joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401340
Capabilities:
Encode data using xor

Disassembly:
call 0x69fcf460
sti
ret
clc
lea eax, [esi + edi*8 - 0x33]
invalid
mov al, 0x2f
fldenv [esi]
invalid
rcr dword [esi + 0x67], 1
sub al, 0x2c
mov byte [edx + ebx*2 + 0x5c], 0xee
pop esp
or al, 0xbc
mov esp, 0x6b00f7f7
arpl word [ebx + 0x6b7110c5], ax
fisttp qword [eax]
jbe 0x401317
stosd dword es:[edi], eax
clc
add dl, ah
imul eax, ecx, 0x4b
push es
fdiv qword [ecx]
cmpsb byte [esi], byte es:[edi]
salc
add eax, 0x3ac17c37
das
xor dword [esi + 0x37c081d6], esp
jl 0x40132e
cmp ch, byte [edi]
lahf
leave
xlatb
jb 0x401365
in eax, 0x96
add bh, bh
test dword [eax], 0xff00e2e2
dec eax
invalid

Function at 0x412bc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45d240]
test eax, eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
je 0x412cc5
mov ecx, dword [0x45d230]
call fcn.0042f7d0
test eax, eax
je 0x412cc5
mov ecx, dword [eax + 0x14]
test ecx, ecx
mov ebx, dword [eax + 0x1818]
je 0x412cc5
mov edx, dword [0x45417c]
test edx, edx
je 0x412cc5
mov edx, dword [eax + 0x10]
test edx, edx
je 0x412cc5
mov edx, dword [ecx + 0xc]
mov eax, edx
xor eax, esi
and eax, 0xff
mov eax, dword [eax*4 + 0x44c2a0]
shr edx, 8
xor eax, edx
mov edx, esi
mov esi, eax
shr edx, 8
xor esi, edx
shr eax, 8
and esi, 0xff
mov esi, dword [esi*4 + 0x44c2a0]
xor esi, eax
shr edx, 8
mov eax, esi
xor eax, edx
and eax, 0xff
push edi
mov edi, dword [eax*4 + 0x44c2a0]
xor eax, eax
mov al, dh
shr esi, 8
xor edi, esi
mov edx, edi
and edx, 0xff
shr edi, 8
or bl, 0x80
xor eax, edx
mov eax, dword [eax*4 + 0x44c2a0]
mov edx, dword [ecx + 0x4524]
xor eax, edi
mov dword [ecx + 0xc], eax
mov eax, edx
and eax, 0xff
inc edx
mov dword [ecx + 0x4524], edx
lea edx, [ecx + eax*4]
lea eax, [eax + edx + 0x4020]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov byte [eax + 4], bl
mov eax, dword [ecx + 0x4520]
mov esi, dword [ecx + 0x4524]
lea edx, [eax + 0x101]
cmp esi, edx
pop edi
jne 0x412cc5
inc eax
mov dword [ecx + 0x4520], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x45f900]
test eax, eax
push ebx
push edi
mov edi, edx
mov ebx, ecx
je 0x44701a
push esi
lea esi, [eax - 1]
xor esi, eax
and esi, eax
call sym.War3.exe_G0
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push edi
mov edx, esi
mov ecx, ebx
call fcn.00447510
mov eax, dword [0x45f900]
test eax, eax
jne 0x446ff3
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4c8a20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret 4
Function at 0x401000
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Read file via mapping
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
push str.TEMP
call fcn.00402697
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push str.agent.vbs
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
push edx
push 0
push 0
push 0xf001f
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x4010a6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jge 0x4010c0
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
mov al, byte [edx]
mov byte [ecx], al
jmp 0x40109d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x44
push 0
lea edx, [ebp - 0x6c]
push edx
call fcn.00401c40
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
push 0x10
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.00401c40
add esp, 0xc
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push str.cscript_agent.vbs
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40566a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040532a
Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x70041b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x70041c5
pop dword [ebp - 0x20]
mov eax, 0x70041c5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x6e772a3
sub dword [ebp - 0x30], 0xb8952d58
mov dword [ebp - 0x2c], 0x6f9df3a5
sub dword [ebp - 0x2c], 0x3d6aa760
mov dword [ebp - 0x28], 0x551f0672
add dword [ebp - 0x28], 0xf72d3dbc
mov dword [ebp - 0x24], 0x9d24d6e0
add dword [ebp - 0x24], 0x62db2920
lea eax, [ebp - 0x30]
push eax
