joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487d20
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push str.Success_created.
push 0x491d30
mov ebx, ecx
call fcn.00401280
mov edx, str.Success_created.
call fcn.00405ba0
push eax
call fcn.00405db0
push 8
call fcn.0042c39e
push 4
mov esi, eax
call fcn.0042c39e
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x408a00
push 0
push 0
mov dword [eax], 0x487c50
call fcn.0043aeda
add esp, 0x2c
mov dword [esi], eax
test eax, eax
je 0x487db3
cmp dword [edi], 0
je 0x487dc0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi], eax
je 0x487dc7
push 0
push dword [esi + 4]
push dword [esi]
call fcn.0040c052
add esp, 0xc
test eax, eax
jne 0x487dce
mov dword [esi + 4], eax
mov dword [esi], eax
cmp dword [edi], eax
jne 0x487dd5
push 8
push esi
call fcn.0042c3ce
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
push 6
mov dword [edi], 0
call fcn.004096c3
push 1
call fcn.004096c3
push 5
call fcn.004096c3
push 2
call fcn.004096c3
call fcn.00454f76
int3
Function at 0x402460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4e8
mov eax, dword [0x4211d0]
xor eax, esp
mov dword [esp + 0x4e4], eax
push esi
mov esi, ecx
mov dword [esp + 0x5c], 0x54535953
lea ecx, [esp + 0x4c]
mov word [esp + 0x60], 0x4d45
push edi
mov byte [esp + 0x66], 0
lea edx, [ecx + 1]
mov dword [esp + 0x50], 0x52525543
mov dword [esp + 0x54], 0x5f544e45
mov dword [esp + 0x58], 0x52455355
mov word [esp + 0x5c], 0x5c
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4024b8
sub ecx, edx
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4024c6
sub edx, edi
lea eax, [edx + 1]
add eax, ecx
push eax
call fcn.00403b90
lea edx, [esp + 0x54]
mov dword [esp + 0x14], eax
mov edi, eax
add esp, 4
mov eax, edx
sub edi, eax
nop dword [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], cl
test cl, cl
jne 0x4024f0
mov edx, esi
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x402500
mov edi, dword [esp + 0x10]
sub esi, edx
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402510
mov ecx, esi
lea eax, [esp + 0xe9]
mov dword [esp + 0x1c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push 0x3ff
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00406440
push 0x7f
lea eax, [esp + 0x79]
mov byte [esp + 0xf8], 0
push 0
push eax
mov dword [esp + 0x3c], 0x400
call fcn.00406440
add esp, 0x18
mov byte [esp + 0x68], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 0x80
xor edi, edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x74]
push eax
push edi
call fcn.0042a151
push 0xffffffffffffff85
ror byte [edi], 0x84
scasb al, byte es:[edi]
add byte [eax], al
add byte [ebx - 0x72efdb8c], cl
inc esp
and al, 0x28
push eax
push edi
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push edi
push edi
push 4
push 1
push esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
push esi
call fcn.00434c7d
push 3
push 2
push 0x20019
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0x72657665
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x64], 0x656e6f79
push eax
mov byte [esp + 0x6c], 0
push esi
call fcn.0042c926
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
push 1
push eax
call fcn.00430f32
test eax, eax
jne 0x402668
push eax
push eax
push eax
lea eax, [esp + 0xf4]
push eax
push 1
push 4
push esi
pop esi
call fcn.0042e2e8
call esi
push edi
push dword [esp + 0x1c]
lea eax, [esp + 0xf0]
push edi
push eax
push 0x80000005
push 4
push dword [esp + 0x28]
call esi
test eax, eax
mov ecx, 1
cmove edi, ecx
mov ecx, dword [esp + 0x4ec]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
Function at 0x402680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4f8
mov eax, dword [0x4211d0]
xor eax, esp
mov dword [esp + 0x4f4], eax
push esi
mov esi, ecx
mov dword [esp + 0x64], 0x696d6441
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], 0x7473696e
push edi
mov dword [esp + 0x70], 0x6f746172
lea edx, [ecx + 1]
mov word [esp + 0x74], 0x7372
mov byte [esp + 0x76], 0
mov dword [esp + 0x58], 0x52525543
mov dword [esp + 0x5c], 0x5f544e45
mov dword [esp + 0x60], 0x52455355
mov word [esp + 0x64], 0x5c
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4026e8
sub ecx, edx
mov edx, esi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4026f6
sub edx, edi
lea eax, [edx + 1]
add eax, ecx
push eax
call fcn.00403b90
lea edx, [esp + 0x5c]
mov dword [esp + 0x14], eax
mov edi, eax
add esp, 4
mov eax, edx
sub edi, eax
nop dword [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], cl
