joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a521
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4cf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49a56c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0049a996
test al, al
jne 0x49a566
sub edx, 2
cmp edx, edi
jne 0x49a54c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49a58e
lea eax, [edi + 2]
cmp edx, eax
je 0x49a58e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049a11a
add esp, 0x10
jmp 0x49a688
push esi
lea ecx, [ebp - 0x255]
call fcn.0049a996
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49a5d1
push dword [ebp - 0x25c]
jmp 0x49a57e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49a60e
cmp word [ebp - 0x226], 0
je 0x49a62f
cmp word [ebp - 0x226], ax
jne 0x49a60e
cmp word [ebp - 0x224], 0
je 0x49a62f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049a11a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49a67b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49a5e8
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49a663
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49a688
push 0x499b02
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405547
add esp, 0x10
jmp 0x49a658
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004030a8
leave
ret

Function at 0x49ff83
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004042f5
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x49fff2
cmp esi, dword [ebp - 4]
je 0x49ffed
cmp dword [ebp + 0xc], 0
je 0x49ffed
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x49ffca
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0049f9ab
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x49fff4
xor eax, eax
inc eax
jmp 0x49fff4
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4a4597
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4d2968]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a45d7
cmp byte [ebx], 0xa
jne 0x4a45d7
or byte [edi + eax + 0x28], 4
jmp 0x4a45dc
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4a46db
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4a46be
inc eax
cmp dl, 0xd
je 0x4a4608
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4a462e
cmp eax, ecx
jae 0x4a463c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4a45f0
jmp 0x4a46db
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a46b9
cmp dword [ebp - 0x10], 0
je 0x4a46b9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4d2968]
test byte [eax + edi + 0x28], 0x48
je 0x4a4693
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4a467e
mov byte [esi], dl
jmp 0x4a468f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4d2968]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4a46db
cmp byte [ebp - 1], 0xa
jne 0x4a46a2
cmp esi, ebx
jne 0x4a46a2
mov byte [esi], 0xa
jmp 0x4a46da
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401979
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4a46db
mov byte [esi], 0xd
jmp 0x4a46da
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4d2968]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a46d8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a46db
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a4737
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4d2968]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a477d
cmp word [ebx], dx
jne 0x4a477d
or byte [eax + edi + 0x28], 4
jmp 0x4a4782
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4a48e5
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4a48c5
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4a47c3
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a47f9
cmp eax, edx
jae 0x4a4807
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4a479e
jmp 0x4a48e5
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a48c0
cmp dword [ebp - 0x18], 0
je 0x4a48c0
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4d2968]
test byte [eax + edi + 0x28], 0x48
je 0x4a4896
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4a485a
mov word [esi], cx
jmp 0x4a4891
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4d2968]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4d2968]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4d2968]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4a48e5
pop eax
cmp word [ebp - 4], ax
jne 0x4a48a6
cmp esi, ebx
jne 0x4a48a6
mov word [esi], ax
jmp 0x4a48e2
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401979
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4a48e5
push 0xd
pop eax
jmp 0x4a48a1
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4d2968]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4a48df
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4a48e5
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x300086ae
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x300094f8
call fcn.30008790
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x3000ba88
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x3000844d
cmp eax, esi
jne 0x30008440
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30008450
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30008427
