joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088bf
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0xc]
mov dword [0x461080], 0x55004e
mov dword [0x461084], 0x4c
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test ebx, ebx
jne 0x408918
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x460880
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x408b0a
cmp eax, 0x400
jle 0x408969
jmp 0x408b0a
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00407eb9
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x461080
mov dword [esp], ebx
call esi
sub esp, 0xc
test eax, eax
je 0x408b0a
cmp eax, 0x400
jle 0x4088e9
jmp 0x408b0a
mov dword [esp + 0xc], 0x460880
mov dword [esp + 8], 0x461080
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x460480
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x469d60]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x460880
mov dword [esp + 4], eax
call fcn.0040857c
push esi
push esi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x460880
call fcn.00407eb9
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
je 0x408b0a
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, esi
mov dword [esp], 0x40
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
push ebx
push ebx
mov ebx, eax
je 0x408b00
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00407f86
sub esp, 0xc
test eax, eax
je 0x408b00
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], ebx
call fcn.00407d8c
test eax, eax
push edx
push edx
jne 0x408a63
lea eax, [ebx + esi]
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esi + 0xa]
push eax
push eax
mov esi, edx
jmp 0x408aa0
add eax, 0xa
mov dword [esp + 4], 0x40c6d3
mov dword [esp], eax
call fcn.00407d8c
test eax, eax
push ecx
mov dword [ebp - 0x20], eax
push ecx
mov edx, esi
je 0x408aa0
mov ecx, dword [ebp - 0x24]
lea edx, [ebx + esi]
add ecx, ebx
cmp dword [ebp - 0x20], edx
jae 0x408a98
dec edx
mov al, byte [edx + 1]
dec ecx
mov byte [ecx + 1], al
jmp 0x408a89
mov eax, dword [ebp - 0x20]
sub eax, ebx
lea edx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add edx, ebx
mov dword [esp + 4], 0x460480
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.00407dfb
add esi, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00407fcc
sub esp, 0xc
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408b8f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x461880
mov dword [esp + 4], eax
call fcn.004083c8
push ebx
push ebx
mov dword [esp], 0x461880
call fcn.00407cf8
test eax, eax
push esi
jne 0x408bc4
xor eax, eax
jmp 0x408c48
mov dword [esp], eax
mov ebx, eax
call fcn.00408499
test byte [0x469dc4], 0x80
push ecx
jne 0x408be8
sub ebx, 0x461880
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar ebx, 1
jmp 0x408c0f
mov ax, word [ebx]
test ax, ax
je 0x408bbd
cmp ax, 0x5c
jne 0x408bd8
jmp 0x408bbd
call fcn.00408b57
test eax, eax
push edx
jne 0x408c26
mov dword [esp], 0x461880
call fcn.00407c7f
push eax
mov dword [esp], 0x461880
call esi
push ecx
cmp ebx, eax
mov dword [esp], 0x461880
jl 0x408bf8
jmp 0x408c2d
test byte [eax], 0x10
jne 0x408c02
jmp 0x408bbd
call fcn.00408404
push eax
mov dword [esp], 0x461880
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x408ee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408f1e
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408f25
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4090d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698e4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4090f1
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x40911f
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4090fa
mov dword [ecx*4 + 0x4698e0], eax
inc ecx
cmp ecx, 0x100
jne 0x4090f3
jmp 0x4090e5
cmp edx, ebx
je 0x409138
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4698e0]
jmp 0x40911f
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x40a81f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x40a846
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40a849
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040a7fb
pop esi
leave
ret 8

Function at 0x40bd05
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40bd44
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bd44
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bd44
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40bd44
cmp dword [ecx + 0x74], 0xe
jbe 0x40bd44
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41103e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x411089
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004111d9
test al, al
jne 0x411083
sub edx, 2
cmp edx, edi
jne 0x411069
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4110ab
lea eax, [edi + 2]
cmp edx, eax
je 0x4110ab
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00410f8a
add esp, 0x10
jmp 0x4111a5
push esi
lea ecx, [ebp - 0x255]
call fcn.004111d9
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4110ee
push dword [ebp - 0x25c]
jmp 0x41109b
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41112b
cmp word [ebp - 0x226], 0
je 0x41114c
cmp word [ebp - 0x226], ax
jne 0x41112b
cmp word [ebp - 0x224], 0
je 0x41114c
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00410f8a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x411198
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x411105
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x411180
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4111a5
push 0x410dba
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00413d10
add esp, 0x10
jmp 0x411175
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b448
leave
ret
Function at 0x411ce1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x411cf2
pop esi
ret
push ebx
push edi
push esi
call fcn.00411caa
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00410b02
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x411d1a
push ebx
push esi
push edi
call fcn.0040c7f0
add esp, 0xc
push 0
call fcn.00410328
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4120ea
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411d2f

Function at 0x41301b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bf5c
push 0x41bf54
push str.FlsAlloc
push 0x1f
call fcn.00412ef9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41304f
push dword [ebp + 8]
mov ecx, esi
call dword [0x419154]
call esi
jmp 0x413055
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x413099
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bf6c
push 0x41bf64
push str.FlsGetValue
push 0x21
call fcn.00412ef9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4130d0
push dword [ebp + 8]
mov ecx, esi
call dword [0x419154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4130d8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bf74
push 0x41bf6c
push str.FlsSetValue
push 0x22
call fcn.00412ef9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x413112
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x419154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x417970
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41799d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41799d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0xf0e6cf0
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x6c0a67d5
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x3fce7302
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x34492602
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423004]
jne 0x401010
repz ret
jmp fcn.00401788

