joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7043ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x704482
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [eax]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
shr ecx, 9
add eax, ecx
cmp eax, 0x100
jae 0x70441a
movsx edx, byte [eax + 0x77a7ec]
mov ecx, 9
sub ecx, edx
shl eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x77a8ec]
shl edx, 8
add eax, edx
add ebx, eax
jmp 0x704482
cmp eax, 0x10000
jae 0x704432
mov edx, eax
shr edx, 8
movsx edx, byte [edx + 0x77a7ec]
add edx, 8
jmp 0x704459
cmp eax, 0x1000000
jae 0x70444a
mov ecx, eax
shr ecx, 0x10
movsx edx, byte [ecx + 0x77a7ec]
add edx, 0x10
jmp 0x704459
mov ecx, eax
shr ecx, 0x18
movsx edx, byte [ecx + 0x77a7ec]
add edx, 0x18
lea ecx, [edx - 9]
shr eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x77a8ec]
mov ecx, edx
shl ecx, 8
add eax, ecx
mov edx, eax
add ebx, eax
test esi, esi
je 0x704482
cmp esi, edx
jg 0x704482
or eax, 0xffffffff
jmp 0x704493
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x7043d9
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x7080e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, ecx
mov eax, ebx
call fcn.00708174
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, 1
xor edx, eax
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
movzx eax, byte [esi]
call fcn.006d2318
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x708104
movzx eax, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x708174
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
test eax, eax
je 0x70819f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x7081e7
mov edi, 1
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.006d2318
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x7081aa
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x708358
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00708650
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00404b50
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006d2318
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x70837d
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00708650
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
movzx eax, byte [edi]
mov edx, dword [ebx + 8]
call fcn.006d2318
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x7083fb
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006d2318
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, 1
xor eax, esi
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
movzx eax, byte [ebp - 9]
call fcn.006d2318
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x708650
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
test eax, eax
je 0x70867b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x7086c3
mov edi, 1
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.006d2318
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.006d2318
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x708686
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x708f8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x28]
cmp ecx, dword [esp]
jge 0x708fa1
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 4], edx
mov esi, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
dec ecx
test ecx, ecx
jl 0x708fdd
inc ecx
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x5c]
mov ebp, dword [esp + 4]
lea ebp, [ebp + edi*4]
mov edi, dword [esi + edx*4]
mov dword [ebp], edi
mov dword [esi + edx*4], eax
inc eax
dec ecx
jne 0x708fb4
mov ecx, dword [esp + 4]
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x709016
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x709030
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x709030
mov eax, ebx
call fcn.007093d0
jmp 0x709030
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x60]
jl 0x709030
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x60]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x709068
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x709068
mov dword [esp + 8], esi
fild dword [esp + 8]
fmul dword [0x709080]
fild qword [ebx + 0x50]
fdivp st(1)
call fcn.00404c0c
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x709077
mov eax, ebx
call fcn.007093d0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x719b38
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x719b89
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x719b70
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x719b60
jmp 0x719b89
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x719b71
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72d014
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040707c
xor eax, eax
push ebp
push 0x72d175
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x72d190
call fcn.00408408
dec eax
jne 0x72d12b
mov eax, dword [ebp - 4]
test eax, eax
je 0x72d063
sub eax, 4
mov eax, dword [eax]
mov edi, eax
mov esi, 0x10
lea eax, [ebp - 8]
push eax
mov ecx, edi
sub ecx, esi
dec ecx
lea edx, [esi + 2]
mov eax, dword [ebp - 4]
call fcn.0040825c
mov eax, dword [ebp - 8]
mov edx, 0x72d1c0
call fcn.00408224
jne 0x72d099
mov eax, ebx
call fcn.0072e954
jmp 0x72d152
mov eax, dword [ebp - 8]
mov edx, 0x72d1e4
call fcn.00408224
jne 0x72d0b4
mov eax, ebx
call fcn.0072e980
jmp 0x72d152
mov eax, dword [ebp - 8]
mov edx, 0x72d200
call fcn.00408224
jne 0x72d0cf
mov eax, ebx
call fcn.0072e830
jmp 0x72d152
mov eax, dword [ebp - 8]
mov edx, 0x72d224
call fcn.00408224
jne 0x72d0f0
cmp dword [ebp - 0xc], 0
je 0x72d152
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0072d298
jmp 0x72d152
mov eax, dword [ebp - 8]
mov edx, 0x72d244
call fcn.00408224
jne 0x72d111
cmp dword [ebp - 0xc], 0
je 0x72d152
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0072d4e8
jmp 0x72d152
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, 0x72d264
call fcn.004080ec
mov eax, dword [ebp - 0x10]
call fcn.004d9a7c
jmp 0x72d152
push 1
push 0x72d288
push 0x72d288
mov eax, dword [ebp - 4]
call fcn.00407e90
push eax
push 0x72d28c
mov eax, ebx
call fcn.0049efd0
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72d17c
lea eax, [ebp - 0x10]
call fcn.00406f98
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ff8
ret
Function at 0x100269ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100060ec]
jne 0x10027054
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1002bda8], eax
mov dword [0x1002bda4], ecx
mov dword [0x1002bda0], edx
mov dword [0x1002bd9c], ebx
mov dword [0x1002bd98], esi
mov dword [0x1002bd94], edi
mov word [0x1002bdc0], ss
mov word [0x1002bdb4], cs
mov word [0x1002bd90], ds
mov word [0x1002bd8c], es
mov word [0x1002bd88], fs
mov word [0x1002bd84], gs
pushfd
pop dword [0x1002bdb8]
mov eax, dword [ebp]
mov dword [0x1002bdac], eax
mov eax, dword [ebp + 4]
mov dword [0x1002bdb0], eax
lea eax, [ebp + 8]
mov dword [0x1002bdbc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1002bcf8], 0x10001
mov eax, dword [0x1002bdb0]
mov dword [0x1002bcac], eax
mov dword [0x1002bca0], 0xc0000409
mov dword [0x1002bca4], 1
mov eax, dword [0x100060ec]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1002baac]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1002bcf0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100060fc
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1002bcf0], 0
jne 0x10027140
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x10026a54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10026a63
pop dword [ebp - 0x28]
mov eax, 0x10026a63
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xbd39299b
add dword [ebp - 0x38], 0x91191bb0
mov dword [ebp - 0x34], 0xb7f7a905
sub dword [ebp - 0x34], 0x85c45cc0
mov dword [ebp - 0x30], 0x929e33c7
add dword [ebp - 0x30], 0xb9ae1067
mov dword [ebp - 0x2c], 0x6e871e42
add dword [ebp - 0x2c], 0x9178e1be
lea eax, [ebp - 0x38]
push eax
mov eax, 0x62562cb0
sub eax, 0x52561b80
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xf60120eb
sub dword [ebp - 0x38], 0x818eb795
mov dword [ebp - 0x34], 0xba3c62ce
add dword [ebp - 0x34], 0x872ffea7
mov dword [ebp - 0x30], 0xcb835a55
add dword [ebp - 0x30], 0x97ec1217
mov dword [ebp - 0x2c], 0xcb5bcca6
sub dword [ebp - 0x2c], 0xcb5bcca6
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x666cbeec
sub eax, 0x566cadd8
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3ee37
push 0
call eax
mov ecx, 0x11a24b9d
sub ecx, 0x11a20234
xor edi, edi
add edi, eax
mov esi, 0x8aee0000
add esi, 0x8514f800
add esi, dword [ebp - 0x28]
mov ebx, 0xbfa7ef2
sub ebx, 0x24ce16da
xor dword [ebp - 0x18], 0x1516c832
mov edx, dword [esi]
add dword [ebp - 0x20], esi
sub edx, ebx
sub dword [ebp - 0xc], 0x1fe2513d
mov dword [edi], edx
sub dword [ebp - 0x14], 0xb1a4357f
add edi, 0xf0123cd6
sub edi, 0xf0123cd2
add esi, 0xe510351f
add esi, 0x1aefcae5
loop 0x10026b82
add eax, 0x11877
mov ebx, eax
add eax, 5
mov ecx, 0xdb0d7d65
sub ecx, 0xcb0d7d65
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x100c54b
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.010080f0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100c5b1
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100e724]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x100c5b5
xor eax, eax
jmp 0x100c5c2
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100caf1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002110
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100cb49
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1001b5b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100cb3c
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100cb4b
xor eax, eax
pop esi
leave
ret 4
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a004]
jne 0x4010f2
repz ret
jmp fcn.00401553

Function at 0x404ebb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403ba9
and dword [ebp - 0x14], 0
cmp dword [0x43cc78], 0
mov dword [ebp - 0x18], eax
jne 0x404f6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405016
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405016
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43cc78], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43cc7c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43cc80], eax
call edi
push eax
call esi
mov dword [0x43cc88], eax
test eax, eax
je 0x404f6e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43cc84], eax
mov eax, dword [0x43cc84]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404fc7
cmp dword [0x43cc88], ecx
je 0x404fc7
push eax
call esi
push dword [0x43cc88]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404fc7
test ebx, ebx
je 0x404fc7
call edi
test eax, eax
je 0x404fbe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404fbe
test byte [ebp - 8], 1
jne 0x404fc7
or dword [ebp + 0x10], 0x200000
jmp 0x404ffa
mov eax, dword [0x43cc7c]
cmp eax, dword [ebp - 0x18]
je 0x404ffa
push eax
call esi
test eax, eax
je 0x404ffa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404ffa
mov eax, dword [0x43cc80]
cmp eax, dword [ebp - 0x18]
je 0x404ffa
push eax
call esi
test eax, eax
je 0x404ffa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43cc78]
call esi
test eax, eax
je 0x405016
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405018
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x42ef10
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x43a004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x43add0]
push ebx
mov ebx, dword [0x2be024c]
push edi
mov edi, dword [0x2be26cc]
call fcn.0042ee90
cmp dword [0x2be26cc], 0x2f
jne 0x42ef7d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0042eec0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x42f1f0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x42f208
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x42f251
mov dword [0x2be2334], 0x8e46a6f0
cmp dword [0x2be26cc], 0x3dc
jne 0x42f24f
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x42f1ff
mov dword [ebp - 0x10], 0
jmp 0x42f263
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x42f2fe
cmp dword [0x2be26cc], 0xa5f
jne 0x42f284
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x10], 0x84620b
jne 0x42f2a9
mov eax, dword [0x43bbf0]
mov dword [0x2be26cc], eax
mov ecx, dword [0x2be26cc]
add ecx, 0xa231
mov dword [0x2be26cc], ecx
cmp dword [0x2be26cc], 0x141
jne 0x42f2f9
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x43d1b8], 0xec58acac
mov dword [0x43d1bc], 0xffffffff
jmp 0x42f25a
call fcn.0042efa0
jmp dword [0x2be024c]
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4203d6
pop dword [ebp - 0x28]
mov eax, 0x4203d6
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xb370f50a
add dword [ebp - 0x38], 0x9ae15041
mov dword [ebp - 0x34], 0xd8685e62
add dword [ebp - 0x34], 0x59caede3
mov dword [ebp - 0x30], 0x913c9a20
sub dword [ebp - 0x30], 0x44f055f2
mov dword [ebp - 0x2c], 0x1178802
sub dword [ebp - 0x2c], 0x1178802
lea eax, [ebp - 0x38]
push eax
mov eax, 0x9ae32abe
sub eax, 0x9aa0fa4a
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6d1d3953
sub dword [ebp - 0x38], 0xf8aacffd
mov dword [ebp - 0x34], 0x66d5f1b4
sub dword [ebp - 0x34], 0x2569903f
mov dword [ebp - 0x30], 0x895b81b
add dword [ebp - 0x30], 0x5ad9b451
mov dword [ebp - 0x2c], 0x6b507a83
sub dword [ebp - 0x2c], 0x6b507a83
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3f892
push 0
call eax
mov ecx, 0x7383fd28
sub ecx, 0x7383aecd
xor esi, esi
add esi, eax
mov edx, 0x434400
add edx, dword [ebp - 0x28]
mov edi, 0xa2728c0c
sub edi, 0x46513b7a
sub dword [ebp - 0x14], 0xb283b8ca
mov ebx, dword [edx]
add dword [ebp - 4], esi
add ebx, edi
sub dword [ebp - 0x20], 0xffbb0dd5
mov dword [esi], ebx
xor dword [ebp - 8], 0x9bcef4e8
add esi, 0x5ebf66bb
sub esi, 0x5ebf66b7
add edx, 0x27c9ea67
add edx, 0xd836159d
loop 0x4204ea
add eax, 0x1baf6f76
add eax, 0xe451bcc9
mov ebx, eax
add eax, 0x3a190b34
sub eax, 0x3a190b2f
mov ecx, 0xac5e25a2
sub ecx, 0xac1e25a2
add ecx, dword [ebp - 0x28]
call ebx
leave
ret