joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x597e4432
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0x50a95b1d
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x2f49386c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x61647b33
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x46337b
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
push esi
push edi
push eax
push 0x101
mov edi, edx
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x46343e
push 0x100
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x46343e
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp dword [edx], ecx
je 0x4633db
mov eax, edx
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x4633d2
cmp esi, ecx
jle 0x4633ee
push 0x4b5544
push edi
call fcn.00421d2c
pop ecx
pop ecx
jmp 0x463436
push 4
push dword [edx + esi*4 - 4]
lea eax, [ebp - 4]
push eax
call fcn.0041fdb0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004232b0
or edx, 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.004641c6
mov esi, eax
push esi
push edi
call fcn.00421d2c
push esi
call fcn.0041fda4
add esp, 0x14
call dword [sym.imp.WSOCK32.dll_WSACleanup]
jmp 0x46344b
push 0x48e91c
push edi
call fcn.00421d2c
pop ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46368b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4636e4
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, 1
pop ebx
sete al
mov esp, ebp
pop ebp
ret

Function at 0x46375b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46376e
test al, 0x10
je 0x46376e
mov al, 1
ret
xor al, al
ret
Function at 0x401a90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401bdd
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401b24
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401bd6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401b10
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401c1a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401bfa
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401bcf
sub eax, 0x40
and eax, 0xffffffbf
je 0x401bcf
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401be4
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x4020e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402135
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40212e
test esi, esi
je 0x40212e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402110
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402350
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402388
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40237e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40238a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402370
xor eax, eax
pop ebx
pop esi
ret
Function at 0x416bf3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f9de
and dword [ebp - 0x14], 0
cmp dword [0x4b7b74], 0
mov dword [ebp - 0x18], eax
jne 0x416ca6
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416d4e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x416d4e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x4b7b74], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x4b7b78], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x4b7b7c], eax
call edi
push eax
call esi
mov dword [0x4b7b84], eax
test eax, eax
je 0x416ca6
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x4b7b80], eax
mov eax, dword [0x4b7b80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416cff
cmp dword [0x4b7b84], ecx
je 0x416cff
push eax
call esi
push dword [0x4b7b84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416cff
test ebx, ebx
je 0x416cff
call edi
test eax, eax
je 0x416cf6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416cf6
test byte [ebp - 8], 1
jne 0x416cff
or dword [ebp + 0x10], 0x200000
jmp 0x416d32
mov eax, dword [0x4b7b78]
cmp eax, dword [ebp - 0x18]
je 0x416d32
push eax
call esi
test eax, eax
je 0x416d32
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d32
mov eax, dword [0x4b7b7c]
cmp eax, dword [ebp - 0x18]
je 0x416d32
push eax
call esi
test eax, eax
je 0x416d32
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b7b74]
call esi
test eax, eax
je 0x416d4e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416d50
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b55e
leave
ret
Function at 0x402211
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ecx + 0x18]
mov edi, dword [ecx + 0x14]
movzx ecx, word [ecx + 0x1e]
cdq
mov esi, eax
shr ecx, 3
xor esi, edx
mov dword [ebp - 4], edi
sub esi, edx
test esi, esi
jle 0x4022ac
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
imul ebx, edi
inc edx
mov dword [ebp - 8], ebx
test edi, edi
jle 0x4022a6
mov ebx, edx
mov dword [ebp + 8], edi
movzx eax, byte [ebx]
movd xmm1, eax
movzx eax, byte [ebx + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mulsd xmm1, qword [0x41e610]
movzx eax, byte [ebx - 1]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x41e600]
addsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x41e5f8]
addsd xmm1, xmm0
cvttsd2si eax, xmm1
mov byte [ebx + 1], al
mov byte [ebx], al
mov byte [ebx - 1], al
add ebx, ecx
dec edi
jne 0x40224c
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
add edx, ebx
dec esi
jne 0x402243
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40269c
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x41d00c
call fcn.004078b8
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x402799
cmp byte [ebx + 0x45], 0
je 0x402799
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4026d3
xor al, al
jmp 0x40279b
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00403988
and dword [ebp - 4], 0
push esi
push edi
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x10]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40272f
dec eax
je 0x402733
dec eax
dec eax
je 0x402785
xor bl, bl
jmp 0x402787
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, edx
sub esi, eax
je 0x40276b
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00407259
add esp, 0x10
cmp esi, eax
jne 0x40272b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x45], 0
je 0x402785
test esi, esi
jne 0x4026f9
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004037cc
jmp 0x4026f3
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403688
pop edi
mov al, bl
pop esi
jmp 0x40279b
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4054ca
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x2faf080
xor edi, edi
call fcn.00405744
mov esi, eax
pop ecx
test esi, esi
je 0x40557f
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [esi + 0x2faf080]
push eax
push esi
call fcn.00401328
mov ecx, edi
mov ebx, 0x1ea7
mov al, byte [ecx + section..data]
ror al, 3
xor al, byte [edi + str.ovteaylkdjqrd]
mov byte [ecx + section..data], al
lea eax, [edi + 1]
push 0xd
pop edi
cdq
idiv edi
inc ecx
mov edi, edx
cmp ecx, ebx
jb 0x405505
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, section..data
call eax
push esi
call fcn.00407827
pop ecx
lea eax, [ebp - 0x40]
push eax
push str.ddser.bmp
call fcn.004022b4
mov esi, eax
test esi, esi
je 0x40557f
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.00402211
push esi
lea eax, [ebp - 0x40]
push eax
push str.rtertert.bmp
call fcn.0040243e
push esi
call fcn.00407827
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417e6f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a600]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a642
mov dword [ebp - 0x14], eax
cmp dword [0x42cbdc], esi
jne 0x417f62
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x417eef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x418042
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x418042
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418042
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42cbdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42cbe0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42cbe4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42cbec], eax
test eax, eax
je 0x417f5f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42cbe8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x417f87
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x417f7a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417f9c
push 4
pop eax
jmp 0x418044
cmp dword [ebp - 0x14], esi
je 0x417f9c
push dword [0x42cbdc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x417f81
mov eax, dword [0x42cbe8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x417ffa
cmp dword [0x42cbec], edi
je 0x417ffa
push eax
call ebx
push dword [0x42cbec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x417ffa
test eax, eax
je 0x417ffa
call ecx
test eax, eax
je 0x417fef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417fef
test byte [ebp - 8], 1
jne 0x417ffa
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41802a
mov eax, dword [0x42cbe0]
cmp eax, edi
je 0x418027
push eax
call ebx
test eax, eax
je 0x418027
call eax
mov esi, eax
test esi, esi
je 0x418027
mov eax, dword [0x42cbe4]
cmp eax, edi
je 0x418027
push eax
call ebx
test eax, eax
je 0x418027
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42cbdc]
call ebx
test eax, eax
je 0x418042
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x418044
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004095db
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x48f05320
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1a895ee4
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x405561
Capabilities:
Encode data using xor

Disassembly:
les eax, [eax*4 - 0x74a62a40]
dec ebp
lea ebx, [ebp + 0x18]
invalid

Function at 0x405ea5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
outsd dx, dword [esi]
call 0x405ea5
test eax, eax
jne 0x405e30
inc esp
add al, 0xdc
or byte [ecx], al
adc al, 0xf
mov esi, gs
add byte [eax], al
ret 0x3ea1
ror byte [0x85788b00], 0xf6
je 0x405da4
mov eax, dword [0x416058]
test eax, eax
jne 0x405d89
push eax
push str.CommandLineToArgvW
xor eax, 0x4bc7e880
add byte [eax], al
add esp, 0xc
mov dword [0xeb410324], eax
test dword [edi + 0xf], ecx
test byte [edi - 0x73000000], ch
dec ebp
cld
lea ecx, [ebp - 4]
xchg esp, eax
retf
mov ecx, dword [ebp + 0x4c]
and edx, 0x59
push esi
mov dword [ecx], eax
invalid
jne 0x405e90
mov esp, ebp
push ss
ret 0xed
adc eax, sym.imp.KERNEL32.dll_SetLastError
jmp 0x405d5a
inc eax
add byte [ebx + 0x10458bf8], cl
lea eax, [ebp - 0x76a9fec0]
popfd
mov edi, 0xc15c15ff
sbb eax, dword [eax]
or dword [ebx - 0x3a6724b], 0xffffff89
jecxz 0x405e3b
push ebp
adc byte [ecx + 0x50], dl
mov edx, dword [0xe83f520c]
xor al, 0x4d
add byte [eax], al
mov edx, dword [ebp - 4]
mov eax, dword [edi]
sub esi, edx
rcl dword [eax - 1]
xchg edx, eax
and byte [eax + eax*2 - 0x4dfe4700], dl
add byte [eax], al
add esp, 8
cmp ebx, ecx
je 0x405ede
jle 0x405f02
lea ecx, [ebx - 1]
invalid
add al, 0x89
dec ebp
or al, 0x41
mov ebx, dword [esi - 4]
add edx, 2
xor byte [eax], dl
mov bl, 0x30
mov dl, byte [esi]
mov es, word [edi + 0x759da8d2]
cmc
mov edx, dword [edi + 0xc]
adc dword [eax + 4], 0x4a
mov dword [ebp + 0x30], edx
jne 0x405ee3
daa
inc ebp
or bh, al
add al, 0x8f
add byte [eax], al
fiadd word [eax]
mov dword [eax], edi
pop edi
mov eax, ebx
pop esi
xchg ecx, eax
mov ecx, dword [edx]
pop ebp
push ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x684103b2]
mov ecx, eax
inc eax
test ecx, ecx
mov esi, 0x410388
je 0x405ed3
xor ecx, eax
mov ebp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2a7716e2
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x309041ef
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219