test cl, cl
jne 0x402720
mov edx, esi
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x402730
mov edi, dword [esp + 0x10]
sub esi, edx
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402740
mov ecx, esi
lea eax, [esp + 0xf9]
mov dword [esp + 0x1c], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push 0x3ff
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00406440
push 0x7f
lea eax, [esp + 0x89]
mov byte [esp + 0x108], 0
push 0
push eax
mov dword [esp + 0x3c], 0x400
call fcn.00406440
add esp, 0x18
mov byte [esp + 0x78], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], 0x80
xor edi, edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push eax
push edi
call fcn.00429961
test eax, eax
je 0x40289e
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push edi
push edi
push 4
push 1
push esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
call fcn.0042d84d
retf
mov ecx, dword [esp + 0x4fc]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
Function at 0x4028c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x4211d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov esi, ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x4028ec
pop eax
lea eax, [ebp - 0x460]
push 0x400
push 0
push eax
call fcn.00406440
push 0x400
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.00406440
add esp, 0x18
mov dword [ebp - 0x86c], 3
lea eax, [ebp - 0x864]
mov dword [ebp - 0x868], 0x400
push eax
push 1
push 0
push esi
push SysReAllocString
push ebx
call fcn.0042fb10
test eax, eax
jne 0x402a6c
movaps xmm0, xmmword [0x41e910]
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x1c], 0x7465536e
push eax
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x18], 0x676e6974
push eax
push 0
lea eax, [ebp - 0x2c]
mov word [ebp - 0x14], 0x73
push eax
push dword [ebp - 0x864]
movups xmmword [ebp - 0x2c], xmm0
push ecx
call fcn.00429cad
test eax, eax
jne 0x402a60
mov al, byte [ebp - 0x458]
cmp al, 0xd
je 0x4029a9
cmp al, 5
jne 0x402a60
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4029b0
sub ecx, edx
lea eax, [ecx + 0x18]
cmp eax, 0x18
jbe 0x4029f3
xor esi, esi
mov al, byte [ebp + esi - 0x448]
lea esi, [esi + 1]
mov edx, edi
mov byte [ebp + esi - 0x861], al
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4029e0
sub edx, ecx
lea ecx, [esi + 0x18]
lea eax, [edx + 0x18]
cmp ecx, eax
jb 0x4029c3
lea edx, [ebp - 0x60]
mov dword [ebp - 0x10], 0x3a706f74
lea ecx, [ebp - 0x860]
mov dword [ebp - 0xc], 0x32393834
mov byte [ebp - 8], 0
call fcn.00401ee0
push eax
push ebx
push edx
call fcn.00434ade
test eax, eax
jne 0x402a41
push dword [ebp - 0x864]
call dword [0x417024]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x860]
push eax
call fcn.00405810
add esp, 8
push dword [ebp - 0x864]
test eax, eax
jne 0x402a25
jmp 0x402a66
push dword [ebp - 0x864]
call dword [0x417024]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040368f
mov esp, ebp
pop ebp
ret

Function at 0x40ac34
Capabilities:
Parse pe header

Disassembly:
push 0
push ebp
call fcn.0042f7f4
mov ecx, eax
test ecx, ecx
jne 0x40ac45
xor al, al
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40ac42
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40ac42
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40ac42
cmp dword [eax + 0x74], 0xe
jbe 0x40ac42
cmp dword [eax + 0xe8], 0
setne al
ret
Function at 0x43fdc5
Capabilities:
Encode data using xor

Disassembly:
stc
pushal
cmp ecx, dword [ebp - 8]
pushfd
pushal
push 0xcc2af5db
mov word [esp + 4], bp
lea esp, [esp + 0x48]
jbe 0x43e68e
shld di, bx, 1
cmp bh, 0xbb
bts di, 0xf
bts si, 0xd
sub ecx, 1
btr di, 7
xchg edi, esi
pushfd
sal di, 0xa
mov dword [ebp - 4], ecx
sub esp, 0xfffffffc
xchg di, cx
xchg si, di
not cx
push 0xd466dc59
mov ecx, dword [ebp - 8]
clc
or esi, 0x83d14b46
pushfd
btr di, bp
add ecx, dword [ebp - 4]
xor si, 0x2022
shr ecx, 1
btr si, 0xb
and di, 0xa352
mov edi, dword [ebx + ecx*4]
lea esi, [ebx + 0x46389617]
add edi, eax
bswap si
not esi
call fcn.004427e4
jne 0x4427ec
lea edi, [0x3988a8ee]
neg di
mov edi, dword [edx + 0x24]
call fcn.004391bf
pushfd
lea eax, [edi + 0x77368653]
movzx ax, al
mov eax, dword [esp + 0x40]
mov byte [esp + 4], 0x9f
pushfd
push 0xfc144904
push dword [esp + 4]
lea esp, [esp + 0x50]
ja 0x43fd8b
push ebp
push 0xebdec4f7
pushfd
mov dword [esp + 4], ecx
lea esp, [esp + 0xc]
jb 0x43f5f6
or al, 0xf
add byte [edx + 0x45], 0
add ch, dh
cmc
stc
cmp byte [edi - 1], 0
jno 0x441eb3
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x4427ec