mov eax, 0x70543ffd
add eax, 0x96ace02f
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x9abfdf45
add dword [ebp - 0x30], 0xd9b28a11
mov dword [ebp - 0x2c], 0x8ffdfd4e
add dword [ebp - 0x2c], 0xb16e6427
mov dword [ebp - 0x28], 0xcfd55772
add dword [ebp - 0x28], 0x939a14fa
mov dword [ebp - 0x24], 0xd3c9c20e
add dword [ebp - 0x24], 0x2c363df2
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x324f4227
sub eax, 0x2b4e21ff
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3aa81
push 0
call eax
mov ecx, 0x482c
xor ebx, ebx
add ebx, eax
mov edx, 0x83a2dfef
sub edx, 0x7ca0ffef
add edx, dword [ebp - 0x20]
mov edi, 0x120cfd44
xor dword [ebp - 8], ebx
mov esi, dword [edx]
sub dword [ebp - 0x1c], eax
add esi, edi
xor dword [ebp - 0xc], edx
mov dword [ebx], esi
add ebx, 0xa7c21df5
sub ebx, 0xa7c21df1
add edx, 0x7f01475a
add edx, 0x80feb8aa
loop 0x70042d8
add eax, 0xddfebcff
add eax, 0x22025684
xor ebx, ebx
add ebx, eax
add eax, 0xebe3918f
sub eax, 0xebe3918a
mov ecx, 0xf35d6b2d
add ecx, 0x13a294d3
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070041b6
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4065e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d480
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00406285
push esi
call fcn.0040d40a
pop ecx
push esi
mov ebx, eax
call fcn.00406524
test al, al
je 0x4066a2
push esi
call fcn.00406285
test al, al
je 0x406652
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x40676b
mov edi, dword [ebp + 0xc]
push 4
push 0x41a620
push edi
call fcn.0040e54f
push esi
add edi, 8
push edi
call fcn.0040d452
add esp, 0x14
mov al, 1
jmp 0x40676d
cmp word [esi], 0x5c
jne 0x40676b
add esi, 2
cmp word [esi], 0x5c
jne 0x40676b
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40676b
mov edi, dword [ebp + 0xc]
push 4
push 0x41a620
push edi
call fcn.0040e54f
lea eax, [edi + 8]
push 0x41a618
push eax
call fcn.0040d452
push esi
add edi, 0xe
push edi
call fcn.0040d452
add esp, 0x1c
jmp 0x40664b
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40676b
cmp eax, edi
ja 0x40676b
movzx eax, word [esi]
push eax
call fcn.00406179
test al, al
je 0x406712
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40676b
mov edi, dword [ebp + 0xc]
push 4
push 0x41a620
push edi
call fcn.0040e54f
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0040e54f
push esi
add edi, 0xc
push edi
call fcn.0040d452
add esp, 0x20
jmp 0x40664b
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.00406191
lea eax, [ebp - 0x1000]
push eax
call fcn.0040d40a
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x40676b
mov edi, dword [ebp + 0xc]
push 4
push 0x41a620
push edi
call fcn.0040e54f
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0040d452
add esp, 0x14
push dword [ebp + 0x10]
push esi
push edi
call fcn.0040b6cd
jmp 0x40664b
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40845e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x4365ac], ebx
jne 0x408477
mov ecx, 0x4365a4
call fcn.0040841f
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], bl
je 0x4084c1
mov ecx, dword [0x4365ac]
cmp ecx, ebx
je 0x4084dd
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x4084fe
push str.CryptProtectMemory_failed
mov esi, 0x43f61c
push esi
call fcn.0040176c
pop ecx
pop ecx
mov ecx, esi
call fcn.004157d7
push 2
mov ecx, esi
call fcn.00401828
jmp 0x4084fe
mov ecx, dword [0x4365b0]
cmp ecx, ebx
je 0x4084dd
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x4084fe
push str.CryptUnprotectMemory_failed
jmp 0x4084a2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x4084fe
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x4084ee
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40863b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x41f03c], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x408686
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x44acdc], ax
xor eax, eax
mov word [0x44acde], ax
mov dword [0x41f03c], 0x44acdc
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b6fc
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x41f02c
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x40bb34
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x434514]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x44ccf8]
mov ecx, dword [0x43451c]
mov dword [0x434514], eax
movzx eax, al
add eax, dword [0x434518]
imul eax, eax, 0x8088405
inc eax
mov dword [0x434518], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x44ccf8]
mov eax, dword [esp + 4]
mov dword [0x43451c], ecx
ret 4

Function at 0x40bbd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040bb8e
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040dbb0
add esp, 0xc
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040bb14
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040bb34
inc esi
cmp esi, 0xc
jl 0x40bbf3
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x4233b0]
test byte [eax + 0x40], 2
movzx eax, byte [0x43342f]
jne 0x40bc2e
movzx eax, byte [0x433437]
movzx ecx, cx
cmp ecx, eax
je 0x40bc3a
or eax, 0xffffffff
jmp 0x40bc7f
mov ecx, dword [0x4333c8]
mov eax, ecx
cdq
cmp edx, dword [0x42218c]
push edi
jl 0x40bc5c
mov edx, dword [0x422188]
jg 0x40bc58
cmp eax, edx
jbe 0x40bc5c
mov edi, edx
jmp 0x40bc5e
mov edi, ecx
mov esi, dword [0x4333c0]
jmp 0x40bc78
dec edi
call fcn.0040bb14
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040bb34
inc esi
test edi, edi
jne 0x40bc66
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x417cf7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412606
and dword [ebp - 4], 0
cmp dword [0x44dbdc], 0
mov ebx, eax
jne 0x417da8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417e59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x417e59
push eax
call fcn.00412594
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44dbdc], eax
call esi
push eax
call fcn.00412594
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44dbe0], eax
call esi
push eax
call fcn.00412594
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44dbe4], eax
call esi
push eax
call fcn.00412594
pop ecx
mov dword [0x44dbec], eax
test eax, eax
je 0x417da8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412594
pop ecx
mov dword [0x44dbe8], eax
mov eax, dword [0x44dbe8]
cmp eax, ebx
je 0x417e00
cmp dword [0x44dbec], ebx
je 0x417e00
push eax
call fcn.0041260f
push dword [0x44dbec]
mov esi, eax
call fcn.0041260f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417e00
test edi, edi
je 0x417e00
call esi
test eax, eax
je 0x417df7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417df7
test byte [ebp - 0xc], 1
jne 0x417e00
or dword [ebp + 0x10], 0x200000
jmp 0x417e39
mov eax, dword [0x44dbe0]
cmp eax, ebx
je 0x417e39
push eax
call fcn.0041260f
pop ecx
test eax, eax
je 0x417e39
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417e39
mov eax, dword [0x44dbe4]
cmp eax, ebx
je 0x417e39
push eax
call fcn.0041260f
pop ecx
test eax, eax
je 0x417e39
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44dbdc]
call fcn.0041260f
pop ecx
test eax, eax
je 0x417e59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417e5b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4019b1
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp edi, 0x58ced85
jg 0x4019d7
inc edi
cmp edi, 0x1f6502b1
jl 0x4019bd
cmp dword [0x280fac4], 0x400
jne 0x401a39
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x41eb18
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call fcn.00401ff7
push esi
call fcn.00401fbd
push esi
push esi
call fcn.004021b7
push esi
call fcn.00402264
push esi
call fcn.00402273
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x401a4a
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ce6e
jg 0x401a72
inc edi
cmp edi, 0x26bcf
jl 0x401a3b
mov eax, dword [0x421c14]
mov dword [0x280fac4], eax
call fcn.0040172b
mov edi, 0x3078f
cmp dword [0x280fac4], 0x51f
jne 0x401a9e
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a86
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x404c7e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421930]
jne 0x404c88
repz ret
