joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4d8013f6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, str.BN_N
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4e027ac3
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x417887
Capabilities:
Encrypt data using rc4 prga

Disassembly:
arpl word [ecx], bx
sahf
arpl sp, bp
fdivr dword [ebx - 0x54c6a698]
cld
ret
mov bh, 0x1f
test dword [esi + 0x504ed5b1], 0xf377c341
mov eax, 0x96eb48ec
outsb dx, byte [esi]
pop ds
jnp 0x41784e
inc eax
and esp, dword [edi - 0x75f22f9f]
popal
ror byte [0x31a4008a], 1
cmpsb byte [esi], byte es:[edi]
and esp, dword [ecx - 0x67]
pop es
out 0x79, eax
in eax, dx
push 0xfffffffffffffffa
sbb bl, dh
adc cl, dh
xor cl, byte [esi + 0x5b9aee22]
les ebx, [eax - 5]
jno 0x41786d
push 0x2b8242c9
mov ecx, 0x4327b63b

Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baaa0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax

Function at 0x417a3f
Capabilities:
Get common file path

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baaa0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ba05c
push eax
call esi
mov ecx, dword [0x4baaa0]
push 0x4ba044
push ecx
mov dword [0x4baa9c], eax
Function at 0x431368
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0043155b
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0043c0b0
xor ebx, ebx
cmp eax, ebx
jne 0x431516
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0043155b
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00438d8f
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0048a684
add esp, 0x10
test eax, eax
jne 0x431431
push esi
call fcn.0042ea1a
mov esi, eax
cmp esi, ebx
pop ecx
je 0x431431
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x43141c
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x431431
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x43142a
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0043d5c3
cmp byte [esp + 0x13], bl
je 0x431461
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00431598
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4314d1
push 0x14
call fcn.004898f1
cmp eax, ebx
pop ecx
je 0x43148b
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x43148d
xor edi, edi
cmp edi, ebx
je 0x4314d1
push esi
push edi
call fcn.00430abe
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00430b86
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430caf
add esp, 0x18
call fcn.0043155b
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0043b77d
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4314e8
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4314fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x43153d
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [int.00497250]
jmp 0x43153d
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00430b86
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00430caf
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472d7a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp dword [edx*4 + 0x473034]
and esi, 0x3f
inc esi
jmp case.default.0x472d5a
mov cl, byte [ebp - 8]
and esi, 0x3ff
add eax, edi
add esi, 0x41
xor cl, 1
add dword [eax + 0x75ebf84d], ecx
inc eax
add esi, 0x441
jmp case.default.0x472d5a
mov edx, dword [ebp + 0x14]
lea ecx, [edi + eax + 2]
cmp ecx, edx
ja 0x472fdf
mov cl, byte [ebp - 8]
inc eax
xor cl, 1
mov byte [ebp - 8], cl
je 0x472db6
mov cl, byte [eax + ebx]
and ecx, 0xf
shl ecx, 0xe
lea esi, [esi + ecx + 0x4441]
jmp case.default.0x472d5a
xor ecx, ecx
mov cl, byte [eax + ebx]
shr ecx, 4
inc eax
shl ecx, 0xe
lea esi, [esi + ecx + 0x4441]
jmp case.default.0x472d5a
mov cl, byte [ebp - 8]
xor cl, 1
mov byte [ebp - 8], cl
je 0x472e08
mov cl, byte [eax + ebx]
and ecx, 0xf
jmp 0x472e11
xor ecx, ecx
mov cl, byte [eax + ebx]
shr ecx, 4
Function at 0x475608
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004757fb
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call int.00480350
xor ebx, ebx
cmp eax, ebx
jne 0x4757b6
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004757fb
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047d02f
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4ce924
add esp, 0x10
test eax, eax
jne 0x4756d1
push esi
call fcn.00472cba
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4756d1
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4756bc
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4756d1
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4756ca
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00481863
cmp byte [esp + 0x13], bl
je 0x475701
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00475838
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x475771
push 0x14
call 0x4cdb91
cmp eax, ebx
pop ecx
je 0x47572b
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x47572d
xor edi, edi
cmp edi, ebx
je 0x475771
push esi
push edi
call fcn.00474d5e
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00474e26
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474f4f
add esp, 0x18
call fcn.004757fb
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call int.0047fa1d
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x475788
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x47579a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4757dd
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [int.00497250]
jmp 0x4757dd
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00474e26
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474f4f
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489e3a
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
pop ebx
push es
xchg ebp, eax
or bh, bl
xchg edx, eax
sbb al, 0x9f
lahf
out dx, al
xlatb
les eax, [ebp - 0x35cd3fb7]
xor ebx, dword [edx + esi + 0x19a2be23]
pop esi
sub byte [esi + 0x2356982d], dh
