joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ba0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x420bdc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x420f30
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x420f28
cmp word [edx], 0
je 0x420f28
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x420e4e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x420ead
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x420e80
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420e60
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00420f60
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420e80
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00421070
mov edi, eax
test edi, edi
je 0x420ea3
cmp dword [esi + 4], 0
je 0x420efb
push dword [esp + 0x14]
push edi
push esi
call fcn.00420f60
push edi
push 0
push dword [0x43214c]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x43214c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
push dword [esp + 4]
push dword [0x432df8]
call fcn.00427df9
test eax, eax
je 0x420f4c
mov dword [esp + 4], eax
jmp 0x420e20
xor eax, eax
ret 0xc
Function at 0x420f60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x421067
cmp dword [esi + 0x14], 1
jne 0x420fab
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x421028
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x421013
dec eax
je 0x420ffc
sub eax, 2
je 0x420fe7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00420ba0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x421055
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x420fd1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x421fcd
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x422042
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x421feb
mov esi, 0x42b054
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x422039
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x422039
push ebp
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 4
Function at 0x423ea0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x423ed2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423ecd
cmp dword [esp + 0xc], esi
je 0x423ee9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x427c88
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x432cac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x427ce9
push esi
push dword [0x432ca8]
push 8
push dword [0x43214c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x432cac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x432ca4]
jmp 0x427cd9
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x427cd7
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x427cc7
push edi
push 0x427c26
call fcn.00429857
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x427cf3
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x427d09
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x432ca8]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x427d40
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x43214c]
mov dword [0x432cac], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x432cac]
call ebx
mov eax, dword [0x432ca8]
mov edi, eax
add eax, esi
push eax
push dword [0x432cac]
mov dword [0x432ca8], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x43214c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x432cac]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x427d80
test ebx, ebx
je 0x427da1
push 0x14
push 0x432ca4
call fcn.004285f5
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x427da1
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x4286f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x428736
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x432f38]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x428757
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x432f38]
push edx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.00428e10
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x428780
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4288f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x428950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x428b00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x428b24
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x428b74
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x432f38]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x428bbc
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x428bbc
cmp dword [ebp - 8], 0x100000
jge 0x428b90
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x432f38]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x428be0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x428d60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x428d9e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x428d9e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x428da0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x428e60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x429240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4301ec]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x429857
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x432cec], 0
push ebx
push esi
mov esi, 0x432cf4
jne 0x429883
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x432d0c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x432cec], 1
push dword [0x432d0c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x429920
push 0x14
push 8
push dword [0x43214c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x42994a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x432cf0]
test eax, eax
je 0x4298c5
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x432cf0], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x42994f