jmp fcn.004061fc
Function at 0x4059fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402f52
and dword [ebp - 0x14], 0
cmp dword [0x42c78c], 0
mov dword [ebp - 0x18], eax
jne 0x405aae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405b56
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405b56
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c78c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c790], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c794], eax
call edi
push eax
call esi
mov dword [0x42c79c], eax
test eax, eax
je 0x405aae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c798], eax
mov eax, dword [0x42c798]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405b07
cmp dword [0x42c79c], ecx
je 0x405b07
push eax
call esi
push dword [0x42c79c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405b07
test ebx, ebx
je 0x405b07
call edi
test eax, eax
je 0x405afe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405afe
test byte [ebp - 8], 1
jne 0x405b07
or dword [ebp + 0x10], 0x200000
jmp 0x405b3a
mov eax, dword [0x42c790]
cmp eax, dword [ebp - 0x18]
je 0x405b3a
push eax
call esi
test eax, eax
je 0x405b3a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405b3a
mov eax, dword [0x42c794]
cmp eax, dword [ebp - 0x18]
je 0x405b3a
push eax
call esi
test eax, eax
je 0x405b3a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c78c]
call esi
test eax, eax
je 0x405b56
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405b58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404c7e
leave
ret
Function at 0x57dcad
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x5b6f90
call fcn.00562c0c
sub esp, 0x198
mov eax, dword [0x63c8b0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x57bbd5
mov ecx, 0x7e3758
mov dword [ebp - 0x10], eax
call fcn.0057c842
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x57dd11
cmp esi, ebx
jne 0x57dcef
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x57dd43
cmp byte [esi], 1
jne 0x57dd3d
cmp byte [esi + 1], 1
jne 0x57dd3d
mov dword [edi + 0xc], 0x57dc7a
call fcn.0057b347
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x57dd50
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x57dd47
push 0xa
call fcn.00571840
jmp 0x57dd49
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x57ddb3
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x57dd82
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x57dd79
push 0xa
call fcn.00571840
jmp 0x57dd7b
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x57ddb0
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x57ddab
push 0xa
call fcn.00571388
jmp 0x57ddad
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 4

Function at 0x450012
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
xor ebx, ebx
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x44ff28]
sub edi, edi
sub ecx, ecx
mov cl, 0xe5
inc edi
loop 0x45003a
call 0x450042
pop esi
sub esi, 0xffffffc2
push esi
sub ebx, ebx
or ebx, 0x2394
mov al, byte [esi]
xor ax, di
xchg byte [esi], al
inc esi
sub ebx, 1
cmp ebx, 0
ja 0x450052
pop esi
mov esp, dword fs:[0]
pop dword fs:[0]
pop edi
pop ebp
jmp esi
Function at 0x40b740
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40b7cb
cmp ax, 9
je 0x40b7b8
cmp ax, 0x20
je 0x40b7b8
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x40b820
cmp ax, 0x22
je 0x40b830
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40b7cb
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40b770
test edi, 1
jne 0x40b770
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x40b7b8
cmp ax, 0x20
je 0x40b7b8
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x40b848
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x40b78b
and dword [ebp - 0x54], 1
jne 0x40b784
xor edi, 1
jmp 0x40b78b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x40b7e4

Function at 0x40b860
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x1b9a39ee
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x6cee5b1e
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219