joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d16f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004238d0
mov eax, dword [0x43b028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x1000
push 0xffd
lea eax, [ebp - 0x2004]
push esi
push eax
call dword [sym.imp.MSVCR90.dll__vsnwprintf_s]
push 0x42c918
lea eax, [ebp - 0x2004]
push esi
push eax
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0x20
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00423038
leave
ret
Function at 0x40d5ea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20008
call fcn.004238d0
mov eax, dword [0x43b028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20008]
push eax
push 0x10000
lea eax, [ebp - 0x20004]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp word [ebp - 0x20004], 0
mov eax, edi
je 0x40d630
lea eax, [ebp - 0x20004]
imul esi, esi, 0x590
push eax
lea eax, [esi + ebx + 0x98]
push 0x104
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
lea eax, [ebp - 0x20004]
push eax
push edi
push str._s___s
call fcn.0040d16f
mov ecx, dword [ebp - 4]
add esp, 0x18
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.00423038
leave
ret

Function at 0x40d66f
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x43b028]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
push 0x59000
mov ebx, ecx
push 0
push ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, ebx
mov esi, 0x100
or eax, 0xffffffff
mov dword [edx], eax
push 0x20
lea edi, [edx + 4]
pop ecx
add edx, 0x590
dec esi
rep stosd dword es:[edi], eax
jne 0x40d6a5
mov esi, 0x104
push esi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x40d6d9
xor eax, eax
jmp 0x40d72f
and dword [esp + 0x10], 0
lea edi, [esp + 0x18]
xor ecx, ecx
call fcn.0040d5ea
push 0
jmp 0x40d702
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x18]
call fcn.0040d5ea
push dword [esp + 0x10]
push ebx
lea ecx, [esp + 0x20]
call fcn.0040d1d6
pop ecx
pop ecx
push esi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x40d6ed
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00423038
mov esp, ebp
pop ebp
ret

Function at 0x40e32f
Capabilities:
Get session user name

Disassembly:
push 0x10
mov eax, 0x424351
call fcn.004239ed
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x100
call dword [0x4299ec]
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
add eax, eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
pop ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40e394
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0
je 0x40e3a6
push dword [ebp - 0x14]
call sub.mfc90u.dll_delete__
pop ecx
mov eax, dword [ebp + 8]
call fcn.00423a59
ret 4
Function at 0x4165f5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x426782
call fcn.004239ed
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0x4000
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 3
push dword [ebp + 8]
xor eax, eax
inc eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x1c], esi
call fcn.0040691d
test eax, eax
jne 0x4166a6
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
add eax, eax
push eax
push esi
push edi
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416684
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
shr eax, 1
push eax
mov eax, edi
call fcn.0041674a
mov dword [ebp - 0x1c], 1
push edi
call sub.mfc90u.dll_delete__
pop ecx
cmp dword [ebp - 0x24], esi
je 0x4166b4
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], esi
jmp 0x4166a6
cmp dword [ebp - 0x24], esi
je 0x4166b4
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [ebp - 0x1c]
call fcn.00423a59
ret 0xc
Function at 0x41a78b
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push dword [esi + 0x14]
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call edi
mov dword [ebp - 0x14], eax
jmp 0x41a861
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a845
mov dword [ebp - 0xc], 1
push 0
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a845
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
mov dword [esi + 0x5c], eax
jle 0x41a7e1
call edi
cmp dword [ebp - 4], 0
je 0x41a83c
sub eax, dword [ebp - 0x14]
fild dword [ebp - 0x10]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
test eax, eax
jge 0x41a82a
fadd qword [0x4322b0]
fdiv qword [0x4322b8]
fdivp st(1)
call fcn.00423b30
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8
add ebx, dword [ebp - 8]
push 0
push dword [esi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41a871
call edi
sub eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x28]
jb 0x41a7bd
jmp 0x41a80c
push 2
pop eax
jmp 0x41a83f

Function at 0x41a876
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push dword [esi + 0x14]
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call edi
mov dword [ebp - 0x14], eax
jmp 0x41a943
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41a927
mov dword [ebp - 0xc], 1
push 0
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41a927
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x41a8cc
call edi
cmp dword [ebp - 4], 0
je 0x41a91e
sub eax, dword [ebp - 0x14]
fild dword [ebp - 0x10]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
test eax, eax
jge 0x41a90c
fadd qword [0x4322b0]
fdiv qword [0x4322b8]
fdivp st(1)
call fcn.00423b30
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 8
add ebx, dword [ebp - 8]
push 0
push dword [esi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41a953
call edi
sub eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x28]
jb 0x41a8a8
jmp 0x41a8ee
push 2
pop eax
jmp 0x41a921
Function at 0x41db4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0xc
push edi
xor edi, edi
push edi
push 0xa0000080
push 1
push edi
push edi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
je 0x41dbd8
push esi
mov esi, 0x100000
cmp dword [ebp + 8], esi
jae 0x41db84
mov esi, dword [ebp + 8]
push esi
call sub.mfc90u.dll_new__
push esi
push edi
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.MSVCR90.dll_memset
add esp, 0x10
cmp esi, dword [ebp + 8]
ja 0x41dbc9
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 0xc]
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41dbbf
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, esi
cmp eax, dword [ebp + 8]
jbe 0x41dba3
push dword [ebp - 0xc]
call sub.mfc90u.dll_delete__
pop ecx
xor eax, eax
inc eax
pop esi
jmp 0x41dbda
xor eax, eax
pop edi
leave
ret 4
Function at 0x41dbdf
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov esi, eax
push ebx
push dword [esi + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [eax], ebx
call sub.mfc90u.dll_new__
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x10
call edi
mov dword [ebp - 0x1c], eax
jmp 0x41dcfb
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push dword [ebp - 0x10]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41dcc3
mov dword [ebp - 0x14], 1
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41dcc3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x41dc53
call edi
push dword [ebp - 0x10]
mov esi, eax
call sub.mfc90u.dll_delete__
pop ecx
cmp dword [ebp - 8], ebx
je 0x41dcb9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
sub esi, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp + 8], eax
fild dword [ebp + 8]
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jge 0x41dca7
fadd qword [0x4322b0]
fdiv qword [0x4322b8]
fdivp st(1)
call fcn.00423b30
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x14]
mov dword [ebp - 8], 1
jl 0x41dced
push ebx
push ebx
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
add dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41dd0e
call edi
sub eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 0x24]
jb 0x41dc31
jmp 0x41dc74
push dword [ebp - 0x10]
call sub.mfc90u.dll_delete__
pop ecx
push 2
pop eax
jmp 0x41dcbc
Function at 0x41dd1c
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov esi, eax
push ebx
push dword [esi + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [eax], ebx
call sub.mfc90u.dll_new__
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0x10
call edi
mov dword [ebp - 0x1c], eax
jmp 0x41de38
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push dword [ebp - 0x10]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41de00
mov dword [ebp - 0x14], 1
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41de00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x41dd90
call edi
push dword [ebp - 0x10]
mov esi, eax
call sub.mfc90u.dll_delete__
pop ecx
cmp dword [ebp - 8], ebx
je 0x41ddf6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
sub esi, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp + 8], eax
fild dword [ebp + 8]
mov dword [ebp + 8], esi
fild dword [ebp + 8]
test esi, esi
jge 0x41dde4
fadd qword [0x4322b0]
fdiv qword [0x4322b8]
fdivp st(1)
call fcn.00423b30
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x14]
mov dword [ebp - 8], 1
jl 0x41de2a
push ebx
push ebx
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 4]
add dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41de4b
call edi
sub eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 0x24]
jb 0x41dd6e
jmp 0x41ddb1
push dword [ebp - 0x10]
call sub.mfc90u.dll_delete__
pop ecx
push 2
pop eax
jmp 0x41ddf9
Function at 0x423038
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b028]
jne 0x423042
repz ret
jmp fcn.0042355e

Function at 0x8ccbc7
Capabilities:
Encode data using xor

Disassembly:
push 0x8cc92e
pop eax
add ebx, ebx
dec ecx
sub ebx, 1
call fcn.008ccbfa
sub esp, 4
mov dword [esp], 0x1ac2bb48
pop ecx
inc ebx
xor dword [edi], eax
push ecx
pop ebx
inc edi
dec ebx
cmp edi, edx
jne fcn.008ccbc7
add ecx, ecx
dec ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x330e1d27
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x120a6e12
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x42cd7b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440160]
jne 0x42cd85
repz ret
jmp fcn.004312e6

Function at 0x43404c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x440160]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00430d0e
and dword [ebp - 0x14], 0
cmp dword [0x444058], 0
mov dword [ebp - 0x18], eax
jne 0x4340ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4341a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43bab0
push ebx
call edi
test eax, eax
je 0x4341a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x444058], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44405c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x444060], eax
call edi
push eax
call esi
mov dword [0x444068], eax
test eax, eax
je 0x4340ff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x444064], eax
mov eax, dword [0x444064]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x434158
cmp dword [0x444068], ecx
je 0x434158
push eax
call esi
push dword [0x444068]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x434158
test ebx, ebx
je 0x434158
call edi
test eax, eax
je 0x43414f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43414f
test byte [ebp - 8], 1
jne 0x434158
or dword [ebp + 0x10], 0x200000
jmp 0x43418b
mov eax, dword [0x44405c]
cmp eax, dword [ebp - 0x18]
je 0x43418b
push eax
call esi
test eax, eax
je 0x43418b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43418b
mov eax, dword [0x444060]
cmp eax, dword [ebp - 0x18]
je 0x43418b
push eax
call esi
test eax, eax
je 0x43418b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x444058]
call esi
test eax, eax
je 0x4341a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4341a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cd7b
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 0xbc]
mov eax, dword [ecx + 0x14]
add esi, edi
mov edx, dword [edi + 0x1c]
mov dword [ebp - 0xc], edx
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x18]
mov ecx, 1
mov dword [esi + 0xc], eax
mov eax, 0x100
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x401afa
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x78]
mov dword [ebp - 8], eax
lea eax, [edx + 0x3a]
test byte [ebp - 8], 4
je 0x401b15
test byte [eax], 1
je 0x401b4c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
and eax, 0xfffffffb
mov dword [edi + 0x78], eax
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
or ecx, 0x200
mov edx, eax
mov dword [esi + 0x10], ecx
test byte [edx], 2
mov edx, dword [ebp - 0xc]
je 0x401b4c
mov eax, dword [edx + 0x46]
or ecx, 0x400
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x10], ecx
test dword [edi + 0x78], 0x400
je 0x401b5e
or ecx, 0x4000
mov dword [esi + 0x10], ecx
test byte [eax], 4
je 0x401b6c
or ecx, 0x100
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 8]
test byte [eax + 6], 2
je 0x401b99
or ecx, 0x80
mov eax, 1
mov dword [esi + 0x10], ecx
mov word [esi + 0x20], ax
cmp word [edi + 0x18], 3
jne 0x401b9e
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x401b9e
or word [esi + 0x20], 0x20
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [edx + 0x40]
mov dword [esi + 0x1c], eax
cmp cx, 0xd
jne 0x401c03
mov ecx, dword [0x4f3be4]
movsx edx, word [edx]
cmp edx, dword [ecx + 0x194]
jge 0x401bf6
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
mov eax, dword [0x4f3be4]
imul edx, dword [eax + 0x1a0], 0x2c
add edx, dword [eax + 0x400]
je 0x401bf6
mov ecx, dword [edx + 0x24]
test ecx, ecx
je 0x401bf6
mov edx, dword [edx + 0xc]
call fcn.0043e510
jmp 0x401bf8
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x401c03
mov word [esi + 0x18], ax
cmp dword [edi + 0xcc], 0
jne 0x401c2a
or word [esi + 0x20], 2
mov eax, 1
or dword [esi + 0x10], 8
mov ecx, dword [esi + 0x10]
movzx ecx, cx
pop edi
mov word [esi + 0x22], cx
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x10]
mov word [esi + 0x22], ax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4034a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x4f3be4]
test eax, eax
je 0x4034d4
cmp dword [eax + 0x1fc], 0
jne 0x403670
push 0
push 0
push 0
push 0
push esi
mov dword [0x4f3a9c], 0
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x403658
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop dword [eax]
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x40360c
mov ecx, dword [0x4f39cc]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x403553
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
test eax, eax
je 0x403553
lea eax, [ebp - 8]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x40360c
cmp dword [ebp - 8], eax
je 0x403553
mov ecx, dword [0x4f39cc]
jmp 0x403530
mov eax, dword [0x4f3be4]
test eax, eax
je 0x4035fe
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x4035fe
push dword [0x4f3bb8]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x403597
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov ecx, dword [ebp - 4]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x4035a8
cmp eax, 0x104
jne 0x4035f8
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x4035f8
cmp edi, 0x11
je 0x4035f8
mov ecx, dword [0x4f3be4]
test ecx, ecx
je 0x4035f8
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x4035f8
cmp eax, 0x104
je 0x4035df
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x4035df
xor edx, edx
jmp 0x4035e4
mov edx, 1
push ecx
mov ecx, dword [0x4f3bc0]
push edi
call fcn.0045f1b0
add esp, 8
test eax, eax
jne 0x40360c
cmp dword [ebp - 4], 0
jne 0x40360c
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40363a
test al, 1
je 0x403620
cmp dword [esi + 4], 0x111
je 0x403657
test al, 2
je 0x40362d
cmp dword [esi + 4], 0x201
je 0x403657
test al, 4
je 0x40363a
cmp dword [esi + 4], 0x202
je 0x403657
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x403500
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x4f3aa0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [0x4f3a9c], eax
pop esi
mov esp, ebp
pop ebp
ret