joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423947
Capabilities:
Create service
Delete service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 4], 0
mov dword [ebp - 0x10], 0x10
mov eax, dword [ebp + 0x1c]
and eax, 0xff
test eax, eax
je 0x42396d
mov ecx, dword [ebp - 0x10]
or ch, 1
mov dword [ebp - 0x10], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x423aa0
push 0
push 0
push 0x470eec
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 1
push 2
mov eax, dword [ebp - 0x10]
push eax
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x423a58
mov ecx, dword [ebp + 0x14]
and ecx, 0xff
test ecx, ecx
je 0x423a48
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4239f3
mov byte [ebp - 4], 1
jmp 0x423a30
mov edx, dword [ebp + 0x14]
and edx, 0xff
test edx, edx
je 0x423a09
mov dword [ebp - 0x18], 0x46c580
jmp 0x423a10
mov dword [ebp - 0x18], 0x46c588
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.InstallService___s_____s____s__StartService___Error__d_
call fcn.004288c1
add esp, 0x14
mov eax, dword [ebp + 0x18]
and eax, 0xff
test eax, eax
je 0x423a46
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
jmp 0x423a4c
mov byte [ebp - 4], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x423a94
mov eax, dword [ebp + 0x14]
and eax, 0xff
test eax, eax
je 0x423a6d
mov dword [ebp - 0x1c], str.true
jmp 0x423a74
mov dword [ebp - 0x1c], str.false
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.InstallService___s_____s____s__CreateService___Error__d_
call fcn.004288c1
add esp, 0x14
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x423ab4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Utils_Services::InstallService__cannot_open_SCManager__ld
call fcn.004288c1
add esp, 8
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x427fea
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
je 0x428048
mov dword [ebp - 4], 0xffffffde
push 2
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x428048
push 0
lea edx, [ebp - 8]
push edx
push 0x20
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 2
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esp, ebp
pop ebp
ret

Function at 0x42804c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov byte [ebp - 4], 0
call fcn.004210d1
cmp eax, 0x29
jle 0x42806f
mov dword [ebp - 0x12c], str.Global_
jmp 0x428079
mov dword [ebp - 0x12c], 0x470f20
mov eax, dword [str.ntrexe.log]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
push str._s_s
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x4280e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4280cc
mov byte [ebp - 4], 1
jmp 0x4280e8
push 0xfa
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4280e8
mov byte [ebp - 4], 1
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x428840
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
mov eax, dword [str.ntrexe.log]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4288ba
push 2
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xe4e1c0
jbe 0x4288ba
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str.ntrexe.log]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
mov ecx, dword [str.ntrexe.log]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4288c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov byte [ebp - 4], 1
mov byte [ebp - 0x30], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4289bc
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x30], 1
lea edx, [ebp - 0x3c]
push edx
call fcn.0042804c
add esp, 4
and eax, 0xff
test eax, eax
je 0x4289bc
call fcn.00428840
mov dword [ebp - 0x44], eax
push 0x21
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00428c00
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call fcn.00427fea
add esp, 8
cmp dword [ebp - 0x44], 0xffffffff
je 0x4289b0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov dl, byte [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042810e
add esp, 0x1c
mov byte [ebp - 4], al
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
je 0x4289a6
push 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00429d80
add esp, 4
push eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x3c]
push edx
call fcn.004280ef
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.004267ad
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x442f2a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x442f4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042c1b1
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x442f6d
test byte [esp + 8], 2
je 0x442f6d
call fcn.0042c224
mov dword [eax], 0xd
call fcn.0042c22d
mov dword [eax], 5
jmp 0x442f46
xor eax, eax
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7cba6d58
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4cae3d88
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40d040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ebp + 8]
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x468738]
sub esi, 1
jne 0x40d062
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc0], ebx
jne 0x40d097
push esi
push dword [ebp + 8]
push 4
push ebx
call fcn.0040aba0
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x40d100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x10]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 8], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 4], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x468738]
sub edi, 1
jne 0x40d170
pop edi
not edx
pop esi
mov eax, edx
mov esp, ebp
pop ebp
ret 4

Function at 0x40dcc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x40dd23
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x40dd06
cmp edi, 2
jb 0x40dd06
cmp byte [esi], cl
jne 0x40dd06
cmp byte [esi + 1], cl
jne 0x40dd06
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x468738]
jmp 0x40dcd7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x468738]
test edi, edi
jne 0x40dcd7
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x40dd58
nop word [eax + eax]
cmp cl, 0x23
jne 0x40dd3f
cmp byte [esi], cl
jne 0x40dd3f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x468738]
test cl, cl
jne 0x40dd30
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x40df30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
xor ecx, ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x40df50
cmp eax, esi
jae 0x40e0a4
mov bl, byte [eax]
test bl, bl
je 0x40e0a4
movzx ecx, bl
mov edx, esi
shr ecx, 3
movsx edi, byte [ecx + 0x468ea0]
xor ecx, ecx
test edi, edi
mov dword [ebp - 8], edi
sete cl
add ecx, edi
mov dword [ebp - 0xc], ecx
test esi, esi
jne 0x40df7f
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x40df93
mov bh, byte [esi]
jmp 0x40df95
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x40dfa3
mov ch, byte [esi]
jmp 0x40dfa5
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x40dfb3
mov bl, byte [esi]
jmp 0x40dfb5
xor bl, bl
mov edi, dword [edi*4 + 0x468ec0]
movzx edx, ch
movzx ecx, cl
and edi, ecx
movzx esi, bh
shl edi, 6
mov ecx, esi
and ecx, 0x3f
mov byte [ebp - 1], bl
or edi, ecx
movzx ebx, bl
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
and esi, 0xc0
mov ecx, ebx
shl edi, 6
and ecx, 0x3f
shr ebx, 2
or edi, ecx
or ebx, edx
mov ecx, dword [ebp - 8]
shr ebx, 2
or ebx, esi
mov esi, dword [ebp - 8]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x468ee8]
shr edi, cl
cmp edi, dword [esi*4 + 0x468ed4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, pe_nt_image_headers32
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x468efc]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x40e096
xor edx, edx
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp dword [ebp - 0xc], edx
cmovl edx, dword [ebp - 0xc]
mov ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x40df3e
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x40df3e
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x40e2c6
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push edi
nop dword [eax]
test esi, esi
je 0x40e14c
cmp eax, esi
jae 0x40e2c1
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x40e2c1
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x468ea0]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x40e17b
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x40e193
mov ch, byte [esi]
mov byte [ebp + 0xf], ch
jmp 0x40e197
mov byte [ebp + 0xf], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x40e1a2
mov ch, byte [esi]
jmp 0x40e1a4
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x40e1b2
mov al, byte [esi]
jmp 0x40e1b4
xor al, al
movzx esi, byte [ebp + 0xf]
movzx edx, ch
movzx ecx, cl
movzx edi, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x468ec0]
and eax, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], eax
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov eax, dword [ebp - 8]
and ecx, 0x3f
or eax, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x468ee8]
shr eax, cl
mov esi, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp esi, dword [eax*4 + 0x468ed4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, pe_nt_image_headers32
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [eax*4 + 0x468efc]
mov eax, dword [ebp - 0x10]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x40e2a4
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp + 0xf], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x10], eax
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x40e140
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x40e2d4
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x424497
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.0040fd80
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4244bc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.0040fd80
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4244e1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.0040fd80
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x424522
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.0040fd80
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x424547
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.0040fd80
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x42456c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.0040fd80
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00420230
Function at 0x4360b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x3c
push ebx
push esi
xor esi, esi
push edi
cmp edx, 0x40
jb 0x4360e0
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x43650a
mov eax, dword [ecx + 0x3c]
add eax, 0xf8
cmp edx, eax
jae 0x4360f1
push 0xd
push edx
call 0x6e754b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ecx + 0x3c]
add ebx, ecx
mov dword [ebp - 0xc], ebx
cmp dword [ebx], 0x4550
jne 0x43650a
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x43650a
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x10], eax
test al, 1
jne 0x43650a
movzx ecx, word [ebx + 0x14]
movzx edi, word [ebx + 6]
add ecx, 0x24
test edi, edi
je 0x436157
add ecx, ebx
mov ebx, eax
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
test eax, eax
jne 0x436143
lea eax, [edx + ebx]
jmp 0x436145
add eax, edx
cmp eax, esi
cmovbe eax, esi
add ecx, 0x28
mov esi, eax
sub edi, 1
jne 0x436135
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x3c]
push eax
push esi
call 0x23434b4
mov ecx, dword [ebp - 0x38]
lea edx, [ecx - 1]
lea edi, [ecx - 1]
not edx
add edi, dword [ebx + 0x50]
lea eax, [ecx - 1]
add eax, esi
and edi, edx
and eax, edx
cmp edi, eax
jne 0x43650a
mov esi, dword [ebp + 0x24]
push esi
push 4
push 0x3000
push edi
push dword [ebx + 0x34]
call dword [ebp + 0x10]
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
jne 0x4361b3
push esi
push 4
push 0x3000
push edi
push eax
call dword [ebp + 0x10]
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
je 0x4361e2
call 0x6e8af5
push 0x40
push 8
mov dword [ebp - 0x18], eax
call eax
push eax
call 0x1ea113f
ret
push 0xe
push ecx
call 0xeee4b2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc1
push ebp
call 0x11f097c
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457c7f
Capabilities:
Parse pe header

