0x70bc8fd3
push esi
push edi
mov edi, dword [ebp + 8]
or ecx, eax
and dword [0x46308c], ecx
mov edx, dword [edi + 4]
dec edx
js 0x4258eb
mov eax, dword [edi + 8]
lea eax, [eax + edx*4]
lea ecx, [ecx]
cmp dword [eax], 0
jne 0x4258eb
sub eax, 4
dec edx
jns 0x4258e0
movzx eax, word [0x4770a4]
mov esi, dword [ebp + 0xc]
add eax, 0x65a0c31
mov word [0x4770a4], ax
mov ecx, dword [esi + 4]
dec ecx
js 0x42591b
mov eax, dword [esi + 8]
lea eax, [eax + ecx*4]
lea esp, [esp]
cmp dword [eax], 0
jne 0x42591b
sub eax, 4
dec ecx
jns 0x425910
mov eax, dword [0x462388]
dec dword [0x462388]
cmp eax, 0x13a1ed5
je 0x425943
mov eax, dword [0x45f554]
sub eax, dword [0x4653d4]
mov dword [0x45f554], eax
inc dword [0x4653d4]
test edx, edx
jns 0x42594f
test ecx, ecx
js 0x425aa2
mov eax, dword [0x45ae68]
inc dword [0x45ae68]
and eax, 0x20f9d0db
cmp eax, 0x1044483
je 0x425970
mov dword [0x4673d8], 0xe2a032de
cmp edx, ecx
jle 0x42597d
pop edi
mov eax, 1
pop esi
pop ebp
ret
mov eax, dword [0x45d1a0]
sar eax, 0xa
xor eax, 0x4d92af5
cmp eax, 0xfd248797
je 0x4259ba
inc word [0x475834]
mov ax, word [0x475834]
cwde
cmp eax, 0x50040
jle 0x4259c4
movzx eax, word [0x477a74]
sub eax, 0x54b2e3d0
mov word [0x477a74], ax
jmp 0x4259c4
add dword [0x45a68c], 0xe444d1d3
cmp ecx, edx
jle 0x4259cf
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [0x46b048]
mov eax, dword [0x45a9fc]
sar ecx, 2
and eax, ecx
or eax, 0xb41f819d
mov dword [0x458a34], eax
test edx, edx
js 0x425a98
jmp 0x425a00
mov eax, dword [0x4696dc]
imul ecx, eax, 0x2689211b
mov eax, dword [0x45d004]
sub ecx, eax
movsx eax, word [0x478a74]
dec dword [0x4696dc]
sar eax, 3
imul eax, eax, 0xc28abba5
cmp ecx, eax
jle 0x425a3e
movzx eax, word [0x475020]
add eax, 0x733090bb
mov word [0x475020], ax
mov eax, dword [edi + 8]
mov ecx, dword [esi + 8]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
ja 0x425974
imul ecx, dword [0x45b5d0], 0x3ec137b3
movzx eax, word [0x473894]
or ecx, 0xa176306f
sub eax, ecx
mov word [0x473894], ax
dec dword [0x45b5d0]
mov eax, dword [edi + 8]
mov ecx, dword [esi + 8]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jb 0x4259c8
add dword [0x469c40], 0xdedfb6f9
dec edx
jns 0x425a00
add dword [0x4584d0], 0x853e7f21
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4356a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4563c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042f67c
mov dword [ebp - 0x14], eax
cmp dword [0x47d1d4], esi
jne 0x435798
push 0x800
push esi
push 0x44c250
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x435725
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x435878
push esi
push esi
push 0x44c250
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x435878
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435878
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x47d1d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x47d1d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x47d1dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47d1e4], eax
test eax, eax
je 0x435795
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47d1e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4357bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4357b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4357d2
push 4
pop eax
jmp 0x43587a
cmp dword [ebp - 0x14], esi
je 0x4357d2
push dword [0x47d1d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4357b7
mov eax, dword [0x47d1e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x435830
cmp dword [0x47d1e4], edi
je 0x435830
push eax
call ebx
push dword [0x47d1e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x435830
test eax, eax
je 0x435830
call ecx
test eax, eax
je 0x435825
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x435825
test byte [ebp - 8], 1
jne 0x435830
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x435860
mov eax, dword [0x47d1d8]
cmp eax, edi
je 0x43585d
push eax
call ebx
test eax, eax
je 0x43585d
call eax
mov esi, eax
test esi, esi
je 0x43585d
mov eax, dword [0x47d1dc]
cmp eax, edi
je 0x43585d
push eax
call ebx
test eax, eax
je 0x43585d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x47d1d4]
call ebx
test eax, eax
je 0x435878
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43587a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004354f7
mov esp, ebp
pop ebp
ret
Function at 0x4014f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401500
repz ret
jmp fcn.00401a9e

Function at 0x404e05
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00402eaf
xor ebx, ebx
cmp dword [0x40c684], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x404eda
