joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432305
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4515a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00428002
mov dword [ebp - 0x14], eax
cmp dword [0x456954], esi
jne 0x4323f8
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x432385
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4324d8
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4324d8
push 0x444584
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4324d8
push eax
call ebx
push 0x444590
push edi
mov dword [0x456954], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4445a0
push edi
mov dword [0x456958], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45695c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456964], eax
test eax, eax
je 0x4323f5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456960], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43241d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x432410
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x432432
push 4
pop eax
jmp 0x4324da
cmp dword [ebp - 0x14], esi
je 0x432432
push dword [0x456954]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x432417
mov eax, dword [0x456960]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x432490
cmp dword [0x456964], edi
je 0x432490
push eax
call ebx
push dword [0x456964]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x432490
test eax, eax
je 0x432490
call ecx
test eax, eax
je 0x432485
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x432485
test byte [ebp - 8], 1
jne 0x432490
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4324c0
mov eax, dword [0x456958]
cmp eax, edi
je 0x4324bd
push eax
call ebx
test eax, eax
je 0x4324bd
call eax
mov esi, eax
test esi, esi
je 0x4324bd
mov eax, dword [0x45695c]
cmp eax, edi
je 0x4324bd
push eax
call ebx
test eax, eax
je 0x4324bd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x456954]
call ebx
test eax, eax
je 0x4324d8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4324da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420e80
mov esp, ebp
pop ebp
ret
Function at 0x402594
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025a2
call dword [0x40b004]
or eax, eax
je 0x4025a3
ret
mov al, 1
jmp fcn.00402614

Function at 0x4025ac
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4025ba
call dword [0x40b008]
or eax, eax
jne 0x4025bb
ret
mov al, 2
jmp fcn.00402614

Function at 0x4025c4
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025fc
test edx, edx
je 0x4025e6
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402614
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025df
ret
mov al, 1
jmp fcn.00402614
test edx, edx
je 0x402610
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025f5
mov dword [ecx], eax
ret

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x403780
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402614
cmp eax, edx
je 0x4037f0
cmp word [eax], 8
jb 0x4037a5
push eax
push edx
cmp word [eax], 0x100
je 0x40379b
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4037a3
add eax, 8
call fcn.00403198
pop edx
pop eax
cmp word [edx], 8
jae 0x4037bc
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037dc
mov edx, dword [edx + 8]
or edx, edx
je 0x4037d3
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037d3
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403744
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x406638
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40662f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40664d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add al, 1
add byte [eax], al
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4066ab
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x406692
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40669b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4066a5
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x406687
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406611
invalid
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4066f8
dec eax
je 0x4066ef
sub eax, 3
je 0x4066e6
mov dword [ebp - 4], 0x40
jmp 0x406715
mov dword [ebp - 4], 4
jmp 0x4066fb
mov dword [ebp - 4], 0x20
jmp 0x4066fb
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x406747
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4066c7
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00405f58
cmp ecx, dword [ebx + 1]
mov ecx, 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x406753
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408104
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
in al, dx
pop es
cmpsb byte [esi], byte es:[edi]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40811c
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00405f58
sub eax, 0x8bad540e
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00405f58
daa
push esp
fadd qword [edi + 0x49]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x408145
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x408145
call fcn.00405f58
or cl, bh
iretd
in al, dx
ret 0x5a8b

