joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009410
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header

Disassembly:
jmp 0x1000aa1e
push ebp
xor ax, ax
rdtsc
mov ebp, esp
bsf eax, eax
bt edx, 0xb3
push ebx
sub ax, sp
push edi
rcl dx, 0x8a
mov ax, 0xadb0
rcr ch, cl
push esi
sub esp, 0x138
movzx edx, di
mov eax, dword [0x10076200]
shl dx, cl
xor eax, ebp
rcl dh, 0x12
btr edx, edi
movsx ecx, ax
mov dword [ebp - 0x10], eax
or ecx, edi
mov ecx, dword [0x10077528]
rcr ax, 0x33
shl dh, 0xbc
sub ax, 0x99e
mov eax, dword [0x10077524]
xor edx, esi
movsx dx, bl
mov edx, ecx
cmp esp, 0x91a3dcb1
lea edx, [edx - 0xcff33f3]
sub edx, 1
cmc
test ebp, esp
lea edx, [edx + 0xcff33f3]
imul ecx, edx
test eax, 0x5a14d426
and ecx, 1
stc
cmc
cmp ecx, 0
sete cl
clc
test si, 0x4813
and cl, 1
stc
test ch, cl
mov byte [ebp - 0x13a], cl
cmp dx, 0xe6b5
clc
cmp eax, 0xa
setl al
jmp 0x10013bb5
and al, 1
mov byte [ebp - 0x139], al
rol ax, cl
movzx eax, di
cmp bp, 0x8a38
mov dword [ebp - 0x140], 0xcde51427
bt ax, 0xa8
cwde
btc ax, 0x8e

Function at 0x1001b4a3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001b4e2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b4e2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b4e2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001b4e2
cmp dword [ecx + 0x74], 0xe
jbe 0x1001b4e2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001e15f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001e1fc
push ebx
push esi
call fcn.1001e128
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001e0bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001e1a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e1fb
push edi
push eax
call fcn.1001f11a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001e1c9
call fcn.1001cc04
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001e1fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001e0bc
add esp, 0x20
test eax, eax
jne 0x1001e1e8
push edi
call fcn.1001cc04
jmp 0x1001e1f0
push ebx
call fcn.1001cc04
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001e469
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cb8
push 0x10025cb0
push str.FlsAlloc
push 0x1f
call fcn.1001e385
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e49d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024140]
call esi
jmp 0x1001e4a3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001e4e7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsGetValue
push 0x21
call fcn.1001e385
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e51e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001e526
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd0
push 0x10025cc8
push str.FlsSetValue
push 0x22
call fcn.1001e385
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e560
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023be0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10023c0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10023c0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x5213d4
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.0052140b
mov ebx, eax
xor ah, byte [esi]
call fcn.0052140b
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x5213f2
ret

Function at 0x52140b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x521414
cmp byte [esi], 0
jne 0x521411
pop edx
pop esi
pop ecx
ret

Function at 0x52145c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x521470
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x5234bd
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x52351d
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x5234d3
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1d460897
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xab7627
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x61df6382
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x16c32a7a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x23b0bf5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x38a14c4c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10019930
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001996f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001996f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001996f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001996f
cmp dword [ecx + 0x74], 0xe
jbe 0x1001996f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001c62d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001c6ca
push ebx
push esi
call fcn.1001c5f6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001c58a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001c677
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001c6c9
push edi
push eax
call fcn.1001a66d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001c697
call fcn.1001b0d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001c6c8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001c58a
add esp, 0x20
test eax, eax
jne 0x1001c6b6
push edi
call fcn.1001b0d2
jmp 0x1001c6be
push ebx
call fcn.1001b0d2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001c937
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d10
push 0x10024d08
push str.FlsAlloc
push 0x1f
call fcn.1001c853
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c96b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
jmp 0x1001c971
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001c9b5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d20
push 0x10024d18
push str.FlsGetValue
push 0x21
call fcn.1001c853
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c9ec
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c9f4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d28
push 0x10024d20
push str.FlsSetValue
push 0x22
call fcn.1001c853
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ca2e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10021fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10021ffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10021ffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x3dff13c5
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
mov ecx, 0x43b34056
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x10001707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + esi + 0x78]
lea edi, [eax + esi]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.100016da
pop ecx
test eax, eax
pop ecx
jne 0x1000176e
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x10001767
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.100016da
pop ecx
test eax, eax
pop ecx
jne 0x1000176e
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x10001747
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + esi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x10001769
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429004]
jne 0x401010
repz ret
jmp fcn.00401748

Function at 0x405478
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402f5b
and dword [ebp - 4], 0
cmp dword [0x42b430], 0
mov ebx, eax
jne 0x405529
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4055da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4055da
push eax
call fcn.00402ee9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42b430], eax
call esi
push eax
call fcn.00402ee9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42b434], eax
call esi
push eax
call fcn.00402ee9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42b438], eax
call esi
push eax
call fcn.00402ee9
pop ecx
mov dword [0x42b440], eax
test eax, eax
je 0x405529
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402ee9
pop ecx
mov dword [0x42b43c], eax
mov eax, dword [0x42b43c]
cmp eax, ebx
je 0x405581
cmp dword [0x42b440], ebx
je 0x405581
push eax
call fcn.00402f64
push dword [0x42b440]
mov esi, eax
call fcn.00402f64
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405581
test edi, edi
je 0x405581
call esi
test eax, eax
je 0x405578
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405578
test byte [ebp - 0xc], 1
jne 0x405581
or dword [ebp + 0x10], 0x200000
jmp 0x4055ba
mov eax, dword [0x42b434]
cmp eax, ebx
je 0x4055ba
push eax
call fcn.00402f64
pop ecx
test eax, eax
je 0x4055ba
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4055ba
mov eax, dword [0x42b438]
cmp eax, ebx
je 0x4055ba
push eax
call fcn.00402f64
pop ecx
test eax, eax
je 0x4055ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42b430]
call fcn.00402f64
pop ecx
test eax, eax
je 0x4055da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4055dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420c66
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x42cec4]
push dword [0x42cbe0]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x420cf5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp ebx, 0x19f
jne 0x420d0a
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420d42
push esi
and dword [ebp - 8], 0
lea esi, [ebp - 8]
mov dword [ebp - 4], 5
call fcn.00420cea
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0x46
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420d12
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420d59
or dword [0x42ced4], 0xffffffff
mov dword [0x42ced0], 0xa62e7790
leave
ret
Function at 0x63743df0
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x63aa7440]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x63743fc0
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.637aaca0
jmp fcn.63743df0
Function at 0x63745bc0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [0x63aa7440]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x50], eax
je 0x63745c0a
call fcn.6377bcc0
lea eax, [0x6394015e]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.6377c530
call fcn.6377bd20
mov dword [esp], 2
call fcn.63776850
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov byte [esp + 8], 0
call fcn.637459b0
mov eax, dword [0x63aa7440]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
nop
inc dword [eax + 0x140]
mov eax, dword [0x63aa7440]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, eax
nop
mov dword [ecx + 0xb8], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x84], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x30], ecx
test byte [ecx], al
lea esi, [ecx + 0x234]
lea edi, [esp + 0xc]
call fcn.637ac804
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x28], ecx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x24], edx
call fcn.637a8680
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x8c], 0
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x8d]
test dl, dl
je 0x63745caa
mov byte [ecx + 0x8e], 0
mov ecx, dword [eax + 0x18]
test byte [ecx], al
add ecx, 0x374
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.637435f0
mov eax, dword [esp + 0x2c]
movzx ecx, byte [eax + 0x71]
test cl, cl
jne 0x63745d76
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.63745d90
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x8c], 1
call fcn.63786df0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x8d]
test dl, dl
je 0x63745d1d
mov byte [ecx + 0x8e], 1
mov ecx, dword [eax + 0x18]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jne 0x63745d60
mov dword [esp], ecx
call fcn.637780c0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.63785010
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x234]
lea esi, [esp + 0xc]
call fcn.637ac804
add esp, 0x34
ret
lea eax, [0x63942806]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.6377a010
lea eax, [0x6390c5a0]
mov dword [esp], eax
lea eax, [0x6397b5a8]
mov dword [esp + 4], eax
call fcn.637795a0
nop
int3