joyce8/EMBER2024-capa huggingface dataset:
Function at 0x569460
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 4], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov eax, dword [esi + edi*4 + 0x18]
test eax, eax
jne 0x56949e
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
mov edx, dword [ebp + edi*4 - 8]
push eax
push ecx
push edx
push esi
call fcn.005690d0
add esp, 0x10
mov dword [esi + edi*4 + 0x18], eax
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x569575
mov eax, dword [esi + edi*4 + 0x18]
mov edi, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push ebx
push 1
push eax
mov dword [ebp + 8], eax
call fcn.004f8380
mov eax, dword [ebp + 8]
push eax
call fcn.004f6bd0
add esp, 0x14
cmp eax, 0x65
jne 0x569510
mov eax, dword [ebp + 0xc]
test eax, eax
mov eax, str.__rowid
jne 0x5694e3
mov eax, str.__parent
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
push edi
push ebx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.00569140
mov eax, dword [ebp + 8]
add esp, 0x1c
push eax
push esi
call fcn.00569440
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x64
jne 0x569567
mov eax, dword [ebp + 8]
push 0
push eax
call fcn.004f7e00
mov ecx, dword [ebp + 0x18]
add esp, 8
cmp eax, ecx
mov dword [ebp + 0x14], edx
jne 0x569532
cmp edx, dword [ebp + 0x1c]
je 0x569567
mov edx, dword [ebp + 0xc]
mov dword [ebp + 0xc], str.__rowid
test edx, edx
jne 0x569547
mov dword [ebp + 0xc], str.__parent
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
push edi
push ebx
push ecx
push edx
push eax
push edi
push ebx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.00569140
add esp, 0x2c
mov eax, dword [ebp + 8]
push eax
push esi
call fcn.00569440
add esp, 8
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x571140
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
lea esi, [edi + 0x3c]
test eax, eax
jne 0x571171
mov eax, dword [edi]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
push ecx
push edx
push str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
call fcn.004e3af0
push eax
push esi
push edi
call fcn.0056be80
add esp, 0x18
mov eax, dword [esi]
pop edi
pop esi
pop ebp
ret

Function at 0x5713e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, 0xd
dec ecx
test ecx, ecx
jl 0x57140a
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edx, edx
lea edi, [eax*8]
mov dl, byte [ecx + esi]
xor edx, edi
xor eax, edx
dec ecx
jns 0x5713f5
pop edi
pop esi
xor edx, edx
div dword [ebp + 8]
mov eax, edx
pop ebp
ret
Function at 0x57c330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, 0xd
dec eax
test eax, eax
jl 0x57c35a
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edx, edx
lea edi, [ecx*8]
mov dl, byte [eax + esi]
xor edx, edi
xor ecx, edx
dec eax
jns 0x57c345
pop edi
pop esi
mov edx, dword [ebp + 0xc]
lea eax, [ecx*8]
and edx, 0xff
xor eax, edx
xor edx, edx
xor eax, ecx
div dword [ebp + 8]
mov eax, edx
pop ebp
ret
Function at 0x57dd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 8]
push ebx
xor eax, eax
push esi
push edi
test edx, edx
mov dword [ebp - 4], eax
mov dword [ecx], eax
je 0x57de3a
mov esi, dword [ebp + 0x14]
mov ecx, 0xd
lea eax, [esi - 1]
test eax, eax
jl 0x57dda0
mov edi, dword [ebp + 0x10]
lea ebx, [ecx*8]
movsx edi, byte [eax + edi]
xor edi, ebx
xor ecx, edi
dec eax
jns 0x57dd8b
mov edi, dword [ebp + 0xc]
mov ebx, ecx
xor ebx, edi
and ecx, 0x3f
and ebx, 0x1ff
shl ecx, 3
xor ebx, ecx
mov edx, dword [edx + ebx*4]
test edx, edx
je 0x57ddf4
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
cmp ecx, eax
jne 0x57dddb
cmp dword [edx + 4], esi
jne 0x57dddb
mov edi, dword [ebp + 0x10]
mov ecx, esi
mov esi, dword [edx]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x57dde4
mov esi, dword [ebp + 0x14]
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x57ddbc
jmp 0x57ddf4
mov ecx, dword [ebp + 0x18]
test edx, edx
mov dword [ecx], 1
jne 0x57de37
mov esi, dword [ebp + 0x14]
lea edx, [esi + 0x10]
push 0
lea eax, [ebp - 4]
push edx
push eax
call fcn.0056aa50
add esp, 0xc
test eax, eax
je 0x57de37
mov ecx, dword [ebp + 0xc]
lea edi, [eax + 0x10]
mov dword [eax + 8], ecx
mov ecx, esi
mov edx, ecx
mov dword [eax + 4], esi
mov esi, dword [ebp + 0x10]
mov dword [eax], edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + ebx*4]
mov dword [eax + 0xc], edx
mov dword [ecx + ebx*4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5844c0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
pop ebp
ret
Function at 0x591ca0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x778490]
test eax, eax
jne 0x591cc0
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x778490], eax
je 0x591ce4
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x591ce4
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ecx
call eax
neg al
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x591d20
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push str.main
push edi
mov byte [ebx], 0
call fcn.00591e90
add esp, 8
test eax, eax
jne 0x591d49
pop edi
mov byte [ebx], 3
pop esi
pop ebx
pop ebp
ret
mov eax, dword [edi + 0x1f8]
test eax, eax
jne 0x591d5d
pop edi
mov byte [ebx], 1
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push str.SELECT_pwsqlite_crypt__1_pw___isAdmin_FROM___w_.sqlite_user_WHERE_uname_2
push edi
call fcn.00591e00
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x591d7f
pop edi
pop esi
mov eax, 7
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1f0]