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call 0x406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x68
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40d09a
pop dword [ebp - 0x3c]
mov eax, 0x4df37714
sub eax, 0x4db2a67a
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x357e6
push 0
mov eax, 0x777d2551
sub eax, 0x773c4479
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x3908
xor esi, esi
add esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x3c]
mov ebx, 0x5aa6bdb6
sub ebx, 0x9c890a67
add dword [ebp - 4], edx
mov edx, dword [edi]
mov dword [ebp - 0x30], 0x64fbc25c
add edx, ebx
add dword [ebp - 0x28], 0xe2b2b8b4
mov dword [esi], edx
xor dword [ebp - 8], 0x6775990a
add esi, 4
add edi, 0xf1fba116
sub edi, 0xf1fba112
loop 0x40d0ef
add eax, 0xbb19b670
add eax, 0x44e72083
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4bf9012e
add ecx, 0xb446fed2
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402ee4
pop dword [ebp - 0x48]
mov eax, 0x66b7db
add eax, 0xffd97709
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x6bf48368
sub dword [ebp - 0x58], 0x1da23e1d
mov dword [ebp - 0x54], 0x21398e1f
add dword [ebp - 0x54], 0x10f9be26
mov dword [ebp - 0x50], 0x721a92b6
add dword [ebp - 0x50], 0xda31b178
mov dword [ebp - 0x4c], 0xbf462bb0
sub dword [ebp - 0x4c], 0xbf462bb0
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xdbf3d2f8
sub dword [ebp - 0x58], 0x678169a2
mov dword [ebp - 0x54], 0x1227443
sub dword [ebp - 0x54], 0xbfb612ce
mov dword [ebp - 0x50], 0x6b607fd0
sub dword [ebp - 0x50], 0x7f11364
mov dword [ebp - 0x4c], 0x19cd0f6a
sub dword [ebp - 0x4c], 0x19cd0f6a
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7741ef31
add eax, 0x88fe91cf
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x363b7
push 0
call eax
mov ecx, 0x44c9
xor edi, edi
add edi, eax
mov esi, 0x491329f6
sub esi, 0x48cc45f6
add esi, dword [ebp - 0x48]
mov ebx, 0x9af6d000
xor dword [ebp - 0x44], 0xb30fe2d
mov edx, dword [esi]
xor dword [ebp - 0x38], 0x82d384a3
add edx, ebx
xor dword [ebp - 4], esi
mov dword [edi], edx
xor dword [ebp - 0x18], 0xe8ccce76
add edi, 4
add esi, 0xe9e4fd22
add esi, 0x161b02e2
loop 0x402ff7
add eax, 0x6f72a6b0
sub eax, 0x6f71a0b9
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0xbb0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bb01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbb007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbb006a
add dl, dl
jne 0xbb0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbb00dc
xor eax, eax
add dl, dl
jne 0xbb0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbb017d
add dl, dl
jne 0xbb00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbb00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbb0075
mov eax, 1
add dl, dl
jne 0xbb00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbb00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbb00e1
sub eax, ebx
mov ebx, 1
jne 0xbb0128
mov ecx, 1
add dl, dl
jne 0xbb010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbb0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbb0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbb0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbb013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbb014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbb0136
cmp eax, 0x7d00
jae 0xbb016d
cmp eax, 0x500
jb 0xbb0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbb0075
cmp eax, 0x7f
ja 0xbb0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbb0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbb019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbb0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403cf8
nop
nop
sub eax, 0x403c9e
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4248ca
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52ec60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00422110
mov dword [ebp - 0x14], eax
cmp dword [0x530798], edi
jne 0x4249bb
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x424948
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x424a9b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x424a9b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424a9b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x530798], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x53079c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x5307a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5307a8], eax
test eax, eax
je 0x4249b8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5307a4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4249e0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4249d3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4249f5
push 4
pop eax
jmp 0x424a9d
cmp dword [ebp - 0x14], edi
je 0x4249f5
push dword [0x530798]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4249da
mov eax, dword [0x5307a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x424a53
cmp dword [0x5307a8], esi
je 0x424a53
push eax
call ebx
push dword [0x5307a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x424a53
test eax, eax
je 0x424a53
call ecx
test eax, eax
je 0x424a48
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x424a48
test byte [ebp - 8], 1
jne 0x424a53
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x424a83
mov eax, dword [0x53079c]
cmp eax, esi
je 0x424a80
push eax
call ebx
test eax, eax
je 0x424a80
call eax
mov edi, eax
test edi, edi
je 0x424a80
mov eax, dword [0x5307a0]
cmp eax, esi
je 0x424a80
push eax
call ebx
test eax, eax
je 0x424a80
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x530798]
call ebx
test eax, eax
je 0x424a9b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x424a9d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004230c0
leave
ret
Function at 0x480a8e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004681a7
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x480ac6
xor eax, eax
jmp 0x480af2
cmp esi, dword [ebp - 4]
je 0x480aef
cmp dword [ebp + 0xc], 0
je 0x480aef
push dword [edi + 0x9c]
call fcn.0048069c
push dword [edi + 0x9c]
mov esi, eax
call fcn.00465be2
pop ecx
pop ecx
cmp esi, eax
je 0x480ac2
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.00401938
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x404659]
lea edx, [fcn.0040199c]
sub eax, edx
push eax
push fcn.0040199c
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401326
push edi
call fcn.00401830
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00401885
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
xor eax, edi
push eax
lea eax, [0x4060e4]
or eax, edi
push eax
call fcn.0040199c
add esp, 0x18
xor eax, eax
pop edi
leave
ret

Function at 0x401938
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x120], 0
xor edi, edi
mov dword [ebp - 0x11c], 0x14
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x40e447
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40e456
pop dword [ebp - 0x28]
mov eax, 0xc399ac
add eax, 0xff7d4aaa
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x43926
push 0
mov eax, 0xc69090b5
sub eax, 0xc64e3e9d
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x5f21
xor edx, edx
add edx, eax
mov ebx, 0x4f325c50
add ebx, 0xb110f7b0
add ebx, dword [ebp - 0x28]
mov edi, 0x15ef8363
add edi, 0xd8591472
mov esi, dword [ebx]
xor dword [ebp - 4], ecx
sub esi, edi
add dword [ebp - 0x24], 0x53dc80a0
mov dword [edx], esi
add edx, 4
add ebx, 0x4c02a6a0
sub ebx, 0x4c02a69c
loop 0x40e4b1
add eax, 0xee2f4b6e
sub eax, 0xee2ddc17
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3bdf3a69
add ecx, 0xc460c597
add ecx, dword [ebp - 0x28]
call ebx
leave
ret