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x404e45
xor eax, eax
jmp 0x404f9e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x408950
push edi
call esi
cmp eax, ebx
je 0x404e3e
push eax
call fcn.00402e4c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40c684], eax
call esi
push eax
call fcn.00402e4c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40c688], eax
call esi
push eax
call fcn.00402e4c
mov dword [0x40c68c], eax
lea eax, [ebp - 8]
push eax
call fcn.0040215e
test eax, eax
pop ecx
pop ecx
je 0x404ea8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404899
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x404eda
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402e4c
cmp eax, ebx
pop ecx
mov dword [0x40c694], eax
je 0x404eda
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e4c
pop ecx
mov dword [0x40c690], eax
mov eax, dword [0x40c690]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x404f53
cmp dword [0x40c694], esi
je 0x404f53
push eax
call fcn.00402eb8
pop ecx
call eax
cmp eax, ebx
je 0x404f20
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40c694]
call fcn.00402eb8
pop ecx
call eax
test eax, eax
je 0x404f20
test byte [ebp - 0x18], 1
jne 0x404f53
lea eax, [ebp - 0xc]
push eax
call fcn.00402195
test eax, eax
pop ecx
je 0x404f3b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404899
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x404f4a
or dword [ebp + 0x10], 0x200000
jmp 0x404f84
or dword [ebp + 0x10], 0x40000
jmp 0x404f84
mov eax, dword [0x40c688]
cmp eax, esi
je 0x404f84
push eax
call fcn.00402eb8
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x404f84
mov eax, dword [0x40c68c]
cmp eax, esi
je 0x404f84
push dword [ebp - 4]
push eax
call fcn.00402eb8
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40c684]
call fcn.00402eb8
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x41ced0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44caad
mov eax, dword fs:[0]
push eax
sub esp, 0x9e4
mov eax, dword [0x665500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x9ec], esi
mov edx, 1
mov dword [ebp - 0x9ec], esi
mov dword [ebp - 0x9e8], 0x1571
mov dword [ebp - 0x28], edx
nop dword [eax]
mov eax, dword [ebp + edx*4 - 0x9ec]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [ebp + edx*4 - 0x9e8], eax
mov edx, dword [ebp - 0x28]
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x270
jb 0x41cf20
mov ecx, dword [ebp - 0x3b8]
xor ecx, dword [ebp - 0x2c]
jge 0x41cf64
xor ecx, 0x1908b0df
add ecx, ecx
or ecx, 1
jmp 0x41cf66
add ecx, ecx
mov eax, dword [ebp - 0x9e8]
and ecx, 0x7fffffff
and eax, 0x80000000
or eax, ecx
mov dword [ebp - 0x9e8], eax
xor eax, eax
cmp dword [ebp + eax*4 - 0x9e8], 0
jne 0x41cf9d
inc eax
cmp eax, 0x270
jb 0x41cf81
mov dword [ebp - 0x9e8], 0x80000000
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0041c9f0
mov edx, dword [ebp - 0x1c]
mov dword [esi + 0xc], 0
test edx, edx
je 0x41d00d
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x41d003
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d029
push ecx
push edx
call fcn.00434a22
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434679
mov esp, ebp
pop ebp
ret
call fcn.00439430
int3
Function at 0x423430
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x42346b
cmp esi, edx
jb 0x42346b
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x423454
pop esi
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop dword [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [esi - 0x40]
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x423480
pop esi
ret
Function at 0x426fe0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
movzx ecx, byte [esi + 3]
shl ecx, 8
movzx eax, byte [esi + 2]
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x14], ecx
movzx ecx, byte [esi + 7]
shl ecx, 8
movzx eax, byte [esi + 6]
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x28], ecx
movzx ecx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x3c], ecx
movzx ecx, byte [esi + 0xf]
movzx eax, byte [esi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x30], ecx
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x1c], ecx
movzx ecx, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x10], ecx
movzx ecx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x24], ecx
movzx ecx, byte [esi + 0x1f]
movzx eax, byte [esi + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edx + 0x38], ecx
mov dword [edx], 0x61707865
mov dword [edx + 4], 0x3320646e
mov dword [edx + 8], 0x79622d32
mov dword [edx + 0xc], 0x6b206574
pop esi
ret