mov edx, dword [edi + 0x1f4]
push 0
push ecx
push edx
push 1
push esi
call fcn.004f80c0
mov eax, dword [edi + 0x1f8]
push 0
push 0xffffffffffffffff
push eax
push 2
push esi
call fcn.004f8470
push esi
call fcn.004f6bd0
add esp, 0x2c
cmp eax, 0x64
jne 0x591de4
push 0
push esi
call fcn.004f7dd0
add esp, 8
test eax, eax
je 0x591de4
push 1
push esi
call fcn.004f7dd0
add esp, 8
add al, 2
mov byte [ebx], al
push esi
call fcn.004f3620
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
mov byte [ebx], 1
call fcn.004f3620
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x592bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, 1
cmp dword [esi + 0x1c], ecx
jbe 0x592cbf
push ebx
push edi
lea eax, [esi + 0x32]
xor ebx, ebx
xor edx, edx
mov bl, byte [eax - 1]
mov dl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x73c618]
mov edx, dword [edx*4 + 0x73ce18]
xor ebx, ebx
xor edx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x73ca18]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c218]
xor ebx, ebx
xor edx, edi
mov dword [eax - 0x12], edx
mov bl, byte [eax - 0xc]
xor edx, edx
mov dl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x73ca18]
xor ebx, ebx
mov edx, dword [edx*4 + 0x73ce18]
mov bl, byte [eax - 0xd]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c618]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c218]
xor ebx, ebx
xor edx, edi
mov dword [eax - 0xe], edx
mov bl, byte [eax - 8]
xor edx, edx
mov dl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x73ca18]
xor ebx, ebx
mov edx, dword [edx*4 + 0x73ce18]
mov bl, byte [eax - 9]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c618]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c218]
xor ebx, ebx
xor edx, edi
mov dword [eax - 0xa], edx
mov bl, byte [eax - 4]
xor edx, edx
mov dl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x73ca18]
xor ebx, ebx
mov edx, dword [edx*4 + 0x73ce18]
mov bl, byte [eax - 5]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c618]
xor ebx, ebx
mov bl, byte [eax - 6]
xor edx, edi
mov edi, dword [ebx*4 + 0x73c218]
xor edx, edi
inc ecx
mov dword [eax - 6], edx
mov edx, dword [esi + 0x1c]
cmp ecx, edx
jb 0x592bca
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x5938a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0
mov dword [eax + 4], 0
pop ebp
ret
Function at 0x594710
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
xor eax, eax
mov byte [ebp + eax - 0x108], al
inc eax
cmp eax, 0x100
jl 0x594726
xor edi, edi
mov eax, esi
mov ebx, dword [ebp + 8]
cdq
idiv dword [ebp + 0xc]
xor ecx, ecx
xor eax, eax
mov cl, byte [ebp + esi - 0x108]
mov al, byte [edx + ebx]
add eax, ecx
add edi, eax
and edi, 0x800000ff
jns 0x594762
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], dl
inc esi
cmp esi, 0x100
mov byte [ebp + edi - 0x108], cl
jl 0x594737
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x594815
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
sub edx, ecx
mov dword [ebp + 0xc], eax
inc esi
and esi, 0x800000ff
jns 0x5947ad
dec esi
or esi, 0xffffff00
inc esi
xor eax, eax
mov al, byte [ebp + esi - 0x108]
add edi, eax
and edi, 0x800000ff
jns 0x5947c8
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], bl
xor ebx, ebx
mov byte [ebp + edi - 0x108], al
mov bl, byte [ebp + esi - 0x108]
and eax, 0xff
add ebx, eax
and ebx, 0x800000ff
jns 0x5947fd
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov bl, byte [edx + ecx]
xor al, bl
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
inc ecx
dec eax
mov dword [ebp + 0xc], eax
jne 0x59479c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bdd1c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5bdd54
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005bbcf7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005bbccf
jmp 0x5bdd60
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5bf516
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5bf558
call fcn.005c5a43
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5bf558
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5bf54f
xor eax, eax
jmp 0x5bf560
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005bf566
pop edi
pop esi
pop ebx
ret 4

Function at 0x5c5f73
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5c5fa1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5c5fbf
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005c5ed9
jmp 0x5c5fbf
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5c5fbf
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005c5ed9
test edi, edi
mov eax, edi
jne 0x5c5fa9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1003bf70
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1006e024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push pe_nt_image_headers32
mov ebx, edx
mov dword [ebp - 0x41c], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1003bfcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003c07e
movzx eax, ax
pop edi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003475
mov esp, ebp
pop ebp
ret
cmp eax, 0x100
jbe 0x1003bfe8
pop edi
mov eax, 0x80020013
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003475
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 0
push 0x10044b2c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1003bfa6
push esi
xor eax, eax
push eax
push 0x2100
push 2
push eax
push eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003c057
push 0
lea eax, [ebp - 0x420]
push eax
push ebx
push dword [ebp - 0x41c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003c057
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1003c06d
call fcn.1003deb0
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003475
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.100016d0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10003475
mov esp, ebp
pop ebp
ret
Function at 0x401380
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5a
push 0x57
call fcn.00401090
add esp, 8
mov dword [0x409cb8], 0x44
push 0x5a
push 0x57
call fcn.00401090
add esp, 8
mov dword [0x4099b8], 0x1003f
push 0x5a
push 0x57
call fcn.00401090
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00401200
add esp, 4
push 0xef
push 0x2e
call fcn.00401030
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4013e9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4099a4]
xor eax, eax
mov ax, word [edx + 6]
cmp dword [ebp - 4], eax
jge 0x401473
push 0xef
push 0x2e
call fcn.00401030
add esp, 8
mov ecx, dword [0x409f24]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
imul eax, eax, 0x28
add eax, dword [ebp + 8]
lea ecx, [eax + edx + 0xf8]
mov dword [0x4099a0], ecx
push 0xef
push 0x2e
call fcn.00401030
add esp, 8
push 0
mov edx, dword [0x4099a0]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [0x4099a0]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [0x4099a4]
mov ecx, dword [eax + 0x34]
mov edx, dword [0x4099a0]
add ecx, dword [edx + 0xc]
push ecx
mov eax, dword [0x409990]
push eax
call dword [0x409d0c]
jmp 0x4013e0
push 0x30
push 0x63
call section..text
add esp, 8
call fcn.00401300
push 0x30
push 0x63
call section..text
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x25763fa2
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3f490df2
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x401426
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041b0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x40132e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014f0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014f0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014d5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4182d8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4182dc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x9e3779b9
mov dword [ebp - 0x34], eax
call fcn.00401200
add dword [ebp - 0x10], 0x23f
cmp dword [0xae02a4], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x834]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov eax, dword [0x4182e4]
mov edi, dword [0x4182e0]
push 0x20
pop edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov eax, esi
mov dword [ebp - 0xc], 0xedeb2e40
shl eax, 4
add eax, edi
cmp dword [0xae02a4], 0xfa9
mov dword [ebp - 8], eax
mov eax, dword [0xae02a0]
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp dword [0xae02a4], 0x3eb
mov dword [0xae02a0], eax
mov eax, dword [0xae01f8]
cmove eax, dword [ebp - 0xc]
mov dword [0xae01f8], eax
mov eax, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x14], 0
mov dword [0xae029c], 0xf4ea3dee
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 0x18], eax
mov eax, ebx
shl eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
add eax, ebx
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor dword [ebp - 0x14], eax
cmp dword [0xae02a4], 0xb03
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jne 0x401362
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x10], eax
dec edx
mov dword [ebp - 0x20], edx
jne 0x401277
mov edi, dword [ebp - 0x30]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c062
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f6c
mov dword [ebp - 0x14], eax
cmp dword [0x43ba94], esi
jne 0x40c155
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c0e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c235
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c235
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c235
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43ba94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43ba98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43ba9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43baa4], eax
test eax, eax
je 0x40c152
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43baa0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c17a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c16d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c18f
push 4
pop eax
jmp 0x40c237
cmp dword [ebp - 0x14], esi
je 0x40c18f
push dword [0x43ba94]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c174
mov eax, dword [0x43baa0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c1ed
cmp dword [0x43baa4], edi
je 0x40c1ed
push eax
call ebx
push dword [0x43baa4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c1ed
test eax, eax
je 0x40c1ed
call ecx
test eax, eax
je 0x40c1e2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c1e2
test byte [ebp - 8], 1
jne 0x40c1ed
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c21d
mov eax, dword [0x43ba98]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
call eax
mov esi, eax
test esi, esi
je 0x40c21a
mov eax, dword [0x43ba9c]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43ba94]
call ebx
test eax, eax
je 0x40c235
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c237
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040a8
mov esp, ebp
pop ebp
ret