Disassembly:
push 0
push eax
call fcn.00b97e93
test eax, eax
je 0x457cbf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x457cbf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x457cbf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x457cbf
cmp dword [ecx + 0x74], 0xe
jbe 0x457cbf
cmp dword [ecx + 0xe8], 0
je 0x457cbf
mov al, 1
ret
xor al, al
ret

Function at 0x45bd96
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045bc07

Function at 0x467020
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46704d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46704d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x23a0463
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
cdq
not bl
dec esi
push edi
cmovne bx, bx
push ecx
dec edx
mov ecx, 0
push ecx
xchg dh, bl
movsx edx, ax
mov edi, dword [esp + 0x28]
xchg ah, ah
dec edi
btc eax, 0x5e
bswap edi
btc dx, dx
rol edi, 0x10
movsx ebp, sp
rdtsc
dec edi
btc ebp, esi
setg al
ror edi, 0x19
not si
rcr bp, 0xc2
add edi, ecx
btr ebp, edx
movzx esi, di
mov ebp, esp
bsf bx, sp
btr dx, 0xde
sub esp, 0xc0
clc
mov ebx, edi
mov edx, 0
mov ah, 0xf6
sub ebx, edx
and si, cx
bt esi, 0x8a
lea esi, [0x18482bf]
mov eax, dword [edi]
cmp ebp, edx
cmc
lea edi, [edi + 4]
test dl, 0x6f
cmp esi, 0x721618bc
xor eax, ebx
add eax, 0x655c3ca0
bswap eax
test esp, 0x2aff7600
stc
cmp esi, ecx
sub eax, 0x76cd7325
cmp di, ax
cmp cl, 0xdd
bswap eax
cmp esi, ecx
cmp ebp, 0x4b913c63
xor ebx, eax
stc
cmp dh, 0x84
add esi, eax
push esi
ret
push ebx
push edx
pushfd
movsx edx, di
push eax
rdtsc
push esi
jmp 0x1848251
Function at 0x423aa4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419328
and dword [ebp - 4], 0
cmp dword [0x43879c], 0
mov ebx, eax
jne 0x423b55
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423c06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x423c06
push eax
call fcn.004192b6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43879c], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4387a0], eax
call esi
push eax
call fcn.004192b6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4387a4], eax
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387ac], eax
test eax, eax
je 0x423b55
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004192b6
pop ecx
mov dword [0x4387a8], eax
mov eax, dword [0x4387a8]
cmp eax, ebx
je 0x423bad
cmp dword [0x4387ac], ebx
je 0x423bad
push eax
call fcn.00419331
push dword [0x4387ac]
mov esi, eax
call fcn.00419331
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423bad
test edi, edi
je 0x423bad
call esi
test eax, eax
je 0x423ba4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423ba4
test byte [ebp - 0xc], 1
jne 0x423bad
or dword [ebp + 0x10], 0x200000
jmp 0x423be6
mov eax, dword [0x4387a0]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423be6
mov eax, dword [0x4387a4]
cmp eax, ebx
je 0x423be6
push eax
call fcn.00419331
pop ecx
test eax, eax
je 0x423be6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43879c]
call fcn.00419331
pop ecx
test eax, eax
je 0x423c06
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423c08
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
jmp int.00401219