Function at 0x405655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030b9
and dword [ebp - 4], 0
cmp dword [0x424db0], 0
mov ebx, eax
jne 0x405706
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057b7
push eax
call fcn.00403047
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x424db0], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x424db4], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x424db8], eax
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x424dc0], eax
test eax, eax
je 0x405706
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x424dbc], eax
mov eax, dword [0x424dbc]
cmp eax, ebx
je 0x40575e
cmp dword [0x424dc0], ebx
je 0x40575e
push eax
call fcn.004030c2
push dword [0x424dc0]
mov esi, eax
call fcn.004030c2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40575e
test edi, edi
je 0x40575e
call esi
test eax, eax
je 0x405755
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405755
test byte [ebp - 0xc], 1
jne 0x40575e
or dword [ebp + 0x10], 0x200000
jmp 0x405797
mov eax, dword [0x424db4]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405797
mov eax, dword [0x424db8]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424db0]
call fcn.004030c2
pop ecx
test eax, eax
je 0x4057b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4208ae
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x432d24]
push dword [0x432a40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42093d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp ebx, 0x19f
jne 0x420952
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x42098e
push esi
and dword [ebp - 8], 0
lea esi, [ebp - 8]
mov dword [ebp - 4], 5
call fcn.00420932
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0xa
sub dword [ebp - 4], 0x3c
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x42095a
pop esi
pop edi
cmp ebx, 0x2d
jne 0x4209a5
or dword [0x432d34], 0xffffffff
mov dword [0x432d30], 0xa62e7790
leave
ret
Function at 0x4070ed
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40ba68], ebx
push esi
push edi
jne 0x40716d
push 0x409f50
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4071a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x409f44
push edi
call esi
test eax, eax
mov dword [0x40ba68], eax
je 0x4071a8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40ba6c], eax
call esi
cmp dword [0x40b900], 2
mov dword [0x40ba70], eax
jne 0x40716d
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40ba78], eax
je 0x40716d
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40ba74], eax
mov eax, dword [0x40ba74]
test eax, eax
je 0x4071b2
call eax
test eax, eax
je 0x407199
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40ba78]
test eax, eax
je 0x407199
test byte [ebp - 8], 1
jne 0x4071b2
cmp dword [0x40b90c], 4
jb 0x4071ac
or byte [ebp + 0x12], 0x20
jmp 0x4071d1
xor eax, eax
jmp 0x4071e1
or byte [ebp + 0x12], 4
jmp 0x4071d1
mov eax, dword [0x40ba6c]
test eax, eax
je 0x4071d1
call eax
mov ebx, eax
test ebx, ebx
je 0x4071d1
mov eax, dword [0x40ba70]
test eax, eax
je 0x4071d1
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40ba68]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008e70
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37c8
call fcn.1007f5e0
mov eax, dword [0x100b500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ecx]
lea eax, [ebp - 0x108]
xor esi, esi
push str..PhysicalDrive_d
push eax
call fcn.10009740
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009093
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37bc], esi
push esi
push eax
mov dword [ebp - 0x37c0], esi
mov dword [ebp - 0x37c8], esi
mov dword [ebp - 0x37c4], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push esi
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c8]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10009086
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0x8d8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10008ce0
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0xcc0]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10008ce0
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10008ce0
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.10008ce0
add esp, 0x20
cmp byte [0x100b7ea8], 0
jne 0x10009049
movsx eax, byte [ebp - 0x4f0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
jne 0x10008fc2
movsx eax, byte [ebp - 0x4dd]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x10009049
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x8d8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100b7aa7], al
test al, al
jne 0x10008fd0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xcc0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100b72a7], al
test al, al
jne 0x10008ff0
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x4f0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100b7ea7], al
test al, al
jne 0x10009010
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x10a8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100b76a7], al
test al, al
jne 0x10009030
mov esi, 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1000908c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1007e249
mov esp, ebp
pop ebp
ret
Function at 0x1000a260
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x100b500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000a2e1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x1000a2b0
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007e249
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x100b500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000a347
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x1000a324
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007e249
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1007e249
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f68d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x100b500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x100b68ac], 0x10
mov eax, 0x100b6898
cmovae eax, dword [0x100b6898]
cmp byte [eax], 0
je 0x1000a47a
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x1000a47a
cmp dword [0x100b6508], 0x10
mov eax, 0x100b64f4
cmovae eax, dword [0x100b64f4]
cmp byte [eax], 0
je 0x1000a47a
mov esi, 0x100bc4a8
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x1000a3d6
mov edx, 0x100b8470
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1000a3f0
mov ecx, dword [0x100bcd6c]
mov edx, 0x100b6898
cmp dword [0x100b68ac], 0x10
push 0x100bc4a8
cmovae edx, dword [0x100b6898]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x1000a47a
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x100a3c4c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x1000a44d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x1000a430
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x100c0a20]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x100c0a20]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4