sar di, 3
clc
sar di, cl
or di, si
mov edi, dword [edx + 0x24]
push esi
add edi, eax
call fcn.00442d45
pop ebp
jne 0x43b0dc
invalid
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
in al, 0xbd
pop ss
rol dword [ebx - 0x6b], cl
test ebp, ebp
test esp, esp
lea ecx, [edx]
mov dl, 0x68
stosb byte es:[edi], al
jb 0x43b165
lds ecx, [edx - 0x762615b7]
dec edi
aam 0x34
mov ebp, 0xbde4a519
jmp 0x43b0ad
ret 0x7372
jmp 0x4363f1
cmc
pushal
cmp ecx, dword [ebp - 4]
pushfd
pushfd
lea esp, [esp + 0x28]
jae 0x43e68e
clc
bt sp, 1
cmc
add ecx, 1
call fcn.0043e31f
add byte [eax], al
inc edi
je 0x43fdfe
outsd dx, dword [esi]
jne 0x43fe21
inc esi
imul ebp, dword [ebp + 0x4e], 0x57656d61
add al, ch
call 0x4389d5
lea esp, [esp + 0x2c]
je 0x43e68e
neg cx
test eax, 0xa81f6f9e
wait
mov ebx, 0xe53d4dad
sub edi, dword [ebx]
invalid
jmp 0x438105

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3e8a311f
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x65582a04
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4010d0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp dword [esp + 0x24], 0x10
push ebp
mov ebp, dword [esp + 0x2c]
jae 0x4010e8
lea eax, [esp + 0x14]
push esi
push ebx
push ecx
push 2
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401129
push ebx
lea edx, [esp + 0x10]
push edx
push ebp
push edi
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401122
cmp dword [esp + 0xc], ebp
jne 0x401122
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], 0x10
pop esi
jb 0x40113e
mov eax, dword [esp + 0x14]
push eax
call fcn.004024d9
add esp, 4
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x401150
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x409a18
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40d090]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
mov esi, eax
push 0x6f
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x401207
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
jbe 0x401207
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401207
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
mov edi, eax
push ebx
lea eax, [esp + 0x50]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov esi, 0x80
mov byte [ecx + 4], bl
call fcn.004017d0
mov ecx, esi
call fcn.004010d0
mov eax, dword [esp + 0x4c]
add esp, 0x20
cmp dword [esp + 0x40], 0x10
jae 0x4011fa
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x40], 0x10
jb 0x40121b
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004024d9
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x401240
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x10c
mov eax, dword [0x40d090]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [esp + 0xd]
push ebx
push eax
mov dword [esp + 0x10], ebx
mov byte [esp + 0x14], bl
call fcn.00403590
add esp, 0xc
push ebx
push 0x26
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 8]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x401295
sub eax, edx
push eax
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004019f0
mov ecx, dword [esp + 0x10c]
pop ebx
xor ecx, esp
mov eax, esi
call fcn.0040221e
add esp, 0x10c
ret
Function at 0x40221e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d090]
jne 0x402228
repz ret
jmp fcn.00402c29

Function at 0x403dcf
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x40d228]
je 0x403dea
inc edi
cmp edi, 0x17
jb 0x403ddb
cmp edi, 0x17
jae 0x403f6a
push ebp
push 3
call fcn.00407649
cmp eax, 1
pop ecx
je 0x403f36
push 3
call fcn.00407649
test eax, eax
pop ecx
jne 0x403e1e
cmp dword [0x40d088], 1
je 0x403f36
cmp ebx, 0xfc
je 0x403f69
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x40e180
push ebp
call fcn.00403975
add esp, 0xc
test eax, eax
je 0x403e54
push esi
push esi
push esi
push esi
push esi
call fcn.0040331f
add esp, 0x14
push 0x104
mov esi, 0x40e199
push esi
push 0
mov byte [0x40e29d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x403e98
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00403975
add esp, 0xc
test eax, eax
je 0x403e98
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040331f
add esp, 0x14
push esi
call fcn.00402710
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x403edd
push esi
call fcn.00402710
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x40e494
push 0x40a7cc
sub ecx, eax
push ecx
push eax
call fcn.00407596
add esp, 0x14
test eax, eax
je 0x403edd
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040331f
add esp, 0x14
jmp 0x403edf
xor esi, esi
push 0x40a7c8
push ebx
push ebp
call fcn.00407525
add esp, 0xc
test eax, eax
je 0x403eff
push esi
push esi
push esi
push esi
push esi
call fcn.0040331f
add esp, 0x14
push dword [edi*8 + 0x40d22c]
push ebx
push ebp
call fcn.00407525
add esp, 0xc
test eax, eax
je 0x403f21
push esi
push esi
push esi
push esi
push esi
call fcn.0040331f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00407368
add esp, 0xc
jmp 0x403f69
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x403f69
cmp ebp, 0xffffffff
je 0x403f69
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x40d22c]
push dword [esi]
call fcn.00402710
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x407368
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004048de
xor ebx, ebx
cmp dword [0x40e77c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40743e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40751e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40751e
push eax
call fcn.00404870
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e77c], eax
call esi
push eax
call fcn.00404870
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e780], eax
call esi
push eax
call fcn.00404870
mov dword [0x40e784], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403b5c
test eax, eax
pop ecx
pop ecx
je 0x40740c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040331f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40743e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404870
cmp eax, ebx
pop ecx
mov dword [0x40e78c], eax
je 0x40743e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404870
pop ecx
mov dword [0x40e788], eax
mov eax, dword [0x40e788]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4074c3
cmp dword [0x40e78c], ecx
je 0x4074c3
push eax
call fcn.004048e7
push dword [0x40e78c]
mov esi, eax
call fcn.004048e7
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4074c3
cmp edi, ebx
je 0x4074c3
call esi
cmp eax, ebx
je 0x407490
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407490
test byte [ebp - 0x18], 1
jne 0x4074c3
lea eax, [ebp - 0x10]
push eax
call fcn.00403b93
test eax, eax
pop ecx
je 0x4074ab
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040331f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4074ba
or dword [ebp + 0x10], 0x200000
jmp 0x4074fe
or dword [ebp + 0x10], 0x40000
jmp 0x4074fe
mov eax, dword [0x40e780]
cmp eax, dword [ebp - 8]
je 0x4074fe
push eax
call fcn.004048e7
cmp eax, ebx
pop ecx
je 0x4074fe
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4074fe
mov eax, dword [0x40e784]
cmp eax, dword [ebp - 8]
je 0x4074fe
push eax
call fcn.004048e7
cmp eax, ebx
pop ecx
je 0x4074fe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e77c]
call fcn.004048e7
cmp eax, ebx
pop ecx
je 0x40751e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407520
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x523c3c32
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6d64705f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x406046
pop dword [ebp - 0x50]
mov eax, 0x913ad38f
sub eax, 0x90fa7349
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x13a9751d
add dword [ebp - 0x60], 0x3aa8d02e
mov dword [ebp - 0x5c], 0x20e3e2db
sub dword [ebp - 0x5c], 0xeeb09696
mov dword [ebp - 0x58], 0x431425e9
sub dword [ebp - 0x58], 0xf6c7e1bb
mov dword [ebp - 0x54], 0x9e16ea7e
sub dword [ebp - 0x54], 0x9e16ea7e
lea eax, [ebp - 0x60]
push eax
mov eax, 0x3093a87b
add eax, 0xcfad27d9
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xaff72342
add dword [ebp - 0x60], 0xc47b4614
mov dword [ebp - 0x5c], 0xbb33f5dd
sub dword [ebp - 0x5c], 0x79c79468
mov dword [ebp - 0x58], 0xbc4a16f1
add dword [ebp - 0x58], 0xa725557b
mov dword [ebp - 0x54], 0xae775a94
sub dword [ebp - 0x54], 0xae775a94
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xb20d1021
sub eax, 0xb1cc3fd5
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3d6b3
push 0
call eax
mov ecx, 0x8e8a5fad
sub ecx, 0x8e8a0850
mov edi, eax
mov ebx, 0x351fb9d9
sub ebx, 0x34de09d9
add ebx, dword [ebp - 0x50]
mov esi, 0xeed8dff1
xor dword [ebp - 8], 0x56a2e274
mov edx, dword [ebx]
add dword [ebp - 8], 0xc93cac30
sub edx, esi
sub dword [ebp - 0x28], edx
mov dword [edi], edx
add dword [ebp - 0x4c], 0xac14e467
add edi, 0x56e11e6a
add edi, 0xa91ee19a
add ebx, 0xab1f9506
sub ebx, 0xab1f9502
loop 0x406162
add eax, 0xce77c7a5
sub eax, 0xce76775e
mov ebx, eax
add eax, 5
mov ecx, 0xe56a4ba
add ecx, 0xf1e95b46
add ecx, dword [ebp - 0x50]
call ebx
leave
ret