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x432d0c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x43214c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42994a
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0xa3b790
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa3b7cf
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xa53d42
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a539bf

Function at 0xa5a3f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a5a26b

Function at 0x100011f1
Capabilities:
Create thread
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov dword [0x10003418], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [0x10003414], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [0x10003410], eax
mov eax, dword [ebp + 0x18]
push 0x10001159
push dword [0x1000340c]
call dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp + 8]
xor ebx, ebx
mov edi, eax
mov dword [0x10003408], ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
mov dword [0x10003400], ebx
lea ecx, [ebp + 0xc]
push ecx
push ebx
sbb eax, eax
and eax, dword [ebp + 8]
push eax
push 0x100010d1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10003404], eax
jmp 0x10001281
cmp dword [0x10003408], ebx
jne 0x10001285
cmp dword [0x10003400], ebx
jne 0x10001285
call fcn.1000115c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10003404]
test eax, eax
jne 0x1000125f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push dword [ebp + 0xc]
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [0x10003408]
test eax, eax
je 0x100012b7
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x100012bd
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x651923b4
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x7bab788f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403e59
pop dword [ebp - 0x30]
mov eax, 0x73708120
add eax, 0x8ccfbd39
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7ab7742
sub dword [ebp - 0x40], 0xb95931f7
mov dword [ebp - 0x3c], 0x2e1f7b7c
sub dword [ebp - 0x3c], 0xfbec2f37
mov dword [ebp - 0x38], 0x7b3f23a6
add dword [ebp - 0x38], 0xd10d2088
mov dword [ebp - 0x34], 0xf4e62272
sub dword [ebp - 0x34], 0xf4e62272
lea eax, [ebp - 0x40]
push eax
mov eax, 0x67bf4684
add eax, 0x98813a08
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xd34bc95d
sub dword [ebp - 0x40], 0x5ed96007
mov dword [ebp - 0x3c], 0xea1f6966
add dword [ebp - 0x3c], 0x574cf80f
mov dword [ebp - 0x38], 0x539e2e88
add dword [ebp - 0x38], 0xfd13de4
mov dword [ebp - 0x34], 0x47b283e9
add dword [ebp - 0x34], 0xb84d7c17
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xd64e989
add eax, 0xf2db974b
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37d09
push 0
call eax
mov ecx, 0x4c45
mov ebx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x30]
mov edx, 0x891b3d0e
add dword [ebp - 0x24], 0x415f1db2
mov edi, dword [esi]
xor dword [ebp - 0x1c], 0xd05d97cc
xor edi, edx
sub dword [ebp - 0xc], 0x4beb1b6b
mov dword [ebx], edi
mov dword [ebp - 4], 0x57914dd2
add ebx, 4
add esi, 4
loop 0x403f69
add eax, 0xdbefd963
sub eax, 0xdbeeb57c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1e5ff5a7
add ecx, 0xe1e00a59
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x35c00453
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x469b154c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
invalid
Function at 0x40121a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 8], eax
mov ax, word [0x40a2e4]
mov word [ebp - 0x418], ax
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00404530
add esp, 0xc
mov ax, word [0x40a2e4]
mov word [ebp - 0x210], ax
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00404530
add esp, 0xc
and dword [ebp - 0x420], 0
push 0x208
lea eax, [ebp - 0x418]
push eax
call fcn.00401b21
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4012f0
push 0
push 0
lea eax, [ebp - 0x424]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x40
push 0x40a2e8
push dword [ebp - 0x424]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
jmp 0x40147c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x5c
je 0x401320
push 0x40a2f8
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040103e
call fcn.0040148a
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x40133c
xor eax, eax
inc eax
jmp 0x40147c
lea eax, [ebp - 0x210]
push eax
call fcn.004016f9
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40146d
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xfffffffd
je 0x401439
cmp dword [ebp - 0x42c], 0xfffffffe
je 0x401399
cmp dword [ebp - 0x42c], 0xffffffff
je 0x40138a
jmp 0x401445
mov dword [ebp - 0x428], 0x40a2fc
jmp 0x40144f
push 0
push 0x200
lea eax, [ebp - 0x424]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov dword [ebp - 0x41c], eax
push str._r_npath:__
push dword [ebp - 0x41c]
push dword [ebp - 0x424]
call fcn.0040108a
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x41c]
push dword [ebp - 0x424]
call fcn.0040108a
push 0x40a32c
push dword [ebp - 0x41c]
push dword [ebp - 0x424]
call fcn.0040108a
push 0x40
push 0x40a2e8
push dword [ebp - 0x424]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40144f
mov dword [ebp - 0x428], 0x40a330
jmp 0x40144f
mov dword [ebp - 0x428], 0x40a354
cmp dword [ebp - 0x428], 0
je 0x40146d
push 0
push 0x40a2e8
push dword [ebp - 0x428]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401ced
leave
ret 0x10
Function at 0x40148a
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.BSPDL_030
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4014aa
xor eax, eax
jmp 0x4014db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4014d8
push 0
push 0x40a2e8
push 0x40a388
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4014db
mov eax, dword [ebp - 4]
leave
ret