xor al, byte [edi + ebx*8 + 0x2f]
inc esp
fild qword [edi]
nop
jae 0x489e22
sub byte [edi - 7], 0x4b
in eax, 0x30
mov bl, 0xd8
outsb dx, byte [esi]
and byte [esi], dl
hlt
Function at 0x48c6a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048c89b
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004973f0
xor ebx, ebx
cmp eax, ebx
jne 0x48c856
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048c89b
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004940cf
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e59c4
add esp, 0x10
test eax, eax
jne 0x48c771
push esi
call fcn.00489d5a
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48c771
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48c75c
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48c771
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c76a
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00498903
cmp byte [esp + 0x13], bl
je 0x48c7a1
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048c8d8
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48c811
push 0x14
call 0x4e4c31
cmp eax, ebx
pop ecx
je 0x48c7cb
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48c7cd
xor edi, edi
cmp edi, ebx
je 0x48c811
push esi
push edi
call fcn.0048bdfe
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048bec6
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048bfef
add esp, 0x18
call fcn.0048c89b
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00496abd
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c828
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48c83a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48c87d
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [int.00497250]
jmp 0x48c87d
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048bec6
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048bfef
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a3578
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a376b
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004ae2c0
xor ebx, ebx
cmp eax, ebx
jne 0x4a3726
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a376b
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004aaf9f
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4fc894
add esp, 0x10
test eax, eax
jne 0x4a3641
push esi
call 0x4a0c2a
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a3641
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a362c
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a3641
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a363a
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004af7d3
cmp byte [esp + 0x13], bl
je 0x4a3671
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a37a8
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a36e1
push 0x14
call 0x4fbb01
cmp eax, ebx
pop ecx
je 0x4a369b
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a369d
xor edi, edi
cmp edi, ebx
je 0x4a36e1
push esi
push edi
call fcn.004a2cce
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a2d96
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2ebf
add esp, 0x18
call fcn.004a376b
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call int.004ad98d
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a36f8
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a370a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a374d
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [int.00497250]
jmp 0x4a374d
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a2d96
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2ebf
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414247
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040d989
xor ebx, ebx
cmp dword [0x4276fc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41431c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x414287
xor eax, eax
jmp 0x4143e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x417e54
push edi
call esi
cmp eax, ebx
je 0x414280
push eax
call fcn.0040d926
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4276fc], eax
call esi
push eax
call fcn.0040d926
mov dword [esp], 0x417e30
push edi
mov dword [0x427700], eax
call esi
push eax
call fcn.0040d926
mov dword [0x427704], eax
lea eax, [ebp - 8]
push eax
call fcn.0040ff80
test eax, eax
pop ecx
pop ecx
je 0x4142ea
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b64f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41431c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040d926
cmp eax, ebx
pop ecx
mov dword [0x42770c], eax
je 0x41431c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d926
pop ecx
mov dword [0x427708], eax
mov eax, dword [0x427708]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x414395
cmp dword [0x42770c], esi
je 0x414395
push eax
call fcn.0040d992
pop ecx
call eax
cmp eax, ebx
je 0x414362
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42770c]
call fcn.0040d992
pop ecx
call eax
test eax, eax
je 0x414362
test byte [ebp - 0x18], 1
jne 0x414395
lea eax, [ebp - 0xc]
push eax
call fcn.0040ffb7
test eax, eax
pop ecx
je 0x41437d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b64f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41438c
or dword [ebp + 0x10], 0x200000
jmp 0x4143c6
or dword [ebp + 0x10], 0x40000
jmp 0x4143c6
mov eax, dword [0x427700]
cmp eax, esi
je 0x4143c6
push eax
call fcn.0040d992
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4143c6
mov eax, dword [0x427704]
cmp eax, esi
je 0x4143c6
push dword [ebp - 4]
push eax
call fcn.0040d992
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4276fc]
call fcn.0040d992
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x3689343d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x5cd91613
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b008]
jne 0x40100a
repz ret
jmp fcn.00401bf2