xor esi, esi
inc esi
mov eax, dword [0x3000ba84]
cmp eax, esi
jne 0x30008463
push 0x1f
call fcn.3009b000
pop ecx
jmp 0x30008492
mov eax, dword [0x3000ba84]
test eax, eax
jne 0x3000848c
mov dword [0x3000ba84], esi
push 0x30001268
push 0x30001260
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30008492
jmp 0x300085ba
mov dword [0x3000b730], esi
mov eax, dword [0x3000ba84]
cmp eax, esi
jne 0x300084b6
push 0x3000125c
push 0x30001254
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3000ba84], 2
test ebx, ebx
jne 0x300084c2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3000ba94], 0
je 0x300084e6
push 0x3000ba94
call fcn.30008a8c
pop ecx
test eax, eax
je 0x300084e6
push 0
push 2
push 0
call dword [0x3000ba94]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30008542
test al, al
je 0x30008500
cmp dword [ebp - 0x1c], 0
jne 0x30008542
mov al, byte [esi]
test al, al
je 0x30008510
cmp al, 0x20
ja 0x30008510
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30008500
test byte [ebp - 0x3c], 1
je 0x3000851c
movzx eax, word [ebp - 0x38]
jmp 0x3000851f
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x3000b72c], eax
cmp dword [0x3000b720], 0
jne 0x30008596
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30008551
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30008564
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x300084ed
cmp dword [0x3000b730], 0
jne 0x300085a5
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3000b72c]
jmp 0x300085c6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.300087d5
ret
call fcn.300082d6
jmp 0x300083ed
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b3d
push ebx
mov ebx, dword [ebp + 0x30]
push esi
push edi
mov eax, dword [ebx + 0x38]
adc esp, 0xffffffff
inc dword [esp + edx*4 - 0x74ffebff]
std
adc byte [esi], ch
leave
je 0x4069ef
mov eax, dword [ebx + 0xc]
mov ecx, dword [esi + 0x55]
lea edx, [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
invalid
mov eax, 0x975ef
invalid

Function at 0x408613
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x61
push edx
dec ebx
imul esi, dword [ebx + esi], 0xffffffac
pop ebp
call fcn.00408528
xor ecx, ecx
sub ecx, 0xffffff89
call 0x408613
rcr byte [esi - 0x7f], 0x76
push cs
dec byte [0xee83cc84]
cld
xor dword [esi + 0xe], 0xcc840dfe
sub esi, 0xfffffffc
loop 0x408616
xchg esp, eax
jl 0x408602
adc eax, 0xe8f0d410
or dl, byte [esi + 5]
mov edi, 0x58d267ed
sub eax, 0x1c306f8e
stc
test cl, dh
xor eax, dword [edi]
add byte [ebx + 0x1e], al
cli
sbb al, cl
jmp 0x4085f1
Function at 0x40e420
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50
push ebx
push esi
push edi
xor ebx, ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, 1
mov cl, bl
shl eax, cl
test ebp, eax
je 0x40e48b
lea eax, [ebx + 0x43]
lea ecx, [esp + 0x10]
push eax
push str._c:_
push ecx
call edi
lea ecx, [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, 0x2e
lea eax, [esp + 0x10]
push str.VCOP2PROJECTPPJ2DD.EXE
push eax
call esi
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
jmp 0x40e493
inc ebx
cmp ebx, 0x20
jl 0x40e43d
jmp 0x40e49a
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 0xffffffff
cmp ebx, 0x20
je 0x40e4a6
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x50
ret
Function at 0x426c60
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 4
push ebx
push esi
mov ebx, dword [esp + 0x14]
push edi
push ebp
xor edi, edi
mov eax, dword [ebx + 8]
cmp dword [ebx], 2
je 0x426cbe
add ebx, 4
mov ebp, dword [esp + 0x18]
mov esi, dword [ebx]
test esi, esi
je 0x426cb1
mov eax, dword [ebx + 8]
test eax, eax
je 0x426cb1
lea eax, [esp + 0x10]
push 0
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426cb1
mov edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx + 0xc]
add ebx, 0x10
cmp eax, 2
jne 0x426c7c
jmp 0x426cc2
mov ebp, dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x42b4c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42b4c6
ret

Function at 0x438a88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438c39
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004055d0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x438c50
call fcn.0040522c
mov eax, ebx
call fcn.00429340
mov edi, eax
dec edi
test edi, edi
jl 0x438b40
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00429314
mov edx, dword [0x45d310]
call fcn.00404188
test al, al
je 0x438b3c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00429314
lea edx, [ebp - 0x14]
call fcn.00469770
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004055d0
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004052a0
inc esi
dec edi
jne 0x438aee
mov al, byte [0x438c54]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x438c60
mov eax, dword [ebp - 0xc]
call fcn.0040fef8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404fb8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00469770
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x438c50
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00469770
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x438c50
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x438c50
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x438c6c
call fcn.0040b1e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438c40
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404f44
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404f44
lea eax, [ebp - 0x14]
call fcn.00404f20
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404f44
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e004]
jne 0x401010
repz ret
jmp fcn.00401562

Function at 0x409246
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405eb4
and dword [ebp - 4], 0
cmp dword [0x430ac0], 0
mov ebx, eax
jne 0x4092f7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093a8
push eax
call fcn.00405e42
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x430ac0], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x430ac4], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430ac8], eax
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x430ad0], eax
test eax, eax
je 0x4092f7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x430acc], eax
mov eax, dword [0x430acc]
cmp eax, ebx
je 0x40934f
cmp dword [0x430ad0], ebx
je 0x40934f
push eax
call fcn.00405ebd
push dword [0x430ad0]
mov esi, eax
call fcn.00405ebd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40934f
test edi, edi
je 0x40934f
call esi
test eax, eax
je 0x409346
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409346
test byte [ebp - 0xc], 1
jne 0x40934f
or dword [ebp + 0x10], 0x200000
jmp 0x409388
mov eax, dword [0x430ac4]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409388
mov eax, dword [0x430ac8]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430ac0]
call fcn.00405ebd
pop ecx
test eax, eax
je 0x4093a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b8e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
push esi
cmp ebx, 0x19f
jne 0x40b8f6
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor esi, esi
cmp ebx, ebp
jle 0x40b931
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
call fcn.0040b8d0
add esp, 4
mov eax, dword [esp + 0xc]
add eax, 0x64
mov dword [esp + 8], eax
sub dword [esp + 8], 0x64
mov cl, byte [esp + 8]
xor byte [esi + edi], cl
inc esi
cmp esi, ebx
jl 0x40b900
pop esi
pop ebp
cmp ebx, 0x2d
jne 0x40b94c
mov dword [0x2ae9508], 0xa62e7790
mov dword [0x2ae950c], 0xffffffff
add esp, 8
ret
Function at 0x1000b131
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000b140
pop dword [ebp - 0x24]
mov eax, 0xbd0c817b
add eax, 0x52f42fc5
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xf98eaae3
sub dword [ebp - 0x34], 0xab3c6598
mov dword [ebp - 0x30], 0xe3a0f452
sub dword [ebp - 0x30], 0xb16da80d
mov dword [ebp - 0x2c], 0x3501746a
sub dword [ebp - 0x2c], 0xe8b5303c
mov dword [ebp - 0x28], 0xc86f237c
add dword [ebp - 0x28], 0x3790dc84
lea eax, [ebp - 0x34]
push eax
mov eax, 0xe0104f9a
add eax, 0x2ff17152
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xcda3c623
add dword [ebp - 0x34], 0xa6cea333
mov dword [ebp - 0x30], 0x99b06a75
add dword [ebp - 0x30], 0xa7bbf700
mov dword [ebp - 0x2c], 0xf9fb3eac
sub dword [ebp - 0x2c], 0x968bd240
mov dword [ebp - 0x28], 0xc4598353
sub dword [ebp - 0x28], 0xc4598353
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x498a24c4
add eax, 0xc6779b84
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38859
push 0
call eax
mov ecx, 0x10120401
sub ecx, 0x1011c8e3
xor edi, edi
add edi, eax
mov esi, 0x10029a00
add esi, dword [ebp - 0x24]
mov ebx, 0xad5ce4bf
xor dword [ebp - 8], ebx
mov edx, dword [esi]
sub dword [ebp - 8], 0x786909a
xor edx, ebx
xor dword [ebp - 0x10], 0x3401169a
mov dword [edi], edx
sub dword [ebp - 0x18], 0x581d3509
add edi, 4
add esi, 0x5d0a8823
add esi, 0xa2f577e1
loop 0x1000b258
add eax, 0x5c4afd46
sub eax, 0x5c4a1dfb
xor ebx, ebx
add ebx, eax
add eax, 0xc3825209
add eax, 0x3c7dadfc
mov ecx, 0x1947370d
sub ecx, 0x947370d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4036b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x51d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403748
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403728
xor eax, eax
push ebp
push 0x403721
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403764
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403728
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x51d020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x51d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404430
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x52204c], 0
je 0x404491
cmp word [0x522220], 0xd7b2
jne 0x404459
cmp dword [0x522228], 0
jbe 0x404459
mov eax, 0x52221c
call dword [0x522238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x51d070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4044b8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51d030], 0
jne 0x4044ad
push 0
push 0x51d068
push 0x51d070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4045e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402814
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x52204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4045ac
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc