joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4607b7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x482c33
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x48a990
mov dword [esp + 0x20], 1
call fcn.0045ff57
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
lea esi, [edi + 0x2c]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x34], 0
call fcn.00465ad7
mov eax, dword [esi + 4]
push eax
call 0x4da985
add esp, 4
mov ecx, edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esp + 0x20], 0xffffffff
call 0x4c69a7
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4613f7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x482f32
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x48a9f4
mov dword [esp + 0x20], 2
call 0x4c7307
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
lea esi, [edi + 0x2c]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x34], 1
call fcn.00465ad7
mov eax, dword [esi + 4]
push eax
call 0x4da985
xor ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov eax, dword [edi + 0x28]
add esp, 4
cmp eax, ecx
je 0x461476
push eax
call fcn.0046fc3a
add esp, 4
lea ecx, [edi + 0xc]
mov dword [esp + 0x20], 0xffffffff
call dword [fcn.0048a314]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4625d7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x483539
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
push 0x497e64
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00462577
add esp, 0xc
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push edx
mov dword [esp + 0x30], 0
call fcn.00493987
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call dword [fcn.0048a314]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
Function at 0x47bcc0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4da620]
push esi
test eax, eax
push edi
jne 0x47bd5f
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push 0x8001
mov dword [0x4da620], 1
call edi
push str.imm32.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call edi
test esi, esi
pop ebx
je 0x47bd5f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmGetContext
push esi
call edi
test eax, eax
mov dword [0x4da624], eax
je 0x47bd5f
push str.ImmReleaseContext
push esi
call edi
test eax, eax
mov dword [0x4da628], eax
je 0x47bd5f
push str.ImmSetCompositionWindow
push esi
call edi
test eax, eax
mov dword [0x4da62c], eax
je 0x47bd5f
push str.ImmSetCompositionFontA
push esi
call edi
test eax, eax
mov dword [0x4da630], eax
je 0x47bd5f
push str.ImmGetCompositionStringW
push esi
call edi
mov dword [0x4da634], eax
mov dword [0x4da620], 2
pop edi
pop esi
ret

Function at 0x47da90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret

Function at 0x47db10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47db2e
shr eax, 4
and al, 1
pop ebx
add esp, 0xc
ret
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], eax
mov edi, ecx
mov dword [esp + 0x10], eax
test edi, edi
mov dword [esp + 0x14], eax
jle 0x47db7b
cmp byte [esi + ebx], 0x5c
jne 0x47db67
test esi, esi
je 0x47db67
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov cl, byte [esi + ebx]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041ba00
inc esi
cmp esi, edi
jl 0x47db50
test edi, edi
je 0x47db8d
cmp byte [edi + ebx - 1], 0x5c
je 0x47db8d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [esp + 0xc]
mov ebx, eax
shr ebx, 4
push edx
mov ecx, 0x4da3e8
and bl, 1
call fcn.0041e810
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x47dc40
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret

Function at 0x47dc70
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret
Function at 0x47dca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x47dd0e
lea ecx, [esp + 0x104]
lea edx, [esp]
push ecx
push 0
push 0x4d27d8
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x47dd0e
push esi
push edi
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x208
ret
xor al, al
add esp, 0x208
ret

Function at 0x47ddc0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0
lea ecx, [esp + 0xc]
push eax
push ecx
xor bl, bl
call fcn.0047dbc0
add esp, 0xc
test al, al
je 0x47ddfd
mov edx, dword [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edx
mov bl, 1
mov dword [ecx], eax
call fcn.0047dda0
add esp, 4
mov al, bl
pop ebx
ret

Function at 0x47de10
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x20], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x47de90
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push esi
push str.AppData
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x47de85
mov ecx, dword [esp + 0x414]
lea edx, [esp + 0x10]
push edx
call fcn.0041bc40
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x40c
ret

Function at 0x47f960
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa4]
push edi
mov ecx, 0x227
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.0040ac60
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x10]
lea ebp, [esi + 0x88c]
rep stosd dword es:[edi], eax
lea ebx, [esi + 0x890]
lea eax, [esp + 0x10]
push eax
mov dword [ebp], 0
mov dword [ebx], 0
mov byte [esi + 0x888], 0
mov byte [esi + 0x894], 0
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 5
ja 0x47fa18
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x47fa18
push ebp
push 0x4cbbc0
push 3
push 0
push 0x4cbbb0
mov byte [esi + 0x894], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebp, dword [ebp]
test ebp, ebp
je 0x47fa18
mov ecx, dword [ebp]
push ebx
push 0x4d28c0
push ebp
call dword [ecx]
cmp dword [ebx], 0
je 0x47fa18
mov byte [esi + 0x888], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x47fa90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x118
lea eax, [esp]
push ebx
mov ebx, ecx
push 0x105
push eax
mov dword [0x4da6fc], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x47faf3
push ebp
push esi
push edi
mov edi, 0x4d28d0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.0040b4a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x480110
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 2
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
test ebx, ebx
jl 0x4801ab
cmp ebx, 0xff
jg 0x4801ab
cmp ebx, 0x7f
jle 0x48013f
mov al, bl
pop esi
pop ebx
ret 4
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
mov al, byte [esi + 9]
je 0x480178
test al, al
je 0x4801a4
push ebx
call fcn.0041c590
add esp, 4
test al, al
je 0x48017c
and ebx, 0xff
xor ecx, ecx
pop esi
mov cl, byte [ebx + 0x4c2368]
mov edx, ecx
xor ebx, edx
mov al, bl
pop ebx
ret 4
test al, al
je 0x480192
push ebx
mov ecx, esi
call fcn.0047ffe0
and eax, 0xff
pop esi
mov ebx, eax
mov al, bl
pop ebx
ret 4
and ebx, 0xff
xor eax, eax
mov al, byte [ebx + 0x4c2368]
mov ecx, eax
xor ebx, ecx
mov al, bl
pop esi
pop ebx
ret 4
mov al, byte [esp + 0xc]
pop esi
pop ebx
ret 4

Function at 0x483070
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [ecx + 0x11c4]
xor bl, bl
call dword [sym.imp.USER32.dll_GetFocus]
cmp esi, eax
jne 0x48309a
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
pop esi
pop ebx
setl al
ret 4
mov al, bl
pop esi
pop ebx
ret 4

Function at 0x483180
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4daf74]
sub esp, 0x190
cmp eax, 1
push esi
jne 0x483199
pop esi
add esp, 0x190
ret
cmp eax, 2
je 0x4832e8
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4832de
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
push esi
call edi
push str.WSAStartup
push esi
mov dword [0x4daf30], eax
call edi
push str.listen
push esi
mov dword [0x4daf34], eax
call edi
push str.closesocket
push esi
mov dword [0x4daf38], eax
call edi
push str.bind
push esi
mov dword [0x4daf3c], eax
call edi
push str.htons
push esi
mov dword [0x4daf40], eax
call edi
push str.htonl
push esi
mov dword [0x4daf44], eax
call edi
push str.socket
push esi
mov dword [0x4daf48], eax
call edi
push str.WSAAsyncSelect
push esi
mov dword [0x4daf4c], eax
call edi
push str.accept
push esi
mov dword [0x4daf50], eax
call edi
push str.WSAGetLastError
push esi
mov dword [0x4daf54], eax
call edi
push str.WSAAsyncGetHostByName
push esi
mov dword [0x4daf58], eax
call edi
push str.inet_addr
push esi
mov dword [0x4daf5c], eax
call edi
push str.connect
push esi
mov dword [0x4daf60], eax
call edi
push str.send
push esi
mov dword [0x4daf64], eax
call edi
push str.recv
push esi
mov dword [0x4daf68], eax
call edi
push str.WSACancelAsyncRequest
push esi
mov dword [0x4daf6c], eax
call edi
mov dword [0x4daf70], eax
lea eax, [esp + 8]
push eax
push 0x101
call dword [0x4daf34]
test eax, eax
pop edi
jne 0x4832de
mov ax, word [esp + 4]
cmp al, 1
jne 0x4832d8
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x4832d8
mov dword [0x4daf74], 1
mov eax, 1
pop esi
add esp, 0x190
ret
call dword [0x4daf30]
mov dword [0x4daf74], 2
xor eax, eax
pop esi
add esp, 0x190
ret
Function at 0x4c0a60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x4c0aab
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.004bb900
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x4cb274]
xor ebx, edx
dec edi
jne 0x4c0a86
pop edi
test ebp, ebp
jle 0x4c0ad7
push 1
mov ecx, esi
call fcn.004bb900
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x4c0ad4
xor ebx, 0x8005
dec ebp
jne 0x4c0aaf
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
test eax, eax
setne cl
pop ebx
dec ebp
cld
mov ecx, dword [ecx + 0xc]
cmp ecx, 0x40
push ecx
jg 0x4090b7
shld dword [edi], eax, 2
add byte [eax], al
dec ecx
cmp ecx, 0xf
ja 0x409185
xor edx, edx
mov ch, dl
adc byte [edx], dl
inc eax
adc bh, bh
and al, 0x95
clc
nop
inc eax
xchg esp, eax
mov esi, dword [ebp + 8]
xor esi, esp
mov ecx, dword [esi + 0x38]
and ecx, 2
xor dl, 2
adc edx, dword [edx + eax*8 + 0x2f8fe4f0]
das
mov ecx, dword [esi + 0x63]
lea esp, [eax + 0x50046afc]
mov cs, word [eax]
push 0x34ff11
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
sbb dword [edx], 0xffffffff
je 0x409065
mov eax, dword [ebp + 0x10]
test eax, eax
mov eax, dword [esi + 0x38]
je 0x408e61
or al, 2
mov dword [esi + 0x38], eax
dec esi
rcr byte [esi + 0x58], 0x18
pop ebp
push cs
or al, 0
and al, 0xfd
mov dword [esi + 0x42], eax
jle 0x408e01
in eax, dx
fisttp word [ecx + 0xcc2a5]
mov ebp, dword [esi]
or byte [ebx], dh
leave
mov edx, dword [esi + 0x42]
and edx, 4
dec edx
cli
add al, 0x76
xchg esp, eax
sar dword [ebx], 0xc1
je 0x408e31
mov eax, dword [esi + 4]
lea ecx, [ecx - 4]
dec ecx
cld
push 4
push edx
push 1
push 0xff0c
xor cl, byte [edx]
pop ds
mov eax, 0x830040c1
js 0x408e76
dec dword [edi]
test al, ch
or al, byte [eax]
add byte [ebx - 0x3f7aefbb], cl
je 0x409965
mov eax, dword [ebp + 0x10]
test eax, eax
xchg edx, eax
inc esi
cmp byte [esi + ecx + 0xc], dh
add al, 0x89
inc esi
cmp byte [ebx], dh
rcr byte [esi - 0x75], 0xe5
pop ebp
ret 0xc
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dh, 0xd6
test eax, eax
clc
pop es
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [eax - 0x4a]
sbb al, 2
adc byte [eax], cl
add byte [eax - 1], ch
inc dword [eax]
add byte [ecx - 1], dl
adc eax, sym.imp.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x3fd831
jmp 0x409065
cdq
test esi, 0x2001c641
inc ecx
add al, 0x30
add dl, 0x30
mov byte [ecx], al
rol byte [ebp - 0x20], 1
inc ecx
mov byte [ecx], dl
invalid
push cs
mov ecx, dword [ebp + 0xc]
mov ebx, 6
invalid
Function at 0x4013b2
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x34], edi
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a318]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41a31c]
mov dword [ebp - 0x2c], eax
call fcn.004013ab
mov esi, dword [ebp - 0x10]
mov ecx, dword [0x41a320]
add esi, 0x23f
mov eax, dword [0x41a324]
push 0x20
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
pop edi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 0x14]
mov eax, edx
shl eax, 4
add eax, ecx
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x859688], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x859684]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x859688], 0x3eb
mov dword [0x859684], eax
mov eax, dword [0x859110]
cmove eax, dword [ebp - 0x1c]
mov dword [0x859110], eax
lea eax, [esi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [0x859680], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
cmp dword [0x859688], 0xb03
mov dword [ebp - 4], eax
jne 0x4014df
push str.Poh_pabatosipixalilasexamupopajohija_xopitotazucepewifodufalejilemi_karemabuzaniyuzavegusaribufate
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
add esi, 0x61c88647
mov dword [ebp - 0x10], esi
dec edi
jne 0x401404
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d337
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407aeb
mov dword [ebp - 0x14], eax
cmp dword [0x813e1c], esi
jne 0x40d42a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d50a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d50a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d50a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813e1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813e20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813e24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813e2c], eax
test eax, eax
je 0x40d427
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813e28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d44f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d442
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d464
push 4
pop eax
jmp 0x40d50c
cmp dword [ebp - 0x14], esi
je 0x40d464
push dword [0x813e1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d449
mov eax, dword [0x813e28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4c2
cmp dword [0x813e2c], edi
je 0x40d4c2
push eax
call ebx
push dword [0x813e2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4c2
test eax, eax
je 0x40d4c2
call ecx
test eax, eax
je 0x40d4b7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4b7
test byte [ebp - 8], 1
jne 0x40d4c2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4f2
mov eax, dword [0x813e20]
cmp eax, edi
je 0x40d4ef
push eax
call ebx
test eax, eax
je 0x40d4ef
call eax
mov esi, eax
test esi, esi
je 0x40d4ef
mov eax, dword [0x813e24]
cmp eax, edi
je 0x40d4ef
push eax
call ebx
test eax, eax
je 0x40d4ef
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813e1c]
call ebx
test eax, eax
je 0x40d50a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d50c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404010
mov esp, ebp
pop ebp
ret
Function at 0x401393
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x30], 0x9e3779b9
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 0x34], esi
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a308]
mov dword [ebp - 0x24], eax
mov eax, dword [str.:4Yb]
mov dword [ebp - 0x2c], eax
call fcn.0040138c
mov eax, dword [0x41a314]
add dword [ebp - 8], 0x23f
mov esi, dword [0x41a310]
push 0x20
mov dword [ebp - 0x20], eax
pop ebx
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, dword [ebp - 0x14]
shl eax, 4
add eax, esi
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x48e068], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x48e064]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x48e068], 0x3eb
mov dword [0x48e064], eax
mov eax, dword [0x48daf0]
cmove eax, dword [ebp - 0x1c]
mov dword [0x48daf0], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub edi, eax
mov dword [ebp - 0xc], eax
mov eax, edi
mov dword [0x48e060], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, edi
shr eax, cl
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
cmp dword [0x48e068], 0xb03
mov dword [ebp - 4], eax
jne 0x4014c0
push str.Poh_petopanoz_fonoso_culowisuvekocamoc
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec ebx
jne 0x4013e4
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret