joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x10005637
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0x40
push 0x20
push eax
mov dword [ebp - 8], 0x20
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000567c
call fcn.10006f60
mov eax, dword [0x100d05dc]
lea ecx, [ebp - 4]
push ecx
push 0x40
lea ecx, [ebp - 8]
mov dword [0x100d05d8], eax
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0xffffffffffffffff
call eax
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x28]
push ebx
mov dword [ebp - 0xc], 5
mov dword [ecx], eax
mov al, byte [esi + 0x2c]
mov byte [ecx + 4], al
lea ecx, [ebp - 4]
mov ebx, dword [ebp - 4]
mov eax, dword [esi + 0x24]
push ecx
push ebx
push 5
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100056cd
call fcn.10006f60
mov eax, dword [0x100d05dc]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 0xc]
mov dword [0x100d05d8], eax
push ecx
lea ecx, [ebp - 8]
push ecx
push 0xffffffffffffffff
call eax
pop ebx
mov dword [esi + 0x24], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10006e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2074
call fcn.100a3110
mov eax, dword [0x100ce16c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x1000
lea eax, [ebp - 0x100c]
push 0
push eax
call fcn.10062e60
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x100c]
push 0xfff
push eax
call fcn.10006f20
add esp, 0x14
lea eax, [ebp - 0x2074]
push 0x1064
push 0
push eax
call fcn.10062e60
add esp, 0xc
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov cl, byte [eax + str._EVEA_]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x2075], cl
test cl, cl
jne 0x10006eb0
lea edx, [ebp - 0x100c]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x10006ed0
lea edi, [ebp - 0x2074]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10006ee0
mov ecx, edx
lea eax, [ebp - 0x2074]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.1005fb30
mov esp, ebp
pop ebp
ret
Function at 0x10006f60
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x100d05dc], 0
jne 0x100070a3
push ebx
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.C:WindowsSystem32_ntdll.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffffff
jne 0x10006fb1
push 0
push str.error
push str.CreateFileError
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.ZwProtectVirtualMemory
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10007104
test esi, esi
je 0x10007104
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp - 8]
mov edi, eax
add esi, edi
push esi
call fcn.10060240
push esi
push 0
push eax
mov dword [ebp - 4], eax
call fcn.10062e60
add esp, 0x10
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
mov eax, dword [ebp - 8]
add eax, edi
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov ebx, dword [ebp - 0x10]
xor edx, edx
sub ebx, dword [ebp - 0x18]
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 6]
cmp cx, ax
jae 0x10007078
nop dword [eax + eax]
movzx eax, dx
lea ecx, [eax + eax*4]
mov esi, dword [edi + ecx*8 + 0x104]
cmp ebx, esi
jbe 0x1000706e
mov eax, dword [edi + ecx*8 + 0x108]
add eax, esi
cmp ebx, eax
jb 0x100070a7
movzx eax, word [edi + 6]
inc edx
cmp dx, ax
jb 0x10007050
push 0
push str.error
push 0x100c6418
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call fcn.1005fb40
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + ecx*8 + 0x10c]
sub edi, esi
add edi, ebx
je 0x10007078
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, eax
mov dword [0x100d05dc], ecx
test ecx, ecx
jne 0x100070e1
push eax
push str.error
push str.VirtualAlloc_Error
jmp 0x10007084
mov edx, dword [ebp - 4]
push edx
mov eax, dword [edi + edx]
mov dword [ecx], eax
mov al, byte [edi + edx + 4]
mov byte [ecx + 4], al
mov eax, dword [ebp - 0x10]
add eax, 5
mov byte [ecx + 5], 0x68
mov dword [ecx + 6], eax
mov byte [ecx + 0xa], 0xc3
jmp 0x1000708f
push 0
push str.error
push str.LoadLibraryGetProcAddress_Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100656c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100652e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100656f2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100a618c]
call dword [ebp - 8]
jmp 0x100656fc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x10081f30
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100a3110
mov eax, dword [0x100ce16c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100cfac0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10082108
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10082057
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10082057
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10082035
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x10081fb9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100820c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10082128
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10082103
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10082128
jmp 0x10081f92
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fb30
mov esp, ebp
pop ebp
ret
Function at 0x10082140
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.100a3110
mov eax, dword [0x100ce16c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100cfac0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x1008232b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10082276
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10082276
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10082252
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x100821c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100822e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1008234b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10082326
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1008234b
jmp 0x100821a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fb30
mov esp, ebp
pop ebp
ret
Function at 0x1008a8d0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1008a1b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1008a904
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100a618c]
call dword [ebp - 8]
jmp 0x1008a90a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1008a960
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1008a1f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1008a994
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100a618c]
call dword [ebp - 8]
jmp 0x1008a99e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1008a9b0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1008a210
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1008a9e8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x100a618c]
call dword [ebp - 8]
jmp 0x1008a9f6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1008aa00
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1008a270
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1008aa40
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100a618c]
call dword [ebp - 8]
jmp 0x1008aa5e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1008ac50
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10094630
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.10066a70
lea ecx, [ebp - 4]
call fcn.10094600
movzx eax, al
test eax, eax
jne 0x1009466d
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.10094540
mov eax, dword [ebp - 0x18]
jmp 0x10094795
lea ecx, [ebp - 4]
call fcn.100661d0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.100945c0
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.100661d0
push eax
push 0
push 0
call fcn.10094480
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100946d3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.10094540
mov eax, dword [ebp - 0x20]
jmp 0x10094795
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1007de90
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.100629d0
lea ecx, [ebp - 8]
call fcn.10062a10
movzx edx, al
test edx, edx
jne 0x1009471c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.100632f0
lea ecx, [ebp - 4]
call fcn.10094540
mov eax, dword [ebp - 0x24]
jmp 0x10094795
lea ecx, [ebp - 8]
call fcn.10062a60
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.100661d0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10094480
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x10094777
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.100632f0
lea ecx, [ebp - 4]
call fcn.10094540
mov eax, dword [ebp - 0x34]
jmp 0x10094795
lea ecx, [ebp - 8]
call fcn.10072fd0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.100632f0
lea ecx, [ebp - 4]
call fcn.10094540
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401443
pop dword [ebp - 0x44]
mov eax, 0x401443
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xf61e44cf
sub dword [ebp - 0x54], 0xa7cbff84
mov dword [ebp - 0x50], 0xd84b396c
sub dword [ebp - 0x50], 0xa617ed27
mov dword [ebp - 0x4c], 0x50fa549f
sub dword [ebp - 0x4c], 0x4ae1071
mov dword [ebp - 0x48], 0xaaaaf96e
sub dword [ebp - 0x48], 0xaaaaf96e
lea eax, [ebp - 0x54]
push eax
mov eax, 0x7beb3656
add eax, 0x84554a22
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb227cc18
sub dword [ebp - 0x54], 0x3db562c2
mov dword [ebp - 0x50], 0x6bb9dad3
add dword [ebp - 0x50], 0xd5b286a2
mov dword [ebp - 0x4c], 0xec63f078
add dword [ebp - 0x4c], 0x770b7bf4
mov dword [ebp - 0x48], 0x4f3fdf44
sub dword [ebp - 0x48], 0x4f3fdf44
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xc911f884
sub eax, 0xc8d17808
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3b9d9
push 0
call eax
mov ecx, 0x6100e619
sub ecx, 0x61009124
xor edi, edi
add edi, eax
mov esi, 0xcc79b634
sub esi, 0xcc34a234
add esi, dword [ebp - 0x44]
mov ebx, 0xe023b1ff
xor dword [ebp - 0x14], eax
mov edx, dword [esi]
sub dword [ebp - 0x10], edx
add edx, ebx
add dword [ebp - 0x2c], 0xb1fb7a59
mov dword [edi], edx
sub dword [ebp - 0x40], 0x65fe7410
add edi, 0x72035362
sub edi, 0x7203535e
add esi, 4
loop 0x40155c
add eax, 0x8869d396
add eax, 0x77977311
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402217
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x414f35
call fcn.00411b28
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00402fdc
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.0040395a
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x40225f
call fcn.00402c48
mov dword [ebx], eax
call fcn.00402a76
mov ecx, eax
call fcn.004011e9
mov eax, ebx
jmp 0x402261
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404244
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b3e0]
jne 0x40424e
repz ret
jmp fcn.0040abfc
Function at 0x4101b4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004083fc
and dword [ebp - 4], 0
cmp dword [0x41d5a4], 0
mov ebx, eax
jne 0x410265
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410316
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410316
push eax
call fcn.0040838a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d5a4], eax
call esi
push eax
call fcn.0040838a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d5a8], eax
call esi
push eax
call fcn.0040838a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d5ac], eax
call esi
push eax
call fcn.0040838a
pop ecx
mov dword [0x41d5b4], eax
test eax, eax
je 0x410265
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040838a
pop ecx
mov dword [0x41d5b0], eax
mov eax, dword [0x41d5b0]
cmp eax, ebx
je 0x4102bd
cmp dword [0x41d5b4], ebx
je 0x4102bd
push eax
call fcn.00408405
push dword [0x41d5b4]
mov esi, eax
call fcn.00408405
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4102bd
test edi, edi
je 0x4102bd
call esi
test eax, eax
je 0x4102b4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4102b4
test byte [ebp - 0xc], 1
jne 0x4102bd
or dword [ebp + 0x10], 0x200000
jmp 0x4102f6
mov eax, dword [0x41d5a8]
cmp eax, ebx
je 0x4102f6
push eax
call fcn.00408405
pop ecx
test eax, eax
je 0x4102f6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4102f6
mov eax, dword [0x41d5ac]
cmp eax, ebx
je 0x4102f6
push eax
call fcn.00408405
pop ecx
test eax, eax
je 0x4102f6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d5a4]
call fcn.00408405
pop ecx
test eax, eax
je 0x410316
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410318
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411560
Capabilities:
Create mailslot
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x912964]
sub esp, 0xc18
push ebx
push esi
push edi
inc eax
mov edi, 0xff
and eax, edi
movzx ecx, byte [eax + 0x4356a0]
add ecx, dword [0x91295c]
xor ebx, ebx
and ecx, edi
mov dword [0x912964], eax
mov dword [0x91295c], ecx
cmp eax, 0xb5b
jae 0x4115d7
push ebx
push ebx
push ebx
push str.Zeherixo
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
push ebx
lea eax, [ebp - 0x418]
push eax
push str.Bade_juleni
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push ebx
lea eax, [ebp - 0xc18]
push eax
push ebx
call dword [sym.imp.USER32.dll_RealGetWindowClassW]
mov eax, dword [0x912964]
mov ecx, dword [0x91295c]
lea esi, [ecx + 0x4356a0]
mov dl, byte [esi]
mov byte [ebp - 1], dl
mov dl, byte [eax + 0x4356a0]
mov byte [esi], dl
cmp eax, 0x1e8
jae 0x41160e
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
mov eax, dword [0x912964]
mov ecx, dword [0x91295c]
mov dl, byte [ebp - 1]
mov byte [eax + 0x4356a0], dl
movzx esi, byte [ecx + 0x4356a0]
movzx ecx, dl
add esi, ecx
cmp eax, 0x14872c
jbe 0x411635
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
and esi, edi
mov al, byte [esi + 0x4356a0]
pop edi
pop esi
pop ebx
leave
ret