Function at 0x4068d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004037b4
and dword [ebp - 4], 0
cmp dword [0x41d240], 0
mov ebx, eax
jne 0x406981
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406a32
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406a32
push eax
call fcn.00403742
mov dword [esp], 0x4192dc
push edi
mov dword [0x41d240], eax
call esi
push eax
call fcn.00403742
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d244], eax
call esi
push eax
call fcn.00403742
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d248], eax
call esi
push eax
call fcn.00403742
pop ecx
mov dword [0x41d250], eax
test eax, eax
je 0x406981
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403742
pop ecx
mov dword [0x41d24c], eax
mov eax, dword [0x41d24c]
cmp eax, ebx
je 0x4069d9
cmp dword [0x41d250], ebx
je 0x4069d9
push eax
call fcn.004037bd
push dword [0x41d250]
mov esi, eax
call fcn.004037bd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4069d9
test edi, edi
je 0x4069d9
call esi
test eax, eax
je 0x4069d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4069d0
test byte [ebp - 0xc], 1
jne 0x4069d9
or dword [ebp + 0x10], 0x200000
jmp 0x406a12
mov eax, dword [0x41d244]
cmp eax, ebx
je 0x406a12
push eax
call fcn.004037bd
pop ecx
test eax, eax
je 0x406a12
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406a12
mov eax, dword [0x41d248]
cmp eax, ebx
je 0x406a12
push eax
call fcn.004037bd
pop ecx
test eax, eax
je 0x406a12
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d240]
call fcn.004037bd
pop ecx
test eax, eax
je 0x406a32
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406a34
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4177a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc0c], eax
cmp ebx, 0x182
jne 0x4177d5
lea ecx, [ebp - 0xc2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x4177e5
cmp ebx, 0x19f
jne 0x4177e5
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
xor edi, edi
test ebx, ebx
jle 0x41785f
push esi
lea ecx, [ecx]
lea esi, [ebp - 0xc08]
mov dword [ebp - 0xc08], 0
call fcn.00417790
mov dl, byte [ebp - 0xc08]
mov eax, dword [ebp - 0xc0c]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x417859
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0xc04]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.menobetogemarez
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc edi
cmp edi, ebx
jl 0x4177f0
pop esi
pop edi
cmp ebx, 0x2d
jne 0x417879
mov dword [0x512f18], 0xa62e7790
mov dword [0x512f1c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x417890
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x512de4]
push ebx
push esi
mov esi, dword [0x512c2c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x4178cd
push 0
lea eax, [ebp - 0x404]
push eax
push str.gepavexovaxajay_yatejusiwovogoyo
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x41bff0]
call fcn.00417760
cmp dword [0x512de4], 0x2f
jne 0x4178e8
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.004177a0
add esp, 4
cmp dword [0x512de4], 0x568
pop esi
pop ebx
jne 0x41791a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x408]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret